5.5System Auditing

System auditing is the activity of verifying, from a standpoint distinct from those who build and operate a system, whether an information system is properly established and operated in line with the organization's goals. The focus here is the audit's pattern of "who verifies what, based on what evidence, and how," together with the concepts of internal control and independence that make an audit meaningful in the first place.

5.5.1The audit process, audit evidence, and audit techniques

• The system audit process proceeds as: audit planning (defining scope, audit items, and schedule) -> execution (collecting and evaluating evidence) -> reporting (reporting the results to management and others as an audit report) -> follow-up (confirming afterward whether the findings have been corrected).
• Audit evidence is the objective supporting material an auditor uses to reach a conclusion (meeting minutes, logs, forms, configuration files, and so on). Because the auditor forms an audit opinion based on this evidence, both sufficiency (quantity) and appropriateness (quality) of the evidence are required.
• Audit techniques are the concrete methods for gathering evidence. Interviews question the people responsible. Document review (checklist method) examines regulations, manuals, and similar documents. On-site inspection (observation) visits the actual work site to confirm conditions. Computer-assisted audit techniques (CAAT) use tools and software to analyze logs and data. Multiple techniques are combined depending on the purpose and target.