What exactly the auditing team will or should check in my database.

Question

Dear all,
i am using oracle 10g database on windows server 2003 and oracle application server 10g on windows server 2003.
now an internal auditing team is going to audit my database.
i want to know what they will audit so that i do preparation for it.
thanks

Answer 1

i am using oracle 10g database on windows server 2003 and oracle application server 10g on windows server 2003.
now an internal auditing team is going to audit my database.
i want to know what they will audit so that i do preparation for it.
There is no way to know without knowing what type of 'audit' they are going to audit for.
1. access security? who has access to the physical hardware? how is that access managed (granted/revoked/documented)?
2. data security? who has access to the data in the database? how is that access managed? what levels of access are implemented?
3. financial? what controls are in place to monitor/log/track transactions that affect security has been implemented
The biggest step you can take to 'prepare' is to either find, or create, documentation about the system components.
ANYTHING that you tell them that isn't backed up by company approved and documented procedures is a security risk. No competent auditor is simply going to take anyone's word for an issue that is part of an audit.
The next step you can take is to be prepared to DEMONSTRATE that what you describe has, in fact, been implemented.
The third step during the actual audit is DON'T LIE! If you don't know an answer just say so. If a particular feature hasn't been implemented, or you know it has problems, just say so. Remember - anything you say can be EASILY verified if they choose to do so.
Get caught in a lie and you WILL pay the price, one way or the other.
There are reasons management has decided to audit your database. You may, or may not, know what those reasons are. If they are looking to dump you  they are going to dump you no matter how good the audit turns out. But if they are looking for problem areas that need to be corrected this is your opportunity to make them aware of those areas since that can be used to justify getting the money you need to address them.
Got no backup server? That risks losing valuable corporate data and causing problems for users. So document that there is no backup server and the risks involved. That gives you a chance to seek money for a backup server. And so on. Use the audit as an opportunity to make a sales pitch for needing new hardware, software and people to get the job done.