IsAuditing.com (Information Systems Audit & Security)
All about IS audit, CISA, and Information Security
As an information systems auditor, your work produces opinions and assertions on the status of different controls that the management has instituted. But the auditor doesn’t make arbitrary opinions. Any final view that auditor expresses in their report is backed by evidence and powered by audit testing that they performed to reach their conclusions. Doing … Read more
Information systems auditors have been using computer assisted audit techniques for many decades now. Initially their tools were limited to spreadsheets and SQL on database. However, the need to data analytics has been growing over time and shift of audit focus has been away from sample to audit of whole population. This demand has led … Read more
We discussed earlier why there is need for risk management in an organization. The risks identified minus the residual risks need to be controlled, minimized, mitigated or prevented. And this is where the role of internal controls comes. What are internal controls Before learning about types of internal controls, we should have a basic idea … Read more
There are many definitions of risk but the most comprehensive one that puts risk in a business context is given in the CISA Review Manual, 26th Edition and it is from International Standards Organization, as given in their Guidelines for the Management of IT Security: Risk is a potential that a given threat will exploit … Read more
We already discussed the ISACA auditing standards and if you have read the standards, you must have found that these are very brief. They are like commandments about what is expected from a CISA auditor who has to be in compliance with the ISACA auditing standards when performing an IS Audit. But these standards do … Read more
Anybody familiar with information technology knows it clearly that it changes at a very fast pace. So it is quite logical and imperative that IS auditors need to remain updated about all these continuously updating developments in technology. Otherwise, it will become very difficult to audit information systems for an IS auditor who does not … Read more
So how should the IS audit function be organized in an organization. By organization we mean what should be the scope and objectives. How it should be managed collectively and at individual audit level. Among other things related to IS audit management are audit planning, actual audit implementation, IS audit resource management, effect of prevalent … Read more
Sometimes a control self assessment is also branded as an audit, which it is but there is a major difference. So in this article we are going to learn about what is control self assessment and how it is different from an audit. What is Control Self Assessment? This is basically a process of evaluating … Read more
As an information systems auditor, you will be performing a lot of different types of audits. But first we need to understand the auditing in general. Broadly speaking, there are following three types of audits and then we can further dig down to each of these. Internal audit External Audit Third Party Audit What is … Read more
Auditing standards regulate audits and all types of audit rely on some auditing standards for performing the audit assignment. Before discussing the ISACA IS auditing standards in detail, let us first know the reasons why auditing standards exist and whey these are mandatory to be used in audit assignments. Why using Auditing Standards is important? … Read more