IT Audit A Complete Guide
You're not just another auditor. You’re someone tasked with protecting your organisation from invisible threats, systemic vulnerabilities, and cascading compliance failures-under constant pressure to deliver certainty in an environment where risks evolve by the hour. Every unpatched system, every misunderstood control, every ambiguous finding report isn’t just a gap. It’s potential downtime, regulatory penalties, or worse: a breach that erodes stakeholder trust and job security. The cost of uncertainty isn’t just financial. It’s reputational. Career-limiting. But what if you could walk into any audit with precision, confidence, and a methodology so robust that your peers defer to you, your managers rely on you, and your board listens when you speak? What if you could transform from reactive verifier to proactive assurance leader? IT Audit A Complete Guide is not another theoretical overview. It’s the exact framework used by elite internal audit professionals to design, execute, and report on high-impact IT audits across complex enterprise environments-delivered in a battle-tested, step-by-step system. One senior auditor at a global fintech told us: “After applying Module 5’s control validation technique, I uncovered a critical access flaw in our core banking API that outside auditors had missed for three years. My report led to an immediate security overhaul-and a fast-track promotion.” This course delivers a clear outcome: You will go from scattered checklists to producing board-ready, action-oriented audit findings in under 30 days-with a methodology that stands up to regulatory scrutiny and adds measurable value. Here’s how this course is structured to help you get there.Flexible, Risk-Free Access Designed for Demanding Professionals This is not a rigid training program. IT Audit A Complete Guide is engineered for professionals who need depth without disruption-delivered entirely on-demand with lifetime access and zero time pressure. Self-Paced Learning with Immediate Online Access
The course opens the moment you enroll. There are no fixed dates, no scheduled sessions, and no deadlines. You progress at your own pace-whether you complete it in two weeks or six months. Most learners implement core audit methodologies within 14 days and finish the full curriculum in 25-30 hours of focused study. - Access all materials online from day one
- Learn at your own speed-no time constraints
- Complete in as little as 3 weeks with 1 hour per day
- Apply concepts directly to your current audit projects
Lifetime Access and Ongoing Updates Included
Technology and compliance standards change. Your training shouldn’t become obsolete. You receive automatic updates to all content-controls frameworks, audit templates, regulatory benchmarks-free for life. This course evolves with the industry. - Future updates included at no additional cost
- Automatic revisions when standards shift (e.g. ISO, NIST, COBIT)
- Revisit materials anytime, for any audit cycle
- Always aligned with current best practices and regulatory expectations
Global, Mobile-Friendly Learning Anytime, Anywhere
Whether you're preparing for an audit walkthrough on a train, refining your workpapers in a conference room, or reviewing risk matrices from home, full functionality is available across devices. The platform is optimised for mobile, tablet, and desktop-24/7 access worldwide. - Fully responsive design-no apps to install
- Seamless progress syncing across devices
- Downloadable templates and frameworks for offline use
- Accessible in high-latency environments
Direct Instructor Support and Practical Guidance
You’re not learning in isolation. The course includes structured guidance from audit practitioners with 20+ years of Big Four and enterprise risk experience. You’ll receive clear, actionable feedback paths for applying methodologies to real audits-through embedded review checkpoints, decision trees, and scenario-based validations. - Expert-crafted templates validated across industries
- Guided workflows for scoping, testing, and reporting
- Scenario-based frameworks to handle edge cases
- Context-specific examples from financial, healthcare, and tech sectors
Receive a Globally Recognised Certificate of Completion
Upon finishing the course and passing the final assessment, you will earn a Certificate of Completion issued by The Art of Service-a credential trusted by auditors, risk officers, and compliance leads in over 90 countries. This certification validates your mastery of end-to-end IT audit execution and strengthens your professional credibility. - Issued by The Art of Service-recognised in GRC, internal audit, and risk communities
- Verifiable digital badge for LinkedIn and professional profiles
- Aligns with core competencies required for CISA, CRISC, and CIA candidates
- Bolsters audit team credibility during regulatory or third-party reviews
Transparent Pricing, No Hidden Fees
You pay one clear price with no recurring charges, no upsells, and no surprise costs. The fee includes full curriculum access, all templates, updates, and certification. - No subscription model-pay once, own it for life
- No add-ons or required tools
- All audit frameworks, checklists, and risk matrices included
Accepted Payment Methods
We accept Visa, Mastercard, and PayPal-securely processed with bank-level encryption. Payments are one-time and final, with immediate enrollment confirmation. Zero-Risk Enrollment: Satisfied or Refunded
We are confident this course will transform your audit capability. If you complete the first two modules and find the content does not meet your expectations for depth, practicality, or relevance, simply request a full refund within 30 days. No questions asked. This is 100% risk-reversed. Instant Confirmation, Seamless Onboarding
After enrollment, you’ll receive a confirmation email. Your access credentials and course entry instructions will be delivered separately once your learner profile is activated-ensuring system stability and a smooth start. This Works Even If:
- You’ve never led an end-to-end IT audit before
- Your organisation uses a mix of legacy and cloud systems
- You’re transitioning from financial or operational auditing
- You’re under pressure to deliver faster, more accurate reports
- You’re preparing for CISA or CRISC and need applied knowledge
One mid-level auditor shared: “I was handed an SAP access review with zero prior experience. Using the segregation of duties checklist from Module 12, I identified 17 high-risk conflicts in under two days. My manager said it was the most thorough review he’d seen from a junior auditor.” This course works because it was built for real complexity-not textbook simplicity. It’s used by internal auditors at Fortune 500s, compliance officers in regulated sectors, and consultants at top-tier firms who need to deliver undeniable value on every engagement.
Module 1: Foundations of IT Auditing - What is IT auditing and why it matters in modern organisations
- Differentiating IT audit from security assessments and risk reviews
- Core responsibilities of an IT auditor
- Understanding the audit lifecycle: plan, test, report, follow-up
- Common types of IT audits: general control, application, security, infrastructure
- The role of independence and objectivity in audit practice
- Key stakeholders: audit committee, management, regulators, external auditors
- Auditor ethics and professional conduct standards
- Mapping audit scope to business objectives and threat models
- Introduction to risk-based auditing methodology
Module 2: Regulatory and Compliance Frameworks - Overview of key regulations affecting IT audits (SOX, GDPR, HIPAA, PCI-DSS)
- How regulations translate into audit requirements
- Understanding the role of NIST Cybersecurity Framework in IT audits
- Using ISO 27001 for information security control validation
- COBIT 2019: structure, domains, and practical application in audits
- Familiarity with ITIL and its relevance to control design
- Mapping internal controls to regulatory mandates
- Auditing third-party compliance across vendor ecosystems
- Documentation requirements for regulatory readiness
- Handling multi-jurisdictional compliance demands
Module 3: Risk Assessment and Audit Scoping - Conducting preliminary risk assessments for IT environments
- Using threat modelling to inform audit scope
- Identifying critical systems and data repositories
- Assessing inherent vs. residual risk in technology stacks
- Techniques for evaluating risk likelihood and impact
- Developing risk heat maps for prioritisation
- Defining audit objectives based on risk findings
- Creating an audit universe and rotation schedule
- Scoping decisions: depth vs. breadth trade-offs
- Documenting scope justification for audit committee review
Module 4: Audit Planning and Strategy Development - Building a comprehensive audit work program
- Defining key control objectives for systems under review
- Selecting appropriate testing methods: inquiry, observation, inspection, reperformance
- Determining sample sizes and selection methodologies
- Planning resource allocation and timeline forecasting
- Integrating data analytics into test planning
- Preparing pre-audit questionnaires for efficiency
- Engaging with process owners and IT teams early
- Anticipating resistance and building stakeholder buy-in
- Documenting planning decisions in the audit file
Module 5: Control Design Evaluation - Determining whether controls are suitably designed
- Differentiating preventive, detective, and corrective controls
- Evaluating control alignment with risk objectives
- Identifying control gaps and redundancies
- Reviewing process flow diagrams for control points
- Validating role-based access design and segregation of duties
- Assessing automated vs. manual control design
- Testing control triggers and expected outcomes
- Evaluating change management control structure
- Analysing exception handling procedures for robustness
Module 6: Control Implementation Assessment - Determining if controls are operating as designed
- Conducting walkthroughs with process participants
- Documenting actual control execution steps
- Identifying deviations between design and practice
- Assessing training and awareness in control operations
- Evaluating documentation completeness and accuracy
- Verifying segregation of duties in practice
- Testing exception reporting and management oversight
- Reviewing system logs and access records for control activity
- Assessing management's monitoring of key risks
Module 7: Testing Key IT General Controls (ITGCs) - Understanding the importance of ITGCs in audit coverage
- Access management: user provisioning and deprovisioning
- Password policies and multi-factor authentication audits
- Role-based access control (RBAC) evaluation
- Privileged access management (PAM) testing
- Reviewing access review and attestation processes
- Change management: emergency vs. standard changes
- Auditing approval workflows and documentation
- Segregation of duties in change control systems
- Problem management and incident response controls
Module 8: Auditing Network and Infrastructure Security - Reviewing network architecture and segmentation
- Assessing firewall configuration and rule sets
- Validating intrusion detection and prevention systems (IDS/IPS)
- Auditing endpoint protection and patch management
- Testing remote access controls (VPNs, zero-trust, RDP)
- Assessing wireless network security configurations
- DNS and email security (SPF, DKIM, DMARC) validation
- Physical security of data centres and server rooms
- Backup and disaster recovery controls testing
- Evaluating cloud infrastructure security responsibility models
Module 9: Application Control Audits - Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- What is IT auditing and why it matters in modern organisations
- Differentiating IT audit from security assessments and risk reviews
- Core responsibilities of an IT auditor
- Understanding the audit lifecycle: plan, test, report, follow-up
- Common types of IT audits: general control, application, security, infrastructure
- The role of independence and objectivity in audit practice
- Key stakeholders: audit committee, management, regulators, external auditors
- Auditor ethics and professional conduct standards
- Mapping audit scope to business objectives and threat models
- Introduction to risk-based auditing methodology
Module 2: Regulatory and Compliance Frameworks - Overview of key regulations affecting IT audits (SOX, GDPR, HIPAA, PCI-DSS)
- How regulations translate into audit requirements
- Understanding the role of NIST Cybersecurity Framework in IT audits
- Using ISO 27001 for information security control validation
- COBIT 2019: structure, domains, and practical application in audits
- Familiarity with ITIL and its relevance to control design
- Mapping internal controls to regulatory mandates
- Auditing third-party compliance across vendor ecosystems
- Documentation requirements for regulatory readiness
- Handling multi-jurisdictional compliance demands
Module 3: Risk Assessment and Audit Scoping - Conducting preliminary risk assessments for IT environments
- Using threat modelling to inform audit scope
- Identifying critical systems and data repositories
- Assessing inherent vs. residual risk in technology stacks
- Techniques for evaluating risk likelihood and impact
- Developing risk heat maps for prioritisation
- Defining audit objectives based on risk findings
- Creating an audit universe and rotation schedule
- Scoping decisions: depth vs. breadth trade-offs
- Documenting scope justification for audit committee review
Module 4: Audit Planning and Strategy Development - Building a comprehensive audit work program
- Defining key control objectives for systems under review
- Selecting appropriate testing methods: inquiry, observation, inspection, reperformance
- Determining sample sizes and selection methodologies
- Planning resource allocation and timeline forecasting
- Integrating data analytics into test planning
- Preparing pre-audit questionnaires for efficiency
- Engaging with process owners and IT teams early
- Anticipating resistance and building stakeholder buy-in
- Documenting planning decisions in the audit file
Module 5: Control Design Evaluation - Determining whether controls are suitably designed
- Differentiating preventive, detective, and corrective controls
- Evaluating control alignment with risk objectives
- Identifying control gaps and redundancies
- Reviewing process flow diagrams for control points
- Validating role-based access design and segregation of duties
- Assessing automated vs. manual control design
- Testing control triggers and expected outcomes
- Evaluating change management control structure
- Analysing exception handling procedures for robustness
Module 6: Control Implementation Assessment - Determining if controls are operating as designed
- Conducting walkthroughs with process participants
- Documenting actual control execution steps
- Identifying deviations between design and practice
- Assessing training and awareness in control operations
- Evaluating documentation completeness and accuracy
- Verifying segregation of duties in practice
- Testing exception reporting and management oversight
- Reviewing system logs and access records for control activity
- Assessing management's monitoring of key risks
Module 7: Testing Key IT General Controls (ITGCs) - Understanding the importance of ITGCs in audit coverage
- Access management: user provisioning and deprovisioning
- Password policies and multi-factor authentication audits
- Role-based access control (RBAC) evaluation
- Privileged access management (PAM) testing
- Reviewing access review and attestation processes
- Change management: emergency vs. standard changes
- Auditing approval workflows and documentation
- Segregation of duties in change control systems
- Problem management and incident response controls
Module 8: Auditing Network and Infrastructure Security - Reviewing network architecture and segmentation
- Assessing firewall configuration and rule sets
- Validating intrusion detection and prevention systems (IDS/IPS)
- Auditing endpoint protection and patch management
- Testing remote access controls (VPNs, zero-trust, RDP)
- Assessing wireless network security configurations
- DNS and email security (SPF, DKIM, DMARC) validation
- Physical security of data centres and server rooms
- Backup and disaster recovery controls testing
- Evaluating cloud infrastructure security responsibility models
Module 9: Application Control Audits - Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Conducting preliminary risk assessments for IT environments
- Using threat modelling to inform audit scope
- Identifying critical systems and data repositories
- Assessing inherent vs. residual risk in technology stacks
- Techniques for evaluating risk likelihood and impact
- Developing risk heat maps for prioritisation
- Defining audit objectives based on risk findings
- Creating an audit universe and rotation schedule
- Scoping decisions: depth vs. breadth trade-offs
- Documenting scope justification for audit committee review
Module 4: Audit Planning and Strategy Development - Building a comprehensive audit work program
- Defining key control objectives for systems under review
- Selecting appropriate testing methods: inquiry, observation, inspection, reperformance
- Determining sample sizes and selection methodologies
- Planning resource allocation and timeline forecasting
- Integrating data analytics into test planning
- Preparing pre-audit questionnaires for efficiency
- Engaging with process owners and IT teams early
- Anticipating resistance and building stakeholder buy-in
- Documenting planning decisions in the audit file
Module 5: Control Design Evaluation - Determining whether controls are suitably designed
- Differentiating preventive, detective, and corrective controls
- Evaluating control alignment with risk objectives
- Identifying control gaps and redundancies
- Reviewing process flow diagrams for control points
- Validating role-based access design and segregation of duties
- Assessing automated vs. manual control design
- Testing control triggers and expected outcomes
- Evaluating change management control structure
- Analysing exception handling procedures for robustness
Module 6: Control Implementation Assessment - Determining if controls are operating as designed
- Conducting walkthroughs with process participants
- Documenting actual control execution steps
- Identifying deviations between design and practice
- Assessing training and awareness in control operations
- Evaluating documentation completeness and accuracy
- Verifying segregation of duties in practice
- Testing exception reporting and management oversight
- Reviewing system logs and access records for control activity
- Assessing management's monitoring of key risks
Module 7: Testing Key IT General Controls (ITGCs) - Understanding the importance of ITGCs in audit coverage
- Access management: user provisioning and deprovisioning
- Password policies and multi-factor authentication audits
- Role-based access control (RBAC) evaluation
- Privileged access management (PAM) testing
- Reviewing access review and attestation processes
- Change management: emergency vs. standard changes
- Auditing approval workflows and documentation
- Segregation of duties in change control systems
- Problem management and incident response controls
Module 8: Auditing Network and Infrastructure Security - Reviewing network architecture and segmentation
- Assessing firewall configuration and rule sets
- Validating intrusion detection and prevention systems (IDS/IPS)
- Auditing endpoint protection and patch management
- Testing remote access controls (VPNs, zero-trust, RDP)
- Assessing wireless network security configurations
- DNS and email security (SPF, DKIM, DMARC) validation
- Physical security of data centres and server rooms
- Backup and disaster recovery controls testing
- Evaluating cloud infrastructure security responsibility models
Module 9: Application Control Audits - Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Determining whether controls are suitably designed
- Differentiating preventive, detective, and corrective controls
- Evaluating control alignment with risk objectives
- Identifying control gaps and redundancies
- Reviewing process flow diagrams for control points
- Validating role-based access design and segregation of duties
- Assessing automated vs. manual control design
- Testing control triggers and expected outcomes
- Evaluating change management control structure
- Analysing exception handling procedures for robustness
Module 6: Control Implementation Assessment - Determining if controls are operating as designed
- Conducting walkthroughs with process participants
- Documenting actual control execution steps
- Identifying deviations between design and practice
- Assessing training and awareness in control operations
- Evaluating documentation completeness and accuracy
- Verifying segregation of duties in practice
- Testing exception reporting and management oversight
- Reviewing system logs and access records for control activity
- Assessing management's monitoring of key risks
Module 7: Testing Key IT General Controls (ITGCs) - Understanding the importance of ITGCs in audit coverage
- Access management: user provisioning and deprovisioning
- Password policies and multi-factor authentication audits
- Role-based access control (RBAC) evaluation
- Privileged access management (PAM) testing
- Reviewing access review and attestation processes
- Change management: emergency vs. standard changes
- Auditing approval workflows and documentation
- Segregation of duties in change control systems
- Problem management and incident response controls
Module 8: Auditing Network and Infrastructure Security - Reviewing network architecture and segmentation
- Assessing firewall configuration and rule sets
- Validating intrusion detection and prevention systems (IDS/IPS)
- Auditing endpoint protection and patch management
- Testing remote access controls (VPNs, zero-trust, RDP)
- Assessing wireless network security configurations
- DNS and email security (SPF, DKIM, DMARC) validation
- Physical security of data centres and server rooms
- Backup and disaster recovery controls testing
- Evaluating cloud infrastructure security responsibility models
Module 9: Application Control Audits - Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Understanding the importance of ITGCs in audit coverage
- Access management: user provisioning and deprovisioning
- Password policies and multi-factor authentication audits
- Role-based access control (RBAC) evaluation
- Privileged access management (PAM) testing
- Reviewing access review and attestation processes
- Change management: emergency vs. standard changes
- Auditing approval workflows and documentation
- Segregation of duties in change control systems
- Problem management and incident response controls
Module 8: Auditing Network and Infrastructure Security - Reviewing network architecture and segmentation
- Assessing firewall configuration and rule sets
- Validating intrusion detection and prevention systems (IDS/IPS)
- Auditing endpoint protection and patch management
- Testing remote access controls (VPNs, zero-trust, RDP)
- Assessing wireless network security configurations
- DNS and email security (SPF, DKIM, DMARC) validation
- Physical security of data centres and server rooms
- Backup and disaster recovery controls testing
- Evaluating cloud infrastructure security responsibility models
Module 9: Application Control Audits - Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Understanding application architecture for control testing
- Determining key financial and operational applications
- Validating input controls: edit checks, validation rules
- Processing controls: batch balancing, job scheduling
- Output controls: report accuracy, distribution restrictions
- Change management for custom applications
- SOX-relevant application audit techniques
- Third-party application control considerations
- Validating reconciliation procedures in ERP systems
- Testing error handling and exception reporting
Module 10: Cloud and SaaS Environment Audits - Understanding shared responsibility models (IaaS, PaaS, SaaS)
- Assessing vendor compliance reports (SOC 1, SOC 2, ISO)
- Validating data residency and encryption in cloud platforms
- Testing access controls in multi-tenant environments
- Auditing Microsoft 365, Salesforce, and AWS configurations
- Reviewing API security and integration risks
- Assessing configuration drift and drift detection tools
- Validating cloud backup and recovery capabilities
- Testing cloud logging and monitoring effectiveness
- Evaluating cloud cost management and resource governance
Module 11: Data Protection and Privacy Audits - Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Mapping data flows for privacy compliance
- Identifying personally identifiable information (PII) locations
- Validating data classification policies and tagging
- Testing data minimisation and retention controls
- Assessing consent mechanisms and opt-out processes
- Reviewing data subject access request (DSAR) procedures
- Testing data transfer safeguards (encryption, masking)
- Auditing cross-border data transfer mechanisms
- Evaluating data anonymisation and pseudonymisation practices
- Reviewing privacy impact assessments (PIAs) and records
Module 12: Identity and Access Management (IAM) Audits - Reviewing identity lifecycle management
- Validating joiner-mover-leaver (JML) processes
- Testing role-based and attribute-based access controls
- Analysing segregation of duties (SoD) conflicts
- Using automated tools to detect access anomalies
- Reviewing privileged user activity logs
- Testing emergency access (break-glass) accounts
- Assessing identity federation and SSO security
- Auditing contractor and third-party access
- Validating access reviews and recertification processes
Module 13: Change and Configuration Management Audits - Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Understanding change management policies and procedures
- Testing change request submission and approval workflows
- Verifying segregation of duties in change systems
- Reviewing emergency change protocols and oversight
- Auditing backout and rollback procedures
- Testing configuration management database (CMDB) accuracy
- Assessing version control in development and production
- Validating test environment separation
- Reviewing change-related incident trends
- Evaluating automated deployment controls (CI/CD pipelines)
Module 14: Incident Response and Disaster Recovery Audits - Reviewing incident response plans and escalation paths
- Testing incident classification and severity levels
- Validating communication protocols during breaches
- Auditing incident logging and analysis procedures
- Reviewing post-incident reviews and action tracking
- Testing disaster recovery and business continuity plans
- Validating recovery time objectives (RTO) and recovery point objectives (RPO)
- Assessing backup testing frequency and success rates
- Reviewing alternate site readiness and failover capability
- Evaluating tabletop exercise outcomes and improvements
Module 15: Penetration Testing and Vulnerability Management Audits - Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Understanding the role of pen testing in audit validation
- Reviewing vulnerability scanning schedules and coverage
- Assessing patch management timelines and effectiveness
- Validating remediation tracking and closure processes
- Analysing critical vulnerability trends over time
- Reviewing zero-day response procedures
- Testing vulnerability scanning tool configurations
- Assessing integration between security and IT operations
- Verifying external pen test reports and follow-up
- Evaluating red team exercise findings and organisational response
Module 16: Data Analytics in IT Auditing - Introduction to data analytics for audit testing
- Using data extraction and transformation techniques
- Identifying anomalies through statistical analysis
- Performing duplicate transaction testing
- Analysing gaps in sequence numbers (missing records)
- Testing for outliers and impossible values
- Using Benford’s Law for fraud detection
- Automating control monitoring with scripts and queries
- Presenting data findings visually in audit reports
- Integrating analytics into ongoing assurance activities
Module 17: Reporting and Communication of Findings - Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Drafting clear, concise, and objective audit findings
- Using the five-component finding model: condition, criteria, cause, consequence, recommendation
- Ensuring findings are evidence-based and irrefutable
- Strategic use of tone: assertive yet constructive
- Creating management action plans with ownership
- Presenting findings to technical and non-technical audiences
- Using visual aids to enhance report clarity
- Obtaining management responses and commitments
- Finalising the audit report for distribution
- Archiving workpapers and supporting documentation
Module 18: Audit Follow-Up and Continuous Monitoring - Tracking management action plans to closure
- Validating remediation evidence and effectiveness
- Assessing root cause correction vs. quick fixes
- Determining residual risk after remediation
- Reporting follow-up status to audit committee
- Implementing continuous control monitoring (CCM)
- Using dashboards for real-time risk visibility
- Setting up automated alerts for control exceptions
- Integrating audit findings into future risk assessments
- Building feedback loops for audit process improvement
Module 19: Advanced Topics in IT Auditing - Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Auditing artificial intelligence and machine learning systems
- Reviewing ethical AI frameworks and bias testing
- Auditing robotic process automation (RPA) controls
- Validating blockchain transaction integrity
- Auditing DevSecOps and secure software delivery
- Testing zero-trust architecture implementations
- Auditing edge computing and IoT device security
- Reviewing quantum computing preparedness (crypto-agility)
- Assessing supply chain risk in software dependencies
- Understanding emerging threats and audit implications
Module 20: Professional Development and Career Advancement - Building your reputation as a trusted internal advisor
- Developing influence without authority
- Preparing for CISA, CRISC, and CIA certifications
- Creating a personal development plan for auditors
- Networking with audit and risk professionals
- Contributing to industry standards and forums
- Mentoring junior auditors and growing leadership skills
- Transitioning from auditor to risk or compliance leadership
- Using audit experience for consulting or advisory roles
- Leveraging your Certificate of Completion for career growth
Module 21: Integrated Audit Project – From Start to Finish - Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission
- Conducting a full lifecycle IT audit simulation
- Selecting a scenario: ERP, cloud migration, access review
- Performing risk assessment and scoping
- Designing audit procedures and sample plans
- Executing control tests using provided templates
- Documenting findings with real-world data sets
- Drafting a board-ready audit report
- Presenting findings and recommendations
- Creating a management action plan
- Conducting a final review and certification submission