IT Auditor Course

Lesson 1 • Roles and Responsibilities in IT Audit

Maps the organisational roles involved in an IT audit engagement. Clarifies auditor independence, objectivity, and stakeholder relationships.

Lesson 2 • IT Audit Purpose and Scope

Defines IT auditing, its objectives, and boundaries within an organisation. Connects audit purpose to business value and risk reduction.

Lesson 3 • Governance and Compliance Frameworks

Introduces major control and governance frameworks used to guide IT audits. Provides the structural vocabulary auditors apply throughout the course.

Lesson 1 • Risk Register Development

Guides students in building and maintaining a formal risk register. The register becomes the living document that tracks risks across the audit lifecycle.

Lesson 2 • Risk Analysis and Prioritization

Applies qualitative and quantitative methods to rank identified risks. Prioritised risk rankings determine where audit resources are focused.

Lesson 3 • Risk Identification Techniques

Presents methods for surfacing IT risks across systems, processes, and people. Connects identification outputs directly to audit scope decisions.

Lesson 4 • Risk Concepts and Terminology

Defines threat, vulnerability, likelihood, and impact in the IT context. Establishes a shared risk vocabulary used in all subsequent audit activities.

Lesson 1 • Coordination with Auditees

Establishes communication protocols between auditors and auditee teams. Effective coordination reduces friction and accelerates evidence collection.

Lesson 2 • Audit Programme Development

Guides construction of step-by-step audit programmes aligned to objectives. Each programme step links to a specific risk and control to be tested.

Lesson 3 • Resource and Timeline Planning

Addresses staffing, scheduling, and budget considerations for an audit engagement. Realistic planning prevents scope creep and missed deadlines.

Lesson 4 • Audit Charter and Engagement Letter

Explains the authority documents that authorise and define an audit engagement. Establishes the formal basis for auditor access and cooperation.

Lesson 1 • Change Management Controls

Reviews the processes governing changes to systems, applications, and infrastructure. Effective change control prevents unauthorised or untested modifications.

Lesson 2 • IT Operations Controls

Assesses job scheduling, incident management, and monitoring practices. Operations controls ensure systems run reliably and issues are detected promptly.

Lesson 3 • Backup and Recovery Controls

Evaluates backup frequency, integrity testing, and recovery procedures. Adequate backup controls protect data availability and business continuity.

Lesson 4 • Physical and Environmental Controls

Reviews data centre physical security, environmental monitoring, and access controls. Physical controls are prerequisites for logical security effectiveness.

Lesson 1 • Database Integrity Controls

Assesses referential integrity, access controls, and logging within database systems. Database controls underpin the reliability of all application-level controls.

Lesson 2 • Processing Controls Assessment

Reviews controls that ensure transactions are processed correctly and completely. Processing controls prevent corruption of data during computation and transformation.

Lesson 3 • Output Controls Assessment

Evaluates controls over report generation, distribution, and retention. Output controls ensure only authorised parties receive accurate information.

Lesson 4 • End-User Computing Controls

Addresses risks in spreadsheets and user-developed applications outside formal IT governance. End-user computing is a frequently overlooked source of material errors.

Lesson 1 • Identifying and Evaluating Findings

Guides auditors in distinguishing control deficiencies from observations and determining severity. Accurate finding classification drives appropriate management response.

Lesson 2 • Types and Quality of Audit Evidence

Defines evidence types and the criteria of sufficiency, reliability, and relevance. Evidence quality directly determines the defensibility of audit conclusions.

Lesson 3 • Audit Sampling Methods

Covers statistical and non-statistical sampling approaches for control testing. Proper sampling ensures conclusions are representative and statistically supportable.

Lesson 4 • Workpaper Documentation Standards

Establishes standards for creating clear, complete, and reviewable audit workpapers. Well-structured workpapers support findings, conclusions, and external review.

Lesson 1 • Vulnerability Management Audit

Assesses the organisation's process for identifying, prioritising, and remediating vulnerabilities. A mature vulnerability programme reduces exploitable attack surface.

Lesson 2 • Network Security Controls Review

Evaluates firewall configurations, network segmentation, and traffic monitoring controls. Network security is the first line of defence against external threats.

Lesson 3 • Security Incident Response Audit

Evaluates the completeness and effectiveness of incident response plans and procedures. Auditors verify that detection, containment, and recovery capabilities are tested.

Lesson 4 • Identity and Access Security Audit

Reviews multi-factor authentication, identity governance, and privileged access security. Identity controls are the most targeted attack vector in modern threats.

Lesson 1 • Communicating Results to Stakeholders

Addresses oral presentation of audit results to management and audit committees. Effective communication ensures findings receive appropriate priority and resources.

Lesson 2 • Audit Report Structure and Content

Defines the components of a formal IT audit report and their purpose. A well-structured report communicates findings clearly to both technical and executive audiences.

Lesson 3 • Remediation Tracking and Follow-Up

Establishes a systematic process for tracking management action plan completion. Follow-up closes the audit loop and verifies that risks are actually mitigated.

Lesson 4 • Report Review and Quality Assurance

Covers internal review processes that ensure accuracy, consistency, and tone. Quality assurance prevents factual errors that undermine auditor credibility.