Building a Project Plan

Having the appropriate people assigned to perform an audit is critical. This affects the effectiveness and efficiency of the audit. Consider that IT professionals could not possibly be experts across all seven domains of the IT infrastructure. Thus, it is not feasible to expect an auditor to be able to perform an adequate audit across all areas. Depending on the scope of an audit, appropriate resources must be obtained to perform the audit.

Other helpful resources include tools to support the IT auditing process. Various tools are available to assist in developing and managing the project plan and associated elements, such as tasks, deliverables, and timelines. The IIA lists several types of tools that can facilitate an audit:

• Electronic work papers—This provides a document management system to help centralize and provide workflow management of the audit process.

• Project management software—This includes mechanisms for managing any project, including auditing projects. These software packages help track progress to established milestones. Project management software helps define the timeline of the plan and for reporting the status.

• Flowcharting software—This provides a way to visually document processes.

• Open issue tracking software—This allows for easy tracking of audit deficiencies and areas that still need to be addressed. In many cases, this function can be integrated or included with a document management system.

• Audit department website—Internal auditing departments typically have an intranet-based solution that provides for collaboration and communication. Even external auditors benefit from maintaining secure Internet-based portals that provide the same functions.

The previous list of tools is useful for the overall management of the audit. During the course of an audit, however, auditors will likely use additional tools to aid in the efficiency and effectiveness of carrying out the audit. Various programs and utilities can help automate tests during the course of the audit. From a planning perspective, it’s important to understand that identification of such tools should be included as part of the planning process.