Audit Planning Process

Strategy for IT Audit planning

In planning for an IT audit, the first step is to determine the audit universe, i.e. all areas taht is under the responsibility of the CIO (Chief Information Officer)

Audit universe can be determined from the:

• organisation structure,
  
• COBIT 34 IT processes or
  
• subject e.g. Datawarehouse.

Using 34 COBIT IT processes as audit universe
If you are using the 34 IT audit processes, assess all the 34 IT processes maturity (in COBIT), rank the maturity of each IT processes from the scale of 0-5.

Also assess the business impact of the processes failure and likelihood of the process failure. Areas which has high business impact and high likelihood of happening (based on previous history) should be given more attention.

Alternatively, you can also linking the audit universe to the 34 COBIT IT processes. Example "IT Budget audit" can be link to PO5, Manage the IT Investment.

What to audit first?

Audit the “ IT Risk Management” process first using either;

- COBIT Assurance Guide: PO9 “ Assess and Manage IT Risk”

- FFIEC “Management” Handbook, IT Risk Management Process

Also audit the “IT Governance” using ISACA Guidelines.

‘To be continued’

IT Control - IT Plan

Purpose of IT plans is to ensure that the use of IT is aligned with the mission and business strategies of the organization

It is also to highlight the IT requirements in achieving the business objectives.

In general there are two types of plan, i.e. short-range and long-range plan.

As like any other plan,it should be reassessed periodically and amended as necessary in response to changing business and IT conditions.

Management should establish processes to capture and report feedback from business process
owners and users regarding the quality and usefulnessof long- and short-range plans.

Risks
Failure to plan and re-assessed the plan could lead to:-

• IT failures to meet the organisation’s missions and goals
• IT failures to match short-range plans with long-range plans
• IT projects failures to meet short-range plans
• IT failures to meet cost and time guidelines
• Missed business opportunities
• Missed IT opportunities