IA-06
Process Understanding and Control Assessment Kit (RCM)
Understand and document the process, then build the risk and control matrix and the audit program.
IA-08
IT General Controls Review Kit (ITGC)
Review IT and cybersecurity controls with templates referenced to the NCA Essential Cybersecurity Controls (ECC).
Inside the kit
What this kit solves
The systems behind a business process are often left out of scope, or tested with a generic checklist unrelated to risk. This kit starts with the IT environment in 406: the systems, applications and databases that support the process, and who is responsible for them. 30202 then assesses access, change and data integrity risks. 505 organises ITGC testing in four areas: access and privilege management, including segregation of duties (50501); system change management (50502); IT operations, backup and recovery (50503); and cybersecurity and data protection (50504), tested against the NCA ECC and the PDPL.
What your file holds afterwards
- A documented view of the systems, applications and databases supporting the process, and their owners (406)
- An IT risk assessment covering access, change and data integrity (30202)
- Access testing: user provisioning and removal, privilege reviews and segregation of duties (50501)
- Change testing for approval and pre-production testing, plus backup, recovery and incident handling (50502, 50503)
- Cybersecurity and data protection testing set against the NCA ECC and the PDPL (50504)
How to use it
- Assess access, change and data integrity risks for the supporting systems in 30202 during engagement planning.
- Document the systems, applications, databases and their owners in 406, and decide which controls to test.
- Test general controls under 505 using 50501, 50502 and 50503.
- Test cybersecurity and data protection in 50504 and link the results to the RCM in IA-06.
Who it is for
Audit firms and in-house internal audit departments whose engagements cover IT-dependent processes, from planning and process understanding through to testing.
What is in the kit
| Code | Paper | Format | What you get | Reference |
|---|---|---|---|---|
| 30202 | IT Risk AssessmentReference: 13.2 | Excel | Template + worked exampleTemplate + example | 13.2 |
| 406 | IT Environment UnderstandingReference: 9.1, 14.1 | Word | Template + worked exampleTemplate + example | 9.1, 14.1 |
| 505 | IT General Controls Testing (ITGC)Reference: 14.2 | Excel | Template + worked exampleTemplate + example | 14.2 |
| 50501 | Access and Privilege ManagementReference: 14.2 | Excel | Template + worked exampleTemplate + example | 14.2 |
| 50502 | System Change ManagementReference: 14.2 | Excel | Template + worked exampleTemplate + example | 14.2 |
| 50503 | IT Operations and BackupReference: 14.2 | Excel | Template + worked exampleTemplate + example | 14.2 |
| 50504 | Cybersecurity and Data ProtectionReference: 14.2 | Excel | Template + worked exampleTemplate + example | 14.2 |
Every kit also includes a user guide (PDF and PowerPoint) and the licence terms, in Arabic and English.
IIA Global Internal Audit Standards (2024) references, with ISQM 1 and SAMA principles where they apply, as given in the guide. References are for cross-referencing and do not imply IIA endorsement.
Where it sits in the audit cycle
- 000File AdministrationIA-01
- 100Acceptance, Engagement and AdministrationIA-02
- 200Permanent and Annual FileIA-03IA-04
- 300Engagement PlanningIA-05IA-08
- 400Process Understanding and Control AssessmentIA-06IA-08
- 500Testing and FieldworkIA-07IA-08
- 600FindingsIA-09
- 700Reporting and Follow-upIA-09IA-10
- 800Advisory EngagementsReplaces 400–700 on advisory engagementsIA-11
- 900Quality Review and File ClosureIA-12