Internal Audit Checklist Samples

Auditors inspect company financial reports for compliance to external and internal requirements.

Companies face a wide array of governmental regulations and legal requirements. Public companies must have their financial statements and the information technology (IT) systems that store them audited on a regular basis in accordance with the Sarbanes-Oxley Act. The Payment Card Industry Data Security Standard requires that companies which process credit cards be audited to ensure their computer systems are configured securely. Companies hire third-party auditing firms to inspect their systems and verify compliance with these standards.

Tasks

Auditors look for a few basic things upon arriving at a company. These include documented policies and processes and evidence that those policies and procedures are followed. The more detailed a company's policies are the easier it is for the auditor to do his work. Companies must establish a framework upon which to build their policies and processes. IT auditors are familiar with standards, such as Control Objectives for IT (COBIT) or ISO 27001. Each of these guide companies by providing checklists of how to secure sensitive data. Auditors use these checklists to ensure a thorough audit.

Sample Documentation, Policies and Procedures Checklist

1. Determine whether a change management process exists and is formally documented.

2. Determine if change management operations has a current list of system owners.

3. Determine accountability for managing and coordinating changes.

4. Determine the process for escalating and investigating unauthorized changes.

5. Determine the change management flows within the organization.

Sample Change Initiation and Approval Checklist

1. Verify a methodology is used for initiation and approval of changes.

2. Determine if priorities are assigned to the change requests.

3. Verify estimated time to completion and costs are communicated.

4. Evaluate the process used to control and monitor changes.

Sample IT Security Checklist.

1. Confirm that all unnecessary and insecure protocols are disabled.

2. Verify that minimum password lengths are set to 7 characters.

3. Verify that complex passwords are used.

4. Ensure that the system is up to date with patches and service packs.

5. Verify that password aging is set to 60 days or less.

References

• "IT Change Control Audit Program Guide and Checklist"; Dwayne Melancon; 2006
• PCI Security Standards Council; Documents Library
• ISACA; COBIT - IT Governance Framework