IT Audit and Controls

[Audio] IT Audit and Controls PowerPoint lesson outline • speaker notes • quiz College-level Information Technology Open the lesson by asking students where they encounter IT systems every day: enrollment portals, online banking, e-wallets, social media, learning platforms, and payroll systems. Explain that the lesson focuses on how organizations check whether these systems are safe, reliable, and properly controlled..

[Audio] Lesson flow Use this as the roadmap for a 60-minute session. Why IT audit matters IT risks and the CIA Triad IT controls: purpose and categories Audit process and sample findings Activity, case study, and quiz IT Audit and Controls Speaker notes: Set expectations. Tell students that this is not only a cybersecurity topic. IT audit also checks governance, access rights, backups, system changes, and whether computer-generated reports can be trusted..

[Audio] Why IT audit matters A simple story: one weak control can affect the whole organization. Technology runs critical decisions Without controls, risks become real problems: Grades and records Unauthorized access Payroll and financial reports Data loss Customer or patient data Fraudulent transactions Inventory and purchasing System downtime Online transactions Inaccurate reports Speaker notes: Give a relatable scenario: if the grading system is down during encoding or if unauthorized users can edit grades, the issue is not just technical—it affects trust, fairness, and operations. Connect this to the idea that IT audit helps prevent or detect these issues..

[Audio] What is an IT audit? An organized evaluation of systems, processes, policies, and controls. Examines information systems and IT processes IT AUDIT Evaluates whether controls are designed and working Reports risks and recommends improvements It checks people, processes, technology, and evidence — not just computers. Speaker notes: Define IT audit in plain language: it is a structured check of whether the organization's technology is safe, reliable, properly managed, and aligned with objectives. Emphasize evidence: auditors need logs, documents, screenshots, approvals, policies, and test results..

[Audio] The CIA Triad The three core goals of information security. Confidentiality Only authorized people can view information. Integrity Data is accurate, complete, and protected from improper changes. Availability Systems and data are accessible when needed. Speaker notes: Use examples: confidentiality is protecting student grades from unauthorized viewing; integrity is preventing grade tampering; availability is ensuring the enrollment system works during enrollment. Ask students which part of CIA is affected when a system is hacked, when a file is corrupted, or when a server is offline..

[Audio] Understanding IT risk Risk happens when a threat can exploit a weakness. Threat Weakness Event Impact No patch, weak password Malware, hacker, error Unauthorized access Data loss or downtime Risk assessment asks: what can go wrong, how likely is it, and how serious is the impact? Speaker notes: Explain that a threat alone does not always create risk. The risk appears when the threat can use a weakness. For example, a ransomware threat becomes more dangerous when computers are not patched and backups are not tested..

[Audio] What are IT controls? Controls are safeguards that reduce risk and support reliable operations. A control may be a policy, procedure, configuration, approval, tool, or monitoring activity. Password policy MFA Backups Firewall Audit logs Patch management Approvals Training RBAC Change review Control objective: reduce the chance of error, fraud, data loss, or unauthorized access. Speaker notes: Clarify that a control is not always a software tool. A signed approval, a separation of duties policy, a backup schedule, and a security awareness training program are also controls..

[Audio] Three control purposes Preventive, detective, and corrective controls work together. Prevent Detect Correct Fix the issue and recover Stop the issue before it happens Find the issue after it happens MFA • access restrictions logs • alerts • reports restore backup • reset access Example: block weak passwords → monitor login attempts → reset compromised accounts. Speaker notes: Walk through a simple password example. Preventive: require strong passwords and MFA. Detective: review login failures and alerts. Corrective: reset compromised accounts and investigate. Stress that mature organizations use all three..

[Audio] IT General Controls (ITGCs) Controls that support the overall IT environment. Access management Who can enter systems and what can they do? Change management Are system changes approved, tested, and documented? Backup & recovery Can data and services be restored when something fails? Physical security Are servers, devices, and facilities protected? Speaker notes: Explain that ITGCs are broad controls. They affect many systems. If access management is weak, many applications may become risky. If change management is weak, updates can break systems or introduce vulnerabilities..

[Audio] ITGC examples auditors commonly check Auditors ask for evidence that controls actually work. User list, role matrix, terminated-account review Access Request ticket, approval, testing evidence, rollback plan Changes Backup schedule, restoration test, offsite/cloud copy Backups Incident logs, monitoring alerts, patch records Operations Speaker notes: Make the connection to documentation. A control is stronger when the organization can show proof: access review sheets, approved tickets, screenshots of settings, backup reports, or incident logs..

[Audio] Application controls Controls built into a specific software system. Input controls Processing controls Output controls Required fields Data type checks Drop-down lists Duplicate detection Calculation rules Transaction numbering Error messages Batch totals Restricted reports Report review Password protection Authorized distribution Speaker notes: Use a student enrollment form as an example. Input control: student number is required. Processing control: total units are calculated correctly. Output control: only authorized staff can generate official enrollment reports..

[Audio] Segregation of duties No single person should control an entire critical transaction. Request Approve Process Review One user does not request, approve, process, and review the same transaction. In IT, developers should not approve and deploy their own changes alone. Separation reduces fraud, error, and conflict of interest. Speaker notes: Explain with purchasing or payroll. If one person can create a vendor, approve payment, and release the payment, fraud is easier. In software development, the person who coded a change should usually not be the only approver of that change in production..

[Audio] Basic IT audit process From planning to follow-up. Plan Assess risk Evaluate Test Report Follow up findings and recommendations scope and objectives what can go wrong control design control operation implementation Speaker notes: This is a simplified audit process. In planning, auditors decide what system or process to check. In risk assessment, they identify likely problems. They then evaluate control design, test whether controls worked, report findings, and later check if the recommendations were implemented..

[Audio] Sample audit finding Translate observations into risk and recommendation. Condition Risk Recommendation Employees share one inventory account. Use unique accounts, role access, and audit logs. Management cannot trace who made changes. Speaker notes: This slide teaches the structure of an audit finding: condition, risk, and recommendation. You can add criteria and cause for more advanced students, but these three are enough for a beginner-friendly lesson..

[Audio] Class activity: identify the control Ask students: preventive, detective, or corrective? 1. A system requires a one-time code before login. 2. The IT team reviews security logs every week. 3. A company restores deleted files from backup. 4. A form rejects letters in a phone number field. 5. A system sends an alert after five wrong passwords. Suggested answers are in the speaker notes. Speaker notes: Suggested answers: 1 Preventive, 2 Detective, 3 Corrective, 4 Preventive, 5 Detective. Ask students to justify their answers. This reinforces that the same topic, such as login security, can have different control types..

[Audio] Case study discussion Shared spreadsheet with customer information. Scenario All employees can open, edit, delete, and download a customer spreadsheet. There is no password, no backup, and no record of changes. Discussion questions What risks are present? Which parts of the CIA Triad are affected? What controls should be implemented? Speaker notes: Guide answers: risks include unauthorized access, accidental deletion, intentional changes, lack of accountability, and data loss. CIA: confidentiality, integrity, and availability are all affected. Controls: role-based permissions, unique accounts, password protection, version history, backups, and access review..

[Audio] Quick quiz 10 items: mix of identification and application. Instructions Answer individually first. Then compare answers with a partner. Use examples from school, business, or government systems. Final answer key is at the end. Estimated time: 8–10 minutes Speaker notes: Tell students not to worry if they are unsure. The quiz is a formative check. Encourage them to explain why an answer is preventive, detective, or corrective rather than only memorizing terms..

[Audio] Quiz: items 1–5 Write the best answer. 1. What does IT audit evaluate? 2. Which CIA principle is about authorized access only? 3. Give one example of a preventive control. 4. Classify: audit logs reviewed weekly. 5. What type of control is restoring files from backup? Speaker notes: Suggested answers: 1 IT systems, processes, policies, risks, and controls; 2 Confidentiality; 3 examples include strong passwords, MFA, access restrictions, firewall; 4 Detective control; 5 Corrective control..

[Audio] Quiz: items 6–10 Apply the concepts. 6. What is the difference between ITGCs and application controls? 7. Why is segregation of duties important? 8. What risk exists when employees share one account? 9. Name one evidence an auditor may request for change management. 10. A form rejects blank student numbers. What control is this? Speaker notes: Suggested answers: 6 ITGCs support the overall IT environment, while application controls are built into a specific application; 7 it reduces fraud, error, and conflict of interest; 8 lack of accountability and unauthorized or untraceable actions; 9 approved change ticket, test evidence, deployment approval, rollback plan; 10 input/application preventive control..

[Audio] Answer key and wrap-up Use for checking and final synthesis. ITGC = general IT environment; app control = specific system 1. 6. IT systems, processes, risks, and controls 2. 7. Confidentiality Reduces fraud, error, and conflict of interest 3. 8. MFA / strong password / access restriction / firewall No accountability or traceability 4. 9. Detective control Approval ticket / testing proof / rollback plan 5. 10. Corrective control Input control / application control / preventive Key takeaway: good IT audit is evidence-based, risk-focused, and control-oriented. Speaker notes: End by returning to the core message: IT audit is not about blaming people. It helps organizations protect information, improve operations, and build trust. Invite students to name one control they would add to a school system they use..