The IT Audit Checklist for Information Security includes:

• More than 225 specific checklist items to help you assess internal audit readiness
• Controls derived from prominent standards/frameworks including ITIL, CobiT, and NIST
• Pointers on audit planning, preparation, testing, and reporting
• Clarification on what auditors want (and don't want) to see

What Is This Paper About?

This paper supports an internal audit of the organization’s information security program with guidance on improving information security practices and processes, as well as information on assessing the robustness of your organizational security efforts. The paper is intended to help IT, compliance, audit, and business managers prepare for an audit of information security controls and management and, ultimately, to ensure that both the audit experience and results are as productive as possible.

Author

Dan Swanson, CMA, CIA, CISA, CISSP, CAP, is a 26-year internal audit veteran and former director of professional practices at the Institute of Internal Auditors. Swanson has completed internal audit projects for more than 30 different organizations, spending almost 10 years in government auditing, at the federal, provincial, and municipal levels, and the rest in the private sector, mainly in the financial services, transportation, and health sectors.

He has completed more than 50 IT conversion audits and a dozen comprehensive audits of the information technology function. The author of more than 150 articles on internal auditing and other management practices, Swanson is currently a freelance writer and health information security officer during the day. He can be reached via email at This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

Series Editor: Cass Brewer