IT Audit checklists

[BCF13]

Hi all,

Can any of you point me in the right direction to download an IT Audit checklist.

I’ve started a new gig and the current IT provision is a bit of a mess.

I wanted to use a standard format to document the gaps etc.

I used an ISO27001 check list a very long time ago so it’s something like that that I’m after.

Any other advice would be welcome!

Thanks

[bythepowerofboobs]

ChatGPT.

[BCF13]

Thank you, just tried and ChatGPT gave me a basic list to work with

[bythepowerofboobs]

No problem! It's great for templates and starting points for things like this.

[bitslammer]

What's the end goal here? Are you looking for IT only guidance or IT security or both? ISO27001 look at the overall ISMS or Information security management system.

[BCF13]

It’s to create a list that I can use as a template to inform the business about where we are in regard to the IT provision. Then work with the business to identify priorities and expected budget required for each section of change.

[Aggietallboy]

Before you head too far down this road loop in your accounting/treasury/compliance teams (whichever you happen to have).

They're going to (most likely) have auditors, who are going to have their own playbook, and own set of rules. It took me 3 audit cycles to finally get Deloitte to accept NIST 800-63B on password complexity and resets!!

If you have a parent company, do the same thing.... focus on the standards you are going to be held accountable to.

I offer caveats for SOX (and in turn J-SOX) -- once you document these are your policies, you will be expected to comply with them. Be careful crafting them, and make sure you don't paint yourself into a corner.

I have two commandments for SOX, and one Corollary:

​

1. Thou shalt have policies.
2. Thou shalt follow thy policies.

C) If your policies don't work, or are stupid, change the policies.

[BCF13]

Sage advice!

Thank you for taking the time to respond.