Summary

This chapter has looked at three important processes in any organization; auditing, risk management, and incident handling. The chapter begins by taking a look at the IT auditing process. We supplied an in-depth explanation of what it is, which also summarizes the advantages of having one carried out in an organization. A disclaimer is given, however, concerning the perception of auditing. Since it is held in high regard, it is important to note that it still has some limitations and cannot cover all potential vulnerabilities in the organization. The chapter then looked at risk management. Here, the five-step process of risk management was discussed. This includes identification, analysis, assessment, mitigation, and monitoring. In addition to this, there was a brief overview of the approaches that an organization can take when handling IT risks. Lastly, the chapter looked...