Steps Flashcards
The auditor’s ROLE is to
EVALUATE the design and operation of internal controls.
The 5 Steps in Verifying Compliance with External Regulations (General Process)
(1) IDENTIFY the external requirements with which the company is responsible for being in compliance.
(2) REVIEW the specific laws and regulations with which the organization must be compliant.
(3) DETERMINE whether the organization CONSIDERED these laws and regulations when policies and procedures were developed.
(4) DETERMINE whether identified policies and procedures ADHERE to external laws and requirements.
(5) DETERMINE whether the employees are adhering to specified policies and procedures or whether DISCREPENCIES exist.
it is so important for auditors to verify compliance by
developing a good audit plan
The goal of the audit function is
to present an independent and objective evaluation of the state of the internal controls with appropriate recommendations to mitigate any detected risks if applicable.
The audit department should report
to the audit committee.
The audit department should NOT report
to senior management directly.
because it might create an independence problem.
At the highest level, the audit FUNCTION requires
an audit charter to establish the IS audit function.
The charter defines
what responsibilities senior management is delegating.
The audit committee is responsible only to
senior management and the board of directors
The audit committee should report findings directly to
senior management and the board of directors
Long-term plans are considered
STRATEGIC.
Strategic planning looks at what effect management’s planned long-term changes
to the infrastructure will have on the security of the organization.
Short-term planning is referred to as .
tactical planning
Tactical planning looks at issues the organization currently faces,
such as what is to be audited during the current year
Understanding the company is
just the first step
Next, the auditor must develop a plan to
help determine what type of audits should be performed.
STEP BY STEP
1.2 Audit Planning Process
- Learn the business, review the mission statement, and understand its purpose and goals.
- Review documentation and evaluate existing policies, procedures, and guidelines.
- Identify threats, risks, and concerns.
- Carry out a risk analysis.
- Identify internal controls.
- Define audit objectives and scope of audit.
- Identify resources needed for the audit and assign appropriate personnel.
an auditor must know when
to perform a compliance test or a sub- stantive test, and must understand the differences between them.
Compliance tests are used to
verify conformity,
substantive tests verify
the integrity of a claim.
Standards are
agreed upon principles of protocol
standards detail mandatory requirements, whereas guidelines and procedures
offer guidance on how to maintain compliance.
Fourteen categories of standards exist:
S1—Audit Charter S2—Independence S3—Professional Ethics and Standards S4—Competence S5—Planning S6—Performance of Audit Work S7—Reporting S8—Follow-Up Activities S9—Irregularities and Illegal Acts S10—IT Governance 1 September 2005 S11—Use of Risk Assessment in Audit Planning S12—Audit Materiality S13—Using the Work of Other Experts S14—Audit Evidence
Thirty-five categories of guidelines exist (1-15):
G1—Using the Work of Other Auditors
G2—Audit Evidence Requirement
G3—Use of Computer-Assisted Audit Techniques (CAATs)
G4—Outsourcing of IS Activities to Other Organizations
G5—Audit Charter
G6—Materiality Concepts for Auditing Information Systems
G7—Due Professional Care
G8—Audit Documentation
G9—Audit Considerations for Irregularities
G10—Audit Sampling
G11—Effect of Pervasive IS Controls
G12—Organizational Relationship and Independence
G13—Use of Risk Assessment in Audit Planning
G14—Application Systems Review
G15—Planning Revised
Thirty-five categories of guidelines exist (16 - 29)
G16—Effect of Third Parties on an Organization’s IT Controls
G17—Effect of Nonaudit Role on the IS Auditor’s Independence
G18—IT Governance
G19—Irregularities and Illegal Acts
G20—Reporting
G21—Enterprise Resource Planning (ERP) Systems Review
G22—Business-to-Consumer (B2C) E-Commerce Review
G23—System Development Lifecycle (SDLC) Review
G24—Internet Banking
G25—Review of Virtual Private Networks
G26—Business Process Reengineering (BPR) Project Reviews
G27—Mobile Computing
G28—Computer Forensics
G29—Post-Implementation Review
Thirty-five categories of guidelines exist (30 -35)
. G30—Competence
. G31—Privacy
. G32—Business Continuity Plan (BCP) Review from IT Perspective
. G33—General Considerations on the Use of the Internet
. G34—Responsibility, Authority, and Accountability
. G35—Follow-Up Activities
Risk management follows a defined process that includes the following steps:
- Develop a risk management team
- Identify assets
- Identify threats
- Perform risk analysis
- Perform risk mitigation
- Monitor
STEP BY STEP
1.3 Risk-Based Audit Process
- Gather information and plan:
. Understand the business
. Review audits from prior years
. Examine financial data
. Evaluate regulatory statutes
. Conduct inherent risk assessments - Determine internal controls and review their functionality:
. Control environment and control procedures
. Detection and control risk assessment
. Total risks - Perform compliance tests—Test and verify that controls are being applied.
- Perform substantive testing—Measure the strength of the process and verify accounts.
- Conclude the audit—Prepare the report.
Best control
would be provided by having the production control group copy the source program to the production libraries and then compile the program.
Decision Support
will be enhanced by using a data warehouse and data marts.
Primary objective of value delivery is to:
optimize security investments in support of business objectives.
The MOST robust method for disposing of magnetic media
Destroying
Data warehousing
involves data cleaning, data integration, and data consolidations.
When drawing up a contract with a cloud service provider, the ideal practice is to remove the customer lock-in clause. It may be important for the client to secure ___________ of their system assets, i.e., the right to transfer from one vendor to another
portability
Fault
ST LOSS POWER
Spike
ST HIGH Volt
Sag
ST LOW Volt
Brownout
LT LOW
Volt Surge
LT HIGH Volt
Blackout
LT LOSS POWER
The GREATEST challenge of performing a quantitative risk analysis
Obtaining accurate figures on the frequency of specific threats
IDS
cannot detect attacks within encrypted traffic and it would be a concern if someone were misinformed and thought that the IDS could detect attacks in encrypted traffic.
Standard establishes mandatory
rules, specifications and metrics used to measure compliance against quality, value, etc. Standards are usually intended for compliance purposes and to provide assurance to others who interact with a process or outputs of a process.
The board of directors and executive officers are accountable for the functionality, reliability, and security within
IT Governance.
Web application attack facilitates unauthorized access to a database
SQLI
Regression testing is undertaken PRIMARILY to ensure that
applied changes have not introduced new errors.
Capacity monitoring
the primary objective is to ensure compliance with the internal SLA between the business and IT, helps in arriving at expected future capacity based on usage patterns, helps in initiating procurement based on the current usage and expected future capacity.
Cryptographic hash
is a primary defense against alteration attacks.
Variable sampling
would be the best sampling technique to review an organization’s balance sheet for material transactions. It is also known as dollar estimation.
Integrity of data
information are changed only in a specified and authorized manner
CSA
highlight noncompliance to the current policy
Batch control reconciliations
is a compensatory control for mitigating risk of inadequate segregation of duties
RFID
Any RFID signal you can read can be duplicated = Issues of privacy
Concurrency control
manages simultaneous access to a database. It prevents two users from editing the same record at the same time and also serializes transactions for backup and recovery.
The first criteria must be to ensure that there is no ______ in the procedures and that, from a security perspective, they meet the applicable standards and, therefore, comply with policy.
ambiguity
The information security manager
is responsible for developing a security strategy based on business objectives with help of business process owners.
Load balancing
best ensures uninterrupted system availability by distributing traffic across multiple servers. Load balancing helps ensure consistent response time for web applications
The IS Auditor’s main responsibility during the test of the plan is to act as _________ to the success of being able to resume timely business processing.
an observer
The IS Auditor’s observations
should be documented, analyzed with appropriate recommendations brought forth to management.
The level of effectiveness of employees will be determined by their existing knowledge and capabilities, in other words, their
proficiencies.
Reviewing the access control configuration would be the first task performed to determine whether security has been appropriately mapped in the system
(During a postimplementation)
Control Objectives for Information and Related Technology (CobiT) is a framework designed around four domains
. Plan and organize
. Acquire and implement
. Deliver and support
. Monitor and evaluate
As an auditor, you have a position of
fiduciary responsibility
Chain of Custody
One important issue that cannot be overlooked during a forensic audit is chain of custody. Chain of custody means that the auditor can account for who had access to the collected data, that access to the information is controlled, and that it is protected from tampering.
The audit program should be defined so that the scope audit objective and procedures are
properly defined to develop and support reliable conclusions and opinions
Procedures for testing and evaluation can include the following:
. Auditing through observation
. Reviewing documentation
. Documenting systems and processes by means of flowcharting
. Using standard audit software controls to examine log files and data records
. Using specialized software packages to examine system parameter files
An audit methodology
is a documented approach for performing the audit in a consistent and repeatable manner.
The audit methodology is designed to meet audit objectives by defining the following (3):
(1) A statement of work
(2) A statement of scope
(3) A statement of audit objectives
The methodology should be approved
by management
The methodology should be horoughly documented so that it
provides a highly repeatable process.
All audit employees must be trained and must have
knowledge of the methodology.
Using a structured and repeatable methodology fosters the establishment of boundaries and builds
confidence in the audit process.
step of the audit process
1.4 Audit Methodology
1. Audit subject—Identify which areas are to be audited
2. Audit objective—Define why the audit is occurring. As an example, the objective of the audit might be
to ensure that access to private information such as social security numbers is controlled.
3. Audit scope—Identify which specific functions or systems are to be examined.
4. Pre-audit planning—Identify what skills are needed for the audit, how many auditors are required, and what other resources are needed. Necessary policies or procedures should be identified, as should the plans of the audit. The plans should identify what controls will be verified and tested.
5. Data gathering—Identify interviewees, identify processes to be tested and verified, and obtain docu- ments such as policies, procedures, and standards. Develop procedures to test controls.
6. Evaluation of test results—These will be organization specific. The objective will be to review the results.
7. Communication with management—Document preliminary results and communicate to management.
8. Preparation of audit report—The audit report is the culmination of the audit process and might include
the identification of follow-up items.
Findings, activities, and tests should be documented in
work papers (WPs)
Confidentiality
Auditors are responsible for maintaining confidentiality of paper, electronic, and sensitive client information. Sensitive information should always be protected.
At what step in the audit process should specific functions to be examined be identified?
At the audit scope step is where specific functions to be examined should be identified.
At what step in the audit process do you identify follow-up review procedures?
Follow-up review procedures should be developed at the audit report preparation step.
At what step in the audit process do you identify the individuals to be interviewed?
(5) At the data gathering step, the individuals to be interviewed should be determined.
In fraud detection, auditors should perform the following:
. Observe employee activity
. Examine and review actual procedures and processes
. Verify employee security awareness training and knowledge
. Examine actual reporting relationships to verify segregation of duties
Common law defines four general elements that must be present for fraud to exist:
. A material false statement
. Knowledge that the statement was false
. Reliance on the false statement
. Resulting damages or losses
Auditors should not overlook any of the following fraud indicators:
. No clear lines of authority
. A lack of documents and records
. A lack of independent checks and balances
. Nonexistent or poor separation of duties
. Few internal controls
The audit opinion is part of the auditor’s report and should include the following components:
. Name of organization being audited . Title, date, and signature . Statement of audit objectives . Audit scope . Any limitations of scope . Audience . Standards used in the audit . A detail of the findings . Conclusions, reservations, and qualifications . Suggestions for corrective actions . Other significant events
Integrated auditing typically involves the following:
. Key controls must be identified.
. Key controls must be reviewed and understood.
. Key controls must be tested to verify that they are supported by the IT system.
. Management controls must be tested to verify that they operate correctly.
. Control risks, design problems, and weaknesses are delivered in the audit report.
six precondi- tions should be present before an organization can adopt continuous auditing:
. The system must have acceptable characteristics. Cost and items such as technical skill must be considered.
. The information system must be reliable, have existing primary controls, and collect data on the system.
. The information system must have a highly automated secondary control system.
. The auditor must be proficient in the system and information technology.
. The audit process must offer a reliable method for obtaining the audit procedure results.
. Verifiable controls of the audit reporting process must exist.
Continuous assurance can be achieved by combining the following:
. Continuous auditing—A methodology of providing assurance that enables auditors to provide written reports quickly.
. Continuous monitoring—Monitoring provided by tools, such as antivirus, used to meet fiduciary responsibilities.
The primary role of an auditor in IT governance is to
provide guidance and recommendations to senior management
The objective of providing IT governance information
is to improve quality and effectiveness.
The first step of IT governance process is to review the following:
. Learn the organization—Know the company’s goals and objectives. Start by review- ing the mission statement.
. Review the IT strategic plan—Strategic plans provide details for the next three to five years.
. Analyze organizational charts—Become familiar with the roles and responsibility of individuals within the company.
. Study job descriptions—Job descriptions detail the level of responsibility and accountability for employees’ actions.
. Evaluate existing policies and procedures—These documents detail the approved activities of employees.
The committee consists of members of high-level manage- ment from within the company:
. Business management—The committee is managed by the CEO or by a personally appointed and instructed representative.
. IT management—This group is represented by the CIO or a CIO representative.
. Legal—This group is represented by an executive from the legal department.
. Finance—A representative from finance is needed to provide financial guidance.
. Marketing—A representative from marketing should also be on the committee.
. Sales—A senior manager for sales should be on the committee to make sure that the organization has the technology needed to convert shoppers into buyers.
. Quality control—Quality control ensures that consumers view products and services favorably and that products meet required standards. As such, quality control should be represented on the committee.
. Research and development (R&D)—Because R&D focuses on developing new prod- ucts, this department should be represented on the committee. IT must meet the needs of new product development.
. Human resources (HR)—Managing employees is as complex as the technology need- ed to be successful. HR should be represented on the committee.
The balanced score card gathers input from the following four perspectives:
. The customer perspective—Includes the importance the company places on meeting customer needs. Even if financial indicators are good, poor customer ratings will even- tually lead to financial decline.
. Internal operations—Includes the metrics managers use to measure how well the organization is performing and how closely its products meet customer needs.
. Innovation and learning—Includes corporate culture and its attitudes toward learn- ing, growth, and training.
. Financial evaluation—Includes timely and accurate financial data. Typically focuses on profit and market share.
Federal law requires government agencies to set up
EA and a structure for its governance.
The FEA is designed to use five models:
. Performance reference model—A framework used to measure performance of major IT investments
. Business reference model—A framework used to provide an organized, hierarchical model for day-to-day business operations
. Service component reference model—A framework used to classify service compo- nents with respect to how they support business or performance objectives
. Technical reference model—A framework used to categorize the standards, specifica- tions, and technologies that support and enable the delivery of service components and capabilities
. Data reference model—A framework used to provide a standard means by which data may be described, categorized, and shared
The three most common funding practice include these:
. Shared cost—With this method, all departments of the organization share the cost. The advantage of this method is that it is relatively easy to implement and for account- ing to handle. Its disadvantage is that some departments might feel that they are paying for something they do not use.
. Chargeback—With this method, individual departments are directly charged for the services they use. This is a type of pay-as-you-go system. Proponents of this system believe that it shifts costs to the users of services. Those opposing the chargeback sys- tem believe that it is not that clear-cut. As an example, what if your city of 1,000 people decided to divide electrical bills evenly so that everyone pays? Many might complain, as not everyone uses the same amount of electricity. Opponents of the chargeback system make the same argument, as end users don’t consume IT resources evenly.
. Sponsor pays—With this method, project sponsors pay all costs. Therefore, if sales asks for a new system to be implemented, sales is responsible for paying the bills. Although this gives the sponsor more control over the project, it might lead to the feeling that some departments are getting a free ride and, thus, can cause conflicts.
Per ISACA, the following items should be examined:
. Human resources documents . Quality-assurance procedures . Process and operation manuals . Change-management documentation . IT forecasts and budgets . Security policies and procedures . Organizational charts and functional diagrams . Job details and descriptions . Steering committee reports
During the review process of policies, procedures, and documentation, any of the following might indicate potential problems:
. Excessive costs . Budget overruns . Late projects . A high number of aborted projects . Unsupported hardware changes or unauthorized purchases . Lack of documentation . Out-of-date documentation . Employees unaware of or unknowledgeable about documentation
Risks can be:
. Accepted—The risk is understood and has been evaluated. Management has decieded that the benefits outweigh the risk. As an example, the company might be considering setting up an e-commerce website. Although it is agreed that risks exist, the benefit of the added cash flow make these risks acceptable.
. Reduced—Installing a firewall is one method in which risk can be reduced.
. Transferred—The risk is transferred to a third party. As an example, insurance is
obtained.
. Rejected—Depending on the situation, any one of the preceding methods might be an acceptable way to handle risk. Risk rejection is not acceptable, as it means that the risk will be ignored on the hope that it will go away or not occur.
The assets commonly examined include:
. Hardware . Software
. Employees . Services
. Reputation
. Documentation
These considerations are key:
. What did the asset cost to acquire or create?
. What is the liability if the asset is compromised?
. What is the production cost if the asset is made unavailable?
. What is the value of the asset to competitors and foreign governments?
. How critical is the asset, and how would its loss affect the company?
These individuals or sources should be consulted or considered to help identify current and emerging threats:
. Business owners and senior managers . Legal counsel . HR representatives . IS auditors . Network administrators . Security administrators . Operations . Facility records . Government records and watchdog groups, such as CERT and Bugtraq
categorize the common types of threats:
. Physical threat/theft . Human error . Application error/buffer overflow . Equipment malfunction . Environmental hazards . Malicious software/covert channels
Examples of losses or impacts include the following:
. Financial loss
. Loss of reputation
. Danger or injury to staff, clients, or customers
. Loss of business opportunity
. Breach of confidence or violation of law
Risk analy- sis can be performed in one of two basic methods:
. Quantitative risk assessment—Deals with dollar amounts. It attempts to assign a cost (monetary value) to the elements of risk assessment and the assets and threats of a risk analysis.
. Qualitative risk assessment—Ranks threats by nondollar values and is based more on scenario, intuition, and experience.
Quantitative Risk Assessment involves six basic steps
- Determine the asset value (AV) for each information asset.
- Identify threats to the asset.
- Determine the exposure factor (EF) for each information asset in relation to each threat.
- Calculate the single loss expectancy (SLE).
- Calculate the annualized rate of occurrence (ARO).
- Calculate the annualized loss expectancy (ALE).
STEP BY STEP
2.1 Quantitative Risk Assessment
- Determine the exposure factor—This is a subjective potential percentage of loss to a specific asset if a specific threat is realized. This is usually in the form of a percentage, similar to how weather reports predict the likelihood of weather conditions.
- Calculate the single loss expectancy (SLE)—The SLE value is a dollar figure that represents the orga- nization’s loss from a single loss or the loss of this particular information asset. SLE is calculated as follows:
Single Loss Expectancy = Asset Value × Exposure Factor
Items to consider when calculating the SLE include the physical destruction or theft of assets, loss of data, theft of information, and threats that might delay processing. - Assign a value for the annualized rate of occurrence (ARO)—The ARO represents the estimated fre- quency at which a given threat is expected to occur. Simply stated, how many times is this expected to happen in one year?
- Assign a value for the annualized loss expectancy (ALE)—The ALE is an annual expected financial loss to an organization’s information asset because of a particular threat occurring within that same cal- endar year. ALE is calculated as follows:
Annualized Loss Expectancy (ALE) =
Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
The ALE is typically the value that senior management needs to assess to prioritize resources and deter-
mine what threats should receive the most attention. - Analyze the risk to the organization—The final step is to evaluate the data and decide to accept,
reduce, or transfer the risk.
The team should review these items for such costs:
. Lost productivity
. Cost of repair
. Value of the damaged equipment or lost data
. Cost to replace the equipment or reload the data
Other types of qualitative assessment techniques include these:
. The Delphi Technique—A group assessment process that allows individuals to con- tribute anonymous opinions.
. Facilitated Risk Assessment Process (FRAP)—A subjective process that obtains results by asking a series of questions. It places risks into one of 26 categories. FRAP is designed to be completed in a matter of hours, making it a quick process to perform.
Some basic common controls should be used dur- ing the hiring practice:
. Background checks . Educational checks . Reference checks . Confidentiality agreements . Noncompete agreements . Conflict-of-interest agreements
Per ISACA, the handbook should address the following issues:
. Security practices, policies, and procedures
. Employee package of benefits
. Paid holiday and vacation policy
. Work schedule and overtime policy
. Moonlighting and outside employment
. Employee evaluations
. Disaster response and emergency procedures
. Disciplinary action process for noncompliance
Common training methods include the following:
. In-house training . Classroom training . Vendor training . On-the-job training . Apprenticeship programs . Degree programs . Continuing education programs
IS services can be provided in these ways:
. Internally—Insourced
. Externally—Outsourced
. Combination—Hybrid
Third parties commonly provide these services:
. Data entry . Application/web hosting . Help desk . Payroll processing . Check processing . Credit card processing
The following steps are a generic overview of the change management process:
- Request a change.
- Approve the request.
- Document the proposed change.
- Test the proposed change.
- Implement the change.
The auditor should be knowledgeable in these areas:
. Hardware and software requisitioning . Software development . Information systems operations . Human resources management . Security
The ISO 9001 is actually six documents that specify the following:
. Control of documents . Control of records . Control of nonconforming product . Corrective action . Preventive action . Internal audits
ISO 17799 provides best-practice guidance on information security management and is divided into 12 main sections:
. Risk assessment and treatment . Security policy . Organization of information security . Asset management . Human resources security . Physical and environmental security . Communications and operations management . Access control . Information systems acquisition, development, and maintenance . Information security incident management . Business continuity management . Compliance
