METHODOLOGY TO PERFORM THE AUDIT OF A COMPANY
Audit planning
The first thing that should be done in a systems audit is how to planThe design of the methods, techniques and procedures necessary to carry it out and finally for the application of documents that will support the execution, ending with the elaboration of the documentation of the plans, programs and budgets to carry it out.
Audit origin
To initiate the planning of the audit, you must determine why the need or concern to carry out an audit arises. The questions that must be answered where?, because?, Who? o For what? You want to make the evaluation of some aspect of the company’s systems.
Preliminary audit view
The planning of the audit is to make a preliminary visit to the computer area that will be audited, after knowing the origin of the request to make the audit and before formally starting it;The purpose is to have a first contact with the personnel assigned to said area, know the location and distribution of the systems the terminal servers and equipment in the computer center, their characteristics, the security measures and other aspects about which problems thatThey are presented in the audited area. The initial visit for the start of the audit whose purpose is to know how the equipment is distributed in the area?, How many, which, how and what kind are the servers and terminals that exist in the area?, What general characteristics of the systems that will be audited?, What type of facilities and physical connections exist in the area?, What is the reaction of the staff in front of the auditor?, What are the existing physical security measures in the area?, And what limitations are observed to perform the audit?. With this information, the auditor can design the necessary measures for adequate audit planning and establish some concrete actions that help the development of the evaluation.
Audit objectives
A global purpose of what is intended to be achieved with the development of computer audit and systems, in which all aspects that must be evaluated are raised.
Specific objectives
They are the individual purposes that are desired to achieve the general objective, which specifically indicates the specific systems, components or elements that must be evaluated.
Points to evaluate
Determine the points that will be evaluated
Once the objectives of the audit are determined, the aspects that will be evaluated mustThe functions of computer personnel and users of the systems, the development systems, the operation of the production systems, the training programs for the personnel of the area and users of the systems, protection of all the databases, confidential data andAccess to them, protection of backups and information restoration, among other aspects.
Plans to perform the audit
To carry out the formal planning of the systems audit, in which the plans are specified, the formal documents for the development of the audit must first be developed, where the stages, events and activities and the execution times are delimited forcompliance with the objective, annexing the budget with the costs of the resources that will be used to carry it out.
Audit methods
This part determines the necessary documentation and means to carry out the review and evaluation in the company, selecting or designing the methods, procedures, tools, and instruments necessary according to the plans, budgets and programs established above for the audit. For this, the following points should be considered: establish the weighting guide of each of the points that must be evaluated;Make an audit guide;Make the formal document of the audit guide;Determine the tools, methods and procedures for systems audit and finally design the systems, programs and test methods for the audit.
Resource allocation
Finally, the resources that will be used to carry out the audit must be assigned. With the allocation of these human, computer, technological and any other types of any other types, the audit will be carried out.
References
- Science Magazine, (2017). Innovation and technology. (RCIYT). Vol. III standard of best practices COBIT 4.1
- Methodology for a blog audit.spot
Leave feedback