Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Clifton Gunderson IT Oversight
Similar to Clifton Gunderson IT Oversight (20)
Clifton Gunderson IT Oversight
- 1. IT Oversight: Six Management Strategies for Construction Companies A CFMA KnowledgeNOW Webinar September 29, 2010 1
- 2. Copyright notice This presentation and all associated materials are copyrighted by CFMA & Clifton Gunderson LLP, and may not be altered, adapted, reproduced, or redistributed in any manner without express written permission from CFMA’s Director of Educational Services & Clifton Gunderson LLP. Unauthorized use of any CFMA copyrighted materials is expressly forbidden by law. 2 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 3. This KnowledgeNOW Webinar was produced for CFMA by… And is sponsored by… 3 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 4. Where IT fits in the organizational chart The role of IT in strategic planning and decision-making Developing an integrated IT group Security challenges and solutions The role of IT in internal controls Internal versus outsourced IT resources Discussion Topics 4 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 5. Today's Presenters: Rodney Almaraz, Senior Manager Clifton Gunderson, Austin, Texas Jeff Lemmermann, Practice Manager Clifton Gunderson, Milwaukee, Wisconsin 5 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 7. Harnessing the power of the IT group
- 8. Outlining the role of IT in the business
- 9. IT governance concepts 6 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 11. Budget Overruns
- 12. Delivered Late
- 13. Death March Projects7 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 15. Position IT as a strategic & competitive necessity
- 16. Make sure that IT plans, actions, and capabilities are clearly linked8 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 18. Definition
- 19. What are we governing?9 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 20. 10 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 22. Alignment of the goals of the business with the goals of IT
- 23. Involvement of the IT Group in the Strategic Vision11 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 25. Six ObjectivesAlignment of organizational and IT strategies Realization of IT project and operations value Realization of IT-related opportunities 12 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 27. Six Objectives4. Effective management and responsible use of IT resources 5. Effective management of IT-related business risks 6. Compliance with applicable laws, regulations and corporate standards 13 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 29. CIO’s want greater role
- 30. Classification of project types
- 31. Minimize maintenance budget14 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 33. Involvement of users in the goal setting process15 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 35. Working with the Business
- 36. Southwest Example
- 37. Campbell Soup Example16 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 38. IT Oversight 17 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 39. IT Oversight 18 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 41. Assess stakeholder importance and influence
- 42. Determine stakeholder interest and motivation19 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 43. IT Oversight Conflicting Mutual Allies - use as a power base Blockers - isolate & negotiate Resources IT’s Action Source’s of IT’s Needs Degree of interdependence with IT process Political Support Network members - build strong political network Slowers - negotiate Conflicting Mutual Degree of common interest with IT 20 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 45. Understanding the security implications of proper oversight
- 46. Safeguarding the “keys to the kingdom”
- 47. Controls over administrator accounts21 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 51. Case Study - Terry Childs22 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 52. IT Oversight Terry Childs San Francisco - super administrator 23 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 54. Properly approving Administrator access24 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 56. Application owners approve users
- 57. Reporting outside of IT25 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 58. IT Oversight 26 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 59. Survey Poll There are six objectives that aim to align the goals of the business with the goals of IT, these goals do not include: 27 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 60. Speaker Transition Financial auditors will refer to this at least five times every year during fieldwork. What is “Segregation of Duties”? 28 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 62. Rights to network resources29 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 64. Data owners need to be involved
- 65. New hire events & terminations
- 68. User directories
- 70. Raw data file access30 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 71. Requires internal enforcement and auditing procedures: Internal enforcement Separation of network and application management Annual user audit procedures Participation of department heads (data owners) IT department overdependence Rights Management 31 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 74. Tracking & ReportingCompensating Controls 32 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 75. Survey Poll The management and auditing of rights to the network and applications should: 33 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 78. Proper approval & assignment process.
- 79. Testing methodology and documentation.
- 80. Separation of development and production systems.
- 81. Project approval and close process.
- 82. REPORTING & REVIEW OF CONTROLS35 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 83. Survey Poll Which statement is most accurate about companies that should implement change controls? 36 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 84. Internal IT Personnel vs. Outsourced IT Resources Key differences in managing security. 37 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 86. Who has skill set to monitor?38 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 88. Google Searches
- 90. Special Procedures for Outsourced Resources
- 91. Confidentiality agreements regarding data
- 92. Reputation checks for specific consultants39 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 93. The Review Process Internal IT Outsourced IT Periodic employment review Parallels the company’s normal review process The Technical Review Technical performance reflected in project success Are projects getting done? Overall Review Is communication occurring? Is member contributing to success of the organization? Periodic performance review Departments with most interaction – can change Communication Component Are channels open? Project Completion Score Are projects being completed? Are they paying off as expected? 40 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 94. Reporting on Activities Key Sources of Information System Logs Resource Access Reports Report Consolidation Utilities Security Monitoring Applications 41 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 97. Deadlines are essential in the process
- 98. Standardized form often most useful:
- 99. Current project progress report
- 100. Upcoming deadlines, points of concern, resources needed
- 101. Priority listing of upcoming projects
- 102. Key points of contacts for projects 43 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 103. Reporting on Activities Communication will always be the key to successful IT oversight. 44 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 104. Contact Information: Rodney Almaraz, Senior Manager Clifton Gunderson, Austin, Texas Jeff Lemmermann, Practice Manager Clifton Gunderson, Milwaukee, Wisconsin 45 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 105. CPEs In order to receive your CPE credit for this session, you must complete the electronic evaluation survey on prolibraries.com. To complete this evaluation, stay logged into prolibraries and click on "My Webinars" under "Your Account" on the left hand side of the page. You will see the session title and this link: "Take CPE Evaluation.“ Click on the CPE Evaluation link to complete the evaluation and print your certificate. You may print your certificate from CFMA's Online Library at any time after you complete the evaluation survey. 46 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 106. CFMAwould like to thank our Producer… and our Sponsor… 47 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
- 107. Thank you for joining us today!Don’t forget to Save the Date for October 13, 2010 as the CFMA’s webinar series continues with a critical update on the FASB Revenue Recognition Proposal for the Construction Industry with FASB representative Ken Bement 48 © 2010 Clifton Gunderson LLP & CFMA. All rights reserved.
Editor's Notes
- There are six objectives that aim to align the goals of the business with the goals of IT, these goals do not include:Alignment of organizational and IT strategiesEffective management and responsible use of IT resourcesRealization of non-IT related opportunities
- Those of you that have been through a financial audit know the topic well.The IT function has its own segregation needs, but can also help with duty segregation in other non-IT areas.
- Rights management is what enforces segregation of duties within information systems.Accounting system what good are user credentials unless different users have different rights?
- Often turned over to the IT group between HR & ITData owners need to take responsibility IT doesn’t know what department heads doNetwork: Can circumvent application rights interface export locations!Applications: Control and reporting of those who can create users. - change parameters should mirror those of the network.
- Problem with having the same person handle both: they could circumvent other segregation of duty controls.Controls should also include documentation between HR, IT & App management groups: forms, email, other tracking mechanismsAnnual audit cannot be an IT Only exercise.
- Compensating controls: Requires appropriate use of the mentioned items. If approvals can be overridden through loose rights assignments, then there is no value.Reporting: Only useful if reports are reviewed: system logs, 3rd party applications.Approval & override reporting.
- The management and auditing of rights to the network and applications shouldBe handled solely by the IT groupInvolve the data owners and those responsible for implementing the systemsMainly focus on application security which overrides network security
- Software applications: same basic intentions of controlling O/S updates. Additional concerns over interfaces with other applications or modifications to basic application.Reporting Systems: Controls and approvals over changes to customized reports – as essential as application changes. Could hide transactions, account groups, etc.
- Also referred to within a system development lifecycle.Formalization is key!Reporting – requestor is same as developer – changes outside of production system.Changes at same time of period by same developer.
- Which statement is most accurate about companies that should implement change controls?Only companies that have internally developed applications need change controlsChanges to reporting tools are not normally part of the change control processChange controls should cover system update procedures
- Internal: Monitoring and understanding of system plans and changes (same for both). Supervisory roles!Physical access to servers, backup media, laptops data or equipment theftCan be influenced by other departments knowingly or unknowingly part of fraudOutsourced: Remote access control (OFF UNLESS REQUESTED!) Access logging reports.Communication is harder – not part of culture, planning meetings, etc. Details on activities not always expressed or understood by organization. Little dialog with data owners to help meet system needs.Consultant storage of credentials, sharing with other consultants, changes in consultant organization (fired employees) could lead to security problems.
- These will potentially be people with access to all of the organization’s IT assets – treated like those in finance or HR. Criminal background checks are a necessity.Credit checks not enough.State court system check not always enough – work in other states.Google searches – message board postings, news stories, etc.Social media content – twitter posts, blogs, facebook wall items, etc. 3rd Party Hiring Procedures part of vendor selection - What are the procedures for consultantsDue diligence on consultants assigned to the account.
- At the backend of the hiring process is the review process.Equally important for Internal and Outsourced IT Resources.For the internal IT group – who handles the Technical review? The review doesn’t need to be highly technical – are projects getting done? Are the department heads satisfied with the project?
- You don’t have to understand the systems to understand the log information.The key is information that is easy to access and easy to understand.
- Remote access sessions – could indicate an attempt to hide activities. Look for patterns – always before and after reporting events.Failed login attempts – trying to break other user credentialsChanges to system level rights – temporarily granting access to items
- Standardized form to help track from period to period. Helps to divide up the review process – open communication channels with managers.
- Communication at all levels – distributed to managers.One group/person in control, but input and help from department heads is key to getting true integration.