When we began writing this book, we had a fundamental tenet: Write a clear handbook
for creating the organization’s IT audit function and for performing their IT audits. We
wanted this book to provide more than checklists and textbook theories but instead to
provide real-life practical guidance from people who have performed IT audit work day
in and day out in real corporations. If we’ve been successful, reading this book will accomplish
three objectives for the reader, above and beyond what can be obtained from
most IT auditing books and classes:
Guide the reader in how to perform the IT audit function in such a way that the
auditors maximize the value they provide to the company.
Part I of this book is dedicated to providing practical guidance on how to perform the
IT audit function in such a way that it will be considered an essential and respected
element of the company’s IT environment. This guidance is pulled from years of experience
and best practices, and even the most experienced of IT auditors will find a
plethora of useful tools and techniques in those chapters.
Enable the reader to perform thorough audits of common IT topics, processes,
and technologies.
Part II of this book is dedicated to guiding the reader with practical, detailed advice on
not only what to do but also why and how to do it. Too many IT audit resources provide
bullet-oriented checklists without empowering the auditor with enough information to
understand why they’re performing that task or how exactly to accomplish the step.
Our goal is to fill that gap for the reader.
Give the reader exposure to IT audit standards and frameworks as well as the
regulations that are currently driving the IT audit profession.
Part III focuses on standards and frameworks such as COBIT, ITIL, and ISO 17799 as
well as regulations such as Sarbanes-Oxley, HIPAA, and PCI. Another goal of this section
is to demystify risk assessment and management, which is required by most regulations.
A wealth of knowledge and resources for hardening systems and performing detailed
penetration tests are available in other texts. That is not the focus of this book. In
our experience as auditors, we have been called on more often to judge the quality of
internal controls from an insider’s standpoint. Therefore, the majority of audit steps in
this book are written with the assumption that the auditor has full access to all configuration
files, documentation, and information. This is not a hackers’ guidebook but
is instead a guidebook on how an auditor can assess and judge the internal controls
and security of the IT systems and processes at his or her company.