Job role capstone: IT auditor
As an IT auditor you run a real audit end to end: risk assessment, planning, ITGC and technical tests, data analytics, evidence, findings, the report and a presentation to the audit committee.
Level 501 · 12 lessons · 12 practice labs
Lessons
Planning
- The role and the audit engagement
- Audit risk assessment
- The audit programme and test steps
- Quick task: an engagement letter and data request list
Fieldwork
- Access tests
- Change tests
- Technical configuration tests
- Full-population testing with data analytics
- Quick task: review the working papers
Reporting
- The draft report and management responses
- Presenting to the audit committee
- Capstone: a complete IT audit file
Practice labs
- Prepare the data request list: List the exports to request for access, change and configuration tests with their period and format.
- Write the engagement letter: Write an engagement letter for an IT audit covering objective, scope, responsibilities, timeline and reporting.
- An audit programme from the risk assessment: From the audit risk assessment, derive an audit programme with control objectives, test steps and sample sizes.
- Run the access test: Compare the user export in the lab with the leavers list and record the exceptions in a working paper.
- Run the change test: Verify approval and test evidence for twenty-five changes selected from the repository history and document the results.
- Test the full population with data analytics: Scan all change and access records with queries and list unapproved changes and segregation of duties conflicts.
- Run the configuration test: Audit the lab server against a ten-item baseline list and record the results with evidence.
- Review the working papers: In five working papers by a junior auditor, find missing references, unsupported conclusions and sampling errors and write review notes.
- Traceability from evidence to conclusion: Verify in an audit file that each finding links to a test step, evidence and a working paper and repair the breaks.
- Rank the findings: Rank twelve findings by risk rating and write the reason for each rating.
- The draft report and management responses: Write the draft report from the findings and prepare feedback on three inadequate management responses.
- The audit committee presentation: From the completed audit, prepare a five-minute speaking note with the overall opinion, the top three findings and the follow-up plan.
About this course
As an IT auditor you run a real audit end to end: risk assessment, planning, ITGC and technical tests, data analytics, evidence, findings, the report and a presentation to the audit committee.
What you will learn
- Planning
- Fieldwork
- Reporting
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.