3.1 The Audit

00:00

greens, everyone and welcome to sever Security Audit Will review Episode six The audit.

00:06

There's a lot of information to cover in this episode, so let's get started.

00:11

In this video. You will learn audio preparation on a performance

00:15

and the proper way of documenting findings

00:18

and chaotic preparation.

00:20

Well, preparations can very according to the company size or location,

00:25

for example, or your small mom and pop

00:28

located locally

00:30

or your multinational company

00:33

with officers around the world.

00:35

Preparations can also take into account the type of audit, annual audit,

00:40

quarterly audit or special audit.

00:43

Each one of them may have their own separate preparations required

00:47

and also internal external team.

00:50

Now, for our purposes, we're going to go through this episode as if we're talking about an internal auditing.

00:57

The first step is to make sure that you actually have an audit charter.

01:00

Now, what is an auto charter? It's a document that provides authority and independence. The auditing.

01:07

It's issue at the highest level, CEO president cetera um and should be current.

01:12

Normally, you would want an audit charter issue once a year. Now it gives independence the auditing because it's signed off

01:21

by the president. Let's say.

01:23

And that way the audit team doesn't have to worry about being pressured by the oddities.

01:30

And I wanted to find the audit scope. Now, why are you doing the audit

01:34

Quarterly audits and you want it. Or maybe it's a special audit because of a recent security or data breach

01:42

location where we're going to be performing the audit,

01:46

You know which building what floor is, what room numbers, et cetera, and also the time frame.

01:51

You know, for example, you could state, you know the upcoming audits will begin on October 1st with an estimated completion date of October 8th.

02:00

Now, you also want to select your audit team.

02:02

You're gonna select personal based on their knowledge of their expertise in certain areas whose walls availability.

02:08

If you remember when we talked about setting up an audit schedule and using that schedule for planning purposes,

02:15

this is one of those reasons for that.

02:17

No one saw that information has been compiled. The want to send out an audit letter notifying the oddity of all the information, a scope as well as the team that's going to be out there performing the audit,

02:30

you know, why do we want to identify the team members. Todt.

02:35

Is it because we want to make sure that those team members can get stopped by security and have their access prevented? You know, it's actually the opposite.

02:45

We want to make sure that the team members are granted access to certain areas,

02:50

so this may require issuing badges or providing escorts. This way. The oddity can properly prepare for the audit as well as make sure that we have access to all the required areas.

03:01

And I also want the audit teen tasks to perform a review of the controls. You want to look for any updates or changes to the controls, as well as verifying applicability. For example, if the company decided to go with an outside vendor to perform certain security functions, you want to make sure that those controls

03:23

have been identified and noted

03:24

is not being applicability.

03:27

You know? No, the selected implemented controls become the audit checklist. If you don't already have one,

03:34

you know, one thing I personally recommend is performing a review of the previous audit.

03:38

This improves familiarity with the different controls, the areas they're going to be looked at, its hetero, and it gives you the opportunity to identify previous problem areas. That's important because continuous failures in the same area

03:53

is something that requires additional attention and could possibly require quarterly audits.

03:59

Okay, the audit will begin with a kickoff for opening meeting and the purposes as introductions. Got a team, was was corresponding lot of team members and review the scope as well as pairings of auditors and oddities.

04:15

Basically, the two individuals get chance to meet each other. Mrs. Jones, for example, is going to be looking at the server farm. Mr. Ford manages the server farm, so the two of them should get together and meet and understand what's going on

04:29

now, After the meeting,

04:30

the control testing and verification phase begins. This is where the auditor oddity parents disperse to go to the respective areas and they begin review of the controls in activities. And this is where the fighting actually begins.

04:45

Okay, During the audit, you have to have tested validation methods. Employee interviews are a must.

04:50

That is to say you talk to the employees, he has some questions.

04:56

Hey, are you doing this? Okay, prove it

05:00

At that part. You're going to review documentation provided by the oddity log records, policies, standards, et cetera. Anything that validates that the oddity is truthful in their answers, saying that they are doing it now. You can also do it through direct observation where the auditors saw compliance

05:19

now. One example that could be a control that says that an armed guard

05:24

must be stationed outside of the server farm. Well, simple enough. You walked by the server farm. You saw the armed guard. They spoke to him. That way you can verify through direct observation.

05:38

The control is being followed now. No, you have to have two out of the three interviews and documentation or interviews and observation to validate compliance.

05:48

You know, sometimes during lot, it's disagreements occur.

05:53

And a lot of times these disagreements are based on vague wording or

06:00

personal interpretations of controls. Now, during a disagreement, always be respectful.

06:05

This is because sometimes believe or not, auditors can get things wrong or the control was not properly written

06:14

or communicated, and the best thing to do is to notify the audit team leader for resolution.

06:18

A lot of times you are the team leader will get in touch with his counterpart in the tomb will review something, and in come to an agreement, it's better to let them do it at their level rather than you trying to fix it

06:31

as an auditor.

06:33

Okay, documenting audit results always follow the auditing protocol. Normally, there's a company template and guidelines designed to help you fill out the results. And you want to make sure that your matching the control reviewed

06:48

to the corresponding results

06:50

and always be honest, hiding things they're exaggerating doesn't help anyone. You know, someone were to ask you Hey, can you just let me slide this time? I'll have it fixed within 30 days. Well, if you trust him, then you're going to have to wait 365 days in the case of an annual on it

07:09

to verify that they actually fix things.

07:12

You should also state how good or how bad a particular program is doing.

07:16

If the program is doing well well in state that you know it's good information to know if it's bad and please identify how bad it is. Single problem, multiple problems all screwed up,

07:30

no chance of ever come down line. Just be honest

07:33

now. Sometimes the company template will have a remark section,

07:39

and this is used for the auditors recommendations. If you have one of these sections and you're going to fill it out, always be professional, no vengeance and always be factual. Remember, we're measuring performance versus the controlled. There's absolutely no reason to try and attack someone who may have been a jerk during the audit,

07:58

because that's gonna come out in your remarks

08:01

and in turn, you're going to lose credibility for it.

08:03

So he's just got a fax, Please.

08:07

All right, a quiz. Select the right answer or answers. Valid audit control testing includes interviews and nothing else. Personal observations are validation of documentation from the oddity.

08:24

Well, the right answers are B N C.

08:28

Valid Audit Control test includes interviews and personal observations. Validation of documentation from the oddity

08:35

is wrong because you need to out of the three interviews and documentation

08:41

or interviews and observation to validate compliance.

08:46

All right.

08:46

In today's video, we discussed auto preparations on a performance