How to Perform an Information Security Audit

What you need to know to perform information security audits

Created by: Adrian Resag, QIAL, CMIIA, CIA, CISA, CRMA, CFSA, GRCP, CIMA Adv Dip MA
Founder of the Risk Governance Institute

What Will I Learn?

• Understand how to properly plan engagements by determining their objectives, criteria and scope.
• Know how to create working papers to document an audit and learn about different ways to staff an audit.
• Learn how to collect engagement information and then analyze and evaluate it. Learn how to supervise engagements.
• Learn how to communicate engagement results and the process of acceptance of risks. Learn how to monitor progress on the implementation status of internal audit
• Know about which threats to information security should be assessed, including threats to the integrity of data, confidentiality and the availability of data.
• Be able to evaluate privacy risks, risks from smart devices, insider threats, illicit software threats and cybersecurity threats amongst others.
• Be able to evaluate risks by using the Asset-Threat-Vulnerability triangle.
• Know about the different types of information security controls, including IT general controls.
• Be able to put in place a solid governance over information security, such as by putting in place IT management and governance controls.
• Be able to implement the segregation of IT duties and IT departmentalization, an information security framework and cybersecurity governance and policies.
• Be able to apply the Three Lines of Defense Model in cybersecurity.
• Learn about controls such as identity access management and authentication, encryption and firewalls, data privacy and protection controls.
• Know about application and access controls, technical IT infrastructure controls, external connections controls and 3rd party information security controls.

Requirements

• No prior experience or knowledge is required.

Target audience

• Current or future IT and information security professionals who wish to learn techniques on how to assess the security of their information and the vulnerability of their information systems.
• Auditors or others performing assessments who wish to learn more about performing information security audits.