fisa

Fundamentals of Information Systems Auditing: 

Fundamentals of Information Systems Auditing Presented by Karl H. Heins, CPA, CMA, CISA University of California February 25-26, 2002

Introductions : 

Introductions Name Office Background in auditing Background in IT auditing What you would like to take away from course

Goals of This Session: 

Goals of This Session To understand basic IT processes To understand IT controls To understand how to approach IT auditing To know when to bring in an IT specialist

Course Topics: 

Course Topics Through lectures, discussions and exercises this course will cover: IT Audit, IT Control & IT Control Objectives Risk Assessment IT Audit standards Application Controls Transaction Life cycle Application Processes General Controls

Course Topics: 

Course Topics IT Policies Logical & Physical Security Software Acquisition, Development & Change Management Data Base Systems and Systems Software issues Business Contingency Planning Networks, Telecommunications & Networks Basics Systems Development. Computer Assisted Audit Techniques

Information Systems Auditing: 

Information Systems Auditing Objectives Management risks Components of internal control Scope General Application Roles of IT auditors

Role of Management Policies: 

Role of Management Policies Management direction Staff guidance Consistency of application Dynamic not static

COBIT Influences: 

COBIT Influences Framework & background Audit objectives Audit guidelines

COBIT Control Objectives: 

COBIT Control Objectives High level Planning & organization Acquisition & implementation Delivery & support Monitoring

Planning & Organization: 

Planning & Organization Define strategic IT plan Define information architecture Determine IT direction Define IT org and relationships Managing IT investment Communicate mgnt. direction Manage human resources Ensure external compliance Assess risks Manage projects Manage quality

Acquisition & Implementation: 

Acquisition & Implementation Identify solutions Acquire & maintain application software Acquire & maintain IT architecture Develop & maintain IT procedures Install & accredit systems Manage changes Define service levels Manage third-party services Manage performance and capacity Ensure continuous service

Delivery and Support: 

Delivery and Support Ensure systems security Identify & attribute costs Educate and train users Assist & advise IT customers Manage the configuration Manage problems & incidents Manage data Manage facilities

Monitoring: 

Monitoring Mange operations Monitor the processes Assess internal control adequacy Obtain independent assurance Provide the independent audit

Standards: 

Standards AICPA IIA ISACA International Government

Standard for Information Systems Auditing: 

Standard for Information Systems Auditing Audit charter Independence Professional ethics and standards Competence Planning Performance of audit work Reporting Follow-up activities

Statement on Auditing Standards: 

Statement on Auditing Standards #1 – Independence Attitude and appearance Organizational relationship #2 –Independence Involvement in systems development process #3 – Performance of work Evidence requirement #4 – Performance of work Due professional care

Statement on Auditing Standards (cont.): 

Statement on Auditing Standards (cont.) # 5 – Performance of work Risk assessment in audit planning # 6 – Performance of work Audit documentation #7 – Reporting Audit reports #8 – Performance of work Audit consideration for irregularities #9 – Performance of work Use of audit software tools

IS Policies: 

IS Policies IS-1, Computer Center Fiscal Operations IS-2, Guidelines for Data Requests to Campuses by Administrative Units of the Office of the President IS-3, Electronic Information Security IS-3 Implementing Guidelines Electronic Communications Policy IS-7, Guidelines for Maintenance of the University Payroll System IS-8, Guidelines for Campus and Office of the President Acquisitions Involving Computing IS-9, Electronic Data Interchange IS-9, Electronic Data Interchange IS-9, Attachment -- Trading Partner Agreement IS-10, Systems Development Standards

Application Controls Review: 

Application Controls Review Objective? Content? Who Benefits?

Applications Review Scope: 

Applications Review Scope Transactions Controls Environments User Operations Audit trails

Application Controls: 

Application Controls Transaction life cycle Data origination Data preparation Data entry Data transmission Data processing Data output

Application Transaction Life Cycle: 

Application Transaction Life Cycle Input Process Output Data Preparation Data Origination Transaction Processing Information Data Entry Data Storage

Application Controls: 

Application Controls Transaction origination Source document design and storage User procedures and manuals Special purpose forms Transaction ID codes Cross reference indices Alternate documents where applicable

Application Controls: 

Application Controls Transaction origination Authorization Separation of duties Written authorizations Signatures, stamps and other evidence of approval Automated authorization/suspense

Application Controls: 

Application Controls Transaction origination Input preparation Transaction numbering Batch serial numbering Balance batches to point of origin Logs Transmittal documents Turnaround documents

Application Controls: 

Application Controls Transaction origination Source document retention Retention dates on source documents Filing Security Disposal procedures

Application Controls: 

Application Controls Transaction origination Source document error handling Written procedures Logging Notification Verifying re-entered data Monitoring corrections

Application Controls: 

Application Controls Transaction entry – batch Transaction data validation Pre-programmed formats Key verification Editing and validation routines Transaction data cutoff

Application Controls: 

Application Controls Transaction entry – batch (cont…) Batch proof and balancing Processing schedules Turnaround documents Cancellation of source documents Logging Batch controls Batch header records

Application Controls: 

Application Controls Transaction entry – batch (cont…) Transaction entry error handling Pre-staging input edits Error messages Verifying re-entered data Monitoring corrections Adjusting control totals if records are removed or modified

Application Controls: 

Application Controls Transaction entry – online Terminals used for data entry Based on terminal identification Terminal location Based on number of times an application or transaction is invoked

Application Controls: 

Application Controls Transaction entry – online Security Passwords Restrictions based on unsuccessful entry Terminal time-outs Secure building wiring and wire closets Message identification Security table Network configuration polling table

Application Controls: 

Application Controls Transaction entry – online User identification/authentication Passwords Questions and answers Keys, cards and tokens Biometrics such as fingerprint, retina scan, voice

Application Controls: 

Application Controls Transaction entry – online Authorization to complete a transaction Terminal ID or location Application Transaction File Data element

Application Controls: 

Application Controls Transaction entry – online Message completeness All mandatory fields are complete

Application Controls: 

Application Controls Transaction entry – online Message integrity Hash totals and check digits Cycle redundancy checks (crc) totals Message sequence numbers Message acknowledgements

Application Controls: 

Application Controls Transaction entry - online Transaction data validation Interactive editing Management error monitoring Reconciliation

Application controls: 

Application controls Computer processing Control totals Defaults Anticipation Exception handling Operator instructions Balancing Destructive update

Application Controls: 

Application Controls Telecommunications Message integrity Logins (system, application and network) Message acknowledgements Sequencing Integrity checks Encryption

Application Controls: 

Application Controls Telecommunications Network availability Preparation against outages Communication Power Hardware Software

Application Controls: 

Application Controls Data storage and retrieval File handling Header labels Master file changes Dormant files Scanning dormant files Backup procedures/contingency planning Program change control Excessive activity Access control Restart procedures

Application Controls: 

Application Controls DBMS controls Administration Views System logging Rollback/roll forward capabilities

Application Controls: 

Application Controls Output processing Controlled documents Negotiable document controls Sequence number printing

Application Controls: 

Application Controls Output processing Reconciling Output to input JCL System output reports SMF audit trails Report distribution Handling procedures Copy control

Application Controls: 

Application Controls Output processing User review Headers & footers Output reconciliation Control totals Confirmations Api’s Exception processing activity Data in decision making

Application Controls: 

Application Controls Output processing Records retention Waste disposal Deletion of unused reports Record retention requirements

Application Controls: 

Application Controls Output processing Output error handling Aging open items Error logging by control groups Responsibility and accountability for error corrections Error notification Edit and verification of re-entered data

Application Controls: 

Application Controls Output processing Output review Departmental review Operator activity Exception processing analysis

Application Processes: 

Application Processes Key information User procedures Programs and interfaces Transactions Data files

Application Environments: 

Application Environments Applications in an integrated system Where is the application? Where is the data? Where are the transactions entered? Where are the exposures ?

Application Audit Trails: 

Application Audit Trails Method to track transactional data Persons initiation transactions Programs initiating transactions Result of the transactions All documented

Systems Development - IS10: 

Systems Development - IS10 Methodologies Traditional Prototyping Vendor Package Purchase Audit involvement? Participatory Independent

Systems Development - IS10: 

Systems Development - IS10 Roles and Responsibilities * Planning and Management * Project Proposal Request for Information System Definition Prototyping Requirements Definition Request for Proposal Feasibility Study Vendor Contract and Plan General design

Systems Development - cont.: 

Systems Development - cont. Detail Design Programming and Unit Testing System Testing * Implementation * Documentation Standards * Post Implementation Review * Data Retention * Privacy * Maintenance * * Apply to all development tracks

Today’s Development Environment: 

Today’s Development Environment Dynamic Need Technology Interactive Economic pressures Resource availability

Audit Service: 

Audit Service Expertise Selective participation Management representation Realistic independence Audit methodology and project

Review of General Controls: 

Review of General Controls Objective Content Who benefits Affect on audit planning

General Controls: 

General Controls Management Hardware Software System Support Database Networking Logical Security Operations Continuity Physical Security Systems development

General Controls - Management: 

General Controls - Management Organization Planning Training Security Resource management Facilities Operations

General Controls Hardware: 

General Controls Hardware Hardware Interaction Processors Mainframes Desktops Laptops Input devices Tape Cartridge Output devices

General Controls Software: 

General Controls Software Systems interactions Operating systems Applications Integrated systems Utilities

Software Functions: 

Software Functions Application Processing Data Processor Online Management Communications Transaction Control Access Control Operating System Function

Software Implementation and Maintenance: 

Software Implementation and Maintenance Compiling and linking Change management

Compiling and Linking: 

Compiling and Linking Source Compiler – Source list & error list Object Linker – Source list & error list Executable

Software Maintenance Change process: 

Software Maintenance Change process Management User Dissatisfaction Change Request Approval Programming Copy to test Coding Testing Approval Operations To production Approval

General Controls Program Integrity: 

General Controls Program Integrity Program integrity Testing Access Maintenance

General Controls System Support: 

General Controls System Support Primary objective Control environment Central vs. Decentralized Control requirements

General Controls Database: 

General Controls Database Defined Logical view Physical view Products How they work

PowerPoint Presentation: 

Information Network

General Controls - Networking: 

General Controls - Networking Basics of networking Topologies Protocols Components Internal Connectivity Performance

General Controls Network Configurations: 

General Controls Network Configurations Centralized Decentralized Distributed Client-Server

General Controls Networking: 

General Controls Networking Internet, intranet, extranet technologies Services External connectivity Objectives Protection steps Firewall configuration Website issues Distributed executables “Cookies”

General Controls Physical Security: 

General Controls Physical Security Physical protections Practices Facilities

General Controls Logical Security: 

General Controls Logical Security Policies – IS 3 Passwords Practices

General Controls Operations: 

General Controls Operations Data center operations Scheduling Media management Production environment

General Controls Programming: 

General Controls Programming System programming Critical functions Controlling functions Make the system programmer your friend Application programming Program maintenance Roles of the programmer

General Controls Continuity Planning: 

General Controls Continuity Planning Proper planning Scenarios Sufficient resources and commitment Human side Media management Inventory Processes Onsite and offsite verification

General Controls Continuity Planning: 

General Controls Continuity Planning Analysis of threats Analysis of processes Consideration of alternatives Selection and development of a plan Documentation to support the plan Test of the Plan

CAATs -- Computer Assisted Audit Techniques: 

CAATs -- Computer Assisted Audit Techniques Audit tools ACL Hummingbird Focus Traditional Non-traditional

Why use CAATs: 

Why use CAATs Electronic data Validate processing Audit requirement for testing

Usage of CAATs: 

Usage of CAATs Functional Real time data capture Data analysis Confirmation of data

CAATs techniques: 

CAATs techniques Program simulation Itf Embedded audit module