https://www.crowdstrike.com/cybersecurity-101/observability/log-management/

Data analytics testing allows an IS auditor to analyze large volumes of incident response data, such as logs, historical incidents, and response times, to identify trends, patterns, and anomalies.
This approach provides a more comprehensive and objective view of the organization's incident response maturity compared to other methodologies. Data analytics can reveal areas where incident response processes are working effectively or where gaps and inefficiencies exist.
While judgmental sampling or compliance testing may provide insights, they rely more on subjective evaluations or specific criteria rather than a broad data-driven approach. Variable sampling is more relevant in financial or quantitative audits rather than cybersecurity incident response. Thus, data analytics testing offers a more reliable, data-backed assessment.

The most important factor for an IS auditor to determine when reviewing the design and implementation of controls is whether there is a proper balance between the magnitude of the risk and the control measures implemented. Effective risk management involves aligning the level of control with the potential impact of the risk, ensuring that resources are appropriately allocated to mitigate significant risks without overburdening the organization with unnecessary controls.

Conducting periodic software scanning is the best way to detect unauthorized copies of licensed software. It allows for regular identification of unlicensed or unauthorized software installations on systems, ensuring compliance and helping to avoid legal and security risks.