The IIA Announces New IT Audit Guide on Identity and Access Management

The IIA has released the new Global Technology Audit Guide (GTAG®) 9 on Identity and Access Management (IAM).

The mission of GTAG 9 is to provide insight into what IAM means to an organization and to recommend internal audit areas for investigation. It can assist CAEs and other internal auditors in understanding, analyzing, and monitoring their organization's IAM processes.

The IAM process is used to initiate, capture, record, and manage the user identities and related access permissions to an organization's proprietary information. Poor or loosely controlled IAM processes may lead to organizational regulatory noncompliance and an inability to determine whether company data is being misused.

Chief audit executives (CAEs) should be involved in development of the organization's IAM strategy, as well as evaluating the implementation of the strategy and effectiveness of companywide access controls.

A checklist for IAM review is also included in this guide. Download GTAG 9 and other free guidance by visiting: http://www.theiia.org/go?to=eblast_2007_11_28_GTAG9