Lab Manual 1, Module 1, Audit Plan

 Purpose of Audit: To provide assurance that Information Systems Infrastructure of Data

Centre is working under secured and control condition and physical and logical access
controls implemented are working reasonably well to safeguard all IT assets.
 Audit Scope: All the assets and processes within the Data Centre of Bank A
 Audit Objectives: Gather, evaluate, adequate and relevant audit evidences to provide an assurance
on the reliability of information systems at the Data Centre of Bank A.
 Audit Criteria: We shall have to conduct the audit in accordance of the following criteria-
a. Guidelines and circular issued by Reserve Bank of India in respect of IS Audit
b. Control objectives as stated in ISO 27001 as the Bank is certified under ISO/IES
27001:2019
c. IS security policy and procedures as approved by the Board
d. IT Act 2000 (as amended in 2008)
 Audit Date: From …… to …………………
 Audit Team: Audit Team Leader – Mr. ……………..Other Auditor : ……………..
 Key Personnel : Audit Committee Head :
Data Centre In-charge:
SOC In-charge :
NOC In-charge:
Development Team head:
Database Administrator:
System Administrator:
Documents required: IS Security policy & Procedures
Asset register
Risk Register
Incident management register
Risk assessment report, if any
 Audit Methodology:
We shall be using the following methodology for this assignment (project)
1. Collecting and analyzing the material evidences
2. Interviewing the authorized personnel
3. Observation of data center operations
4. Studying the relevant materials
5. Discussing with the operation & Management team
 Audit Agenda: Detailed Audit Plan (Audit Program)
a) Study the documents (IS security policy & procedure, relevant guidelines, SOP) – Dates….
b) Discussion with the Auditee (…….), 30 mins each with 7 departments starting at 10.00
am (both auditors)
c) Observation of SOC activity – …….. by Auditor 1
d) Observation of NOC activity- ……… by Auditor 2
e) Study the physical access control system of the Bank – …….. by Auditor 1
f) Collecting user access logs – …… by Auditor 2
g) Study the asset register – ……… by Auditor 1
h) Observe and study change control process – ……….. by Auditor 2
i) Observe and study version control process – ………. by Auditor 1
j) Testing access control of menus in core banking system – …….. by Auditor 2
k) Study the backup process – ……… by Auditor 1
l) Evaluation of collected evidences ……….. by Auditor 2
m) Discussion with the draft report – …………. by both
n) Submission of Final report on ………