Please enable JavaScript.

Coggle requires JavaScript to display documents.

2.6.1 (Audit Phases (Perform preaudit planning (Once the subject,…

- - - - For example, in the previous example (program changes), the scope statement might limit the review to a single application, system or a limited period of time.
    - - A clear scope will help the IS auditor define a set of testing points that is relevant to the audit and further determine the technical skills and resources necessary to evaluate different technologies and their components.
  - - - . For other types of audits (e.g., compliance), conducting a risk assessment is a good practice because the results can help the IS audit team
        
        to justify the engagement
        
        and further refine the scope and preplanning focus
    - - – Technical skills and resources needed
      - – Budget and effort needed to complete the engagement
      - – Locations or facilities to be audited
      - – Roles and responsibilities among the audit team
      - – Time frame for the various stages of the audit
      - – Sources of information for test or review, such as functional flowcharts, policies, standards, procedures and prior audit work papers
      - – Points of contact for administrative and logistics arrangements
      - – A communication plan that describes to whom to communicate, when, how often and for what purposes
  - - - Some of the specific activities in this step are:
        
        • Identify and obtain departmental POLICIES, STANDARDS, GUIDELINES for review.
        
        • Identify any REGULATORY COMPLIANCE requirements.
        
        • Identify a list of individuals to INTERVIEW.
        
        • IdentifyMETHODS (including tools) to perform the EVALUATION.
        
        • DevelopAUDIT TOOLS AND METHODOLOGY to test and verify controls.
        
        • Develop TEST SCRIPTS
        
        • Identify CRITERIA FOR EVALUATIONS TESTS
        
        • Define a METHODOLOGY TO EVALUATE TEST that theTEST and its RESULTS ARE ACCURATE (and repeatable if necessary).