ICAI-1 (2)
-
Upload
harun-raaj-gupta -
Category
Documents
-
view
26 -
download
1
Transcript of ICAI-1 (2)
1
One day seminar on IS Audit – a Practical approach
and CAAT
on 17 July 2004, New Delhi
By
A.Rafeq, FCA, CISA, CQA, CFE, Bangalore
2
Learning Objectives
What is IS Audit? How to plan and perform IS Audit assignments using
technology as a key enabler for audit What are CAATs - digital audit techniques? What are salient features of Guidance note of ICAI
on CAAT? What are key features and functionality of audit
software? How to use concepts of CAAT - digital audit
techniques by using the auditee applications? How to enhance effectiveness of audit and provide
better assurance to clients?
3
Sessions
1. Practical approach to IS Audit 2. Step-by-Step approach to IS Audit
– case study3. How to use CAAT 4. CAAT – case study
4
1. Practical approach to IS Audit Concepts and practice of IS Audit Need and importance of IS Audit Model case study of how to plan
and perform various Information Systems Audit Assignments
How to market the services of IS Audit?
5
2. Step-by-Step approach to IS Audit – case study
Participants to plan and perform a sample IS Audit using the case study as a group
Model answer providing participants with practical tips on performing various types of IS Audits
6
3. How to use CAAT Overview of need/importance of
CAATs - digital audit techniques Guidance note on CAAT issued by
ICAI Tips on how to practical use CAAT
techniques
7
4. CAAT – case study Inter-active discussion on how to use
digital audit techniques for performing various types of audit tests
Audit software Demo - features and functionalities in audit software
How to use Audit Software for enhancing audit productivity
8
Digital Era
“Business is going to change more in the next ten years than it has in the last fifty”- Bill Gates in his book “Business @ the Speed of Thought – using a digital nervous system”.
2001-2010 as the digital decade
9
Need for IS Audit
Impact of IT IT Paradox Impact of IT on Controls Thrust on IT Governance Compliance requirements – RBI Management needs
10
‘If you think technology can solve your security problems, then you don’t
understand the problems and you don’t understand the technology’
Bruce Schneier
‘Secrets & Lies Digital security in a networked world’
11
Impact of IT on CAs Rapid deployment of IT by enterprises makes it imperative
that CAs have practical knowledge of using IT Not just excellence in Information Technology (IT) but
empowerment through IT Creating new challenges and opportunities Enhance utility as knowledge workers with core competency
and domain knowledge in the areas of accounting, finance, auditing, information systems and compliance
Key strategy for success is to keep on learning new ways of delivering our services and creating new avenues in the digital era
IT as a tool for drawing inferences and gathering relevant and reliable evidence as per requirements of their professional assignments
Need to be innovative in using IT and in advising our clients on IT
12
Impact of IT on Controls
Controls are getting automated Controls are becoming more complex,
requiring new knowledge and new decision models and an increased reliance on technologists
Paper is getting eliminated, increasing risk of fraud and requiring new audit approaches
Technology is performing tasks currently done by both white-collar and blue-collar workers
IT is key enabler of business
13
IT ParadoxIT Paradox
Desire forGreater Openness inSystems
Desirefor TighterSecurity
14
Need for IS AuditRisk and Governance Issues with ERP
Single point of failure Organizational Structural changes Job role changes Online,Real-time
– Synchronized processes Change management Managing distributed computing environments Broad system access Dependency on external sources for help Program Interfaces and data conversions Audit expertise
15
Corporate Governance impacting IT Governance
Organizations who wish to be successful in the digital era need to establish a corporate governance model that encompasses key aspects of IT governance, assurance and control.
IT governance is the system by which the IT is directed and controlled.
The objective of IT governance is to ensure that the IT activities meet overall business objectives and are in line with the business plans.
16
Internal audit’s evolving role
Traditional Progressive (best practices)
Audit focus Business focus
Transaction-based Process-based
Financial account focus
Customer focus
Compliance objective
Risk identification, process improvement objective
Policies and procedures focus
Risk management focus
Multiyear audit coverage
Continual-risk-reassessment coverage
Policy adherence Change facilitator
Budgeted cost center
Accountability for performance improvement results
Career auditors Opportunities for other management positions
Methodology: Focus on policies, Transactions and compliance
Methodology: Focus on goals, strategies and risk management processes
Traditional vs. Progressive Approach
17
Effect of IT on internal control
Lack of Transaction trails Segregation of functions
Uniform processing of transactions Potential for errors and irregularities Dependence of controls on computer
processing Potential for
Increased management supervision Use of computer-assisted audit techniques
18
Overview of IS Risks
Risk is defined as: “The potential that a given threat
will exploit vulnerabilities of an asset or group of assets to cause loss or damage to the assets”
19
Information Risks
Vast amounts of critical information can now be stored in very small electronic media and a minor glitch can result in loss of this information
Information is vulnerable to error, omission, abuse by persons, inside and outside the data processing network
20
Threats Damage can range from errors harming
database integrity to fires destroying entire computer centers
Losses can stem from Actions of supposedly trusted employees
defrauding a system Outside hackers
Careless data entry clerks Knowledge of threat environment helps
implementing cost-effective security measures
21
IS Security
Procedures and practices to assure that computer facilities are available at all required times
Data is processed completely and efficiently
Access to data in computer systems is restricted to authorised people
22
Why do you need Information Security
I believe that information security will become an even bigger problem as we move into the next century, especially as even the new smaller computers will be able to operate at blinding speed, making millions of computations in seconds
Akio Morito Co founder of Sony
23
IT Risks and Frauds
IT tends to confound auditors and managers to the extent that they are rarely in a position to detect or prevent computer based embezzlement -Harvard Business review
24
Vulnerability
A weakness that could be exploited to cause damage to the system
Why do you need Security?
25
Threat
Any event with the potential to cause harm to a system in the form of disclosure, modification, destruction or denial of service
Why do You need Security?
26
Error a/c no.88888 overlooked by auditors
- $ 80 million deficit built into a/c No internal controls in place to verify claim of
Leeson that he had made investment in above a/c on behalf of his client
Special password for computer access to above a/c.
Lack of segregation of duties Supervisors looked the other way
Barings Bank Bankruptcy
27
Confidentiality
The concept of how to prevent unauthorized release of information or unauthorized use of system
What is Security?
28
Integrity
The issue of how to preserve information to make them trustworthy, i.e. how to avoid the unauthorized modification of information
What is Security? (CIA)
29
Availability
The probability that a system is operational at any time or, in other words, the percentage of up-time
What is Security?
30
Auditable
Whether the system can be measured against an established criteria or benchmark
What is Security?
31
Reality of Security - RBI
Major Factors Of Security Violation Inadequate/incomplete system design Programming errors Weak/inadequate logical access
controls Poorly designed procedural controls Ineffective employee supervision Ineffective management controls
32
There are NO absolutely secure systems and there are NO absolutely reliable systems.
Increased security most often results in increased cost for the system.
The Reality of Security
33
There must be a trade-off between:
Cost for increasing system control and security
Vs.
Cost incurred as a result of successful security violations or system failures
The Reality of Security
34
Defining Scope and Objectives of IS Audit
What is IS Audit? IS Audit - Risk Perspective IS Audit - Control Perspective What is scope of IS Audit? What are Objectives of IS Audit?
35
What is IS Audit?
Any audit that encompasses: The review and evaluation of all aspects
(or any portion) Of
Automated information processing systems, including related non-automated processes
and The interfaces between them.
36
Objectives of IS Audit
Provide management with reasonable assurance that identified control objectives as relevant are being met by the package.
Where there are significant control weaknesses, to substantiate the resulting risks, and
Advise management on corrective actions Perspectives: Proactive or re-active Stage: Pre-implementation, during
implementation or post-implementation
37
IS Audit – Risk perspectiveIdentifying and assessing Risks
1. Risk management: Assess risks first and implement
appropriate controls Reduce risks to acceptable level
Assignments in this perspective: Security Management Information Risk Management Information Systems Risk Management Security Audit IT Audit, etc
38
IS Audit – Risk perspectiveIdentifying and assessing Risks
Assess the impact of IT failing to meet the business objectives on account of risks or issues impacting the following information criteria:
Effectiveness Efficiency Confidentiality Integrity Availability Compliance Reliability
39
IS Audit – Control perspectiveIdentifying and assessing controls
2. Controls: Review internal control system to ensure
whether business objectives are achieved Set appropriate control objectives
Assignments in this perspective: IS Audit IS Assurance Computer Assurance Services Technology Assurance Services IT Governance IS Controls Review, etc
40
IS Audit - Control Assessment
IS auditor is required to evaluate whether available controls are adequate and appropriate to mitigate the risks
If controls are inadequate or inappropriate Identify the control weakness Provide recommendation Report above to auditee management
41
Defining Controls and Control Objectives
CONTROL : “The Policies, Procedures, Practices and Organisational Structures, Designed to Provide Reasonable Assurance that Business Objectives will be Achieved and that Undesired Events will be Prevented or Detected and Corrected”
Business Orientation - the key of controls “Control is a Management issue not a IT issue”
IT CONTROL OBJECTIVE : “A Statement of the Desired Result or Purpose to be Achieved by Implementing Control Procedures in a Particular IT Activity”
42
1. Practical approach to IS Audit
Model case study of how to plan and perform various Information Systems Audit Assignments
43
Execution of IS Audit – step by step approach
IS Audit could encompass all aspects of operations of the auditee or it may be focussed on a particular area.
IS Audit could be done by internal auditors or external auditors.
IS Audit involves review (view again) and evaluation (against a benchmark or set standard) of any or all aspects of IT processing in the enterprise including the interfaces.
44
Case study of IS Audit
Step by step1. Identify Audit Objectives and Scope2. Understand IT environment3. Understand the business processes4. Understand the Organisation structure5. Understand the Information systems
and Control Architecture6. Identify related standards\guidelines7. Identify \ Select relevant IT process 8. Select Control Objectives (CO) 9. Extend CO by adding BP \ IT controls
45
Case study of IS Audit10. Identify relevant Risks for identified IT
process 11. Identify Management benchmarks12. Prepare Audit program, procedures and
checklist by integrating the information upto step 11
13. Perform the audit and identify control weaknesses
14. Prepare draft report 15. Discuss the report with auditee16. Prepare final report17. Presentation to senior management
46
Sample Scope of IS audit Assessing Risks and Controls related to
from the two perspectives: Environmental Access security or controls
review Physical Access security or controls review Logical Access security or controls review IS Operations security or controls review Application security or audit Implementation security or audit BCP assessment or BCP audit SDLC review or audit IT Strategy ….
47
Understand the IT environment
IT Resources Facilities Technology Applications Data PeopleWhat is the Information Architecture of
the enterprise?
48
IT Control SystemIT Control System
Communic.Network
influences
influences
Hardware
IT O
rgan
izat
ion
Business processes/IT businessprocesses
Applications/IT applications
Equipment/IT infrastructure
EA
DC
BB
ControllingOper. Sys.
Financialreporting
DataData
DataDataDataData
49
Identify related standards IS Audit Standards, Guidelines and IS
Governance standard issued by ISACA. ISA or SAP issued by ICAI\IFAC IS Guidelines issued by IFAC. Specific industry standards (for example,
banks, IT Companies) Technology standards as per technology
deployed. Compliance requirements as relevant. Industry related controls Specific business related controls or guidelines
50
What is COBIT® ? COBIT (Control Objectives for Information and Related
Technology) is a breakthrough Information Technology (IT) Governance tool that helps in understanding and managing the risks associated with Information and related Technology.
COBIT provides a globally accepted framework for reviewing diverse technology platforms across the enterprise.
It provides the best practices researched from a host of international standards on auditing and technology.
COBIT has been developed as a generally applicable and accepted standard for good IT security and control practices that provides a reference framework for management, users, and IS audit, control and security practitioners.
51
COBIT - Tool for IS Audit
Executive Summary - Overview for senior Management
Framework - Conceptual model linking control objectives to business objectives
Control Objectives - provide the landscape Audit Guidelines - provide the Compass Implementation Tool Set - how to get started
? Management Guidelines - provide the
Compass to Management for measuring performance and managing IT
52
53
Formulate audit strategy and control evaluation
Preliminary review of Audit area Obtain & record understanding of
audit area Evaluating audit area Compliance Testing (Test of Controls) Substantive Testing (Test of Details)
54
Prepare draft report
1. Issue (area of control weakness) Rank this based on information criteria as
relevant.
2. Implications (effect) Highlight the IT Resources impacted as relevant.
Critical Success Factors of relevant IT process
3. Cause: identify the probably cause4. Recommendations
Use the best practices as adapted for business requirement \ IT deployment of Auditee Company
5. Management Comment: Auditee to add details
55
Discuss draft report with auditee
Obtain confirmation of findings and their risk ranking
Remove incorrect findings based on confirmation of facts
Obtain agreement on causes and recommendations
Obtain agreed plan of action for implementing recommendations
56
Prepare final report
Outline for each finding: (area of control weakness or area of improvement:
Issue: Rank this based on information criteria
as relevantImplications (effect): Highlight IT Resources impacted as
relevant & CSF of relevant IT process of not met
Cause: Identify probable cause(s)
57
Prepare final report
Recommendation: Base on best practices and adapt it
as per specific business requirement \IT deployment of auditee company
Management Comment: (Obtain) Feedback from management and
identify issues of disagreement which need escalation
Implementation Time-frame
58
Presentation to senior management
Prepare executive summary for senior management – highlight key findings and recommendations
Prepare PPT slides for presentation Make presentation Present executive summary and detailed
audit report Conduct exit interview
59
How to market the services of IS Audit?
Know need and importance of IS Audit Assess the current competencies and skill-sets of your
audit Decide what type of services you intend to provide Update skill-sets as required Develop tie-ups with a panel of IT Consultants or domain
experts Prepare brief outline of services provided Formulate standard approach for each of audit stages and
prepare standard templates Identify your potential clients – existing or new Think long-term and begin with small assignments for your
existing clients
60
Why IS Audit Important?
Growing access to and use of IT Growing concern for data security due
to proliferation of IT Potential of computer fraud Complexity of systems and computers Protectors of information assets and
privacy Regulatory requirement Top priority of executive management
61
OPERATIONAL-LEVEL EMPLOYEES
MIDDLE-LEVELMANAGERS
TOP-LEVEL
MANAGERS
Incr
easi
ng a
bilit
y to
over
ride
cont
rols
mec
hani
sms
Strongest Control M
echanisms
Greatest frequencyof fraud
62
• Assess Current Skills and future career growth path• Extensive domain knowledge and functional
expertise in chosen area of expertise• Strong PC User skills• Operating Systems and Networking• Database and SQL skills (Microsoft Access)• Report writer skills (Crystal)• Web page development (FrontPage, HTML)• Internet and eCommerce• Project management skills
Career Advice: What Should I Know
63
Innovative Avenues in IT Consulting – Infrastructure, HW, SW, MIS,
Controls, Compliance.. Implementation – Infrastructure, HW, SW,
MIS, Controls, Compliance, Design and development – Infrastructure,
SW, MIS, Compliance, Training – SW, IT, MIS, Implementation,
Audit, Compliance, Controls, Assurance – Audit, security, applications,
data, processes, operations, controls, efficiency, effectiveness, compliance, reliability, quality,…..
64
IT RESOURCES
BUSINESS PROCESSES
EffectivenessEfficiencyConfidentialityIntegrityAvailabilityComplianceReliability
INFORMATION CRITERIA
INFORMATION -AUDIT FINDINGS
65
Thank you