
282 software Quality assuranCe
Understanding the Business*
e first step in defining the IT audit plan is to understand the business.
As part of this step, auditors need to identify the strategies, company
objectives, and business models that will enable them to understand the
organization’s unique business risks. e audit team must also under-
stand the business operations and IT service functions of the organiza-
tion to be audited.
Auditors need to become acquainted with the organization’s busi-
ness model as each organization has a distinct mission and set of business
goals and objectives.
Auditors can use different internal resources to identif