What aspects does the information technology risk audit of commercial banks mainly include?

Including information technology governance, information technology risk management, information security management, information system development and test management, information technology operation and maintenance and business continuity.

The information technology risk audit of commercial banks is one of the important standards to judge whether the information system is really safe. Only by collecting, analyzing and evaluating security information through security audit, mastering the security state and formulating security policies can the system be adjusted to the state of "safest" and "lowest risk" to ensure the integrity, rationality and applicability of the whole security system. Security audit has become an indispensable key means of enterprise internal control and information system security risk control, and it is also an important means to deter and crack down on internal computer crimes.

According to the Guidelines on Information Technology Risk Management of Commercial Banks issued by CBRC, conduct a comprehensive audit of information technology and its risk management of commercial banks, including information technology governance, information technology risk management, information security management, information system development and test management, information technology operation and maintenance and business continuity.