Learning note / Reflections on my studies
IT Audit
IT audit makes me look at a system through evidence and accountability. The question becomes how someone could establish that an important process or control is operating as intended.
Turning a concern into a question
A broad concern such as inappropriate access needs to become something that can be examined. I want to know the scope, the expected control, and what evidence could support a conclusion.
That makes planning important: it determines which questions the work can reasonably answer.
A document and a working control are different evidence
A written process tells me what is supposed to happen. Records of actual activity help establish whether it happened. I find that distinction useful because a well-written policy can still leave an operational question unanswered.
Changes, access decisions, and system operations each leave different kinds of evidence to consider.
Why the finding needs to be understandable
A finding needs to connect the observation with its consequence and a useful next action. That is where technical understanding and communication meet. I see the relevance to presenting analysis to a business owner: the detail needs to support a decision.
What I take forward
- Define the scope and expected control.
- Distinguish intended processes from operating evidence.
- Connect findings to consequences and action.