How to Perform an Information Security Audit

Distinguish the extent and nature of audit work, define materiality, set scope limits, and plan engagements using internal control evaluation, tests of control, and substantive procedures.

Define engagement objectives that safeguard assets, support profitability, and ensure reliable reporting, while applying risk assessment and mandatory fraud and data protection considerations in information security audits.

Assess the expenditure cycle to verify goods paid for are received and charged to the correct account, uphold the integrity of financial and operational information, and safeguard assets.

Plan the engagement with a detailed risk assessment to identify significant risks and controls, using risk inventories, heat maps, and a flowchart to uphold due professional care and ethics.

An engagement work program lists objectives and inherent risks, details procedures and tests, supports risk-based audit planning, assigns responsibilities, and ties testing to criteria such as control frameworks and regulations.

Explore generally accepted criteria for assurance engagements, including control frameworks, acts, regulations, and industry best practices, and understand why management objectives are not suitable criteria.

Plan and prepare the engagement from the annual internal audit plan through risk assessment and kickoff; conduct fieldwork with walkthroughs and controls design evaluation; draft and finalize the audit report.

Enhance information gathering through audit techniques, including walkthroughs, observation, interviews, and process mapping, to perform risk-based internal audits and gap analyses against ISO standards.

Learn how to conduct walkthroughs and analyze the walkthrough process to identify root causes and offer practical recommendations. Explore training gaps, control adherence, and handling exceptions within policy and procedure.

Learn how to test the operating effectiveness of internal controls using test of controls, and distinguish design tools from evidence while assessing safeguarding of assets.

Explore interview approaches for information security audits, including structured, behavioral, and situational formats, and master effective skills like active listening, open questions, and creating a relaxed interviewing environment.

Explore process maps and benchmarking to compare current, ideal, and performed paths, identify vulnerabilities, and apply internal, competitive, industrial, and best-in-class benchmarking.

Explore how risk control matrices link objectives to risk assessments within an audit program, focusing on controls, operating effectiveness, and risk-based thinking to assign responsibilities and guide review.

Identify key activities in supervising engagements, from planning and scope confirmation to audit program design, field work, and final report, under multi-level supervision by the chief audit executive.

Implement a performance appraisal system with post engagement evaluations and post audit appraisals to reduce recency bias and tie the annual review to prior internal audits.

Navigate supervision and engagement best practices for internal audits by assigning clear areas of responsibility, enabling full accountability from planning to verification, and addressing blocking points to meet objectives.

Identify appropriate evidence of supervisory review for engagement working papers, including supervisor initials, an engagement review checklist, and a memorandum of supervisory review; avoid relying on performance appraisals as evidence.

Learn to communicate engagement results and monitor the implementation of internal audit recommendations while mastering the confirmation process and risk acceptance.

Learn to communicate interim progress during an information security audit, managing immediate attention items and scope changes, and decide whether resolved issues remain in the final internal audit report.

Describe the risk behind audit findings in information security, identify root causes, and propose actionable recommendations with monitored action plans to remediate risk.

Learn how internal auditors handle risk acceptance, escalate to senior management and the board, determine risk appetite, and evaluate risk responses to audit findings.

Assess engagement outcomes and follow up on the implementation status of internal audit recommendations, ensuring risks are mitigated, evidence supports closure, and management reports to the board.

Examine how to respond when internal control weaknesses are not corrected, evaluate management's risk acceptance, and establish a monitoring process to assess the adequacy, effectiveness, and timeliness of follow-up actions.

Define artificial intelligence and explain machine learning and neural networks, showing how training data and probabilistic parameters yield outputs. Discuss natural language processing, computer vision, and reinforcement learning basics.

Explore the landscape of ai systems, from ai agents and symbolic and subsymbolic ai to learning paradigms—supervised, semi-supervised, unsupervised, and reinforcement learning.

The EU AI Act classifies AI into minimal, limited, high and unacceptable risk, requiring transparency, risk assessments, data quality, intended purpose, human oversight, and robust documentation for high-risk systems.

Explore the ethical principles of AI, including fairness, explainability, accountability, privacy, and security, emphasizing organizational objectives, human oversight, and trusted, reliable systems that protect data and share benefits.

Explore the four AI data analysis types—descriptive, diagnostic, predictive, and prescriptive—and learn how each builds on the last to analyze data, reveal root causes, forecast trends, and support decision making.

Learn how ISO 42,001 frames an artificial intelligence management system that covers planning, do, check, and act, emphasizing risk assessment, leadership commitment, context of the organization, scope, and controls.

Examine the context, scope, and governance of an ISO 42,001 AI management system, covering risk planning, objectives, resources, awareness, operation, and continual improvement.

Explore ISO 42001 annexes: annex a for the statement of applicability, annex b as an implementation guide, and annex c for AI risk objectives to inform your AI risk assessment.