Which option correctly identifies the focus of IT auditing?

• A. Organizational units
• B. Financial processes
• C. IT processes
• D. Security policies

Answer: (C)

IT auditing focuses on IT processes—the actual steps and controls that plan, develop, deliver, operate, and govern IT services. The emphasis is on how activities are carried out, not just on the people or the policies, to ensure information systems are reliable, secure, and aligned with business goals. This includes evaluating how changes are requested and approved, how configurations are managed, how user access is granted and revoked, how incidents are detected and resolved, and how data backups and disaster recovery are tested and performed. By examining these processes, the auditor can verify that the right controls exist, are followed consistently, and effectively mitigate risk.

Organizational units relate to structure and roles rather than the actual processes in operation. Financial processes pertain to monetary activities and accounting, which may intersect with IT control but are not the primary focus of IT auditing. Security policies provide rules and expectations, but the audit assesses whether those policies are actually implemented and followed within the IT processes.