Can please share the risk assessment methods/ questionnaires/approach for application systems.We understand that the assessment may cover technology, people, and process. We need to come-out with the assessment report indicating the risk level & rating of the application systems.
When benchmarking a SAS70 audit to determine if the necessary controls were audited, what standards do you use as guidance to determine the controls to be tested and the control objectives? Does IT rely on internal audit for guidance or do you have your IT processes documented?


