IT Governance, Risk, and Compliance:

Certified Information Systems Auditor


October 14, 2011  8:48 PM

Auditing Information Security Governance – Part VII



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, COBIT, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

An IT auditor should include in the audit ambit relevant processes for planning, organizing, and monitoring information security activities. Furthermore, the audit ambit should include control systems for the use and protection of the full range...

October 11, 2011  7:51 PM

Auditing Information Security Governance – Part VI



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, COBIT, Control Environment, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

Primary drivers for ISG assurance planning is the verification of governance existence, adequacy, and risk management. However, as with standard IT audits, a general control environment, information systems, and control procedures understanding should be obtained during engagement planning to...


October 7, 2011  8:59 PM

Auditing Information Security Governance – Part V



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, COBIT, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

ISG audits normally have an organizational focus. ‘Organizational-based’ ISG audits and reviews examine deployed frameworks, managerial issues, and departmental activities. However, if during organizational-based planning the IT auditor discovers a governance framework is not deployed, the...


October 4, 2011  8:14 PM

Auditing Information Security Governance – Part IV



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

To prevent expectation misinterpretation, the ISG engagement ‘terms of reference’ should minimally address engagement ambit, reporting lines, and IT audit authority. Specifically, ISG functional areas and issues definitions,...


September 30, 2011  8:54 PM

Auditing Information Security Governance – Part III



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

Reflective of ISACA standards and guidelines, the IT audit process should be replicated within for-profit and not-for-profit entities. Foundational assurance topics which should be considered from a management perspective are presented within the Information...


September 27, 2011  8:19 PM

Auditing Information Security Governance – Part II



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

Management is responsible for developing and deploying good security governance, which has been typically defined to include resilient protection regarding the IT infrastructure and related information systems supporting critical functions and business processes. Within the information security...


September 23, 2011  7:47 PM

Auditing Information Security Governance – Part I



Posted by: Robert Davis
Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, External Audit, Information Security Governance, Internal Audit, ISG, IT Audit

Governance supports stakeholder expectations related to management’s fiduciary responsibilities. Governance also reflects how an entity achieves its stated mission. Specifically, governance can be considered the program by which entities are directed and controlled.


March 22, 2010  6:29 PM

IT Audit Follow-up: Assessing Recommendation Resolution – Part IV



Posted by: Robert Davis
AA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement Letter, Evidence, Finding Form, Follow-up Activities, Information Technology, IT Audit, Project Management, Reporting

Depending on the ambit and terms of the engagement,...


March 8, 2010  9:40 PM

IT Audit Reporting: Communicating Results – Part VIII



Posted by: Robert Davis
AA, AICPA, Assurance Service, Attestation, Audit Assurance, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Internal Controls Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Evidence, IFAC, Information Criteria, ISACA, Project Management, Reporting, The IIA, The IIC

IT auditors, like all auditors, are responsible for ‘communicating results to interested individuals.’ Interested individuals can include other members of the audit team, who must integrate the IT auditor’s findings with other aspects of the audit, as well as the client. ...


March 4, 2010  6:48 PM

IT Audit Reporting: Communicating Results – Part VII



Posted by: Robert Davis
AA, AICPA, Assurance Service, Attestation, Audit Assurance, Audit Charter, Audit Opinion, CA, Certified Information Systems Auditor, Certified Information Technology Professional, Certified Internal Auditor, Certified Public Accountant, Chartered Accountant, CIA, CICA, CISA, CITP, CPA, Engagement Letter, Evidence, IFAC, ISACA, IT, IT Audit, PM, Project Management, Reporting, The IIA, The IIC

Upon acknowledgement of final audit report delivery to identified recipients, the IT auditor should await responses from key audit area personnel, as stipulated in the entity’s


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: