A featured contribution from Leadership Perspectives, a curated forum for enterprise technology leaders, nominated by our subscribers and vetted by the CIOApplications Editorial Board.
EFPR Group
IT Auditing
Almost every training document defines IT Audit as “the examination and evaluation of an organization’s information technology infrastructure, policies, and operations. Information technology audits determine whether IT controls protect corporate assets, ensure data integrity, and are aligned with the business’s overall goals.” I found this sentence in over 30 published works, but none of them attributes the original author. It has become the overall definition of IT Audit.
Let’s break down the definition one part at a time starting with “the examination and evaluation of an organization’s information technology infrastructure.” An Asset Management Program should be in place with the required documentation. ISO 55001:2014 Asset Management Systems Requirements is a good standard for evaluating the Governance, Risk, and Compliance of the IT infrastructure.
“IT Policies and Operations” is a broad term and should be scoped before the Audit. IT Governance is covered in ISO/IEC 38500. Information Security is covered in ISO 27001.
“Information technology audits determine whether IT controls protect corporate assets to ensure data integrity and are aligned with the business’s overall goals.” is the last sentence of the definition. The determination of the controls that are in place should have been done during a Risk Assessment. As an auditor, I always start by reviewing the risk assessment to see if it was performed correctly. I use ISO/IEC 270005 Risk Management Standard as an assist in auditing the Risk Assessment.
Outside Auditor Engagement Letter
As an Auditor with an outside Consulting/Audit division of my firm, I find it interesting how many CIO’s and CISO’s hire outside auditors without ensuring the engagement letter is complete.
The engagement letter should include:
• Audit approach explanation
• Auditors responsivity statement
• Client responsibility statement
• Confirmation agreement statement
• Fair presentation statement
• Objective of the Audit
• Scope statement
• Significant weaknesses statement
• Verbal agreement recap statement
Ensure that you feel comfortable with their process. It is critical to verify if the IT Auditor is a certified IT Auditor. If they are auditing specialized topics such as Incident Response, Cyber Security Management Systems, or Disaster Recovery, ask for their certification in this area. It is especially important that if they are conducting a Financial Audit that the Auditor who is auditing your Information Security and Cyber capabilities be certified with this expertise. Just as Auditors should conduct compliance Audits with the specific background, you require.
Types of Audits
Gap Analysis
Prior to an actual audit, it is a good practice to request a Gap Analysis. This will help identify areas that are not compliant with the standards, regulations, and best practices that your organization has agreed to implement. I often conduct periodic Gap Analysis for clients who are in the process of implementing a new standard or regulations. This is an excellent tool to gage areas still needing improvement. Gap Analysis reports usually are given directly to the CIO or CISO to assist them in making their program better.
Compliance Audits
Compliance audits can be first party, second party or third party.
Many clients request a compliance audit for NIST, and various ISO’S (International Standards Organization.), GDPR, and many other compliance requirements so they can provide a sense of comfort to their customers that they are meeting requirements.
First Party or Internal Audits
Internal audits can be performed by Internal Audit or an outside auditor who is contracted to perform an Internal Audit. Internal Audit reports are usually provided to Sr. Management. According to ISO 19011, clause 6.5.1., “the audit report must provide a clear, accurate, concise and complete picture of the Audit.” It should not only provide information as to compliance with requirements, but bust also helps with identifying corrective actions and recommended improvements. Comparing the present report to past ones is a good way to gauge improvements or issues related to past non-conformities that are still not corrected. Internal Audits should be conducted throughout the year.
IT Audits are an excellent tool for organizations to continuously improve and to maintain effective operations while meeting the organizations’ goals and helping with achieving the mission
Secondary Party Audit
A supplier or customer may conduct the Audit themselves or have it done by a contracted organization. These are more formal than an Internal Audit. The supplier or customer may be deciding whether or not to contract with your organization for services or products or deicing if they want to continue to do so.
Third-Party or External Audits
An External Auditor is independent of the origination being audited. They conduct audits annually. An External Audit may be performed by a regulatory authority, as part of the financial Audit, or other authority.
See Also: Top Audit Management Consulting Companies
Third-Party ISO Compliance Audits
Organizations who choose to become certified in one of the ISO Management System Certification standards must have had at least one Internal Audit prior to the certification audit. To be certified, the Audit must be conducted by an accredited Management System Certification Body. A pre-audit is optional and must be done at least three months prior to a certification audit. The next audit stages are stage 1 audit (maybe an offsite review of documents) and stage 2 audit (conducted onsite) prior to certification. After that, a surveillance audit is completed in the second and third years. After the third year, a re-certification audit will be required. Please refer to ISO9000, ISO/IEC 17021, and ISO/IEC 17065 for more information. ISO 19011:2018 – Guidelines for Auditing Management Systems is a good standard to review as part of your preparation.
Preparing to be Audited
Find out the requirements scope of the Audit from the Auditor. If the Audit is going to be conducted by an external party, they will usually provide your Internal Auditor with the scope.
Gather documentation that shows you are compliant with the requirements being audited.
Leadership and its’ commitment to the requirements is most always audited. Auditors will have questions related to this and ask to see documented proof. How has the
organization demonstrated this? Have they ensured policies and objectives have been established, and that objectives have been met? What necessary resources have leadership provided, and how do they confirm continual improvement?
Polices must be suitable for your organization as well as include objectives and a commitment to meet those objectives.
The organization roles, responsibilities, and authorities must conform to the standards, regulations, or best practices that you are being audited against.
The risk assessment process must be robust enough to include risk acceptance criteria and produce consistent and valid results. There are many risk assessment methodologies, including but not limited to: OCTAVE (Operationally Critical Threat and Vulnerability Evaluation). CRAMM (CCTA Risk Analysis and Management Method), MICROSFT, and others. The Auditor will most likely ask to see the documentation pertaining to the risk assessment as well as the risk treatment plans for each risk and the corresponding detailed plans used to attain the objectives.
Any documentation relating to the competence of resources, awareness of employees, and communication strategies should be readily available.
Operation planning and controls are indispensable to IT, and documented information should provide confidence to the Auditor that they are implemented as planned. Proof of regular monitoring, measurement, analysis, and evaluation is a must.
Previous audits should be available and include the executed corrective action plans for nonconformities. Evidence of Top Management reviews of audits, as well as their feedback on performance, is expected to be presented at the same time.
Conclusion
IT Audits are an excellent tool for organizations to continuously improve and to maintain effective operations while meeting the organizations’ goals and helping with achieving the mission.
Certifications
I am including my certifications as an example of the certifications you may wish to look for in your consultants and auditors.
Certified as Lead Implementer:
ISO/IEC 27001 Information Security Management
ISO/IEC 27032 Lead Cyber Security Manager
ISO/IEC 27035 Security Incident Response
ISO 22301 Business Continuity Management Systems
ISO/IEC 21500 Lead Project Manager
ISO 31000 Risk Management
ISO 55001 Asset Management
ISO 14001 Environmental Management
ISO 9001 Quality Management
ISO 26000 Social Responsibility
ISO 37001 Anti Bribery Management Systems
Certified Implementer – Foundation:
ISO 22316 Security and Resiliency Management
ISO 22320 Emergency Management
ISO 20700 Management Consultancy Services
GDPR General Data Protection Regulation (EU) 2016/679
Certified as Lead Auditor:
ISO/IEC 27001 Information Security Management
ISO 22301 Business Continuity Management Systems
ISO 55001 Asset Management
ISO 14001 Environmental Management
ISO 9001 Quality Management
ISO 26000 Social Responsibility
Other Certifications:
Masters Business Continuity Planning (Disaster Recovery Institute) - MBCP
Masters Business Continuity Planning (Business Continuity Institute) - FBCI
Certified Emergency Manager - CEM
Certified Project Manager – PMP
