"Information systems audit is an evaluation of adequacy of controls." What controls are required to be verified by an information systems auditor while auditing management controls? Explain any one of these controls.

Information System (IS) Audit is an evaluation of adequacy of controls. The following four management controls are required to be verified by the Information System Auditor Security Policy and Standards Constitution of Steering Committee Business Continuity Planning Systems Development Methodology 1. Security Policy and Standards The IS auditor should first verify whether the organization has a Security Policy. If it does not exist, the auditor needs to point this out as unless the management has a corporate IS Security policy it cannot follow standard implementation of IS Security across all units and divisions. If a security policy exists, it needs to be examined for accuracy and adequacy in proportion to the risk. Further, the security policy has to be always dynamically updated.