Who Should Attend: Financial and operational auditors with any amount of experience that want to further understand IT Auditing.

Agenda:

I. Introduction and Background

1.Background

2.Topics to Cover

II. IT Risk Assessment

1.What is an IT Risk Assessment?

2.Understanding the IT Environment

3.IT Risk Frameworks

4.The Audit Plan

5.Mapping the IT and Business Environment

6.Heat Maps

III. General Computer Controls　

1.Information Security

2.IS Operations

3.Application System and Maintenance

4.Database Implementation and Support

5.Network Support

6.System Software Support

IV. Pre and Post Implementation Audits

1.Key Concepts

2.Project Risk Management

3.Pre-implementation Review

4.Post-implementation Review

V. Auditing Application Systems

1.General Areas of Risk

2.Auditing Application System Approach

3.Application Configuration

4.Input Controls

5.Data

6.Transaction Processing

7.Security

8.Reporting

9.Data Interfaces and Conversions

10.Benchmarking

VI. Auditing Security

1.Information Security Governance

2.User Access Administration

3.Technology Based Access Security Controls

4.Secure Systems Development

5.Incident Response

6.Remote Access and Third Parties

7.User Awareness and Training

8.Physical Security

9.Legal and Regulatory Compliance

VII. Segregation of Duties

1.General Categories of Duties

2.Comprehensive Example – Purchasing

3.Segregation of Duties in IT Functions

4.SoD Design Concepts

5.Mitigating and Compensating Controls

VIII. Spreadsheets　

1.Spreadsheet Testing Guidance

2.Spreadsheet Assessment