Performing IT Audit Walkthroughs

All right. So good morning, guys and thank

you for joining me here today. So, today, I

just wanted to do a quick training on IT

audio walkthroughs, and to be honest, I

was planning to record this by myself

and then I decided, you know, what, why not

just make it a live training and see if

others are interested in joining, and you

guys are. So, thank you for joining.

It's going to be short. This is just

going to be 30 minutes, maybe about 15-20

minutes of training. And then, I'll see if

you guys have any questions.

It's intended for YouTube, for

transparency sake. So, it will be recorded

to YouTube, but the difference is those

that are here live with me, you get to

ask questions, and those on YouTube can't

ask questions right. So, let's go ahead

and get started. If you guys are ready to

get started, okay. You let me know. Yep, yep,

yep.

All right. So awesome awesome. So let's go

ahead, and get started here. Thank you for

joining me here today for a training on

IT audit walkthroughs. So in today's

training, I just want to give you guys

a quick overview or an introduction

to what IT audit walkthroughs are. I know

many of you might have been searching

the internet trying to find additional

information on audits, and you may have

seen the word walkthrough, right. And you

don't understand what that is. So today,

I'm just going to give you an

introduction to that. And then, we'll see

if you guys have any questions related

to the topic.

Later on, all right. So, I see more of

you joining. Thank you for joining, guys.

So, before we get started, very brief

introduction to myself. I don't want to

take too much time here.

But for those, that are just meeting

me for the first time. My name is Peju Adedeji.

I have over 18 years of experience in

the I.T space. A lot of that is around IT

audit GRC program management. All in the

audit and compliance space really. My

passion is teaching. That's one of the

things that I've always loved to do. So,

I'm also a career coach where I help

people that are looking to start their

careers in I.T cyber security audit, and

compliance.

Okay, for me, I like practical training

recently joined the Forbes coaches

council. Again, I really love teaching so

I like to be with other coaches trying

to develop myself so that I can help my

students as well.

This year, we've already had multiple

six-figure salaries that have come in

our program, and so I I'm really excited

about what we're doing. So let's go ahead

and get started with the training for

today.

So here are the topics for today.

We're going to go over an

introduction to IT audit at a higher

level. So if you are not familiar with

this you can probably check my YouTube

channel. And you see the training, I've

done it on this in the past.

But I'm going to just introduce that

because I know some people that are here

today may not right have watched any

of my videos before or attended any of

my training. And then, we'll talk about

the IT audit phases because it's during

this discussion that we're then going to

talk about walkthroughs, because

walkthroughs that's one of the phases or

part of one of the phases. And there's

going to be a bonus review, where I'm

going to walk through some actual

examples with you. And maybe I'll give

you guys a bonus document. But let's see,

okay. And at the end I'll give about 10

minutes or so for questions.

So let's go ahead and start with our

introduction to IT audit.

I'm not going to go in depth into this

like I said, I have a training on my

YouTube channel that you guys can watch.

But, I do want to introduce this in

today's training because I want you to

understand what audits are before we

talk about walkthroughs, right. So, what's

an audit at the end of the day, you know,

people have different definitions of

what it is, but IT audit at the end of

the day, if you want to use simple terms,

is an examination of the organization

systems to determine if controls are

operating effectively. So systems usually

have controls in there, and for controls.

Again, the prior training I mentioned

will have that but think of a control as

like a password control, right. When you

want to log into your computer, you have

to put in a password,

or maybe your e-mail you have to put

in a password that's a control. So,

organization systems have controls, as

well,

and this controls right.

In order, part of an I.T audit is

testing and examining those systems to

determine if those controls are

operating effectively because if they

are not operating effectively, then the

security of that system right is in

question. And you might be wondering, "Well,

why should I be concerned about the

security or of a system or whether the

controls are operating effectively," and

the reason is one you want to mitigate

risks, right. You don't want people having

inappropriate access to your systems, so

when I say, "You, I'm in the

organization," an organization doesn't

want people having inappropriate access

to the systems. So, it's important to have

controls in place to ensure that that

security is there. And as the I.T auditor,

right, part of your audit objective or

your control objective for your test is

determining if security controls are in

place. So you are examining those systems

to see if those controls are effective

in mitigating risks, like I said for

example security risks or just even

medium compliance and regulatory

requirements, right. So in the US, we have

servings, okay. Other countries have

similar laws and standards as well. We

have PCI, SOX, SSA 18, right. So, all those

standards depending on what your

organization needs to comply with then

the audit is going to take place to

examine and determine if those controls

are meeting those requirements, okay. So

that's a summary of what we have of

what IT audits are.

So,

there are three key phases of IT

audience, all right. So we have the audio

planning phase we have our field

workplace, and this is where you have the

walkthrough, so that's where the

walkthroughs are performed, and you also

have the reporting and the follow-up

phase. So I'm going to again summarize

this. So that I set the stage for what

we really want to talk about today, so in

your audit planning phase right. This is

where you're understanding the

organization trying to define the scope,

and the objective and also trying to

identify what tests you perform so

you're essentially just planning for the

audit in that phase. Now, the field work

phase is, kind of, I'll say, that's where

the medium potatoes are right. I guess

when you do the real field work for the

audit you do your testing and all of

that. But, before you actually start

testing, you have to perform your

walkthroughs, and I'm going to come back

to the World Series after I finish the

third stage or the third phase.

The third phase is where you do the

reporting, so you finish planning, you've

done the actual testing, and you have

results then in the third phase, you're

doing your reporting, and your follow-up.

So, this is where you type up the report

to management on the results. And if

there were any issues identified, you can

go back, and retest to confirm whether or

not, they've been addressed. So those are

the three phases of an audit. Now, I want

to dial in on that walk through piece

because

there are many moving parts, right. So as

you can imagine an audit is like a

pretty big project, right. So, there are

many moving pieces and today, I'm now

going to focus on the IT audio

walkthrough piece right again. The IT or

the walkthrough is part of the field

work phase.

So now, let's talk about what are IT? What

other walkthroughs or what, I'm not sure

if you know, maybe if you've

you rented an apartment, or you bought

a house before they give you the keys,

right. You, kind of, they will take you to

what they call a walkthrough. Typically,

right, you just go in kind of just look

at how things are before they give you

the keys and say, "Okay, we agree that this

is the state that you're giving us the

house or the apartment in or whatnot." So

if you think about that it's not exactly

the same, but a walkthrough from the IT audit

perspective is you getting a better

understanding of the I.T control

environment of the company.

So what you do at the beginning of the

audit, because you're an auditor right,

you're not I.T. You're not, if you're an

external auditor, you're not working in

the company right. So you can't assume

that you know everything about that

company. You can't assume that you know

their control environment. So the reason

for that walkthrough is for the auditors

to get a better understanding, right, of

the control environment that they're

going to be auditing. So, it's absolutely

critical because if you don't conduct

your walkthrough effectively, you might

have gaps in your understanding of the

control environment, and that's going to

ultimately impact right the quality of

the control procedures that you choose

to perform and your understanding of the

impact of the risk. So, walkthroughs are

very important because that's where you

really get a good understanding of that

environment, and a key part of that is

that you have to include key players and

the control owners from I.T. So, you're

not just going to have a random set of

people in your work just giving you

information about the environment. You

have to understand that you have to

invite the right players. So if for your

IT audit walkthrough, you probably have

their management levels there right the

people that are responsible for those

controls. So the control owners you want

to make sure that they are in the room

with you or on Zoom if it's virtual,

right, explaining their an I.T

environment. And even if they're not the

key control owner, but they have a part

in the process.

And, they're a key player or key

stakeholder then you want to make sure

that they're also in the room with you

because if not, then again, you run the

risk of not having that information on

the control environment. So it's

important to have the key players and

especially the control owners in the

meeting where you're having that walk

through and one of the things that

you would test there or that you could

test, there is a test of design again if

you don't know what test of design is,

you can watch my prior video, and I'll

probably link it when I post this on

YouTube, so you can see that video where

I talk about test of design in terms of

operating effectiveness. So depending on

the control that you're testing or the

controls that you're reviewing during

your walkthroughs, you may be able to

perform some tests of design there. Okay.

So again, just to summarize this why

didn't we conduct I.T audit walkthroughs,

it's to understand or better understand

the control environment. The I.T control

environment that you'll be testing, you

should include the key players

stakeholders and control owners from it.

And during this, you may be able to test

the design of controls as, well, okay, one

thing I do want to stay here before we

move on to the next area is that

you'll go through questions should be

worded properly, right. So that you can

get useful responses from those that

you're interviewing. So let me pause here

for a second. Have you guys ever asked a

question and then you got the wrong

answer back? Let me see you guys in the

chat just to make sure, you guys are

still here with me. Have you ever asked

the question and the kind of answers

you're getting, you're like, "Okay, maybe I

asked the wrong question."

Yeah? Okay, so that's the same thing for

walkthroughs. So it takes some skill,

right? You need to know what questions

that you should ask in order to be able

to get the right risk. I don't want to

use the word, right because it's not

really right and wrong, but in order to

get

good responses, right. Useful responses

where you when you're actually testing

it makes sense not the kind of response

is that when you start testing, it's like

okay what they said doesn't make sense

based on what I'm looking at right. So,

that's a skill you'll need to gain as

you go through your walkthroughs because

if you don't write, then you run the

risk of not getting the responses that

will be useful to you in performing your

audience. So, here is the bonus part.

I'm going to now give you a couple of

examples so that, you know. Again, I like

practical teaching, so that this can be

real to you, okay. So let's look at some

sample questions, and there are

different parts of IT audits I'm going

to look at couple of questions, and

logical security.

So logical security, this is around

access to systems we're not going to go

deep into logical security itself, but

let's talk about what are some questions

right. So, you want you're going to have

different levels to your questions. So,

for example, you start off with describe

the user access provisioning process.

This is open-ended. You want to give them

the opportunity to describe the whole

process for you, and then you can go

deeper, right. So who has authority to

approve users, and their privileged

levels. So you again, you're starting

higher getting a broader understanding

of the environment, and their process and

then you can ask deeper questions based

on the controls that you're testing. So,

these are just a few examples for you to

see what you might ask during a

walkthrough, and then

again, let me look at change

management.

So change management again, is another

area that we test for in IT. During IT

audits, and here you might also start

with describe the change management

process, right again. Study high level

giving them the opportunity to describe

the process to you end to end, and then

you ask who's required to approve

changes. For example, so that's a little

bit more, you're diving deeper into

maybe one of the controls to get a

better understanding of that particular

control area, okay. So,

hopefully, that was helpful for you

guys. Do you guys feel like you have a

better understanding of what

walkthroughs are now? Yep, okay, good, good,

I see. Yes, thank you Diamond, Lake Paul,

thank you Ashley. So, that's really what I

wanted to cover here today. Again, this is

intended to be a short training session,

just bite sized. So, that you understand

some unique areas in the audit space

that would help you, all right. So,

rainbow said basically to understand

the yeah. So, to understand the IT control

environment, and that would help you when

you're putting together your

procedures of performing your test for

your IT audit. All right, so now let's do

a summary. I promise you. There'll be some

time for Q/A at the end. Let me see if

you guys have any questions if you have

questions you can put them in the Q/A

section, and I'll take a few minutes to

answer them here. But let me do a quick

summary for you guys because I know some

of you

joined after we already started.

Just to summarize what we talked

about here today, we started off by just

going through an introduction to IT

audits, right. Again, if you want more

information there, you can watch that

video, I have on the channel, and then we

talked about the IT audit faces, right?

What are the phases? So, let me pause

before I answer the question in the chat.

Can you tell me what are the phases that

we talked about today?

Awesome thanks, Bob.

Second phase.

Thank you, and then one more

reporting, and follow awesome, awesome. On

what phase do we have the IT

walkthroughs?

Walk through his field work, so the field

work isn't the ID audio walkthrough

happens in the field work stage, and this

is where again you're getting a better

understanding of the environment? You're

talking to the control owners and you're

talking to the, all the key

stakeholders in the I.T space. And then

we just walk through a few examples so

that you can see how,

how walkthroughs are conducted, okay.

So I'm going to pause now, let's see if

you guys have any questions. I did tell

you, it's going to be about 30 minutes. So

I want to make sure that we don't go

over time. What questions do you guys

have?

You guys have any questions, or was this

straightforward for you guys.

Okay, so great question Nick. And Nick is

asking can walkthroughs be done

virtually, or does he have to be in

person?

It can be done virtually, so if you

think about the pandemic, right? Where

everyone no one went out, right? If we

weren't going to the office, we're all

working remotely a lot of those

walkthroughs were performed remotely

because you can have interviews. Now, the

difference would be physical security

walkthroughs where you have to physically

walk through a data center. For example,

then you'll have to physically go there

but other than that for the most part

you can have them virtually. It can be in

a meeting on Zoom or whatever meeting

software your organization uses.

Someone is asking which video should

you focus on?

Um, I'll say that depends on your

interest, right. Because I have a lot of

videos on different areas so you can

select the one that you want. I'm trying

to do a better job posting. I'm pretty

busy. I have a full-time job, so training

is not the only thing I do.

So, I'm trying to do a better job

posting, but I'll say watch the video

that makes sense to you, all right. So,

um oh, what she was asking walkthroughs

seem to be like something to be done to

enhance your planning. How come it's in

the field work phase?

It depends on your definition of

enhancing your planning right because

planning, you're not really doing any

work, right? In planning, you actually

determine what areas you need to test

and that will then determine what areas

you need to do your walk through, right.

Because you don't necessarily need to

test all the areas of I.T. depending on

the scope of your audit. So, planning is

more scope focused once you identify

your scope, and then you know the areas

you want to test, then it's reasonable

that you would then go do walkthroughs

for that area. You don't need to do

walkthroughs for everything definitely

you don't need to do a walkthrough for

an area you don't need to test, okay. So,

hopefully that addressed the question

the last one. I see here,

so Laker is asking what IT audit

applications are used as a side ERP

systems?

I don't know that. That question is

really accurate

because you're talking about two

different things so when you say it

audit applications, ERP systems, those are

two different things. So maybe you want

to reword that question. Let me better

understand. If you're talking about

applications that the audit team uses

for their audit, and GRC you have

servicenow, orchard, all of that and then

the ERP systems are not audit systems.

ERP systems are systems that the

organization is using for their

operational needs, right. So those are two

different things so hopefully that helps,

all right.

Um, NSHE Iggy is asking, "What's the

name of the YouTube channel?" it's your

I.T career, maybe I'll find the link. Hold

on.

I'll put it in the record when I post

the recording, I'll send an email out and

I'll just, I'll give you guys access

to that, because I don't know that I have

it handy. Let's see,

um.

What's the difference between internal

and external audit? So sure, I will refer

you to my YouTube channel for that just

because I have another video that goes

into that in depth. So I think that'll

probably be more beneficial to you, okay?

Sarah is asking, "You missed the

training?" Yes, the recording is going to

be on YouTube, so I was transparent. I was

planning to record this for YouTube

anyways, and instead of recording it by

myself, I decided to invite you guys to

listen to me record it live. So, let's say

in the next couple of days, or so you

guys should see it on YouTube. The

difference is those that are here live

get to and ask questions, Okay.

All right, so let's now go to, let's see

if there any other questions. I will be

wrapping up in a few minutes.

Lincoln said, "Got it." Okay, good.

So she is asking, "Can virtual audit

be done for a Physical Operation Center?"

Um, it depends on the objective. It

depends on what you're testing, but

typically if the con, it depends on the

controls. So if you don't understand what

controls are again. Let me see if I can

find that channel for you, but it's

the control is what's going to determine

how you perform, right. So you can't just

take an audit, what, what are you actually

testing? Because if the control is a

physical control that someone needs to

see, write, touch or whatever ,then you

will need to do that physically. But, if

it doesn't require physical presence

then if that control could be tested

virtually Okay.

All right, let's see if there's any more

question. If there are any more questions,

hey so, good good good. So thank you guys

for joining me here today now. Did you

guys let

all, some media is asking. Do I have

resume workshops on IT audits? Do you

mean just training on how to do your

your resume is that what you're asking

on some media? Okay, so I don't do

workshops on resume training. However, I

have covered the topic before where I

talked about resume mistakes that you

might make in IT audit. So if and I think

I actually have that on my YouTube

channel as well. So, if you go there, I

think I have one training where I talk

about resume mistakes that you might be

making.

So I don't do workshops and that now

in my full-blown comprehensive training.

I do provide resume training for my

students. I bring in like a live

professional resume writer to come give

training to students in one of my

courses. So that's something I provide.

Because your resume is not just about

finding a template online, and putting it

together right. Your resume should

reflect what, you know, your experience. I

think. Okay, I'll answer one more question

because we have just one more minute.

Did we do control testing in the

process of walkthrough only check the

design?

Typically, during your walkthrough,

you're just, that's where you're really

doing your design review depending on

the control. You may not even be able to

really finish that in the walkthrough,

but you would look at that there. However,

additional testing will be needed to

finish your testing procedures. Okay all

right. So, I think we're up on time here

today. Thank you guys for joining me. If

you guys learned something, I promise to

you guys you will learn something. All

right. Great great great. So before we go

let me, just make sure there's a free

six figure career guide. So this guide has

been downloaded so so many times by so

many people. Let me put it in the chat,

and it's also going to be available in

the YouTube link when I'm done. But if

you guys want the guide for those

interested in IT audits, go ahead and

download this guide.

Um and it just walks through some things

that you need to know, so make sure you

download that guide. it's free. I'm not

charging you for that at all. And um, I'm

not sure how often I'll do this free

training, maybe once a month. I don't know,

but if you're on my email list. So if you

get that guy, for example, you'll be on my

email list. And you'll get invited to

this. I don't publicize this small

meetings anywhere else. It's just going

to be for those on my email list. I think

I scroll too fast, okay. There it is. All

right, so thank you guys. You guys have a

great rest of your day. Bye.