Is ZFPAudit all I need to perform a “complete” IT audit?
A. No. ZFPAudit provides information and analysis on key aspects of a computer’s configuration. For a complete assessment of IT General Controls, either for a specific system or an entire organization, much more is required. At a minimum, I would also include a remote network vulnerability assessment, and additional interviews, document reviews, and evidence gathering to evaluate other key areas, such as data backup, disaster recovery, business continuation, and many other criteria for evaluating IT practice. ISO standards document ISO-17799, “Information Technology Code of Practice” is a helpful guide on this matter, as is, “Control Objectives for Information and related Technology (CObIT). Information on the latter may be obtained at: www.isaca.org/cobit.
