IT Audit Process Step-by-Step Guide | IT Audit Guide Part 05

The IT audit process is a structured methodology that guides auditors from planning through to reporting and follow-up. While specific approaches may vary depending on frameworks (e.g., COBIT, ISO 27001, NIST), most audits follow a similar lifecycle of six core phases:

🧭 Step 1: Planning and Preparation

Objective: Define audit scope, understand the environment, assess risks, and set expectations.

Key Activities:

Define audit scope, objectives, and criteria
Identify regulatory requirements and applicable frameworks
Conduct preliminary risk assessment (based on IT risk register, past audits, or incidents)
Perform stakeholder interviews to understand systems, processes, and pain points
Prepare and issue the Initial Information Request List (IRL)

Deliverables:

Audit Charter and Plan
Risk and Control Matrix (RCM)
Resource Allocation & Audit Schedule
Kick-off Meeting Agenda and Materials

Best Practices:

Align IT audit goals with enterprise risk and compliance priorities
Involve internal stakeholders early to reduce resistance

🧩 Step 2: Risk Assessment and Scoping

Objective: Prioritize audit focus areas based on potential risk and control impact.

Key Activities:

Identify key business processes supported by IT (e.g., finance, operations, HR)
Map IT assets, applications, and infrastructure to business processes
Assess threats, vulnerabilities, and impacts
Define in-scope systems, locations, vendors, and time periods

Deliverables:

Finalized Audit Scope Document
Risk Prioritization Report
Audit Universe Mapping

Best Practices:

Use risk heat maps to visualize control weaknesses
Prioritize systems critical to business continuity or regulatory compliance

🧪 Step 3: Fieldwork and Testing

Objective: Collect evidence to evaluate the design and operational effectiveness of IT controls.

Key Activities:

Perform control walkthroughs and control design validation
Conduct compliance testing (sampling, log reviews, configuration checks)
Interview process owners, IT managers, and control owners
Perform vulnerability scanning and access control reviews
Validate change management, incident response, backup, and DR controls

Common Tools:

GRC platforms (e.g., RSA Archer, MetricStream)
Log analyzers (e.g., Splunk)
Access control review tools
Excel and scripts for sampling and reconciliation

Deliverables:

Working Papers and Test Results
Control Exception Reports
Preliminary Risk & Gap Register

Best Practices:

Document evidence with screenshots, logs, and interviews
Segregate “design gaps” vs “operating failures”

📋 Step 4: Analysis and Evaluation

Objective: Analyze audit findings, identify root causes, and assess business impacts.

Key Activities:

Evaluate the effectiveness of existing controls
Classify findings by severity: High, Medium, Low
Determine potential impacts (financial, reputational, operational, regulatory)
Benchmark against frameworks (e.g., COBIT maturity models, ISO control objectives)

Deliverables:

Risk and Control Deficiency Summary
Root Cause Analysis Documentation
Risk Ranking Matrix

Best Practices:

Focus on material risks, not just technical flaws
Engage IT and business teams in validating preliminary findings

📑 Step 5: Reporting and Communication

Objective: Clearly present audit findings, risk implications, and recommendations.

Key Activities:

Draft formal audit report, including:
- Executive Summary
- Observations and Risk Ratings
- Remediation Recommendations
- Management Responses
Conduct formal exit meeting with stakeholders
Review audit findings with Internal Audit, Risk, or Compliance Committees

Deliverables:

Final IT Audit Report
Management Action Plan
Executive Summary Slides

Best Practices:

Use visuals like dashboards or control heat maps
Separate critical findings (requiring urgent attention) from advisory suggestions

🔁 Step 6: Follow-Up and Remediation Tracking

Objective: Ensure effective implementation of agreed corrective actions.

Key Activities:

Set remediation deadlines and assign responsibility
Monitor progress of corrective actions
Re-perform control testing as needed
Conduct formal follow-up audit (if required by audit committee)

Deliverables:

Remediation Status Report
Updated Risk Register
Follow-up Testing Results

Best Practices:

Automate follow-up tracking using GRC tools or audit workflow systems
Escalate overdue or high-risk remediation delays

✅ Summary of IT Audit Process

Phase	Focus	Key Output
Planning	Define scope & stakeholders	Audit Plan, Kick-off Deck
Risk Assessment	Prioritize focus areas	Final Scope, Risk Map
Fieldwork	Test controls & gather evidence	Working Papers, Gap Register
Analysis	Evaluate & rank findings	Risk Severity Ratings
Reporting	Communicate insights	Final Audit Report, Action Plan
Follow-up	Ensure remediation & accountability	Follow-up Reports, Closure Docs