1. 1 IT / IS AUDIT PROCESS MODELS (MINDMAPS) For personal use only – not for distribution Begin Audit End Audit FamiliariseGather Information Create Working Papers Create Process Maps Annotate Risk Annotate Controls Evaluate Controls Risk Appetite Control Efficiency and Costs Process Hotspots Process Efficiency Testing Reporting

2. Entry meetings

3. Familiarisation – get to know process flow  Identify  Determine  Document

4. Fieldwork 1.Interviews 2.Existing documentation 3.Questionnaires 4.Observations 5.Tests

5. Determine expected controls

6. Locate actual controls

7. Gap analysis shows missing controls Present as expected. Expected but absent.

8. Key application controls

9. Key network controls

10. Key storage controls

11. HOST CONTROLS Router Packet Filter Proxy Firewall Who Limited Few Skill Competence How Security / vulnerability of underlying OS Rules and Rationale How tested How validated Pen testing Key host controls

12. 12 IT / IS AUDIT PROCESS MODELS (MINDMAPS) For personal use only – not for distribution Begin Audit End Audit FamiliariseGather Information Create Working Papers Create Process Maps Annotate Risk Annotate Controls Evaluate Controls Risk Appetite Control Efficiency and Costs Process Hotspots Process Efficiency Testing Reporting