KT Solutions Ltd., a technology-driven organization, is preparing for an Information Systems Audit aimed at evaluating the overall performance and regulatory compliance of its IT framework. Management wants to ensure tha

Information systems auditing or systems audit is an ongoing process of evaluating controls, collecting and evaluating evidence to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively, and uses resources efficiently. Thus, information systems auditing supports traditional audit objectives; attest objectives (those of the external auditor) that focus on asset safeguarding and data integrity, and management objectives (those of the internal auditor) that encompass not only attest objectives but also effectiveness and efficiency objectives. An information systems audit performed in an organization is a comprehensive examination of a given targeted system. The audit consists of an evaluation of the components which comprise that system, with examination and testing in the following areas: High-level systems architecture review Business process mapping (e.g. determining information systems dependency with respect to user business processes) End user identity management (e.g. authentication mechanisms, password standards, roles limiting or granting systems functionality) Operating systems configurations (e.g. services hardening) Application security controls Database access controls (e.g. database configuration, account access to the database, roles defined in the database) Anti-virus/Anti-malware controls Network controls (e.g. running configurations on switches and routers, use of Access control lists, and firewall rules) Logging and auditing systems and processes IT privileged access control (e.g. System Administrator or root access) IT processes in support of the system (e.g. user account reviews, change management) Backup/Restore procedures. During the System audit, the auditors are required to understand and evaluate the overall control environment. The control environment reflects the overall attitude of awareness and actions by the board of directors, management, and others concerning the importance of internal controls in the enterprise.