Information Systems and IT Infrastructure Risk Assessment Programs/Checklists for IT Assurance Practitioners

Risk assessments are carried out primarily to identify risks/vulnerabilities inherent in an organization's business operations, information systems and IT infrastructures, estimate their likelihood of occurrence, determine impact of such risks to the organization and prioritize risks based on their critically, likelihood of occurrence and availability of resources to address them.

Risk assessment revolves around these three factors: Value organizations attach to their assets at risk, Criticality/severity of the threat, and extent of exposure of systems to identified threats. Using these factors, one can assess risk and likelihood of occurrence as well as potential loss (in terms of monetary value) to an organization. Risk can be represented in the following formula:

Risk = Probability of losses * Value at Risk(asset at risk)

Risk = Likelihood of Occurrence * Value at Risk

Where asset at risk is of no value to an organization despite threat and likelihood of occurrence being high or significant, the risk remain zero/low/insignificant given that anything multiplied by zero or value tending to zero is zero/insignificant. To successfully conduct risk assessment, gathering the required level of information about assets in scope of such assessment is imperative to determining what exposure an organization is facing. As such, the assessment team could adopt the following methods/steps in gathering required information.

Interview stakeholders, management, process/business/data owners, users and other employees in scope of such assessment
Analyze relevant systems and infrastructures
Perform vulnerability assessment and penetration testing (VAPT)
Review relevant documentations such as policies, procedures, previous audit/assessment reports, external audit or regulatory assurance reports, etc.

To perform risk assessment,the following steps can be adopted:

Identify vulnerabilities inherent in the system and threats that could exploit those vulnerabilities.
Identify threat agents or threat actors (i.e. individuals, groups or agents that could exploit vulnerabilities within a system).
Identify valuable assets across the organization that could be exploited by threats in which monetary values could be lost. for example, servers, network equipment, applications, confidential information, transaction data, documents.
Identify potential impact to the organization in the event that identified vulnerabilities are exploited. such impact could be data loss, reputational damage, litigation, financial loss, unauthorized access, regulatory sanction, etc.
Estimate likelihood of occurrence of identified risks/threats/vulnerabilities. For example, system failure, malicious attacks, natural disasters.

Having established the right foundations for risk assessment above, it is important for information assurance practitioners (IT Risk Manager, Information Systems Auditor, Information/Cyber Security Analysts, Information Systems Control Analysts, among others) to have the required skill sets to effectively carry out such assessment exercise. Hence the reason we developed the under-listed risk assessment checklists/program to assist practitioners be on top of their assurance activities.

To fill the identified skill gaps in the industry, we are providing IT Assurance practitioners with robust, in-depth risk assessment checklist/templates that will help them understand or be aware of some of the critical risks/vulnerabilities inherent in their operating environment and threats that could exploit those vulnerabilities for effective dimensioning of risk and conducting of risk based audits and information security assessment programs. Being aware of challenges faced by IT assurance practitioners in the areas of skill gaps and identification of their audit universe, we came up with this IT infrastructure risk assessment checklists that capture general vulnerabilities/risk peculiar with widely deployed IT infrastructures and supporting processes to guide professionals in proper scoping of their risk assessment and to be alive to their responsibilities.

To access the highlighted risk assessment checklists below, you can subscribe to our membership package, which gives you access to download the risk assessment checklists/programs including other contents only available to members.

The risk assessment checklists/programs will guide users in performing in-depth risk assessment of their information systems and IT infrastructure, establish a risk-based assessment of their information security/cybersecurity program. The checklists can easily be integrated into templates of popular audit management software such as Teammates, Pentana Audit (previous MKinsight), AutoAudit (Refinitiv), RSA Archer as our team can provide you excel template for easy upload into the audit software. Below are the three membership packages.

Silver Class: $50 subscription fee for 3 months membership

3 Months Subscription(Silver)

Gold Class: $75 subscription fee for 6 months membership

6 Months Subscription(Gold)

Platinum Class: $120 subscription fee for 12 months membership (Premium)

12 Months Subscription(Platinum)

Note: Each class of membership subscription plan gives you access to the listed risk assessment checklists/programs. However, Platinum/VIP subscription gives you FULL access to risk assessment templates listed below in addition to other member-only content on our website IT audit programs, checklists and best practice guides. Gold subscription plan give you access to the risk assessment checklists/programs in addition to some member-only content on our website. Silver membership subscription plan only gives you access to some of the available risk assessment checklists/programs listed below. By purchasing any of our paid services (subscription based access, single document purchase or reseller rights) or accessing any other materials/documents freely available on this website, you commit that you have read and understood our Terms and Conditions of Service and expressly agree to the provisions of the terms and conditions stated therein.

Below are the available risk assessment checklists/programs

Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Leading Practices in Internal Audit Function

How IT Create Value for Business: COBIT 5 Series

Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More

How to Audit Fintech & Payment Applications

Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More

ATM Network Security Best Practices

Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More

Automating the Audit Process

Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More

Top IT Jobs of the Future

The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More

New CBN Regulation on USSD Transaction

The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More

COBIT 5: IT Governance & Management Question Series

The series attempted to answer most of the governance and management questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5 Enterprise GoalsLearn More