Business reliance on technology and the associated risks are reshaping how we audit and what we assess. Attempting to scope an operational audit without drilling into business technology is nearly impossible in today’s business landscape. In turn, conducting an IT audit without factoring business processes delivers limited assurance to the board of directors, and value to the enterprise. Every internal auditor today must have a general understanding of technology and the vulnerabilities, threats and risks that face our enterprises each day to effectively plan and execute any audit engagement. We will explore critical aspects of the IT environment including the importance of data governance and data management, the Scenario-based Risk Assessment process commonly used by IT Risk Managers and will walk through many of the most common technologies and associated vulnerability, threats, risks and controls using common business language and using common applications as our examples. We will have several discussions examining various documents to allow attendees to apply the knowledge learned during the session. By the end of this session attendees will have a better understanding on how to plan, scope and conduct an IT General Controls audit.