Apr 21 2016

Fundamentals of Information Risk Management Auditing

Category: Security Risk AssessmentDISC @ 2:01 pm


An introductory guide to information risk management auditing, giving an interesting and useful insight into the risks and controls/mitigations that you may encounter when performing or managing an audit of information risk. Case studies and chapter summaries impart expert guidance to provide the best grounding in information risk available for risk managers and non-specialists alike.

For any modern business to thrive, it must assess, control, and audit the risks it faces in a manner appropriate to its risk appetite. As information-based risks and threats continue to proliferate, it is essential that they are addressed as an integral component of your enterpriseā€™s risk management strategy, not in isolation. They must be identified, documented, assessed, and managed, and assigned to risk owners so that they can be mitigated and audited.

Fundamentals of Information Risk Management Auditing provides insight and guidance on this practice for those considering a career in information risk management, and an introduction for non-specialists, such as those managing technical specialists.

Ā Book overview

Fundamentals of Information Risk Management Auditing ā€“ An Introduction for Managers and Auditors has four main parts:

  • What is risk and why is it important?Ā An introduction to general risk management and information risk.
  • Introduction to general IS and management risksĀ An overview of general information security controls, and controls over the operation and management of information security, plus risks and controls for the confidentiality, integrity, and availability of information.
  • Introduction to application controlsĀ An introduction to application controls, the controls built into systems to ensure that they process data accurately and completely.
  • Life as an information risk management specialist/auditorĀ A guide for those considering, or undergoing, a career in information risk management.


Each chapter contains an overview of the risks and controls that you may encounter when performing an audit of information risk, together with suggested mitigation approaches based on those risks and controls.

Chapter summaries provide an overview of the salient points for easy reference, and case studies illustrate how those points are relevant to businesses.

The book concludes with an examination of the skills and qualifications necessary for an information risk management auditor, an overview of typical job responsibilities, and an examination of the professional and ethical standards that an information risk auditor should adhere to.

Topics covered

Fundamentals of Information Risk Management Auditing covers, among other subjects, the three lines of defense; change management; service management; disaster planning; frameworks and approaches, including Agile, COBITĀ®5, CRAMM, PRINCE2Ā®, ITILĀ®, and PMBOK; international standards, including ISO 31000, ISO 27001, ISO 22301, and ISO 38500; the UK Government’s Cyber Essentials scheme; IT security controls; and application controls.

Download your copy ofĀ Fundamentals of Information Risk Management Auditing

Leave a Reply

You must be logged in to post a comment. Login now.