Risk level bassed approched:-

- High, medium, or low

-----------------------

Things to consider when planning:-

- Changes in controls

- Changes to the risk environment

- Changing technologies

- Changing business processes

------------------------

Planning Results:-

Reviewed by senior auditor

Approved by the board / committee
Communicated to management

--------------------------------
##ISACA - Steps to Perform IS Audit Planning

1- Understand the business:-

• Perform a walkthrough of the organization

• Review long - term strategic plans
• Interview key leadership and personnel
• Review previous audit reports
• Identify specific IT regulations
• Identify outsourced activities ( Are there third - parties ? )

2- Determine changes in the environment

3- Review previous work

4- Identify policies, standards, and procedures

5- Conduct risk analysis

6- Set scope and objectives

7- Develop a strategy

8- Designate resources

9- Address engagement logistics

---------------------------------------

##Steps to Determine Regulatory Compliance

- Identify and document external requirements

- Determine if management's organizational and IT functions

were designed to address the external requirements

- Map external requirements to internal functions

- Determine adherence

- Report gaps