Risk Management

Practical Steps for Auditing IT Risk Management

Do you want to create a flexible, risk-based audit program for your organization? Well, some believe that internal audits should play a lead role in advising management on risk issues and setting the risk management agenda. On the other hand, others think that internal audits should exist only to screen the risk management functions.

In this article at ISACA, Alexander Obraztsov explains effective steps for IT risk management using ISACA’s IT Risk Management Audit Program.

Steps for Effective Auditing of IT Risk Management

Map the Relevant Standards

Tailor your audit program to meet specific industries and circumstances presented by the information technology environment. Encourage your IS auditors to apply their professional judgment to include all procedures, information, and tests in the audit program. Further, the IS auditors must map the audit program relevant to the industry standards, guidelines, and regulations to avoid overlooking the mandatory regulatory requirements during the planning phase.

Adjust the Audit Objectives

The ISACA program’s control objectives (COs) address IT risk governance and framework, events identification, management processes, assessment and response, and maintenance and monitoring of remediation action plans. “The IS auditor might include all control objectives in the audit program, or only some of them, if the scope is limited to specific themes (e.g., annual risk assessment, risk monitoring, and reporting),” says the author.

Conduct Continuous Monitoring and Assessments

Given the increasing threats and dynamic nature of risks confronting many organizations, a static “annual audit plan” approach will not be enough for an internal audit to address evolving risks. Conducting regular assessments will help organizations in identifying the inefficiencies and mitigating the evolving threats.

IT auditors can certainly streamline their tasks with the help of ISACA’s IT Risk Management Audit/Assurance Program, COBIT 5, and COBIT 2019. With ISACA’s programs in place, IT auditors can even design a standardized approach, increase the efficiency of the audit work, and gain a comprehensive view of the enterprise’s risk management program. To learn more, click on https://www.isaca.org/resources/news-and-trends/newsletters/cobit-focus/2019/five-steps-for-effective-auditing-of-it-risk-management.

Related Articles

Back to top button

We use cookies on our website

We use cookies to give you the best user experience. Please confirm, if you accept our tracking cookies. You can also decline the tracking, so you can continue to visit our website without any data sent to third party services.