Administration of IT Activities Audit Checklist

1. Review the organization chart and evaluate the established procedures for adequacy in defining responsibilities in the security administration area. Implement general control (provision for general authorization over the execution of transactions, e.g., prohibiting the IT department from initiating or authorizing transactions) and COBIT objective (position descriptions clearly and delineate both authority and responsibility).
2. Determine who is responsible for control and administration of security. Verify that adequate security exists in the security administration function. Implement general control (prevents or detects deliberate or accidental errors caused by improper use) and COBIT objective (information services function is in compliance with security standards).
3. Determine whether adequate direction is maintained for each IT functional area within a policy and procedures manual. Evaluate whether the manual is kept up to date by IT management. Implement general control (written manuals in support of systems and procedures)and COBIT objective (operations sta. have operations manuals for all systems and processing within their responsibility).
4. Determine if written personnel policies for the IT administration personnel exist, and if these policies stress adequate quali. cation and level of training and development.
5. Determine if long-range (two to . ve) years’ system planning is maintained by IT management and is adequately considered in the . scal budgeting process.
6. Assess the adequacy of inventory procurement and control pertaining to the administration of the LAN environment. Review available inventory documentation to determine if it is adequately maintained and complete in description and location. Compare the serial numbers on the computer software with inventory records to determine if illegal copies of system and application software are being supported.