How do you develop and maintain IT general controls skills and competencies?

IT General Controls apply to the physical assets within an organisation however IT Application Controls are also important in order to create a secure IT System. CobiT is focused on the IT General Controls whereas ISO 27001 is a standard that included both general and application controls. You need to be more specific as NIST is equivalent to saying ISO .... it is an organisation NOT a framework .... COSO is a very high level organisational government model and should not be aligned with security ,,,,

In an effective system of controls, these five components of the COSO internal controls framework help an organization fulfill its goals and mission and better reach its defined objectives. These objectives are various lines of defense that an organization can use to defend against risk - Risk Assessment, Control Activities, Information and Communications, Control Environment and Monitoring Activities.

1. Study Official Documentation: Familiarize yourself with the official documentation of COBIT, ISO 27001, NIST, and COSO. 2. Training and Certifications: Enroll in training and certifications for structured learning and validation. 3. Online Resources: Utilize online communities and resources for discussions and additional insights. 4. Case Studies: Explore real-world case studies to understand practical applications. 5. Stay Updated and Apply Knowledge: Stay informed through self-study, research, and workshops. Apply knowledge regularly in practical scenarios or simulations.

As professionals, it's imperative to continuously hone our skills and competencies in IT general controls. One effective approach is to stay abreast of industry trends through regular participation in relevant workshops, seminars, and online courses. Additionally, seeking out opportunities to apply theoretical knowledge in practical settings fosters experiential learning and skill refinement. Engaging in peer discussions and knowledge-sharing platforms can also provide valuable insights and perspectives. Ultimately, a proactive approach to learning and adaptation is key to maintaining proficiency in this dynamic field.

It is almost impossible in practice to separate IT General and IT Application controls ... it is a bit silly doing one without the other!!!

Continuous learning is key to developing IT general controls skills. I actively participate in training courses, webinars, and conferences to stay updated. Engaging in professional communities, I share insights, ask questions, and collaborate with peers to enhance my understanding. Following blogs, podcasts, and social media accounts keeps me informed about the latest trends. Building a network within IT auditing provides valuable perspectives and mentorship opportunities. This multifaceted approach ensures I learn from both experts and peers, contributing to my competency in IT general controls.

I am very much in favor of putting the knowledge acquired into practice. This can be accomplished by producing an article, carrying out audit work, teaching classes, simulating real cases, round tables and exchanging experiences in debates. What to evaluate in ITGC can sometimes be clear, but how to evaluate it is not. Experimenting with different paths, alternatives and scopes seems like a successful journey to me. Work can often be carried out in multidisciplinary teams, which I believe is an accelerator of knowledge as at all stages of the work there will be the opportunity to exchange experiences, failures and successes.

Punto clave. La operación de los controles depende casi totalmente del equipo o talento interno. El tener un dise?o óptimo de controles no asegura su plena ejecución.

Developing and maintaining IT general controls skills involves continuous learning and adaptation: Stay Current: Regularly read industry journals, attend webinars, and follow thought leaders. Understand emerging technologies (e.g., cloud, AI, blockchain). Certifications and Training: Pursue relevant certifications (e.g., CISA, CISSP). Attend workshops, conferences, and online courses. Networking and Communities: Join professional associations (ISACA, (ISC)2). Engage in forums, LinkedIn groups, and local meetups. Hands-On Practice: Set up labs to experiment with controls and tools. Collaborate with colleagues on real-world scenarios. Remember, adaptability and curiosity are key to staying ahead in the dynamic IT audit landscape!

Being aligned with ITGC audit trends allows for new insights, understanding of best practices and allows you to learn from examples. I suggest: - chat with experts. - monitor ITGC publications. - participate in study groups. - talk to external consultants or industry colleagues. - join associations. - participate in vendor demos about tools. - frequent virtual and physical libraries. - obtain certification. - reinforce knowledge about the organization's business and innovation. - carry out audit work at ITGC.

No need to self-impose a limited boundary for "general": Expanding what fits under the definition is another way to develop and maintain your skills and competencies.

Staying updated with the latest trends and upskilling one's competencies is perhaps the most critical aspect to consider for professionals in the field of IT Auditing. Given the unprecedented pace at which technology is evolving, it is imperative to remain abreast of the latest developments. This can be achieved through various means, such as becoming a member of esteemed professional bodies like ISACA, ISC2, or IIA, and actively participating in webinars, reading relevant articles, and even contributing by writing articles. For those holding certifications such as CISA, CIA, CISSP, among others, it is essential to ensure the completion of Continuing Professional Development (CPD) hours to engage in regular learning and upskilling.

Building your understanding on standards and Frameworks which requires IT Controls to be implemented or provide guidance on IT Controls design and Implementation. Each Control is designed to fulfill certain control objectives or to mitigate certain risks. By Auditing the Controls, you as an auditor tries to find the risk by obtaining appropriate evidence which will demonstrate either control objectives to be achieved or failed to achieve.

The evolution of ITGC skills and competencies involves the development of technical and behavioral skills, as well as participation in greater scope and depth in projects involving the subject, including the consolidation and acquisition of experiences with effective results. This is a reflection on empowering your own career. I suggest focusing on development based on the following premises. 1 – Knowledge: here it is the theoretical knowledge that can be achieved in ITGC through courses and books. 2 – Skill: seek to transform and apply the theory learned in practical terms, aiming for tangible results. 3 – Attitude: develop pro-activity, self-awareness, emotional control and initiative.

Entry-level audit positions are an excellent route for developing IT general control competencies. Through hands-on walkthroughs, you gain practical insights into the implementation of controls, honing your ability to assess effectiveness and ensure compliance. This experience serves as a foundational step, building both technical expertise and a critical eye for identifying vulnerabilities.

An ITGC framework is typically adopted from public standards such as COSO, COBIT, or NIST. An ITGC framework is implemented to meet the requirements of an ITGC audit conducted by an external audit firm which measures the effectiveness of your IT general controls. Monitoring your controls through internal and external ITGC audits ensures that your policies are functioning properly and that any necessary adjustments are made to match the organization's evolving business environment.

ITGCs are required by the Sarbanes Oxley Act of 2002 to ensure the integrity of financial reports. While SOX is focused on the propriety of your financial and accounting practices, SOX ITGC controls focus on IT systems such as applications, operating systems, databases, and the supporting IT infrastructure. Your SOX ITGCs ensure IT and security activities are managed and governed according to your policies and procedures and support the effective functioning of application controls by helping to ensure the proper operation of information systems. Together ITGCs and application controls ensure the integrity of your data and processes across the IT environment to manage and mitigate risk.

Keep in mind that as business process controls transform as part of a business strategy, IT general controls should also follow the transformation strategy to adequately mitigate the underlying risk of using new technologies and optimized processes.