| Favorites |
 |
|
|
|
|
The IT auditing process is inherently complex as it involves multiple internal and external stakeholders. Existing audit infrastructures have evolved from the bottom up and organizations lack a single system of record preventing top down visibility and control. Moreover, companies leveraging outsourced services that impact their own control environment rely on SAS 70 service auditor reports to gain an understanding of the IT processes of their service providers.
Most organizations regularly test the internal controls within their IT organization to ensure secure and continuous operation of their entire information systems infrastructure. Such controls, typically derived from COBIT control processes, reduce IT related risks and form the basis for good IT governance.
| Insights |
|
|
|
|
MetricStream provides a comprehensive IT Audit Management solution for IT audits and assessments. Designed to support the COBIT framework, the solution ensures sustained compliance of IT controls at significantly lower costs. By deploying the MetricStream IT Audit Management solution, organizations can streamline their IT audit and assessment processes and enable multiple stakeholders to have visibility and control. It also provides a single system of record for IT audits and assessments by integrating with the various solutions that have already been implemented to automate the testing of various controls.
Risk-based IT Audit Planning: MetricStream supports risk-based IT auditing and allows selecting IT processes, assets, projects and other audit entities to define the scope of the audit based on risk assessments. The solution integrates with third-party tools to gather risk and vulnerability information of IT system (such as weak passwords and unused ports in web server)to enable auditors to plan audits based on risk profile of IT assets.
IT Audit Projects: IT audit projects can be schedule periodically based on the annual audit plan or triggered on an ad-hoc basis for specific processes, projects or applications. Based on the master audit calendar auditor or a team of auditors can be selected and assigned the audit responsibility with a due date. Automatic notifications are sent to the auditor as well as the entity to be audited. Work papers with fully configurable workflows are created by the solution to allow auditors to document the activities carried out and results of procedures associated with an audit project.
IT Audits and Assessments: The application enables IT auditors to record qualitative or quantitative findings along with detailed observations and recommendations in predefined formats alongside the checklist of evaluation criteria and questions. The system also supports a systematic mechanism for triggering self-assessments and surveys related to IT controls in a consistent, reliable and predictable manner. Audit managers can track the status of the audit and measure the progress against milestones to ensure timely execution. Time tracking capability captures the time spent in auditing for optimal resource utilization.
IT Audit Reviews: The solution routes audit findings, observation reports and auditors recommendations for review and subsequent actions. Findings are sent to the process owners to seek responses on findings or issues observed. The application has built-in workflows for reviewing responses for approval or rejection with the options to initiate remedial actions for undesirable variations and trends as well as to schedule follow-up audits.
IT Audit Reports and Metrics: The solution provides comprehensive capabilities for compiling IT audit reports and work-papers. It provides complete visibility into the audit process with easy status tracking. The system allows access to all audit data and histories as well as analysis of auditor performance and audit results. Graphical executive dashboards and flexible reports with drill-down capability provide statistics by a variety of parameters such as by audited entities, audit schedule and calendar, finding reports, and corrective and remediation actions triggered. |
