baa ais it controls

8/16/2019 Baa Ais It Controls

1/31

BAA-Audit & Information Systemsy

Winston Phethi


2/31

Introduction What are IT Controls? General Controls

Application Controls Why are IT Controls Important? Who is responsible for IT

Controls? Where are IT Controls Applied?


3/31

―IT controls are fundamental to the reliability and

integrity

of the information processed bythe automated systems on which mostorganizations are dependent for their business

and financial transaction processing — andoverlooking or minimizing their importancecreates a

significant

risk .‖

- CICA Information Technology Advisory Committee (2004)


4/31

Controls over computer-based systems arebroken down into two major categories – general and application controls.

General controls apply to all systemscomponents, processes, and data for a givenorganization or systems environment

pplication controls(a.k.a. business process

controls) pertain to the scope of individualbusiness processes or application systems


5/31

Controls may beclassified to helpunderstand their

purposes and wherethey fit into theoverall system ofinternal controls.


6/31

By definition, General Computer Controls arecontrol activities performed within the ITorganization or the technology that theysupport that can be applied to every system

that the organization relies upon; They are designed to encompass an

organization’s IT infrastructure rather thanspecific applications. General controls help

ensure confidentiality, integrity, andavailability; contribute to safeguarding ofdata; and promote regulatory compliance.


7/31

Purchasing Accounts Payable

Inventory Payroll

IT systems support many of the businessprocesses, i.e. in accounting departmentsuch as these below…


8/31

… AND Without effective General Controls, reliance onthese IT systems may not be possible


9/31

If general controls are ineffective, there maybe potential for material misstatement ineach computer-based accounting application.


10/31

Include: Organization Controls Policies and Procedures Segregation of Duties

Access Controls Physical Security

Logical Access

Change Management Controls

Business Continuity Controls

Disaster RecoveryFault Tolerant SystemsBackup


11/31

A clear, concise, and well-written set ofinformation technology policies, procedures,and control documentation is a strategic link

between the university’s vision and its day-to-day operations. These documents are critical to the university

because they provide guidelines forfaculty/staff/students and enable the smooth

functioning of the computer operationsfunction without constant managementintervention.


12/31

The functions of initiating, authorizing, inputting, processing,and checking data should be separated to ensure no individualcan both create an error, omission, or other irregularity andauthorize it and/or obscure the evidence.

Controls are provided by granting access privileges only in

accordance with job requirements for processing functions andaccessing sensitive information.

Inadequate segregation of duties increases the risk of errorsbeing made and remaining undetected; it also may lead to fraudand the adoption of inappropriate working practices.

Sarbanes-Oxley provided a compelling case for the

implementation and maintenance of appropriate segregation ofduties at the organizational, manual process and system level.


13/31

What is Physical Security? Examples:

Measures used to protect itsfacilities, resources, orproprietary data stored on

physical media.

Facility monitoring (surveillancesystems, cameras, guards,exterior lighting)

Access controls to facilities/data

center/computers (access cards) Alarm systems (fire, burglar,water, humidity, powerfluctuations)

Shred sensitive documents Proper storage/disposal of hard

drives and other electronicstorage media

Secure storage of back-upcopies of data and master copiesof critical software


14/31

What is Logical Access? Examples:

Limit access to system andinformation to authorizedindividual

Passwords System authentication Logs of logon attempts Application-level firewalls Antivirus and anti-spyware

software should be installedand up to date

Intrusion detection systemswhich would identifysuspicious network activity

Encryption for sensitive data File shares should be

adequately restricted toappropriate users

Patches/system updatesshould be applied timely


15/31

Don't use passwords that are based onpersonal information that can be easilyaccessed or guessed.

Don't use words that can be found in anydictionary of any language.

Develop a mnemonic for rememberingcomplex passwords.

Use both lowercase and capital letters. Use a combination of letters, numbers,

and special characters. The longer the password, the tougher it is

to crack. Use at least 10 characters. Use different passwords on different

systems. Keep your passwords in a secure place,

out of plain sight Don’t share passwords on the phone, in

texts or by email.


16/31

Change Management Control Objectivesinclude: To manage the IT change process such that

introduction of errors and incidents related to

change are minimized. To ensure that standard methods and

procedures are used so that changes can beaddressed expediently and with the lowest

impact on service quality.


17/31

Change Management Controls could include:

Monitoring and logging of all changes

Steps to detect unauthorized changes

Confirmation of testing Authorization for moving changes to production

Tracking movement of hardware and other infrastructurecomponents

Periodic review of logs Back out plans

User training

Specific defined and followed procedures for emergencychanges


18/31


19/31

Definition A comprehensive approach to ensuring normal

operations despite interruptions.

Components

Disaster Recovery Fault Tolerant Systems

Backup and Recovery


20/31

A documentation of the procedures to ensure

that the organization continues to operate byproviding the ability to successfully recover

computer services in the event of a disaster. Must ensure that plans are comprehensive, up-

to-date, and approved by key organizational,management, and executive personnel.

Must test the plans regularly and document theresults.


21/31


22/31

The ability of a system to respond gracefullyto an unexpected hardware or softwarefailure.

There are many levels of fault tolerance, thelowest being the ability to continue operationin the event of a power failure. Many fault-tolerant computer systems mirror alloperations -- that is, every operation isperformed on two or more duplicate systems,so if one fails the other can take over.


23/31

Requirements should be defined for backupof critical data (type and frequency).

Procedures should be in place to periodicallyvalidate recovery process.


24/31

Include: Input controls

Processing controls

Output controls


25/31

Input Control objectives: All transactions are initially and completely

recorded

All transactions are completely and accuratelyentered into the system

All transactions are entered only once


26/31

Controls in this area may include: Pre-numbered documents

Control total reconciliation

Data validation Activity logging

Document scanning

Access authorization

Document cancellation


27/31

Processing control objectives: Approved transactions are accepted by the

system and processed

All rejected transactions are reported,corrected, and re-input

All accepted transactions are processed onlyonce

All transactions are accurately processed All transactions are completely processed


28/31

Controls over processing may include: Control totals Programmed balancing Segregation of duties Restricted access File labels Exception reports Error logs Reasonableness tests

Concurrent update control


29/31

Output control objectives: Assurance that the results of input and

processing are output

Output is available only to authorizedpersonnel

The most important output control is reviewof the data for reasonableness.


30/31

Output controls could include: Complete audit trail

Output distribution logs

Output reports


31/31

Global Technology Audit Guide – Information TechnologyControls. D. Richards, A. Oliphant, C. LeGrand

Five Questions to Ask About Information Technology Controlsand Security – Berry Dunn:http://consulting.berrydunn.com/content/five-questions-ask-

about-information-technology-controls-and-security Information Technology Audit –General Principals:

http://www.intosaiitaudit.org/india_generalprinciples.pdf

Auditor’s Guide to Information systems auditing – RichardCascarino

Information Technology General Control Considerations andImplications – Clifton Gunderson

IT For Non-IT Auditors – Matt Hicks UCOP
http://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://www.intosaiitaudit.org/india_generalprinciples.pdfhttp://www.intosaiitaudit.org/india_generalprinciples.pdfhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-securityhttp://consulting.berrydunn.com/content/five-questions-ask-about-information-technology-controls-and-security

baa ais it controls

Documents