Domain 1 IA Operations - Sourcing The IA Function

Question 1

Sourcing IA Function - If decided to either partly or fully outsource IA function then the following should be in place…..

Answer 1

1) written charter, engagement letter or similar service agreement with outsourced vendor
2) Confidentiality requirements
3) Selection, renewal and retention of outsourced vendor must be based on competencies and competitive bidding
4) Audit committee received information on audit engagements from outsourced vendor
5) Contingency procedures for managing temporary or permanent disruptions
6) Outsourced vendor should maintain similar work standards expected of in-house function
7) Outsourced vendor should provide board, audit committee and snr mgt with accurate report on control environment and recommendations for improvement
8) Quality of audit work should be consistent with outsourcing org stds of work expected

Question 2

Sourcing IA Function - Scope of due diligence review can include a review of elements such as….

Answer 2

1) org strategic plans
2) proper due diligence in selecting 3rd party
3) written contracts or agreements outline rights and responsibilities of all parties
4) ongoing monitoring of 3rd party activities and performance levels
5) clear roles and responsibilities for overseeing and managing relationship and risk mgt process
6) Documentation and reporting that facilitate oversight, accountability, monitoring and risk mgt
7) Contingency plans for terminating 3rd party relationship

Question 3

Sourcing IA Function - Written contract and agreement for outsourced vendor should contain….

Answer 3

1) Procedures for changing terms and how audit scope can be expanded or reduced
2) Stipulate that the IA reports and work papers become the property of outsourcing org, if not, outsourcing org will have access
3) Record retention, data destruction plans and security breach notifications
4) Process for resolving problems and clarifying who bears cost of damages
5) Statement that 3rd party will not perform mgt functions, make mgt decisions or act as an employee or mgt
6) Statement requiring access to outsourced vendors audit reports, audit programs, audit work papers and audit related memos and correspondence
7) Statement requiring access to software escrow (source code escrow) for using the outsourced vendors proprietary sw.