Proceedings

3.1 Planning and scoping of the audit
The key starting point in performing the database audit is to understand the business
risk that lies in the system of which the respective database is a component. It is
important for the auditors to understand how the system is used, what is the criticality
of the transactions processed by the system and the confidentiality and availability
requirements for the data stored in its database.
The second step is to obtain an understanding of the IT environment and to see how
the database fits into the overall system architecture. A clear picture of the IT
architecture will help the auditor to identify and assess the risks created by each
component of the information system, e.g. application, interfaces, network topology,
operating system that may potentially influence the database security. In this respect,
the auditor should:
� interview the application / system administrator;
� interview the business owners of the systems;
� review an inventory of IT infrastructure (servers, databases, applications, etc);
� review network topology;
� perform a general review of the IT policies and procedures in place to observe
how the internal control system is.
Based on the review, the risk category is identified for each component of the
information system.
A lack of a clear understanding of the business risks and of the IT environment may
result in an audit report that is not capturing the risks that the information system
really poses to the organization and the findings and recommendation could be
unrealistic and could not mitigate the existing risks.
Following the thorough understanding of the risks involved and the IT environment,
the subsequent steps are performed:
• Define the audit scope and objectives. These should be aligned with the Annual
Audit Plan and Audit Charter and should consider the budget and time
limitations.
• Define the audit limitations and constraints, if any.
• Review the previous database audit reports. Reports issued by both internal and
external auditors and the regulatory bodies should be considered. Determine
whether the issues previously identified have been corrected, taking into
account the following:
� the efficiency and the response time of the corrective measures;
� addressing of the root cause problem (if possible) and not only of the
consequences.
The auditor should assess the overall risk level employed by the remaining
findings and recommendations, left unsolved.
• Based on the assessment of the previous audit reports, changes in the scope and
objectives of the audit should be performed, if it is the case.
~ 294 ~