IT Audit - Complete Course | Plan and Deliver IT Audits

Internal audit provides independent assurance and consulting to enhance governance, risk management, and controls, with a formal charter and board reporting ensuring unrestricted access and value protection.

Discover how the internal audit charter defines purpose, authority, and independence, and how it aligns audit activities with governance, strategy, risk management, and technology risk.

Apply the IIA performance standards to plan, execute, supervise, and communicate internal audit engagements that strengthen governance, risk management, and controls.

Explore four attribute standards: purpose and authority, independence and objectivity, proficiency and due professional care, quality assurance. See how these guide credible, valuable internal audits through charters, reporting, and improvement.

Clarify the differences between assurance and consulting engagements in internal audit, and learn how independence, risk management, controls, and technology trends drive value for stakeholders.

Learn how to safeguard the independence of internal audit by establishing functional reporting to the board or audit committee, addressing threats, upholding the charter, and leveraging governance for objective insights.

Explore functional vs administrative reporting lines in internal audit, and learn how independent reporting to the board or audit committee enhances audit independence, governance, and effectiveness.

Learn to conduct systematic information systems audits that assess risk, controls, and processes to ensure security, governance, ISO 27001, PCI DSS compliance.

Compare internal and external audits to understand independence, credibility, and their impact on information systems governance, risk management, and regulatory compliance through planning, fieldwork, and reporting.

Explore how an engagement letter formalizes audit scope, roles, and evidence handling when outsourcing to external experts, ensuring testing methods, confidentiality, and regulatory alignment.

Plan and scope the audit engagement by defining objectives, assessing feasibility, and allocating resources in a risk-based information systems audit. Manage execution, gather evidence, and report findings to deliver value.

Master audit execution in information systems by turning planning into action through scope, data collection, sampling, evidence, and testing to evaluate internal controls and guide recommendations.

Explore audit evidence, including direct and indirect sources, and learn reliable collection techniques—documentation review, interviews, observation, re-performance, walkthroughs—plus chain-of-custody and secure handling.

Explore the evaluation of controls and audit risk, covering inherent, control, and detection risks, compensating controls, materiality, and practical guidance for real-world information systems audits.

Apply sampling techniques in information systems auditing to balance efficiency and accuracy, using statistical and non-statistical methods such as random, stratified, and systematic sampling.

Craft clear audit reports that document findings, evidence, and opinions on controls, risks, and standards and regulations; support them with robust audit documentation and timely follow-up actions.

Explore the IT assurance framework and its three domains - guiding principles, performance, and reporting - and how standards and guidelines guide risk-based information systems audits, with external experts supporting audits.

Offer feedback as you progress by reconsidering your rating, understanding reviews help the course gain visibility, and choose to rate and write a review if you haven't yet.

Align security with business objectives via a dynamic program integrating policies, controls, risk management, training, and incident response. Secure executive support and cross-functional collaboration to protect assets and enable growth.

Policies underpin governance by outlining intents and expectations, linking to standards, procedures, and exception handling, and guiding staff through approved, risk-aware guidance for auditing.

Explore how standards translate policy into measurable, mandatory controls and how baselines define minimum security across systems. Learn their role in risk-based IT auditing and governance.

Learn how procedures translate policies and standards into actionable steps, and how guidelines offer best practices, with rigorous document and version control and regular reviews to ensure accuracy and compliance.

Explore the cpu, memory, storage, gpu, motherboard, and input-output devices, and learn how virtualization, firmware, and secure boot shape audit objectives for confidentiality, integrity, and availability.

Explore how information systems governance sets strategic direction and how management translates it into operations. Align IT, cybersecurity, and compliance with business goals.

Explore how senior leaders define and coordinate security roles, from the CRO overseeing enterprise risk management to the CISO safeguarding information assets, with the CIO, security manager, and governance practices.

Explore how information security, cybersecurity, and information assurance form a structured security framework with separated duties, aligning governance, risk management, and compliance with ISO 27001 and General Data Protection Regulation.

Explore security controls and their classifications—preventive, detective, deterrent, and corrective—and how to select, implement, and evaluate them for return on security investment in a risk-based information technology audit.

Understand IT general controls (ITGCs) as the foundational, layered framework for secure, reliable information systems, spanning detective, deterrent, preventive, and corrective controls across physical, technological, and administrative domains.

Identify, select, and deploy risk-based controls—preventive, detective, and corrective—to protect information assets, meet regulatory requirements, and support layered defense with leadership, monitoring, training, and disaster recovery.

Define requirements and translate them into control objectives, assess with KCIs, and apply compensating controls and countermeasures to support risk-based auditing in information systems.

Explore defense in depth, a layered security philosophy that deploys multiple, overlapping controls across people, processes, and technology to prevent, detect, contain, and recover from threats.

Learn risk-driven selection and design of security controls aligned with policies, using defense in depth, continuous monitoring, and security awareness training to build resilient, compliant security programs.

Identify uncertainties, assess impacts, and reduce risk to acceptable levels through structured risk management, considering risk categories, appetite, and governance to strengthen organizational resilience.

Master hardware and operating system fundamentals, from CPU, RAM, and storage to BIOS/UEFI, and explore Windows, Linux, and macOS alongside practical troubleshooting and virtualization.

Explore networking fundamentals through the OSI and TCP/IP models, covering IP addressing, subnetting, NAT, VLANs, and essential devices like switches, routers, and firewalls to troubleshoot and secure networks.

Master system administration: manage users and groups, set permissions, control services across Windows, Linux, and macOS, automate tasks, patch systems, back up data, monitor performance, and read logs securely.

Master cloud computing essentials, including IaaS, PaaS, SaaS, FaaS, and KaaS, deployment models, shared responsibility, IAM, encryption, and data residency.

Explore virtualization and containers as the engines behind modern IT and cybersecurity. Learn about hypervisors, VMs, Docker, Kubernetes, and container security practices for scalable, secure deployments.

Explore the CIA triad—confidentiality, integrity, and availability—and how policy, controls, and defense in depth safeguard data with encryption, access controls, hashing, and incident response.

Identify malware types including viruses, worms, trojans, ransomware, spyware, and more, and how phishing and brute-force attacks breach defenses. Learn defenses like antivirus, EDR, IPS, and patch management.

Explore essential security tools and technologies that defend modern systems, from antivirus and EDR to firewalls, SIEM, and MFA, forming a layered defense against threats.

Explore how firewalls, antivirus, and endpoint protection form a defense in depth that safeguards networks and devices through layered traffic filtering, threat detection, and rapid response.

Apply a layered endpoint security strategy with patch management, access controls, standardized platforms, centralized management, and user training to guard devices from phishing, malware, and data loss.

Design secure networks through VLAN segmentation, VPNs, DMZs, WPA3, NAC, MFA, and SIEM, while adopting zero-trust to guard against ARP/DNS spoofing and rogue APs.

Examine authentication and authorization with MFA, SSO, and passwordless methods, then apply RBAC and ABAC plus zero-trust concepts.

Master password hygiene, device security, and software updates to reduce cyber risks. Practice secure browsing, and protect data on public Wi‑Fi using MFA, password managers, and encryption.

Learn how incident response and disaster recovery create operational resilience by detecting, containing, eradicating, and recovering from cyber incidents and disruptions, with practical plans, backups, and recovery objectives.

Explore data privacy foundations, including consent, purpose limitation, data minimization, transparency, security, and accountability, with GDPR and global rights like access, erasure, and data portability.

Explore databases as the backbone of modern IT, covering relational and NoSQL models, SQL concepts, data normalization, and essential security and backup practices.

Identify organizational needs via gap analysis and research technology options. Validate selections with proof of concept and pilot testing, then implement through a risk-based governance framework aligned with business objectives.

Examine commercial off-the-shelf (COTS) and custom-developed software, and compare open-source and proprietary licenses, including licensing models and audit implications for governance and compliance.

Master IT asset management for information systems auditing by building a comprehensive asset inventory and lifecycle approach. Identify ownership, custodianship, and secure disposal to protect data and comply with regulations.

Master configuration management to enforce baselines, maintain a CMDB, deploy from golden images, and use automation and version control for secure, compliant, and efficient IT operations.

Master patch and vulnerability management by building asset inventory, continuous monitoring, risk-based remediation, testing, and reporting within change management to strengthen organizational resilience.

Explore change management in information systems auditing, covering risk assessment, CAB review, testing, rollback, and compliant, secure audit trails.

Explore outsourcing and third-party risk management, covering work styles, vendor due diligence, service level agreements, data protection, and ongoing vendor oversight to balance cost, control, and compliance.

Explore SOC audits, including SOC 1, SOC 2, and SOC 3, and how Type 1 and Type 2 reports support vendor risk management, security, and compliance.

Identify the hierarchy of laws, acts, regulations, and standards shaping information security and risk management, and examine key frameworks like SOX, HIPAA, GDPR, ISO 27001, and NIST CSF.

Explore privacy management and controls, including governance frameworks, notices, consent, data inventories, activity logs, PIAs, e-discovery, and data subject rights, for compliant IT auditing.