ITM537 Mod 1 Case Assignment Control Structures: Auditing

ITM 537 MOD1 Case Control Structures: Auditing
Name
Course
Instructor
Date
Conducting IT and Information Security Audits
Incidences of accounting fraud have highlighted the case for reforms and better vigilance among system auditors when conducting security audits. Data and security audits allow the system auditors to verify the authenticity of accounting information, but they have to focus on some of the financial information by conducting security audits on samples since they are limited in resources and time. Additionally, by auditing the information system it is possible to determine whether there are other security measures required, while highlighting how different data-related activities are related. At other times, unauthorised persons might gain access to financial records and database, and distorting the information. Hence, when conducting security audits it is necessary to understand whether the system has been compromised.
Information systems audit is broader than information security audit and focuses on the network segmentation, device management, operations safety security and servers. On the other hand, security audit entails the security of data and the information as it focuses on the storage and transmission of print and electronic data. The two audits are related as auditors must first gather data that allows them to verify the information while they determine the scope that should be clear even before conducting the security audit (Bayuk, 2009). This further helps in setting the control objectives to facilitate audit testing, and the management is expected to implement the control objectives (Bayuk, 2009). This is necessary since the objectives allow the auditor to cover all aspects of the audit, but the tests may change during the auditing process.
The auditors set the priorities and scope depending on the identity being audited and purpose of conducting the audit process. The audit scope is associated with the organization, and the auditors then prepare based on the identified scope. The case for focusing on the scope that it allows the auditors to set priorities, plan and communicate what is to be expected. The IS auditor then needs to assess that the structures that support adequacy and effectiveness of the audit since prioritizing helps to determine the critical areas to be audited. Additionally, the relevant resources to conduct the audit are identified to support resource allocation and monitoring the auditing process.
There is also a need to establish security policies and standards that guide the auditors as they assess security compliance and risk level (Hayes, 2003). Technological innovations and changes are likely to overwhelm the ability of the IT staff to keep up with all the software. Many program vulnerabilities are discovered, and it is necessary to review the security and ensure that the security guidelines are adequate. IS auditors use previous audits as security baselines, and even when the audit is conducted by different audit partners, they should be able to come with similar opinions based on the risk level. Hence, to conduct IT and information security audits, security assessment is integrated into the auditing process.
When the audit is complete, it is...