This white paper delves into the challenges to maintaining independence and objectivity in IT audits and how ITAF can help address them. It explores various examples of IT security standards and frameworks, such as ISO 27000 and NIST, and discusses how an IT audit program based on the NIST Cybersecurity Framework can cover important sub-processes. An IT audit involves examining a company's IT systems, infrastructure, policies, and procedures. It is important to identify resources, define audit scope, and prepare requirements in order to conduct a successful audit. The main objectives of an IT audit are to ensure compliance with legal and regulatory requirements, as well as confidentiality, integrity, and availability. ISACA and SANS offer various programs and tools to assist in conducting IT audits with competence and confidence. These include information security policy templates and techniques for deploying a security audit policy in a network.