Guide to IT Audits

Keep your IT system and your company safe with IT audits

By Judy Artunian

Action Steps
The best contacts and resources to help you get it done

Ask an independent IT auditor to conduct your IT audit

Seek out an experienced, certified IT auditor who can be objective. That means anyone who works directly with the systems to be audited is out of the running. If there are no qualified IT auditors in your organization, outsource the job.

I recommend: CynergisTek consultants can perform your IT audit or work with your internal IT audit staff. Protiviti’s risk consulting services includes IT auditing. Percento Technologies can perform IT audits on your network architecture, configuration and security measures. IT auditors should be certified by the Information Systems Audit and Control Association. If the auditor will be examining your security controls, look for a certification from (ISC)².

Conduct your own IT audits with IT audit software

Nothing replaces a thorough investigation by an objective IT auditor, but you should routinely test your IT system controls with specialized IT audit software.

I recommend: Check out IT audit software programs, such as MetricStream’s IT Audit Management and Altius Information Technologies’ risk management suite.

Learn the ABCs of IT audits

Find out how to get ready for an upcoming IT audit, and stay up-to-date on issues that could impact your audit.

I recommend: Prepare for IT audits by downloading an IT audit checklist from The IT Compliance Institute. The MIS Training Institute offers IT audit and information security training, conferences and seminars. IT Audit magazine, published by the Institute of Internal Auditors, keeps you updated on information technology issues related to IT audits.

Helpful advice for making the most of this Guide

• •  Before you launch an IT audit, determine exactly which systems and procedures should be audited. Only then can you bring in the right IT auditor for the job.
• •  When evaluating potential IT auditors, look for professionals with experience in your industry.
• •  Remember that your IT auditor is on your side. IT auditors report that some clients see them as the bad guy who is on the hunt for ways to make the client look bad. The result is a client who becomes defensive when an IT auditor pinpoints problems that need to be fixed.