Introduction to IT auditing
You learn the purpose of an audit, design and operating tests, sampling, kinds of evidence, working papers and writing findings, on real evidence files.
Level 201 · 17 lessons · 15 practice labs
Lessons
What an audit is
- Audit types: internal, external, compliance, certification
- Independence, objectivity and professional scepticism
- The audit cycle: plan, fieldwork, report, follow-up
- Standards for auditors: IIA, ISACA, ISO 19011
- Quick task: a one-page audit plan
Testing controls
- Control objectives and control risk
- Design effectiveness and operating effectiveness
- Test methods: inquiry, observation, inspection, re-performance
- Audit sampling
- Quick task: sample and test change tickets
Evidence
- Sufficiency and reliability of evidence
- Working papers
- Evidence integrity: source, date, hash
- Quick task: a working paper for an access review
Reporting
- Writing findings: condition, criteria, cause, effect, recommendation
- Following up findings
- Capstone: auditing password and access controls
Practice labs
- Identify the type of audit: Classify ten scenarios as internal, external, compliance or certification audit.
- A one-page audit plan: Write a plan with objective, scope, criteria, schedule and team for an audit of the backup process.
- Assess threats to independence: Identify what impairs independence in six auditor assignments and write the safeguard to apply.
- Choose the test method: For ten controls, choose the fitting method among inquiry, observation, inspection and re-performance.
- Design or operating effectiveness: Sort eight findings into design deficiencies and operating deficiencies and give the reason.
- Write test steps for a control: Write a step-by-step procedure that tests the design and operation of the new user access approval control.
- Find the sample size from the table: Determine the sample size from the sampling table for eight controls with a given frequency.
- Sample and test change tickets: Select twenty-five random samples from two hundred change tickets and check the approval and test evidence in each.
- Project exceptions to the population: Evaluate three exceptions found in twenty-five samples and write, with reasons, the decision on extending the sample and the control conclusion.
- Rank the reliability of evidence: Rank ten pieces of evidence from most to least reliable by source and how they were obtained.
- A working paper for an access review: From the given user list and approval emails, prepare a working paper with objective, method, result and cross-references.
- Verify the integrity of evidence: Compare the hashes of files in an evidence folder with the record and report those with a doubtful date or source.
- Split a finding into its five parts: Mark the condition, criteria, cause, effect and recommendation in four finding paragraphs.
- Write a finding: From evidence that six leavers' accounts stayed active, write a five-part audit finding.
- Evaluate the follow-up of findings: Review the closure evidence of ten findings and decide which are truly closed, partly closed or need reopening.
About this course
You learn the purpose of an audit, design and operating tests, sampling, kinds of evidence, working papers and writing findings, on real evidence files.
What you will learn
- What an audit is
- Testing controls
- Evidence
- Reporting
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.