Planning and managing an information technology audit is a very essential component that every organization should engage in. Information system audits comprise of examination of the management controls found with an information technology infrastructure. Basically, an IT infrastructure is made up of components that are useful for the existence, operation, and management of an IT business environment. The infrastructure can either be internal or deployed within the clod computing systems and it consists of physical devices such as computers and networking hardware, as well as software applications, and network components needed to operate the organization. IT audits enable an enterprise to maintain effective operations and maintain compliance with both administrative and legal regulations. Assessment derived from the audit evidence helps to determine whether the exiting IT systems within an organization safeguard assets, preserve data integrity and whether the systems are effectively operating to achieve the set goal and objectives. Audits prepare an organization to face potential challenges hence enabling proper functioning of a business. Stakeholders are more informed of the financial, operational, and ethical well-being of an organization they affiliate with through IT audits. Organizations have a responsibility of defining their culture through well stipulated IT policies that define what the members are expected to do and how cases of noncompliance are dealt with. With a well-defined scope, goals, and procedures, it is more likely that a successful audit will be performed which produces evidence that is relevant, reliable, and sufficient to support organizational decision making.
\nAs an information security manager who has been hired by a national retailer to develop a plan for performing regular audits of the IT infrastructure, my duty is to support the goal of the enterprise by providing a two week IUT audit project ( help with nursing paper writing from experts with MSN & DNP degrees) plan. This paper will be addressing the steps necessary in the management of an IT infrastructure and will in depth, look into the development of the following aspects; internal IT audit policy, a management plan, a project ( help with nursing paper writing from experts with MSN & DNP degrees) plan, and a disaster recovery plan.
\nSection 1 (Internal IT Audit Policy)
\nPlanning an IT audit involves gathering information and planning the proceeding to understanding the existing internal control structure. The national retail enterprise has a main office plus 268 across the entire of the United States which means that there are quite a number of employees involved, as well as different servers. Given the size of the enterprise, there is need to establish an organizational IT policy in order to minimize business risk.
\nThe policy that I will develop will be used to advise all the users in the main office and the 268 stores on the security scanning procedures and the precautions that will be observed during the entire audit process. The audit will be conducted to enhance enterprise integrity, confidentiality, as well as availability of both information and resources. It will also be used in the investigation of potential security threats an incidences to ensure conformity to the stipulated policy. Lastly, the audit will be essential when it comes to monitoring both user and system security where applicable.
\nPOLICY STATEMENT
\nThe national retail enterprise has a policy to maintain an effective, independent, and objective Internal Audit Function which is effectively resources hence enabling management of the enterprise through effective sharing of responsibilities. The policy functions as follows;
\n\u2022\tOutlining reasonable assurance that the management processes within the enterprise are sufficient in the identification, management, and monitoring of all the potential risks.
\n\u2022\tEnsuring effectiveness in the operation of the existing internal control systems.
\n\u2022\tMaking sure that a credible feedback process on risk management and assurance is in existence during the entire audit process.
\n\u2022\tInforming on the objective confirmation that council gets sufficient assurance of reliability, accuracy, and relevance of information from the enterprise management.
\nSCOPE
\nThe policy will cover all the over 1000 desktops and 500 laptops and communication devices owned and operated by the national retail enterprise employees across all the branches. Any communication device connected to the enterprise network. Computers or communication devise that has been previously connected to the networks that are believed to have been used contrary to the policy of the enterprise while so connected will also comply with the policy. Any computers and communication devices that are making attempts of connecting, interacting, or making an interface with the enterprise networks will also be covered by the policy.
\nOBJECTIVES
\nThe main objective of the audit is to provide independent and objective assurance as well as consulting and investigation services that are efficiently designed to add value, improve enterprise operation, and enhance achievement of the business goals. The internal audit policy aims at providing reasonable assurance to the enterprise in the following ways;
\n\u2022\tConfirming the commitment of the enterprise to an effective Internal Audit Function.
\n\u2022\tEnsuring independence of the Internal Audit Function.
\n\u2022\tDefining the expected roles and responsibilities of the Internal Audit Function.
\n\u2022\tDefining the principles that will guide the approach of the enterprise to the entire internal audit process.
\n\u2022\tExplaining the planning cycle of the entire audit process to the board of directors, employees, stakeholders, and the auditing team.
\nMANAGEMENT OVERSIGHT & RESPONSIBILITY
\nThe policy aims at ensuring that the oversight of the enterprise resources during the entire audit process is well informed. It is the responsibility of the audit to perform the following tasks for an effective audit that is geared towards the achievement of the enterprise goals;
\n\u2022\tEffectively identifying and ensuring that\u2019s risks are appropriately managed.
\n\u2022\tInteracting with the various governance groups in the numerous stores to enhance coordination of the audit process.
\n\u2022\tEnsuring accuracy, timeliness, and reliability of the financial, managerial, and operating data.
\n\u2022\tMaking sure that actions of all the employees comply with policies, standards, procedures, and all the applicable laws and regulations.
\n\u2022\tEnabling an economical acquisition of enterprise resources, and ensuring that the resources are used efficiently and that they are adequately safeguarded.
\n\u2022\tProviding an environment for the enterprise control process to foster quality and continuous improvement.
\n\u2022\tOutlining significant legislative and regulatory issues that impact the company to ensure that they are recognized and appropriately addressed.
\n\u2022\tEnsuring that programs, plans, and objectives are achieved.
\nCOMPLIANCE WITH APPLICABLE LAWS AND REGULATIONS
\nTo enhance compliance with the applicable laws and regulations, there will be need for adequate collaboration across the entire team of employees, managers, board of directors, stakeholders, and the auditing team. For compliance, the following will have to be achieved;
\n\u2022\tMeeting with divisional leaders to make sure that the set laws and regulations are feasible in the entire enterprise department.
\n\u2022\tEvaluating and determining the best policy format that suits the different audiences that exist within the enterprise since different departments consist of different personalities, schedules, and experiences.
\n\u2022\tMaking policies and procedures that are accessible to the employees of the enterprise. The policies and regulations will be will be in easily identifiable folders that will be structured by department and type of policy.
\n\u2022\tSetting up clear deadlines for each policy and procedure to be recognized. Task-alerts will be included, over-due notifications, and renewal alerts will be included in a program to send alerts to the right people.
\n\u2022\tDetermining the most appropriate methods that will enable the IT audit team to measure the level at which the employees understand the policies and regulations. The step will be automated to increase efficiency during the policy formulation process and during the entire audit process.
\nAREAS COVERED IN IT AUDIT
\nThe audit will cover all areas of the organization inclusive of the IT infrastructure and the existing support services. The following are the areas to be audited;
\n\u2022\tInternal accounting controls
\n\u2022\tOperational controls in all the 268 stores and the main office
\n\u2022\tAdministrative controls in all the 268 stores plus the main office
\n\u2022\tThe existing enterprise security policies and procedures
\n\u2022\tThe usage of documents and records within the enterprise
\n\u2022\tThe IT infrastructure inclusive of all the over 1000 desktops and 500 laptops belonging to the enterprise. All communication devices that have interacted with the enterprise networks.
\n\u2022\tThe enterprise networks will be audited inclusive of cloud computing, the Cisco working group and core switches, Cisco routers and the Microsoft windows 2012 servers.
\n\u2022\tThe physical and logical security systems and policies for all data centers and IT resources within the enterprise.
\nReferences
\nGelbstein, E. (2017). IS Audit Basics: Preparing for Auditing New Risk. Isaca.org Journal, Volume 2.
\nSuduc, A. M., B\u00eezoi, M., & Filip, F. G. (2010). Audit for information systems security. Informatica Economica, 14(1), 43.
\nPetra\u015fcu, D. (2010). INTERNAL AUDIT: DEFINING, OBJECTIVES, FUNCTIONS AND STAGES. Studies in Business & Economics, 5(3).<\/p>\n
SECTION 2: MANAGEMENT PLAN<\/p>\n","protected":false},"excerpt":{"rendered":"
Planning and managing an information technology audit is a very essential component that every organization should engage in. Information system audits comprise of examination of\u2026<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9501],"tags":[],"class_list":["post-115875","post","type-post","status-publish","format-standard","hentry","category-do-my-assignment-paper"],"_links":{"self":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/115875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/comments?post=115875"}],"version-history":[{"count":0,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/115875\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/media?parent=115875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/categories?post=115875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/tags?post=115875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}