blocks|key|4730749|text|这是一个比我想象的要大得多的问题--首先，主要的IT审计公司在这方面拥有大量的知识产权，所以当你能够找到高水平的文档时，你可能很难找到完整的详细文件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4730750|从我在四大会计师事务所的时候，我可能看到了300多个具体技术的审计工作计划，并对其中的50项做出了贡献。时间投资相当高。|4730751|说到这里，我肯定会建议你加入信息系统审计与控制协会，这是这个行业的权威机构。通过ISACA可以获得大量信息，包括CobIT和审计指导。|offset|length|4730752|(披露-我的角色之一是苏格兰ISACA分会主席)|entityMap|0|LINK|mutability|MUTABLE|url|https://www.isaca.org/^0|0|0|E|B|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@$F|T|G|U|1|V]]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]]|J|$K|$5|L|M|N|A|$O|P]]]]

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents.

From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of specific technologies, and contributed to maybe 50 of those. The time investment is pretty high.

In saying that, I would definitely suggest you join <a href="https://www.isaca.org/">ISACA (the Information Systems Audit and Control Association)</a>, which is the definitive body for this industry. A vast amount of information is available through ISACA, including CobIT and audit guidance.

(disclosure - one of my roles is President of the Scottish ISACA chapter)

blocks|key|4730940|text|对于你的问题，传统的回答是--在审计公司找份工作。这将是一个初级职位，但这是你学会交易的方法。您将访问Rory提到的工作计划，但更重要的是，您将获得将它们应用于实际审计情况的经验。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4730941|我遇到过优秀的审计师，也遇到过糟糕的审计师，好的审计不仅仅是拥有合适的软件、日志或模板。我不知道你的主人在做什么，但它很可能没有让你做好在审计中当家作主的准备。当着客户的面，问问题，找出他们有时甚至不知道的答案。(你没有提到你的工作经验，这可能与我所知道的相关)。|4730942|只有我的.02c。祝好运!|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations.

I've met good auditors, and I've met poor auditors, and good auditing is more than having the right software, journals, or templates. I don't know what your masters is in, but it likely has not prepared you for being on-the-ground in an audit. Being in front of clients, asking questions, and digging out the answers that they don't even know they have sometimes. (You don't mention your work experience, which may be relevant for all I know).

Just my .02c. Good luck!

blocks|key|3589010|text|您可以查看PTES+-渗透测试执行标准站点-+http://www.pentest-standard.org/index.php/Main_页面|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3589011|它正在慢慢地被填写，但是有很多非常有用的信息。|3589012|您还可以查看开源安全测试方法手册-+http://www.isecom.org/osstmm/。|entityMap|0|LINK|mutability|MUTABLE|url|http://www.pentest-standard.org/index.php/Main_Page|1|http://www.isecom.org/osstmm/^0|N|1D|0|0|0|I|T|1^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|6|7|U|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]]|H|$I|$5|J|K|L|C|$M|N]]|O|$5|J|K|L|C|$M|P]]]]

You could look at PTES - Penetration Testing Execution Standard site - <a href="http://www.pentest-standard.org/index.php/Main_Page" rel="nofollow">http://www.pentest-standard.org/index.php/Main_Page</a>

It's slowly getting filled out but has a lot of very useful information.

You could also look at the Open Source Security Testing Methodology Manual - <a href="http://www.isecom.org/osstmm/" rel="nofollow">http://www.isecom.org/osstmm/</a>

blocks|key|3589196|text|作为一名实践IT审计师，让我从经验中给你一个答案。在我解释之前，我想说，你的方法与你在问题体中提出的问题有根本的缺陷。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3589197|需要什么软件工具？|blockquote|3589198|这种思维方式是错误的。执行专业审计的第一步是规划和收集有关客户的信息。您希望获得的重要信息包括但不限于：|3589199|审计目标-正在评估哪些程序/过程/标准？|ordered-list-item|3589200|审计的范围是什么?审计将涵盖哪些内容？|3589201|自上一次审计以来，企业内部的任何重大变化|3589202|过去这些审计的任何结论--假设这次审计不是第一次|3589203|从上述情况看，审计员将进行风险评估，最终目标是确定一个总体审计风险水平。首先，IT审核员获得对业务/控制环境的理解，以回答以下问题--而不是独占地依赖于被审核者。|3589204|目前有哪些程序以及它们是如何工作的？|3589205|管理层设置了哪些控制，以确保IT流程按照管理层的意图为业务工作？|3589206|在风险和遵守法律法规/公司政策方面，“高层调子”是什么？|3589207|在这一阶段，审计师将使用的技术包括流程演练、管理查询和观察。随着对业务和当前控制的理解，审计人员量化了总风险。总风险的构成部分将包括：|3589208|固有风险-由于业务的固有性质而产生错误的可能性|unordered-list-item|3589209|控制风险-内部控制不善造成的错误/欺诈|3589210|发现风险-由于审计中使用的工具无法发现错误/异常/欺诈。|3589211|只有在完成上述所有步骤之后，审计师才会开始考虑完成审计所使用的具体技术和工具。根据最初的风险评估，可能不需要或不适当地使用某些工具/技术。|3589212|如果不违背ISACA.1|header-two|offset|length|3589213|给出的应有的注意或参与规划标准，就不可能回答要使用什么工具而不执行上述分析。|3589214|审计师通过对文件的检查、管理的查询和对已完成的工作的独立核实来进行审计。对所做的所有测试和发现的任何调查结果/意见，都要仔细保存文件，作为审计意见的基础。|3589215|审计完成后，审计师会与公司管理层会面，以验证对审计结果的理解，并计划在下一次审计工作中对任何调查结果进行后续测试。|entityMap|0|LINK|mutability|MUTABLE|url|http://www.isaca.org/Knowledge-Center/ITAF-IS-Assurance-Audit-/IS-Audit-and-Assurance/Pages/IS-Audit-and-Assurance-Standard-1005-Due-Professional-Care.aspx|1|2|http://www.isaca.org/Knowledge-Center/ITAF-IS-Assurance-Audit-/IS-Audit-and-Assurance/Pages/IS-Audit-and-Assurance-Standard-1201-Engagement-Planning.aspx^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|B|1|0|0|3|5|1|9|6|2|0|0^^$0|@$1|2|3|4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1U|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|1V|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|1W|8|@]|9|@]|A|$]]|$1|J|3|K|5|I|7|1X|8|@]|9|@]|A|$]]|$1|L|3|M|5|I|7|1Y|8|@]|9|@]|A|$]]|$1|N|3|O|5|I|7|1Z|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|20|8|@]|9|@]|A|$]]|$1|R|3|S|5|I|7|21|8|@]|9|@]|A|$]]|$1|T|3|U|5|I|7|22|8|@]|9|@]|A|$]]|$1|V|3|W|5|I|7|23|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|24|8|@]|9|@]|A|$]]|$1|Z|3|10|5|11|7|25|8|@]|9|@]|A|$]]|$1|12|3|13|5|11|7|26|8|@]|9|@]|A|$]]|$1|14|3|15|5|11|7|27|8|@]|9|@]|A|$]]|$1|16|3|17|5|6|7|28|8|@]|9|@]|A|$]]|$1|18|3|19|5|1A|7|29|8|@]|9|@$1B|2A|1C|2B|1|2C]]|A|$]]|$1|1D|3|1E|5|6|7|2D|8|@]|9|@$1B|2E|1C|2F|1|2G]|$1B|2H|1C|2I|1|2J]]|A|$]]|$1|1F|3|1G|5|6|7|2K|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|6|7|2L|8|@]|9|@]|A|$]]]|1J|$1K|$5|1L|1M|1N|A|$1O|1P]]|1Q|$5|1L|1M|1N|A|$1O|1P]]|1R|$5|1L|1M|1N|A|$1O|1S]]]]

As an a practicing IT Auditor, let me provide you an answer from experience. Before I explain, I want to say that Your approach is fundamentally flawed from the question you asked in the question body.

<blockquote>
 What software tools are required
</blockquote>

This form of thinking is misguided. The first step in performing a professional audit is planning and gathering information on the client. Important information you would want to obtain includes, but is not limited to:

<ol>
<li>Objective of audit - What procedure / process / criteria is being assessed?</li>
<li>What is the scope of the audit - What will the audit cover?</li>
<li>Any material changes within the business since the last audit done</li>
<li>Any findings of these past audits - assuming this audit is not the first</li>
</ol>

From the above, an auditor would conduct a risk assessment with the end goal being to establish a level of total audit risk. To start, the IT auditor obtains an understanding of the business / control environment to answer the following questions - not exclusive depending on auditee.

<ol>
<li>What processes are currently in place and how they work?</li>
<li>What controls have been set by management to ensure IT processes work for the business as management intended?</li>
<li>What is the "tune at the top" with regard to risk and compliance with legal regulations / corporate policies?</li>
</ol>

The techniques an auditor would use at this stage include process walkthrough, inquiry of management and observation. With a understanding of the business and current controls, auditors quantify total risk. Components of total risk would include: 

<ul>
<li>Inherent risk - Likelihood of error due to inherent nature of
business</li>
<li>Control risk - Error / fraud due to poor internal controls</li>
<li>Detection risk - Risk that errors / anomalies / fraud won't be found due to tools used used in audit to detect them.</li>
</ul>

Only after all the above steps is complete would the auditor start thinking about the specific techniques and tools used to complete the audit. Depending on the initial risk assessment, some tools / techniques might not be needed or be inappropriate. 

It is not possible to answer what tools is to be used without performing the analysis outlined above without breaching <a href="http://www.isaca.org/Knowledge-Center/ITAF-IS-Assurance-Audit-/IS-Audit-and-Assurance/Pages/IS-Audit-and-Assurance-Standard-1005-Due-Professional-Care.aspx" rel="nofollow">due care</a> or <a href="http://www.isaca.org/Knowledge-Center/ITAF-IS-Assurance-Audit-/IS-Audit-and-Assurance/Pages/IS-Audit-and-Assurance-Standard-1201-Engagement-Planning.aspx" rel="nofollow">standards of engagement planning</a> given by ISACA.<a href="http://www.isaca.org/Knowledge-Center/ITAF-IS-Assurance-Audit-/IS-Audit-and-Assurance/Pages/IS-Audit-and-Assurance-Standard-1005-Due-Professional-Care.aspx" rel="nofollow">1</a>

The auditor performs the audit by gathering evidence through inspection of documentation, inquiry of management, and independent verification of work done - re-performance. Documentation is meticulously kept of all testing done and any findings / observations found, to be used as the basis of the audit opinion.

After completing the audit, the auditor meets with company management to verify understanding of results and plan for followup testing of any findings during the next audit engagement.

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the right direction. Specific links to journals and/or templates that are used would be very helpful.

<blockquote>
 This question was <a href="https://security.meta.stackexchange.com/questions/356">IT Security Question of the Week</a>. 
 Read the Sep 23, 2011 <a href="http://security.blogoverflow.com/2011/09/qotw10-carrying-out-an-it-audit/" rel="nofollow noreferrer">blog entry</a> for more details or <a href="https://security.meta.stackexchange.com/questions/tagged/qotw?sort=newest">submit your own</a> Question of the Week.
</blockquote>

Carrying out a professional IT audit procedure

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我是一个新的硕士毕业生，我需要了解如何进行一个专业的IT审计。需要哪些软件工具，我需要涉及哪些特定的主题？请给我指出正确的方向。与所使用的日志和/或模板的特定链接将非常有用。这个问题是IT --本周安全问题。阅读了2011年9月23日博客条目的更多细节或本周的提交自己的问题。

问执行专业的信息技术审计程序
EN

回答 4

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问执行专业的信息技术审计程序EN

回答 4

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问执行专业的信息技术审计程序
EN