Auditing

I am a non-technical internal auditor with a financial institution. With expert help from this book I have completed a system access control audit and made several recommendations sure to benefit my organization. I was specifically looking at the controls over passwords and access authority and found the section on logical security controls invaluable. There are numerous cases described which help the reader to understand IS Security risks and related controls. If you are a non-technical auditor, you will find this book easy to follow and incorporate into your audit program.

This is a readable and current introduction to information systems auditing from a qualified and experienced IS auditor.

The book consists of three parts. Part One introduces core information systems concepts and is aimed at readers without much background in IS; Part Two introduces IS audit itself, and Part Three discusses some additional concepts and issues, such as control self-assessment and the human factor. Case studies are extensively used throughout the book to illustrate concepts, approaches and procedures discussed in the text.

While the author is writing from a US perspective and has US work experience, references to British, Canadian, and Australian standards, qualifications and practices are included. One of the good characteristics of this book is its readability and easy flow of information, unlike many other works in this field.

I haven't given this book five stars because in my opinion its coverage of "information systems" is somewhat limited compared with the coverage of "auditing". So if you are looking for a detailed technical volume on information systems auditing, look elsewhere; this book gives a well-rounded non-technical introduction to information systems auditing and does it well.

Edgar Danielyan, CISSP
Published author, editor and instructor
www.danielyan.com