Section 13.114 Internal Audits and Assessments

Question 1

Internal Audits

Answer 1

Systematic evaluations conducted by an organization’s own audit team to assess the effectiveness of internal controls, compliance with regulations, and
the integrity of information systems and processes

Internal Audits Focus areas:
● Data protection
● Network security
● Access controls
● Incident response procedures

Examples of internal audit focus areas
● Password policies - allign weith best practices
● User access controls

Question 2

Process on Internal Audit

Answer 2

● Reviewing policies and procedures

● Examining access rights

● Testing effectiveness of controls

● Findings documented for recommendations and improvements

Question 3

Concepts in Internal Audits

Compliance Requirements

Answer 3

Ensuring that information systems and security practices meet established standarts, regulations and laws

○ Compliance is essential for protecting sensitive data and avoiding legal penalties

○ Internal audits may be required for compliance with specific laws or regulations

Question 4

Audit Committee

Answer 4

A group, often comprising members of a companys board of directors, overseeing audit and compliance activities

Responsibilities:
■ Reviewing financial reporting
■ Internal controls
■ Internal and external audits
■ Legal and regulatory compliance

Addresses issues raised by auditors

Question 5

Internal Assessments

Answer 5

An in-depth analysis to identify and assess potential risks and vulnerabilitites in an organisations information systems

■ Commonly performed before implementing new systems or making significant changes to existing ones

Question 6

Self Assessments

Answer 6

Internal evaluations assessing compliance with specific standards or
regulations

■ Vulnerability assessments, threat modeling exercises, and risk assessments are part of internal assessments

Question 7

Internal Assessment Process

Threat Modeling Exercise

Answer 7

○ Identifies potential threats to applications (e.g., SQL injection, XSS,
DoS attacks)

Question 8

Internal Assessment Process

Vulnerability Assessment

Answer 8

○ Uses automated scanning tools and manual testing techniques to identify known vulnerabilities and code weaknesses

Question 9

Internal Assessment Process

Risk Assessment

Answer 9

○ Evaluates the potential impact of the following

■ Identified threats and vulnerabilities
■ Considering likelihood
■ Potential damage
■ Cost of security measures

Question 10

Internal Assessment Process

Mitigation Strategies

Answer 10

○ Recommendations to address risks and vulnerabilities

○ Code fixes

○ Additional security controls

○ Architectural changes