Key Components and Operability Evaluation of Internal Controls for Risk Assessment Modeling in IT Audit

摘要

the purpose of this paper is to present some directions to improve the implementation methodology of an audit process, from the analysis of tolerance to IT systems unavailability for organizations in a critical situation caused by the materialization of IT vulnerabilities. The article follows a series of key components of IT risk management process, proposing practical elements for risk control, internal controls operability analysis and aggregation of results, providing a deterministic model process. The use of predefined questionnaires and risk matrix can help the services providers to adapt to the market and maintain the service quality. These practical elements can be found in the proposed IT audit questionnaire, along with a workflow process in seven steps for the audit mission.