Fundamentals of IT Auditing

• Objectives of IT Audit
• Business risks in an automated environment
• Information systems security concerns
• Role of IT auditors and business auditors

Auditing Standards

• ISACA
• The AICPA Guidance Statement on Auditing
• SAS 55: consideration of the internal control structure in a financial statement audit
• COBIT: control objectives for information and related technology
• Sarbanes-Oxley Sections 302 and 404 compliance
• PCAOB
• GAO: government audit standards
• IT standards

Infrastructure Essentials

• Computer hardware and operating systems
• How application systems software and systems programmes interact
• Distributed systems hardware
• The translation process from source to executable
• Audit risk in programme management
• Analysing infrastructure risk

Databases

• Non-database and database management environments
• Database risks on the applications, the data, and the operating environment
• Network discovery
• Address spoofing: IP and MAC addresses
• Malicious software
• Unauthorised entry
• Denial-of-service

Distributed Systems

• Comparing distributed systems to centralised systems
• Fundamentals of client/server and its model
• Server functions
• Evaluating risk of distributed systems

Networks

• Host-based environments
• LANs and WANs
• Data communication basics and risks
• Bridges, switches, routers, and gateways

Internet and E-Commerce

• Understanding Internet terms and concepts
• Perimeter controls (firewalls) and security vulnerabilities
• Assessing Internet-related risk
• Confidentiality and authentication in e-commerce

General Controls

• Information technology infrastructure
• Security, operational, management and system software controls
• Identifying and assessing risk
• Placing reliance on general controls

Business Systems Applications

• Types of business applications
• How business applications affect the audit environment

Defining a Transaction

• Transaction-based application auditing
• Life cycle of a transaction
• Transaction origination and authorisation
• Processing, output, and input
• Report distribution
• Reconciliation
• Error identification
  

General Flow of an Audit Application

• The business environment
• The technical environment
• Data risk assessment
• Transactional flow
• Test process

Components of a Business Application

• Transaction origination
• Input
• Processing
• Output
• Audit impact

Data Input and Processing Models

• Characteristics and controls
• Batch input: batch processing
• Online input: batch processing
• Online input: online processing
• Real-time entry: real-time processing
• Internet entry

Application Controls

• Categories
• Differentiating controls from procedures
• Completeness and accuracy of input and processing
• Output controls and authorisation
• Inter-relationship between application controls and general controls

Beginning the Audit

• Risk assessment factors
• Quantifiable and lifiable factors
• The opening meeting
• Understanding the application