3.0 Introduction3.1 Internal Controls3.1.1 Understanding of Internal Controls3.1.2 Management Considerations for Evaluating Internal Controls3.2 IT General Controls3.2.1 Control Environment3.2.2 Change Management3.2.3 Logical Access3.2.4 Backup & Recovery3.2.5 Service Organizations3.3 Application Controls3.4 Information Security3.4.1 Understanding IT Policies, Procedures, and Standards to Ensure Information/Data Security3.4.2 Understanding Hardware and Physical Controls to Ensure Information/Data Security3.4.3 Understanding Software and Other Process Controls to Ensure Information/Data Security3.4.4 Understanding Concepts of Security Authorization and Authentication3.4.5 Understanding Concepts of Encryption3.5 Preparing an IT Audit Plan3.5.1 Scoping of the IT Audit or Review