IT Audit, Control, and Security -- Contents -- Introduction: Importance of IT Auditing -- Part One: Auditing Internal Controls in an IT Environment -- Chapter 1: SOx and the COSO Internal Controls Framework -- ROLES AND RESPONSIBILITIES OF IT AUDITORS -- IMPORTANCE OF EFFECTIVE INTERNAL CONTROLS AND COSO -- COSO INTERNAL CONTROL SYSTEMS MONITORING GUIDANCE -- SARBANES-OXLEY ACT -- WRAPPING IT UP: COSO INTERNAL CONTROLS AND SOx -- NOTES -- Chapter 2: Using CobiT to Perform IT Audits -- INTRODUCTION TO CobiT -- CobiT FRAMEWORK -- USING CobiT TO ASSESS INTERNAL CONTROLS -- USING CobiT IN A SOx ENVIRONMENT -- CobiT ASSURANCE FRAMEWORK GUIDANCE -- CobiT IN PERSPECTIVE -- NOTES -- Chapter 3: IIA and ISACA Standards for the Professional Practice of Internal Auditing -- INTERNAL AUDITING'S INTERNATIONAL PROFESSIONAL PRACTICE STANDARDS -- CONTENT OF THE IPPF AND THE IIA INTERNATIONAL STANDARDS -- STRONGLY RECOMMENDED IIA STANDARDS GUIDANCE -- ISACA IT AUDITING STANDARDS OVERVIEW -- CODES OF ETHICS: THE IIA AND ISACA -- NOTES -- Chapter 4: Understanding Risk Management through COSO ERM -- RISK MANAGEMENT FUNDAMENTALS -- QUANTITATIVE RISK ANALYSIS TECHNIQUES -- IIA AND ISACA RISK MANAGEMENT INTERNAL AUDIT GUIDANCE -- COSO ERM: ENTERPRISE RISK MANAGEMENT -- IT AUDIT RISK AND COSO ERM -- NOTES -- Chapter 5: Performing Effective IT Audits -- IT AUDIT AND THE ENTERPRISE INTERNAL AUDIT FUNCTION -- ORGANIZING AND PLANNING IT AUDITS -- DEVELOPING AND PREPARING AUDIT PROGRAMS -- GATHERING AUDIT EVIDENCE AND TESTING RESULTS -- WORKPAPERS AND REPORTING IT AUDIT RESULTS -- PREPARING EFFECTIVE IT AUDITS -- NOTES -- Part Two: Auditing IT General Controls -- Chapter 6: General Controls in Today's IT Environments -- IMPORTANCE OF IT GENERAL CONTROLS -- IT GOVERNANCE GENERAL CONTROLS -- IT MANAGEMENT GENERAL CONTROLS -- IT TECHNICAL ENVIRONMENT GENERAL CONTROLS -- NOTE.

Chapter 7: Infrastructure Controls and ITIL Service Management Best Practices -- ITIL SERVICE MANAGEMENT BEST PRACTICES -- ITIL'S SERVICE STRATEGIES COMPONENT -- ITIL SERVICE DESIGN -- ITIL SERVICE TRANSITION MANAGEMENT PROCESSES -- ITIL SERVICE OPERATION PROCESSES -- SERVICE DELIVERY BEST PRACTICES -- AUDITING IT INFRASTRUCTURE MANAGEMENT -- NOTE -- Chapter 8: Systems Software and IT Operations General Controls -- IT OPERATING SYSTEM FUNDAMENTALS -- FEATURES OF A COMPUTER OPERATING SYSTEM -- OTHER SYSTEMS SOFTWARE TOOLS -- Chapter 9: Evolving Control Issues: Wireless Networks, Cloud Computing, and Virtualization -- UNDERSTANDING AND AUDITING IT WIRELESS NETWORKS -- UNDERSTANDING CLOUD COMPUTING -- STORAGE MANAGEMENT VIRTUALIZATION -- Part Three: Auditing and Testing IT Application Controls -- Chapter 10: Selecting, Testing, and Auditing IT Applications -- IT APPLICATION CONTROL ELEMENTS -- SELECTING APPLICATIONS FOR IT AUDIT REVIEWS -- PERFORMING AN APPLICATION CONTROLS REVIEW: PRELIMINARY STEPS -- COMPLETING THE IT APPLICATION CONTROLS AUDIT -- APPLICATION REVIEW CASE STUDY: CLIENT-SERVER BUDGETING SYSTEM -- AUDITING APPLICATIONS UNDER DEVELOPMENT -- IMPORTANCE OF REVIEWING IT APPLICATION CONTROLS -- NOTES -- Chapter 11: Software Engineering and CMMi -- SOFTWARE ENGINEERING CONCEPTS -- CMMI: CAPABILITY MATURITY MODEL FOR INTEGRATION -- CMMI BENEFITS -- IT AUDIT, INTERNAL CONTROL, AND CMMI -- NOTE -- Chapter 12: Auditing Service-Oriented Architectures and Record Management Processes -- SERVICE-ORIENTED COMPUTING AND SERVICE-DRIVEN APPLICATIONS -- IT AUDITING IN SOA ENVIRONMENTS -- ELECTRONIC RECORDS MANAGEMENT INTERNAL CONTROL ISSUES AND RISKS -- IT AUDITS OF ELECTRONIC RECORDS MANAGEMENT PROCESSES -- NOTES -- Chapter 13: Computer-Assisted Audit Tools and Techniques -- UNDERSTANDING COMPUTER-ASSISTED AUDIT TOOLS AND TECHNIQUES.

DETERMINING THE NEED FOR CAATTS -- CAATT SOFTWARE TOOLS -- STEPS TO BUILDING EFFECTIVE CAATTS -- IMPORTANCE OF CAATTS FOR AUDIT EVIDENCE GATHERING -- Chapter 14: Continuous Assurance Auditing, OLAP, and XBRL -- IMPLEMENTING CONTINUOUS ASSURANCE AUDITING -- BENEFITS OF CONTINUOUS ASSURANCE AUDITING TOOLS -- DATA WAREHOUSES, DATA MINING, AND OLAP -- XBRL: THE INTERNET-BASED EXTENSIBLE MARKUP LANGUAGE -- NEWER TECHNOLOGIES, THE CONTINUOUS CLOSE, AND IT AUDIT -- NOTES -- Part Four: Importance of IT Governance -- Chapter 15: IT Controls and the Audit Committee -- ROLE OF THE AUDIT COMMITTEE FOR IT AUDITORS -- AUDIT COMMITTEE APPROVAL OF INTERNAL AUDIT PLANS AND BUDGETS -- AUDIT COMMITTEE BRIEFINGS ON IT AUDIT ISSUES -- AUDIT COMMITTEE REVIEW AND ACTION ON SIGNIFICANT IT AUDIT FINDINGS -- IT AUDIT AND THE AUDIT COMMITTEE -- Chapter 16: Val IT, Portfolio Management, and Project Management -- VAL IT: ENHANCING THE VALUE OF IT INVESTMENTS -- IT SYSTEMS PORTFOLIO AND PROGRAM MANAGEMENT -- PROJECT MANAGEMENT FOR IT AUDITORS -- NOTES -- Chapter 17: Compliance with IT-Related Laws and Regulations -- COMPUTER FRAUD AND ABUSE ACT -- COMPUTER SECURITY ACT OF 1987 -- GRAMM-LEACH-BLILEY ACT -- HIPAA: HEALTHCARE AND MUCH MORE -- OTHER PERSONAL PRIVACY AND SECURITY LEGISLATIVE REQUIREMENTS -- IT-RELATED LAWS, REGULATIONS, AND AUDIT STANDARDS -- Chapter 18: Understanding and Reviewing Compliance with ISO Standards -- BACKGROUND AND IMPORTANCE OF ISO STANDARDS IN A WORLD OF GLOBAL COMMERCE -- ISO STANDARDS OVERVIEW -- ISO 19011 QUALITY MANAGEMENT SYSTEMS AUDITING -- ISO STANDARDS AND IT AUDITORS -- NOTES -- Chapter 19: Controls to Establish an Effective IT Security Environment -- GENERALLY ACCEPTED SECURITY STANDARDS -- EFFECTIVE IT PERIMETER SECURITY -- ESTABLISHING AN EFFECTIVE, ENTERPRISE-WIDE SECURITY STRATEGY -- BEST PRACTICES FOR IT AUDIT AND SECURITY -- NOTES.

Chapter 20: Cybersecurity and Privacy Controls -- IT NETWORK SECURITY FUNDAMENTALS -- IT SYSTEMS PRIVACY CONCERNS -- PCI-DSS FUNDAMENTALS -- AUDITING IT SECURITY AND PRIVACY -- SECURITY AND PRIVACY IN THE INTERNAL AUDIT DEPARTMENT -- NOTES -- Chapter 21: IT Fraud Detection and Prevention -- UNDERSTANDING AND RECOGNIZING FRAUD IN AN IT ENVIRONMENT -- RED FLAGS: FRAUD DETECTION SIGNS FOR IT AND OTHER INTERNAL AUDITORS -- PUBLIC ACCOUNTING'S ROLE IN FRAUD DETECTION -- IIA STANDARDS AND ISACA MATERIALS FOR DETECTING AND INVESTIGATING FRAUD -- IT AUDIT FRAUD RISK ASSESSMENTS -- IT AUDIT FRAUD INVESTIGATIONS -- IT FRAUD PREVENTION PROCESSES -- FRAUD DETECTION AND THE IT AUDITOR -- NOTES -- Chapter 22: Identity and Access Management -- IMPORTANCE OF IDENTITY AND ACCESS MANAGEMENT -- IDENTITY MANAGEMENT PROCESSES -- SEPARATION OF DUTIES IDENTIFY MANAGEMENT CONTROLS -- ACCESS MANAGEMENT PROVISIONING -- AUTHENTICATION AND AUTHORIZATION -- AUDITING IDENTITY AND ACCESS MANAGEMENT PROCESSES -- NOTE -- Chapter 23: Establishing Effective IT Disaster Recovery Processes -- IT DISASTER AND BUSINESS CONTINUITY PLANNING TODAY -- BUILDING AND AUDITING AN IT DISASTER RECOVERY PLAN -- BUILDING THE IT DISASTER RECOVERY PLAN -- DISASTER RECOVERY PLANNING AND SERVICE LEVEL AGREEMENTS -- NEWER DISASTER RECOVERY PLAN TECHNOLOGIES: DATA MIRRORING TECHNIQUES -- AUDITING BUSINESS CONTINUITY PLANS -- DISASTER RECOVERY AND BUSINESS CONTINUITY PLANNING GOING FORWARD -- NOTES -- Chapter 24: Electronic Archiving and Data Retention -- ELEMENTS OF A SUCCESSFUL ELECTRONIC RECORDS MANAGEMENT PROCESS -- ELECTRONIC DOCUMENTATION STANDARDS -- IMPLEMENTING ELECTRONIC IT DATA ARCHIVING -- AUDITING ELECTRONIC DOCUMENT RETENTION AND ARCHIVAL PROCESSES -- Chapter 25: Business Continuity Management, BS 25999, and ISO 27001 -- IT BUSINESS CONTINUITY MANAGEMENT PLANNING NEEDS TODAY.

BS 25999 GOOD PRACTICE GUIDELINES -- AUDITING BCM PROCESSES -- LINKING THE BCM WITH OTHER STANDARDS AND PROCESSES -- NOTES -- Chapter 26: Auditing Telecommunications and IT Communications Networks -- NETWORK SECURITY CONCEPTS -- EFFECTIVE IT NETWORK SECURITY CONTROLS -- AUDITING A VPN INSTALLATION -- NOTE -- Chapter 27: Change and Patch Management Controls -- IT CHANGE MANAGEMENT PROCESSES -- AUDITING IT CHANGE AND PATCH MANAGEMENT CONTROLS -- NOTES -- Chapter 28: Six Sigma and Lean Technologies -- SIX SIGMA BACKGROUND AND CONCEPTS -- IMPLEMENTING SIX SIGMA -- LEAN SIX SIGMA -- NOTES -- Chapter 29: Building an Effective IT Internal Audit Function -- ESTABLISHING AN IT INTERNAL AUDIT FUNCTION -- INTERNAL AUDIT CHARTER: AN IMPORTANT IT AUDIT AUTHORIZATION -- ROLE OF THE CHIEF AUDIT EXECUTIVE -- IT AUDIT SPECIALISTS -- IT AUDIT MANAGERS AND SUPERVISORS -- INTERNAL AND IT AUDIT POLICIES AND PROCEDURES -- ORGANIZING AN EFFECTIVE IT AUDIT FUNCTION -- IMPORTANCE OF A STRONG IT AUDIT FUNCTION -- NOTE -- Chapter 30: Professional Certifications: CISA, CIA, and More -- CERTIFIED INFORMATION SYSTEMS AUDITOR CREDENTIALS -- CERTIFIED INFORMATION SECURITY MANAGER CREDENTIALS -- CERTIFICATE IN THE GOVERNANCE OF ENTERPRISE IT -- CERTIFIED INTERNAL AUDITOR RESPONSIBILITIES AND REQUIREMENTS -- BEYOND THE CIA: OTHER IIA CERTIFICATIONS -- CISSP INFORMATION SYSTEMS SECURITY PROFESSIONAL CERTIFICATION -- CERTIFIED FRAUD EXAMINER CERTIFICATION -- ASQ INTERNAL AUDIT CERTIFICATIONS -- OTHER INTERNAL AUDITOR CERTIFICATIONS -- NOTE -- Chapter 31: Quality Assurance Auditing and ASQ Standards -- DUTIES AND RESPONSIBILITIES OF QUALITY AUDITORS -- ROLE OF THE QUALITY AUDITOR -- PERFORMING ASQ QUALITY AUDITS -- QUALITY ASSURANCE REVIEWS OF IT AUDIT FUNCTIONS -- FUTURE DIRECTIONS FOR QUALITY ASSURANCE AUDITING -- NOTE -- Index.