The objectives of a computer network audit are to:

• identify and establish a set of expected standards for the management and security of every network connected to the backbone;
  
• examine the extent to which every network meets these standards;
  
• provide an overall review of the consistency, quality, and reliability of the network management processes; and
  
• identify opportunities for improvement.

As the auditor examines each network, he or she may ensure that a process exists to control software licenses and that the requirement to only install licensed software is communicated.

At the initial meeting for a network audit, the auditor will:

• Provide an outline of the scope of the audit project: What network functions will be included.
  • Administration
  • Security
    
• Request an inventory of LAN, and connected workstation, hardware and software:
  • Is LAN inventory management software in use?
  • Software licensing and support. What records are kept? What process is followed to manage licence's? What software is supported by the network manager and staff?
    
• Discuss the security of servers and workstations considering: physical & logical security, environmental controls, and the operating system controls necessary to ensure the integrity of the server and clients.
  • Number of servers and operating systems
  • Number of users per workstation and operating system
  • Is there a LAN/PC policy?
  • How access to the system, the server and the resources on the server (printers, files, directories, etc.) are controlled:
    • use of intruder detection, console and operators;
    • policy on passwords, access rights assignment, inactive accounts;
    • what data and applications are run on the network? Measures to guard against risks of confidentiality, unauthorized use, and access from both internal and external users.
      
• Discuss what virus protection measures are in place.
  
• Discuss LAN utilization and activity reporting: whether logs of system, downtime, accounting and audit (e.g., AUDITCON) have been activated and used; whether irregular activities and sniffing can be prevented and detected.
  
• Discuss backup and recovery procedures and whether data stored on the system can be restored in an orderly manner from the backup media.