The audit procedure illustrated here should guarantee consistent, high quality IS audits and the ability to compare the results of audits. In all steps, the audit procedure is to be documented by the IS audit team in an orderly and understandable manner. All working documents created to perform an IS audit for a Federal Agency are to be classified as ”VS – Nur für den Dienstgebrauch” (RESTRICTED). The individual classification is with the office head and the affected assistant advisors, and possibly in co-operation with the Data Protection Officer. The management of the organisation to be examined initiates the IS audit procedure.
