Course Information
IT Audit School
Parking for SAO, Professional Development courses is in Garage B (1511 San Jacinto Blvd.). The Garage signage may read 1511 San Jacinto or Garage B. The elevator in Garage B is not reliable. If you are unable to walk the stairs, please contact the professionaldevelopment@sao.texas.gov for alternate parking arrangements. Handicapped parking is free at the meters around the downtown area.
A course coordinator will email you a parking permit prior to the course start date. A permit must be displayed or you will be ticketed.
Course Description
This course is designed for financial, operational, business, and new IT auditors to provide a solid introduction to the risks and controls necessary to audit IT department functions and the underlying technologies. We will cover the basic concepts of information technology to help auditors understand the IT impact on business. We will explore such IT areas as operating systems, networks, database management systems, and application systems. Supporting IT general controls, such as logical and physical access, help desk, system development, change management, and disaster recovery planning will also be covered. We will introduce a top-down, risk-based approach to auditing business applications and ensuring that their supporting infrastructure is considered in the audit process. Learners will leave this intensive seminar with a solid foundation in information technology basics as they apply to IT risks, audit, information security, and business application systems.
Course Objectives
Upon completion of this course, participants will be able to:
Learners will be able to describe what a technical term refers to and understand its place in an organization.
Learners will be able to identify risks associated with the use of technology by their organization.
Learners will be able to describe categories of controls that may be in place to protect systems.
Learners will be able to break down the control environment based on internal policies and standard frameworks to determine if the organization complies with policies and aligns with frameworks.
Detailed Course Outline
Lecture format due to volume of content. Agenda items can be removed or deprioritized for a more interactive learning experience.
How is IT used in Companies?
Business systems
Support systems
Infrastructure
Marketing and sales
IT Risks
Risk overview
Confidentiality, integrity, availability (CIA)
Managing risk
Basics of IT
Computing devices and operating systems
Significant computer types
Client/server technology
Middleware/APIs
Virtualization
Programs and programming overview
Networks
Overview
Network devices
Network protocols, ports, and services
Firewalls
Network monitoring (IDS/IPS/SIEM)-
Cloud – characteristics
Cloud – service models
Cloud – audit considerations
Internet of Things (IoT)
Definitions
Usage and control overview
Databases
Database types
Database terminology/definitions
SQL
Database audit concepts
IT General Controls (ITGCs)
IT general controls introduction
Logical security – authentication
Administration and awareness
Encryption overview
System development lifecycle (SDLC)
Change management
SDLC/System Development Methodology (SDM) audits
IT operations
Vulnerability scanning and penetration testing
Physical and environmental controls
Business continuity planning
Disaster recovery planning
Mobile device management (MDM)/Bring Your Own Device (BYOD)
End-user computing
Frameworks and Laws
Security and audit frameworks – Part 1
Security and audit frameworks – Part 2
Governance
Business and IT strategy
IT and security strategy
IT risk assessment
Risk register and acceptance
Vendor management
Applications
Application control objectives
Business transaction processing
Business support and IoT applications
Audit Planning
Audit risk assessment
IT audit scoping
IT general controls
Technical audits
Application/integrated audits
Prerequisites
Prerequisite not required.
Instructors
Rob Clark, Jr., Chief Audit & Compliance Officer for Howard University, is a nationally recognized authority in internal audit, risk management, compliance and with over 30 years of industry experience. He is a highly rated and engaging speaker and instructor with a gift of being able to connect with his audience in an impactful way. He has created numerous audit classes through ACI Learning and is frequently requested instructor.
He joined Howard in July 2020 and has been leading the internal audit and compliance team to implement best practices. Prior to HU, he served as the Chief Audit & Compliance Officer at Clark Atlanta University. Prior to that he served as the Chief Audit Executive at Georgia Tech and the University of Nebraska, and Audit Manager at Massachusetts Institute of Technology.
He has held leadership positions as President of the Association of College and University Auditors (ACUA); President and now Board Member of the Institute of Internal Auditors (IIA)- Atlanta Chapter. He has served as a teaching faculty member of the IIA, the College Business Management Institute (CBMI), ACI Learning, and has been a highly sought-after speaker for dozens of organizations such as ACUA, The IIA, AGA, DCSHRM, NACUBO, EDUCAUSE, The Chronicle of Higher Education, Office of Inspectors General, SACUBO, Federal Reserve, and many others.
He holds professional designations as a Certified Internal Auditor, Certified Compliance and Ethics Professional, Certified Information Systems Auditor, and Certified Business Manager.? He is a Board Member of the National Speakers Association – GA; a Certified Virtual Presenter through eSpeakers; a CTM through Toastmasters; and has performed stand-up comedy at the Punchline Comedy Club, Laughing Skull, and numerous other engagements.
Although he spent over 20 years in Georgia, he still never developed a taste for grits.