Auditing with IT Control Frameworks (NIST, COBIT, HiTrust, ISOs)

Whether you’re a seasoned IT auditor, an internal audit manager, or part of a governance, risk, and compliance (GRC) team, this session is essential for anyone who wants to better understand the IT control framework landscape and make smarter decisions about implementation and evaluation.

Webinar Nov 20 2025, Thursday 01:00 PM EDT 60 Minutes Basic Level Code: GRC0000126

In an era of increasing regulatory scrutiny, digital transformation, and growing cybersecurity threats, IT governance has become more critical than ever. Organizations must have effective controls in place to manage risk, ensure compliance, and align IT strategy with business goals. But with so many IT control frameworks available, it can be overwhelming to determine which one is best suited for your organization's unique needs.

This webinar will demystify the landscape of IT control frameworks and help you make informed decisions. Through clear comparisons, expert insights, and practical guidance, we’ll explore the key elements of the most widely used frameworks and explain how they differ in scope, design, and application. You’ll walk away with a deeper understanding of each framework's strengths and limitations—and when it makes sense to apply one over another.

We begin by defining what an IT control framework is and why it's critical for establishing structure and accountability in IT operations. From there, we’ll dive into an in-depth comparison of several major frameworks, highlighting their objectives, focus areas, and use cases. Whether your organization is compliance-driven, risk-focused, or pursuing industry certification, this session will help clarify which frameworks align best with your goals.

Attendees will also learn about practical auditing approaches that can be applied regardless of which framework is selected. You’ll gain actionable tips for planning and executing audits that assess IT controls efficiently, while ensuring that your findings are aligned with both the framework and the organization’s risk profile.

  • Define the term “control framework”
  • Compare and contrast the most popular IT control frameworks
  • Discuss an audit approach for using any control framework

Internal Auditors, IT Auditors, Senior Internal Auditors, Internal Audit Managers, Internal Audit Directors

With over 20 IT control frameworks in circulation today, how can you be sure you’re choosing the one that best fits your organization's risk posture, strategic goals, and compliance obligations?

This webinar will help you cut through the confusion and focus on what really matters when selecting an IT control framework. Whether your organization needs a comprehensive risk-based approach like NIST, a governance-focused model like COBIT, or a certification-ready standard like ISO/IEC 27001, understanding the pros and cons of each framework is crucial to making an informed decision.

By attending this session, you’ll gain insight into how each framework operates, what kind of organizations typically use them, and how well they align with common audit objectives. You’ll also learn how to tailor your audit approach so that it works effectively with any framework, whether you’re performing an internal evaluation or preparing for external assessments.

This webinar is especially valuable for internal auditors, IT compliance professionals, GRC specialists, and IT managers who are involved in designing, assessing, or overseeing IT control environments. Even if your organization already uses a framework, understanding alternative approaches can help you enhance your current program or make the case for change.

Join us to gain clarity, reduce complexity, and make smarter decisions when it comes to IT governance. Your ability to navigate the framework landscape will not only strengthen your audits but also improve your organization’s control environment.

TOBY DEROCHE
TOBY DEROCHE
Toby is an experienced internal audit professional with over 20 years in internal audit, fraud examination, and technology consulting, currently working as Senior Manager in IT Control.

Toby DeRoche MBA, CIA, CCSA, CRMA, CISA, cAAP, CFE, SA Toby is an experienced internal audit professional with over 20 years in internal audit, fraud examination, and technology consulting, currently working as Senior Manager in IT Control. He is also an experienced speaker and writer, having delivered many whitepapers, blogs, and presentations on assurance topics with organizations such as The IIA, ISACA, and The ACFE. Toby is the author of the #1 Bestselling book Only Audit What Matters and Agile Audit: Transformation and Beyond. As the founder of Insight CPE, LLC, Toby is dedicated to advancing the profession by providing meaningful continuing education for assurance professionals.

  • Oct 27, Monday | 01:00 PM EDT | 75 Mins

Tattoos were always associated with sailors, marines, and bikers. Not today. Over the past few decades, there has been r...

  • Oct 27, Monday | 01:00 PM EDT | 60 Mins

This webinar is for you if you ever find yourself in a difficult emotional situation where a cool head is necessary. Th...

  • Oct 27, Monday | 08:12 PM EDT | 90 Mins

Nisi earum est dicta ab perspiciatis expedita sint. Sint voluptatem deserunt autem rerum quia possimus ea asperiores. Fa...

By