How to Perform an Information Security Audit

Learn how to plan internal audit engagements by defining objectives, scope, and criteria, linking risk assessment to procedures, and shaping staffing and working papers.

Distinguish the extent and nature of audit work, define materiality, set scope limits, and plan engagements using internal control evaluation, tests of control, and substantive procedures.

Define engagement objectives that safeguard assets, support profitability, and ensure reliable reporting, while applying risk assessment and mandatory fraud and data protection considerations in information security audits.

Assess the expenditure cycle to verify goods paid for are received and charged to the correct account, uphold the integrity of financial and operational information, and safeguard assets.

Plan the engagement with a detailed risk assessment to identify significant risks and controls, using risk inventories, heat maps, and a flowchart to uphold due professional care and ethics.

Assess how an internal auditor should define and refine the scope of engagement to cover significant risks, report a breach, and exercise due professional care.

An engagement work program lists objectives and inherent risks, details procedures and tests, supports risk-based audit planning, assigns responsibilities, and ties testing to criteria such as control frameworks and regulations.

Explore generally accepted criteria for assurance engagements, including control frameworks, acts, regulations, and industry best practices, and understand why management objectives are not suitable criteria.

Plan and prepare the engagement from the annual internal audit plan through risk assessment and kickoff; conduct fieldwork with walkthroughs and controls design evaluation; draft and finalize the audit report.

Enhance information gathering through audit techniques, including walkthroughs, observation, interviews, and process mapping, to perform risk-based internal audits and gap analyses against ISO standards.

Learn how to conduct walkthroughs and analyze the walkthrough process to identify root causes and offer practical recommendations. Explore training gaps, control adherence, and handling exceptions within policy and procedure.

Learn how to test the operating effectiveness of internal controls using test of controls, and distinguish design tools from evidence while assessing safeguarding of assets.

Explore interview approaches for information security audits, including structured, behavioral, and situational formats, and master effective skills like active listening, open questions, and creating a relaxed interviewing environment.

Explore process maps and benchmarking to compare current, ideal, and performed paths, identify vulnerabilities, and apply internal, competitive, industrial, and best-in-class benchmarking.

Explore how risk control matrices link objectives to risk assessments within an audit program, focusing on controls, operating effectiveness, and risk-based thinking to assign responsibilities and guide review.

Learn to build a risk control matrix by first clarifying objectives using the COSO framework, then identify inherent risks, design and test controls, and report findings.

Identify key activities in supervising engagements, from planning and scope confirmation to audit program design, field work, and final report, under multi-level supervision by the chief audit executive.

Implement a performance appraisal system with post engagement evaluations and post audit appraisals to reduce recency bias and tie the annual review to prior internal audits.

Navigate supervision and engagement best practices for internal audits by assigning clear areas of responsibility, enabling full accountability from planning to verification, and addressing blocking points to meet objectives.

Reviewing working papers links risks, objectives, and tests across the audit program, ensuring high-quality documentation and a clear, well-supported final internal audit report.

Identify appropriate evidence of supervisory review for engagement working papers, including supervisor initials, an engagement review checklist, and a memorandum of supervisory review; avoid relying on performance appraisals as evidence.

Learn to communicate engagement results and monitor the implementation of internal audit recommendations while mastering the confirmation process and risk acceptance.

communications must be accurate, objective, fair, impartial, balanced, clear, concise, complete, and timely. avoid acronyms, use plain language, explain mitigating circumstances, and present constructive recommendations to support actionable audit conclusions.

Learn to communicate interim progress during an information security audit, managing immediate attention items and scope changes, and decide whether resolved issues remain in the final internal audit report.

Describe the risk behind audit findings in information security, identify root causes, and propose actionable recommendations with monitored action plans to remediate risk.

Communicate actionable, smart recommendations for information security audits using specific, measurable, achievable, relevant, time-based criteria, and structure lean audit reports with purpose, scope, findings, actions, deadlines, and owners.

Explore engagement opinions and overall opinions in internal audits, and compare positive, negative, and qualified assurances. Understand internal control maturity and the role of COSO maturity in audits.

Learn how internal audit reports include actionable recommendations, emphasize management engagement, and seek agreement with department managers on criteria to measure operating performance using best practices as standards.

Learn how internal auditors handle risk acceptance, escalate to senior management and the board, determine risk appetite, and evaluate risk responses to audit findings.

Assess engagement outcomes and follow up on the implementation status of internal audit recommendations, ensuring risks are mitigated, evidence supports closure, and management reports to the board.

Examine how to respond when internal control weaknesses are not corrected, evaluate management's risk acceptance, and establish a monitoring process to assess the adequacy, effectiveness, and timeliness of follow-up actions.

Examine ai risks, the ai use maturity model, and ISO 42,001 safeguards, with cases of deepfake fraud, chatbot manipulation, data poisoning, model stealing, and model inversion attacks.

Define artificial intelligence and explain machine learning and neural networks, showing how training data and probabilistic parameters yield outputs. Discuss natural language processing, computer vision, and reinforcement learning basics.

Explore the landscape of ai systems, from ai agents and symbolic and subsymbolic ai to learning paradigms—supervised, semi-supervised, unsupervised, and reinforcement learning.

The EU AI Act classifies AI into minimal, limited, high and unacceptable risk, requiring transparency, risk assessments, data quality, intended purpose, human oversight, and robust documentation for high-risk systems.

Explore the ethical principles of AI, including fairness, explainability, accountability, privacy, and security, emphasizing organizational objectives, human oversight, and trusted, reliable systems that protect data and share benefits.

Explore the six-stage artificial intelligence use maturity model, from siloed systems to wide-focus governance, risk, and compliance, revealing how privileged organization data enables real-time monitoring and analytics.

Explore simple ai use cases for governance, risk management and compliance, including anomaly detection, data analytics, fraud detection, kyc and aml, regulatory reporting, and risk assessment.

Explore the four AI data analysis types—descriptive, diagnostic, predictive, and prescriptive—and learn how each builds on the last to analyze data, reveal root causes, forecast trends, and support decision making.

Explore AI data analytics for risk, compliance, and detection, including data cleansing, fraud and anomaly detection, risk analytics, and real-time monitoring with industry tools.

Explore AI data analytics for performance, insight, and optimization across operational performance, compliance verification, sentiment and network analysis, clustering, behavior analytics, and optimization analytics.

Learn how ISO 42,001 frames an artificial intelligence management system that covers planning, do, check, and act, emphasizing risk assessment, leadership commitment, context of the organization, scope, and controls.

Examine the context, scope, and governance of an ISO 42,001 AI management system, covering risk planning, objectives, resources, awareness, operation, and continual improvement.

Explore ISO 42001 annexes: annex a for the statement of applicability, annex b as an implementation guide, and annex c for AI risk objectives to inform your AI risk assessment.

Identify roles in an ai management system and how they coordinate, from ai manager to ethics, compliance, data science, user experience, risk, training, quality assurance, data protection, policy, and documentation.