Information Technology Audit Handbook

Praise for Auditor's Guide to Information Systems Auditing "Auditor's Guide to Information Systems Auditing is the most comprehensive book about auditing that I have ever seen. There is something in this book for everyone. New auditors will find this book to be their bible-reading it will enable them to learn what the role of auditors really is and will convey to them what they must know, understand, and look for when performing audits. For experiencedauditors, this book will serve as a reality check to determine whether they are examining the right issues and whether they are being sufficiently comprehensive in their focus. Richard Cascarino has done a superb job." —E. Eugene Schultz, PhD, CISSP, CISM Chief Technology Officer and Chief Information Security Officer, High Tower Software A step-by-step guide tosuccessful implementation and control of information systems More and more, auditors are being called upon to assess the risks and evaluate the controls over computer information systems in all types of organizations. However, many auditors are unfamiliar with the techniques they need to know to efficiently and effectively determine whether information systems are adequately protected. Auditor's Guide to Information Systems Auditing presents an easy, practical guide for auditors that can be applied to all computing environments. As networks and enterprise resource planning systems bring resources together, and as increasing privacy violations threaten more organization, information systems integrity becomes more important than ever. With a complimentary student'sversion of the IDEA Data Analysis Software CD, Auditor's Guide to Information Systems Auditing empowers auditors to effectively gauge the adequacy and effectiveness of information systems controls.

The IT Regulatory and Standards Compliance Handbook provides comprehensive methodology, enabling the staff charged with an IT security audit to create a sound framework, allowing them to meet the challenges of compliance in a way that aligns with both business and technical needs. This "roadmap" provides a way of interpreting complex, often confusing, compliance requirements within the larger scope of an organization's overall needs. The ulitmate guide to making an effective security policy and controls that enable monitoring and testing against them The most comprehensive IT compliance template available, giving detailed information on testing all your IT security, policy and governance requirements A guide to meeting the minimum standard, whether you are planning to meet ISO 27001, PCI-DSS, HIPPA, FISCAM, COBIT or any other IT compliance requirement Both technical staff responsible for securing and auditing information systems and auditors who desire to demonstrate their technical expertise will gain the knowledge, skills and abilities to apply basic risk analysis techniques and to conduct a technical audit of essential information systems from this book This technically based, practical guide to information systems audit and assessment will show how the process can be used to meet myriad compliance issues

This handbook is an accessible introduction to modern computer audit for new recruits to the profession and for practising financial auditors who need to increase their knowledge of computer auditing. The book will help meet an increasing need for computer audit training in the auditing profession. The basic perspective taken for this handbook is that of the internal auditor and since this is wider than the remit of external auditing, the contents apply to both. Auditors and accountants who wish to develop their knowledge of computer audit and security will find the book especially useful. In addition, information technology professionals and computer science students who are finding issues of security and control increasingly important, will discover this handbook to be of significant use in their work. Published in association with the Institute of Internal Auditors, this book provides a comprehensive introduction to modern computer audit for new recruits to the profession, and for financial auditors who wish to increase their knowledge of computer auditing. The main topics covered include: *computer audit management *auditing applications *small business computers *computer assisted audit techniques *databases *legal and code of practice issues *computer abuse. The author and contributors are audit and security practitioners, with many years' experience in this field. Contributors: Ian Douglas, Deputy Head of Systems Audit at Barclays Bank. Alan Oliphant, Computer Audit Manager, Standard Life Assurance Company, and Chairman of Information Technology Audit Development Committee (IIA); David Bentley, Chief Internal Auditor, Leeds Permanent Building Society and Stephen Hinde (the two latter being Past Presidents, IIA, UK). Published in association with the Institute of Internal Auditors Provides a comprehensive introduction to computer audit for new recruits to this subject Ideal for financial auditors who wish to increase their knowledge of computer auditing

The new edition of a bestseller, Information Technology Control and Audit, Fourth Edition provides a comprehensive and up-to-date overview of IT governance, controls, auditing applications, systems development, and operations. Aligned to and supporting the Control Objectives for Information and Related Technology (COBIT), it examines emerging trends and defines recent advances in technology that impact IT controls and audits—including cloud computing, web-based applications, and server virtualization. Filled with exercises, review questions, section summaries, and references for further reading, this updated and revised edition promotes the mastery of the concepts and practical implementation of controls needed to manage information technology resources effectively well into the future. Illustrating the complete IT audit process, the text: Considers the legal environment and its impact on the IT field—including IT crime issues and protection against fraud Explains how to determine risk management objectives Covers IT project management and describes the auditor’s role in the process Examines advanced topics such as virtual infrastructure security, enterprise resource planning, web application risks and controls, and cloud and mobile computing security Includes review questions, multiple-choice questions with answers, exercises, and resources for further reading in each chapter This resource-rich text includes appendices with IT audit cases, professional standards, sample audit programs, bibliography of selected publications for IT auditors, and a glossary. It also considers IT auditor career development and planning and explains how to establish a career development plan. Mapping the requirements for information systems auditor certification, this text is an ideal resource for those preparing for the Certified Information Systems Auditor (CISA) and Certified in the Governance of Enterprise IT (CGEIT) exams. Instructor's guide and PowerPoint® slides available upon qualified course adoption.

A comprehensive guide to understanding and auditing modern information systems The increased dependence on information system resources for performing key activities within organizations has made system audits essential for ensuring the confidentiality, integrity, and availability of information system resources. One of the biggest challenges faced by auditors is the lack of a standardized approach and relevant checklist. Understanding and Conducting Information Systems Auditing brings together resources with audit tools and techniques to solve this problem. Featuring examples that are globally applicable and covering all major standards, the book takes a non-technical approach to the subject and presents information systems as a management tool with practical applications. It explains in detail how to conduct information systems audits and provides all the tools and checklists needed to do so. In addition, it also introduces the concept of information security grading, to help readers to implement practical changes and solutions in their organizations. Includes everything needed to perform information systems audits Organized into two sections—the first designed to help readers develop the understanding necessary for conducting information systems audits and the second providing checklists for audits Features examples designed to appeal to a global audience Taking a non-technical approach that makes it accessible to readers of all backgrounds, Understanding and Conducting Information Systems Auditing is an essential resource for anyone auditing information systems.

The operational auditing HANDBOOK Auditing Business and IT Processes Second Edition The Operational Auditing Handbook Second Edition clarifies the underlying issues, risks and objectives for a wide range of operations and activities and is a professional companion for those who design self-assessment and audit programmes of business processes in all sectors. To accompany this updated edition of The Operational Auditing Handbook please visit www.wiley.com/go/chambers for a complete selection of Standard Audit Programme Guides.

This book offers a comprehensive, up-to-date presentation of the tasks and challenges facing internal audit. It presents the Audit Roadmap, the process model of internal auditing developed at SAP® which describes all stages of an audit. Coverage provides information on issues such as the identification of audit fields, the annual audit planning, the organization and execution of audits as well as reporting and follow-up. The handbook also discusses management-related subjects. Separate chapters are dedicated to special topics like IT or SOX audits.