Information Technology and Security can be a tricky topic for many Internal Auditors. For most of us, we know we don’t have the technical knowledge to audit this area, but want to ensure that it is appropriately addressed in our risk-based audit plan. That typically means hiring an external specialist.