（2008）Using Assurance Models in IT Audit Engagements.pdfVIP

Using Assurance Models in IT Audit Engagements Adrian Baldwin, Yolanta Beres, Simon Shiu Trusted Systems Laboratory HP Laboratories Bristol HPL-2006-148R1 January 29, 2008* audit, assurance, The document describes an innovative way to assess the effectiveness of compliance, internal IT controls where the control framework is first captured in the Sarbanes-Oxley, models and then the models are used to analyse the evidence gathered SOX, risk, security from the IT environment. The aim is to lift the risk and control management lifecycle from a series of people based processes to one where model based technology enhances, connects and where appropriate automates the process. Modelling in such an approach means capturing the relationship between controls and the way the controls should be analyzed for effectiveness and compliance to regulations and internal policies. This document presents how the model based assurance approach has been applied to automate the analysis of critical IT internal controls during several IT application audits in HP, and the value and benefits we have seen in using models to drive real-time analysis and measurements of the operating environment. Internal Accession Date Only Approved for External Publication © Copyright 2006 Hewlett-Packard Development Company, L.P. Using Model Based Assurance in IT Audits A Baldwin, Y Beres, S Shiu U