The Auditor has been asked to perform preliminary work that will assess the readiness of the organization for a review to measure compliance with the new regulatory requirement. This requirements are design to ensure that management is taking an active role in setting up and maintaining a well-controlled environment. Areas to be assessed include logical and physical security, change management, production control and network management, IT Governance, and IT Control. The Auditor has been given six month to perform this preliminary work so sufficient time should be available. It should be noted that in previous years, repeated problems have been identifiedinte areas of logical security and change management so this area most likely require some degree of remidiation. Logical security deficiencies noted included the sharing of administrator accounts and faliure to enforce adequate controls over paswords. Change management deficiencies included improper segregration of incompatible duties and faliure to document all changes. Additionally, the process of delpoying operation system update to servers was found to be partially effective. In anticipation of the work to be performance by Auditor, the chief information officer (CIO). requested direct reports to develop narratives and process flows describing the major activities for wich It responsible. These were completed, approved by the various process owners and the CIO, and then forwared to the Auditor for examination. Auditor also planning to review the security of financial application web for company with several locations worldwide. The application system is made up of a web interface, a business logic layer and database layer.Questions:
1. What should the Auditor do First?
2. When testing program change management, how should the sample be selected?