IT & Privacy Risk Assessments
Internal Audit is required by professional audit standards and our risk environment to consider IT-related risks. The Internal Audit Charter states that the scope of Internal Audit should include “monitoring and evaluating the effectiveness of the University’s risk management system.”
IT Risk Assessment & Audit Process
Develop and maintain IT risk universe
Select entities, units, applications, and development projects for IT risk assessment
Distribute IT risk assessment questionnaire
Distribute data inventory questionnaire or request data inventory updates
Analyze risk assessment questionnaire results
Request supporting documentation and perform additional testing
Report risk assessment results and obtain management risk remediation plan