The Application Audit Process - A Guide for Information Security Professionals

This paper is meant to be a guide for IT professionals, whose applications are audited, either by an internal or external IS audit. It provides a basic understanding of the IS Audit process. It is also meant as an aid for auditors to facilitate the audit process by communicating audit terms and objectives. The document takes the reader through the different control points of an application audit: Administration, Input, Processing, Outputs, Logical Security, Disaster Recover Plan, Change Management, User Support, General, and Third Party Suppliers. The paper specifies the documentation that the IS auditor will be looking for at each process to ensure controls are in place. It should be readily apparent to the reader that the IS Auditor and Information Security Professional are really both pursuing the same goals but through different terminology. IS audit wants 'control' whereas Information Security pursues 'security'. They are in essence and practice the same thing.