- Information systems auditing processes
- Governance & management of IT
- Information systems acquisition, development & implementation
- Information systems operations & business resilience
- Protection of information assets
- Supporting Tasks:
o Plan audit to determine whether information systems are protected, controlled and provide value to the organization.
o Conduct audit in accordance with IS audit standards and a risk based IS audit strategy.
o Communicate audit progress, findings, results and recommendations to stakeholders.
o Conduct audit follow?up to evaluate whether risks have been sufficiently addressed.
o Evaluate the IT strategy for alignment with the organization’s strategies and objectives.
o Evaluate the effectiveness of IT governance structure and IT organizational structure.
o Evaluate the organization’s management of IT policies and practices.
o Evaluate the organization’s IT policies and practices for compliance with regulatory and legal requirements.
o Evaluate IT resource and portfolio management for alignment with the organization’s strategies and objectives.
o Evaluate the organization's risk management policies and practices.
o Evaluate IT management and monitoring of controls.
o Evaluate the monitoring and reporting of IT key performance indicators (KPIs).
o Evaluate the organization’s ability to continue business operations.
o Evaluate whether the business case for proposed changes to information systems meet business objectives.
o Evaluate whether IT supplier selection and contract management processes align with business requirements.
o Evaluate the organization's project management policies and practices.
o Evaluate controls at all stages of the information systems development lifecycle.
o Evaluate the readiness of information systems for implementation and migration into production.
o Conduct post?implementation review of systems to determine whether project deliverables, controls and requirements are met.
o Evaluate whether IT service management practices align with business requirements.
o Conduct periodic review of information systems and enterprise architecture.
o Evaluate IT operations to determine whether they are controlled effectively and continue to support the organization’s objectives.
o Evaluate IT maintenance practices to determine whether they are controlled effectively and continue to support the organization’s objectives.
o Evaluate database management practices.
o Evaluate data governance policies and practices.
o Evaluate problem and incident management policies and practices.
o Evaluate change, configuration, release and patch management policies and practices./p>
o Evaluate end-user computing to determine whether the processes are effectively controlled.
o Evaluate the organization's information security and privacy policies and practices.
o Evaluate physical and environmental controls to determine whether information assets are adequately safeguarded.
o Evaluate logical security controls to verify the confidentiality, integrity and availability of information.
o Evaluate data classification practices for alignment with the organization’s policies and applicable external requirements.
o Evaluate policies and practices related to asset lifecycle management.
o Evaluate the information security program to determine its effectiveness and alignment with the organization’s strategies and objectives.
o Perform technical security testing to identify potential threats and vulnerabilities.
o Utilize data analytics tools to streamline audit processes.
o Provide consulting services and guidance to the organization in order to improve the quality and control of information systems.
o Identify opportunities for process improvement in the organization's IT policies and practices.
o Evaluate potential opportunities and threats associated with emerging technologies, regulations and industry practices.