{"id":645,"date":"2025-07-17T13:28:52","date_gmt":"2025-07-17T13:28:52","guid":{"rendered":"https:\/\/informatics.ly\/en\/?post_type=session&p=645"},"modified":"2026-06-07T09:02:57","modified_gmt":"2026-06-07T09:02:57","slug":"it-audit-session","status":"publish","type":"session","link":"https:\/\/informatics.ly\/en\/session\/it-audit-session\/","title":{"rendered":"Information Technology Auditing"},"content":{"rendered":"\n

Introduction<\/h3>\n\n\n\n

As part of developing the capabilities of oversight bodies and enhancing the effectiveness of digital governance, a technical session titled “IT Audit”<\/strong> was organized and presented by Mr. Abdul Hamid Al-Deeb from the Information Technology Office of the Libyan Audit Bureau.<\/p>\n\n\n\n

The session aimed to highlight the fundamental concepts of IT auditing, demonstrate its importance in ensuring operational efficiency and protecting digital infrastructure, and review the methodologies used in executing such audits. Additionally, it covered the international and local standards upon which the audit process is based, as well as the approved technical and organizational controls.<\/p>\n\n\n\n

The session began with a historical overview of IT auditing in Libya. The lecturer explained that this specialization began to take institutional form in 2012 through an initiative launched by the IDI (INTOSAI Development Initiative)<\/strong>, an international organization dedicated to developing the capacities of supreme audit institutions across Africa, Asia, and Europe. This initiative contributed to building a deeper understanding of technical auditing and fostering the exchange of expertise between nations.<\/p>\n\n\n\n

Mr. Abdul Hamid emphasized that IT auditing is not merely an assessment of the presence of hardware or operating systems; rather, it is a comprehensive process involving a meticulous examination of an entity\u2019s digital infrastructure and an analysis of evidence and data related to technical performance. The goal is to verify system effectiveness, ensure information security, and promote compliance with approved standards. He further stressed that this audit serves as a pivotal tool in enhancing transparency, mitigating risks, and ensuring the continuous and efficient delivery of public services.<\/p>\n\n\n\n

Workshop Pillars<\/h3>\n\n\n\n

Pillar I: The Concept of IT Audit<\/h4>\n\n\n\n

The session clarified that IT auditing aims to ensure Information Security<\/strong>, based on three core principles known in the field as the CIA Triad<\/strong>:<\/p>\n\n\n\n

    \n
  • Availability:<\/strong> Ensuring information is available whenever needed.<\/li>\n\n\n\n
  • Confidentiality:<\/strong> Protecting information from unauthorized access.<\/li>\n\n\n\n
  • Integrity:<\/strong> Ensuring data is not tampered with or altered without authorization.<\/li>\n<\/ul>\n\n\n\n

    The lecturer noted that as public entities rely on various technical systems for daily operations, it is essential to examine these systems for compliance with security standards and analyze the entity’s level of dependence on them.<\/p>\n\n\n\n

    Pillar II: Categories of Audited Assets<\/h4>\n\n\n\n

    The session classified the assets evaluated during the audit process into four main categories:<\/p>\n\n\n\n

      \n
    1. Information Assets:<\/strong> All forms of data and digital content produced or relied upon by the entity.<\/li>\n\n\n\n
    2. Technical Assets:<\/strong> Hardware, servers, networks, and operating systems that form the IT infrastructure.<\/li>\n\n\n\n
    3. Human Element:<\/strong> Personnel within the entity and the extent of their awareness and commitment to cybersecurity policies.<\/li>\n\n\n\n
    4. Service Assets:<\/strong> Components that enable the delivery of digital services to beneficiaries or other agencies.<\/li>\n<\/ol>\n\n\n\n

      The audit covers the entire institutional context, including cybersecurity culture, operational procedures, and emergency response plans.<\/p>\n\n\n\n

      Pillar III: Audit Execution Methodology<\/h4>\n\n\n\n

      The methodology follows a structured technical path:<\/p>\n\n\n\n

        \n
      • Preliminary Assessment:<\/strong> Understanding the entity’s nature of work and its technical roles.<\/li>\n\n\n\n
      • Risk Assessment:<\/strong> Inventorying information systems and identifying “sensitive systems” critical to business continuity.<\/li>\n\n\n\n
      • Evidence Collection:<\/strong> Using tools such as staff interviews, questionnaires, procedural reviews, and flowcharts<\/strong> to analyze workflows.<\/li>\n\n\n\n
      • Testing Controls:<\/strong> Verifying the effectiveness of:\n
          \n
        • Preventive Controls:<\/strong> To stop errors or breaches before they occur.<\/li>\n\n\n\n
        • Detective Controls:<\/strong> To identify issues as they happen.<\/li>\n\n\n\n
        • Corrective Controls:<\/strong> To remedy issues after they are detected.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • Reporting:<\/strong> Concluding with a comprehensive final report submitted to senior management, including findings and recommendations for addressing vulnerabilities.<\/li>\n<\/ul>\n\n\n\n

          Pillar IV: Approved Audit Standards<\/h4>\n\n\n\n

          The lecturer confirmed that the Libyan Audit Bureau relies on recognized international standards, most notably:<\/p>\n\n\n\n

            \n
          • ISO\/IEC 27001:<\/strong> An integrated framework for Information Security Management Systems (ISMS).<\/li>\n\n\n\n
          • ISACA Frameworks:<\/strong> Including COBIT<\/strong> for IT governance and risk management, and professional practice frameworks for IT.<\/li>\n\n\n\n
          • Local Efforts:<\/strong> Ongoing development of national IT audit standards that account for the Libyan context and the specific challenges faced by public entities.<\/li>\n<\/ul>\n\n\n\n

            Pillar V: Types of Audit Controls<\/h4>\n\n\n\n

            Controls are categorized into two main types:<\/p>\n\n\n\n

              \n
            1. General Controls:<\/strong> Applying to the overall infrastructure and institutional practices.<\/li>\n\n\n\n
            2. Application Controls:<\/strong> Specifically targeting software processes in three stages:\n
                \n
              • Input Controls:<\/strong> Ensuring data accuracy and integrity upon entry.<\/li>\n\n\n\n
              • Processing Controls:<\/strong> Ensuring the system executes operations as planned.<\/li>\n\n\n\n
              • Output Controls:<\/strong> Verifying that results are untampered with and distributed only to authorized parties.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n

                Conclusion and Recommendations<\/h3>\n\n\n\n

                Mr. Abdul Hamid Al-Deeb concluded that IT auditing has become an indispensable element of good governance and the protection of public funds. The effectiveness of this role depends on building qualified cadres and following precise methodologies based on international standards.<\/p>\n\n\n\n

                Key Recommendations:<\/strong><\/p>\n\n\n\n

                  \n
                • Continuous Capacity Building:<\/strong> Ongoing training and qualification of staff in the field of IT auditing.<\/li>\n\n\n\n
                • Balanced Implementation:<\/strong> Applying international and local standards in a balanced manner to ensure comprehensive oversight.<\/li>\n\n\n\n
                • Risk-Based Planning:<\/strong> Prioritizing audit efforts toward the most sensitive and high-risk systems.<\/li>\n\n\n\n
                • Focus on Core Security:<\/strong> Maintaining the principles of Availability, Confidentiality, and Integrity as the fundamental pillars of all evaluation processes.<\/li>\n<\/ul>\n","protected":false},"author":6,"featured_media":757,"parent":0,"template":"","meta":{"_acf_changed":false},"class_list":["post-645","session","type-session","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/session\/645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/session"}],"about":[{"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/types\/session"}],"author":[{"embeddable":true,"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/users\/6"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/media\/757"}],"wp:attachment":[{"href":"https:\/\/informatics.ly\/en\/wp-json\/wp\/v2\/media?parent=645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}