Sarbanes-Oxley Act (SOX) 2002: Federal law that sets requirements for internal controls and financial reporting, particularly sections 302 and 404. Essential for IT audit procedures in publicly traded companies.
FISMA: Federal Information Security Management Act establishes information security standards for federal agencies and their contractors, requiring comprehensive IT security programs.
GLBA: Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices and protect sensitive data.
HIPAA: Health Insurance Portability and Accountability Act sets standards for protecting sensitive patient health information, including specific IT security requirements.
COBIT Framework: Control Objectives for Information and Related Technologies provides a comprehensive framework for IT governance and management.
NIST Guidelines: National Institute of Standards and Technology frameworks provide detailed security standards and guidelines for IT systems.
ISACA Standards: IT Audit and Assurance Standards providing guidance for IT audit professionals on planning, execution, and reporting.
State Privacy Laws: Various state-specific data privacy laws, such as CCPA in California, that may impact IT audit requirements and data handling procedures.
GDPR Compliance: European Union's General Data Protection Regulation requirements when handling data of EU residents, even for US-based operations.
AICPA Standards: American Institute of CPAs' Statements on Auditing Standards providing guidance on audit procedures and reporting.
PCAOB Standards: Public Company Accounting Oversight Board's standards for auditing public companies, including IT-related controls.
GAAS: Generally Accepted Auditing Standards providing fundamental principles and guidelines for conducting audits.
PCI DSS: Payment Card Industry Data Security Standard requirements for organizations handling credit card information.
FFIEC Guidelines: Federal Financial Institutions Examination Council guidelines for IT security in financial institutions.
SEC Requirements: Securities and Exchange Commission requirements for public companies, including IT controls and cybersecurity disclosures.
