Auditing and reporting on the information system
An information system audit assignment, from engagement letter to follow-up, evidence and the five-part finding, the COBIT, ITIL and ISO 27001 frameworks, and reporting to management: summary, priorities, action plan.
- 22 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
External audit: what is it?
Show the answer
An examination of an information system carried out by someone independent of the organisation examined, who judges what they observe against a framework.
An internal audit is carried out by a department of the organisation itself, reporting to top management to keep its independence; an external audit comes from outside, such as a firm or a certification body.
An application owner states that access rights are reviewed every quarter. Which item is audit evidence?
- The signed minutes of the last three reviews
- His statement, confirmed by a colleague in the same department
- The security policy that provides for this quarterly review
- A screenshot of the application, with no date or author
Show the answer
The signed minutes of the last three reviews
The policy proves that the rule exists, not that it is applied. A statement, even repeated, remains testimony. Only signed, dated minutes show that the reviews took place.
An audit finding is written in five parts: the reference, the fact, the …, the … and the recommendation.
Show the answer
An audit finding is written in five parts: the reference, the fact, the cause, the consequence and the recommendation.
The cause explains why the gap exists, the consequence says what it may lead to. These two parts turn an observation into a decision.
Audit evidence: what is it?
Show the answer
A verifiable, traceable item, such as a log extract, a list of accounts or a signed document, on which the auditor's statements rest.
A spoken statement is not enough: it is confirmed by a document anyone else can check again. Without evidence, a finding can be disputed.
A sixty-page audit report is handed to management, who do not read it and decide nothing. Which change to the report is the most effective?
- Attach all the evidence collected as an appendix, so management can check everything
- Open with a one-page summary: major findings, priorities and a dated action plan
- Describe the technical course of each test in more detail, to justify every finding
- Send the full report to more recipients across the company
Show the answer
Open with a one-page summary: major findings, priorities and a dated action plan
Management decides from the summary, the priorities and the action plan. Adding pages or recipients lengthens the report without making the decision easier.