Fundamentals of Information Systems Security, 4th Edition

Defining the Audit Plan

In planning the activities for an audit, auditors must first define the objectives and determine which systems or business processes to review as well as defining which areas of assurance to check.

They must also identify the personnel—both from their own team and from the organization being audited—who will participate in the audit. These people will gather and put together information to move the audit along. Auditors must be sure that everyone has the right skills, is prepared to contribute, and is available when needed.

Some auditors include a review of previous audits to become familiar with past issues, whereas others choose not to review previous audits to avoid being prejudiced by prior conclusions.

Defining ...