Auditing information systems

Auditing
Information
Systems
First Year Staff Training
February 18, 2015
Kenya Allmond
kallmond@allmondcpa.com

Course Objectives:
• Understand why IT is important to a financial
statement audit
• Learn the FISCAM control categories
• Understand the basics of IS control testing

As computer technology has advanced, federal agencies and other
government entities have become dependent on computerized information
systems to carry out their operations and to process, maintain, and report
essential information. Virtually all federal operations are supported by
automated systems and electronic data, and agencies would find it difficult,
if not impossible, to carry out their missions and account for their
resources without these information assets.

What is an information system?
● Information system, an integrated set of components for collecting,
storing, and processing data and for providing information, knowledge,
and digital products. Information system, an integrated set of
components for collecting, storing, and processing data and for
providing information, knowledge, and digital products. – Britannica

Sample Information System
Purchasing
Payables
Inventory
General Ledger
Asset Management
eProcurement

Components of an information system
● Computer Hardware
● Computer Software
● Telecommunications
● Databases and Data Warehouses
● People and Processes
Information
Technology
Business Process

Sample Information Technology
●

Sample Business Process
● Purchasing
Enter a
Requisition
Approve a
Requisition
Create a
Contract
Generate
Purchase
Order
Approve the
PO
Dispatch the
PO
Receive
against PO
Put Away
the Items

Protecting an Information System

What is an information system audit?
● Examination of the management controls within an Information
technology (IT) infrastructure
● Information system audit and information technology audit are used
interchangeably.

Why audit information systems?
● Organizations employ IT systems in various ways, including using
discrete systems that support only particular business units or
complex, highly integrated systems that share data and support
all of an entity’s financial reporting, operations and compliance
objectives.
● An entity may use IT to initiate transactions, as well as to record,
process and report them.
● An organization’s procedures may have changed as a result of the
shift from using paper documents and records to using
automated procedures and records in electronic format.
● The internal controls in most IT systems are a combination of
both automated and manual. The manual controls may be
independent of the IT system, use information from it or only
monitor the system’s effective functioning.
AICPA Statement on Auditing Standards (SAS) No. 94, “The Effect
of Information Technology on the Auditor’s Consideration of
Internal Control in a Financial Statement Audit”

Risk of Ineffective Information System Controls
● Ineffective IS controls can result in significant risk to a
broad array of government operations and assets:
○ Resources, such as payments and collections, could be
lost or stolen.
○ Computer resources could be used for unauthorized
purposes, including the launching of attacks on others.
○ Sensitive information, such as taxpayer data, Social
Security records, medical records, other personally
identifiable information, and proprietary business
information, could be inappropriately added, deleted,
read, copied, disclosed, or modified for purposes such
as espionage, identity theft, or other types of crime.

Risk of Ineffective Information System Controls (cont’d)
○ Critical operations, such as those supporting national defense and
emergency services, could be disrupted.
○ Data could be modified or destroyed for purposes of fraud or
disruption.
○ Entity missions could be undermined by embarrassing incidents that
result in diminished confidence in an entity’s ability to conduct
operations and fulfill its responsibilities.

Relevant Laws and Regulations
● Federal Financial Management Improvement Act of 1996 (FFMIA)
● Federal Managers Financial Integrity Act of 1982 (FMFIA)
● Federal Information Security Modernization Act of 2014 (FISMA)
● Office of Management and Budget Circular A-130, Appendix III,
Management of Federal Information Resources Security of Federal
Automated Information Resources
● Office of Management and Budget Circular A-123, Management's
Responsibility for Internal Control
● Office of Management and Budget Circular A-127, Financial
Management Systems
● Federal Information Processing Standards (FIPS)
● NIST Special Publications
● Department of Defense Directives and Instructions

Relevant Guidance from NIST
● NIST SP 800-53, Security and Privacy Controls for Federal
Information Systems and Organizations
● NIST SP 800-53A, Assessing Security and Privacy Controls in
Federal Information Systems and Organizations: Building
Effective Assessment Plans
● NIST SP 800-50, Building an Information Technology
Security Awareness Program
● NIST SP 800-30, Guide for Conducting Risk Assessments
● NIST SP 800-14, Guide for Developing Security Plans for
Federal Information Systems
● NIST SP 800-47, Security Guide for Interconnecting
Information Technology Systems
● and more

Relevant Guidance from DoD
● DoD Directive 8500.01E, Information Assurance
● DoD Manual 8570.01-M, Information Assurance
Workforce Improvement Program
● DoD Directive 8000.1, Management of DoD
Information Resources
● DoD Instruction 8500.2, Information Assurance
Implementation
● DoD Instruction 8510.01, DoD Information
Assurance Certification and Accreditation Process
(DIACAP)
● and more
OBSOLETE

Audit Methodology
● General Accountability Office’s (GAO) Federal Information Systems
Controls Audit Manual (FISCAM)
○ Consistent with Federal Audit Manual (FAM)
● Divides controls into 2 types:
○ Information technology general controls (ITGC)
○ Application and business process controls

Phases
● Planning Phase
● Internal Control Phase
● Reporting Phase

Planning Phase
● Understand the overall audit objectives and related
scope of the information system controls audit
● Understand the entity’s operations and key business
processes.
● Obtain a general understanding of the structure of the
entity’s networks
● Identify key areas of audit interest
● Assess information system risk on a preliminary basis
● Identify critical control points
● Obtain a preliminary understanding of information
system controls

Planning Phase
● Perform Other Audit Planning Procedures
○ Relevant Laws and Regulations
○ Consideration of the Risk of Fraud
○ Previous Audits and Attestation Engagements
○ Audit Resources
○ Multiyear Testing Plans
○ Communication with Entity Management and Those
Charged with Governance
○ Service Organizations
○ Using the Work of Others
○ Audit Plan

Internal Control Phase
● Understand information systems relevant to the audit
objectives
● Determine which IS control techniques are relevant to the
audit objectives
● For each relevant IS control technique determine whether it
is suitably designed to achieve the critical activity and has
been implemented
● Perform tests to determine whether such control
techniques are operating effectively
● Identify potential weaknesses in IS controls and consider
compensating controls
● Perform testing of corrective actions taken to address
prior-year open recommendations.

Type of IT Controls
● Information Technology General Controls
○ Tested on Entity, Application, and System (Database and Operating
System) Levels.
● Application and Business Processing Controls
○ Tested at the Application Level.
○ Testing automated controls that enforce business process.
○ Includes interfaces to other applications.

Internal Controls: Test of Design and Implementation
● Interviews and walkthroughs.
● Examination of policies and procedures.
○ Are they adequate?
○ Are they approved by management?
● Determine if policies and procedures are implemented.

Internal Controls: Test of Operating Effectiveness
● Observation of controls
● Examination of configuration settings
● Examination of transaction logs or other system generated information.
● Sampling in line with FAM.

Reporting Phase
● Develop and deliver Notifications of Findings and Recommendations to
management as issues are identified and verified with management
and approved by the OIG.
● Report on results of IT testing as appropriate in the internal controls
report.
● Prepare management letter reports on the information systems'
general and application control environments.

Application and Business Process
Controls

Application & Business Process Controls
“The overall objectives of business process application
level controls are to provide reasonable assurance about
the completeness, accuracy, validity and confidentiality
of transactions and data during application processing.
Each specific business process control technique is
designed to achieve one or more of these objectives. The
effectiveness of business process controls depends on
whether all of these overall objectives are achieved.”
○ GAO FISCAM

Completeness (C) controls should provide reasonable assurance that all
transactions that occurred are input into the system, accepted for
processing, processed once and only once by the system, and properly
included in output. Completeness controls include the following key
elements:
● transactions are completely input,
● valid transactions are accepted by the system,
● duplicate postings are rejected by the system,
● rejected transactions are identified, corrected and re-processed; and
● all transactions accepted by the system are processed completely. The
most common completeness controls in applications are batch totals,
sequence checking, matching, duplicate checking, reconciliations,
control totals and exception reporting.

Accuracy (A) controls should provide reasonable assurance that
transactions are properly recorded, with the correct amount/data,
and on a timely basis (in the proper period); key data elements
input for transactions are accurate; and data elements are
processed accurately by applications that produce reliable results;
and output is accurate.
Accuracy control techniques include programmed edit checks (e.g.,
validations, reasonableness checks, dependency checks, existence
checks, format checks, mathematical accuracy, range checks, etc.),
batch totals and check digit verification.

Validity (V) controls should provide reasonable assurance (1) that all
recorded transactions actually occurred (are real), relate to the
organization, and were properly approved in accordance with
management’s authorization; and (2) that output contains only valid
data. A transaction is valid when it has been authorized (for
example, buying from a particular supplier) and when the master
data relating to that transaction is reliable (for example, the name,
bank account and other details on that supplier). Validity includes
the concept of authenticity. Examples of validity controls are
one-for-one checking and matching.

Confidentiality (CF) controls should provide reasonable assurance
that application data and reports and other output are protected
against unauthorized access. Examples of confidentiality controls
include restricted physical and logical access to sensitive business
process applications, data files, transactions, and output, and
adequate segregation of duties. Confidentiality also includes
restricted access to data reporting/extraction tools as well as copies
or extractions of data files.

Availability controls should provide reasonable assurance that
application data and reports and other relevant business
information are readily available to users when needed. These
controls are principally addressed in application security controls
(especially contingency planning) and therefore, are not included as
specific business process controls.

Application controls can be automated or manual (sometimes
referred to as user controls). The auditor will find that most
business processes will have a combination of automated and
manual controls that balance resource requirements and risk
mitigation. Also, management may use manual controls as effective
monitoring controls. It is important to understand how these types
of controls inter-relate when assessing application controls. The
auditor should evaluate the adequacy of controls, both automated
and manual, to determine whether or not management has
appropriately mitigated risks and achieved its control objectives.

Example: A vendor invoice can be blocked for payment
automatically if the goods or services are not received or if the
payment exceeds a specific threshold and requires additional
review and approval. Manual controls, such as the review of reports
or payments over a certain amount, could effectively detect an
invoice payment without goods receipt, or a high-dollar payment,
but may not occur in time to stop the payment.

The operating effectiveness of an automated application control
during the audit period also depends on the operating effectiveness
of related general controls (at the entitywide, system and
applications levels). For example, effective general controls are
necessary to prevent or detect management overrides or other
unauthorized changes to computer applications or data that could
preclude or impair the operation of the automated control.

The auditor should perform the following procedures as part of
testing and evaluating the effectiveness of application level controls:
● Understand information systems relevant to the audit objectives,
building on identification of key areas of audit interest and
critical control points.
● Determine which IS control techniques are relevant to the audit
objectives. The control categories, critical elements, and control
activities in Chapters 3 and 4 of FISCAM are generally relevant to
all audits.

The auditor considers the following in designing the tests of application
level controls:
• The nature of the control;
• The significance of the control in achieving the control objective(s);
• The risk of the control not being properly applied. [also see FAM 340];
• All of the key controls that management is relying on to address the risks
for a specific business process or a sub-process, which may include
automated and manual controls;
• The key controls outside the application under audit, as the business
process may involve other applications for a downstream or upstream
sub-process; and
• The strength or weakness of the entity-wide and system level controls.
The depth of the testing is based on the level of risk of the entity under
review and the audit objectives. In the absence of effective general controls,
the auditor may conclude that business process application level controls
are not likely to be effective.

Specific types of business process controls are:
• Transaction Data Input relates to controls over data that enter the
application (e.g., data validation and edit checks).
• Transaction Data Processing relates to controls over data integrity
within the application (e.g., review of transaction processing logs).
• Transaction Data Output relates to controls over data output and
distribution (e.g., output reconciliation and review).
• Master Data Setup and Maintenance relates to controls over
master data, the key information that is relatively constant and
shared between multiple functions or applications (e.g., vendor file).

Every business process employs master data, or referential data
that provides the basis for ongoing business activities, e.g.,
customers, vendors, and employees. The data that are generated as
a result of these activities are called transaction data, and represent
the result of the activity in the form of documents or postings, such
as purchase orders and obligations. Examples of master data are:
• Organizational structure
• G/L Account Structure
• Vendor Master
• Employee Master

Questions that may be used to collect information from the user include the
following.
● For what purpose do you use the transaction output?
○ initiate transaction, authorize changes to the system, maintain information
controls, or other?
● Can the transaction output be used without correction?
● Is the information accurate and reliable, available when needed, current and
up-to-date?
● Do you maintain manual records to supplement the transaction output?
● Do you check the information for quality (accuracy completeness, and validity)
when you receive it?
● Is the transaction output ever rerun by the data center?
● Are you authorized to make changes to the information and if so, can you
override validation and edit checks incorporated into the business process
application?

Other Control Categories
● Interface Controls
● Data Management System Controls
○ Segregation of Duties
○ Strong Authentication
○ Restrictive access

Information Technology General Controls

Control Areas
● Security Management
● Access Controls
● Configuration Management
● Segregation of Duties
● Contingency Planning

● Controls provide reasonable assurance that security management is
effective

SM Key Terms
● System Security Plan (SSP)
● Department of Defense Information Assurance Certification and
Accreditation Process (DIACAP)
● Plan of Action & Milestones (POA&M)

1. Security Management Program
2. Risk Assessments
3. Security Control Policies and Procedures
4. Security Awareness and Other Security-Related Personnel Policies
5. Monitor effectiveness of the security program
6. Remediation of information security weaknesses
7. Activities performed by external third parties are adequately secure

SM Critical Elements
1. Security Management Program
○ Documented, approved, up-to-date (SSP or DIACAP)
○ Security management structure (independence, authority, expertise, resources)
○ Information security responsibilities
○ Subordinate security plans
○ System Inventory

2. Risk Assessments
○ Systems are classified (low, moderate, high)
according to the impact threats to confidentiality,
integrity and availability would have to
organizational operations, organizational assets and
individuals, determines type of controls that should
be in place
○ Reassessed on periodic basis
○ Changes to system, facilities or other conditions
required reassessment of risk.
○ Federal system is certified and accredited before
being place in operation and at least every 3 years or
when major system changes occur

Potential Impact
Security Objective Low Moderate High
Confidentiality
Preserving authorized
restrictions on information
access and disclosure,
including means for protecting
personal privacy and
proprietary information.
The unauthorized disclosure of
information could be expected
to have a limited adverse
effect on organizational
operations, organizational
assets or individuals.
The unauthorized disclosure of
to have a serious adverse
effected on organizational
operations, organizational
assets or individuals.
The authorized disclosure of
to have a severe or
catastrophic adverse effect
on organizational operations,
organizational assets or
individuals.
Integrity
Guarding against improper
information modification or
destruction, and includes
ensuring non-repudiation and
authenticity.
The unauthorized modification
or destruction of information
could be expected to have a
limited adverse effect on
organizational operations,
individuals.
serious adverse effect on
individuals.
severe or catastrophic
adverse effect on
individuals.
Availability
Ensuring timely and reliable
access to and use of
information.
The disruption of access to or
use of information or
information system could be
expected to have a limited
adverse effect on
individuals.
expected to have a serious
adverse effect on
individuals.
expected to have a severe or
catastrophic adverse effect
on organizational operations,
individuals.

3. Security Control Policies and Procedures
○ Documented, approved by management
○ Appropriately consider risk
○ Address purpose, scope, roles, responsibilities and compliance
○ Ensure that users can be held accountable for their actions
○ Appropriately consider general and application controls
○ Periodically reviewed and updated

4. Security Awareness and Other Security-Related Personnel
Policies
○ Resource owners, system administrators and users are aware of
security policies
○ Hiring, transfer, termination and performance policies address
security
○ Employees have adequate training and expertise

5. Monitor effectiveness of the security program
○ Appropriate monitoring and testing policies and
procedures are documented
○ Management routinely conducts vulnerability
assessments and promptly corrects identified control
weaknesses, tracked on POA&M
○ Frequency and scope of security control testing is
commensurate with risk
○ Independent evaluation of entity’s information security
control tests effectiveness of security policies, procedures
and practices, results submitted to appropriate oversight
bodies

6. Remediation of Information Security Weaknesses
○ Management initiates prompt action to correct deficiencies, action
plans and milestones are documented
○ Deficiencies are analyzed in relation to the entire agency/entity,
appropriate corrective actions applied entity-wide
○ Corrective actions are tested and are monitored after they have
been implemented and monitored on a continuing basis

7. Activities performed by external third parties are
adequately secure
○ Appropriate policies and procedures concerning activities of
external third parties (vendors, contractors, service bureau) are
documented, agreed to, implemented and monitored for
compliance.
○ Include provisions for clearances, background checks,
confidentiality agreements, monitoring, termination
procedures, etc.

● Controls provide reasonable assurance that access to computer
resources (data, equipment, and facilities) is reasonable and restricted
to authorized individuals

AC Key Terms
● Identification – Who you are (username)
● Authentication – How you prove who you are (passwords, PINs,
tokens, fingerprints, etc.)
● Authorization – What you are allowed to do once granted access
● Least privilege – Users only have those privileges which are
essential to that user's work

1. Adequately protect information system boundaries
2. Implement effective identification and authentication mechanisms
3. Implement effective authentication controls
4. Adequately protect sensitive system resources
5. Implement an effective audit and monitoring capability
6. Establish adequate physical security controls

AC Critical Elements
• Is Defense-in-Depth effectively implemented through
multiple security measures among hosts, local area
networks and wide area networks, and the Internet?

○ Information system identifies and authenticates specific network devices before
establishing a connection
○ Remote access is appropriately controlled and protected
○ Connectivity approved only to perform assigned official duties
○ Session is ended after a period of activity
○ Warning banners

2. Implement effective identification and
authentication mechanisms
○ Unique user ID, each user has own and no user IDs
are shared
○ Authentication methods are based on risk:
passwords, token, biometric
○ Passwords
■ Not displayed when entered
■ Sufficiently complex (length, types of characters)
■ Automatically expire, prohibited from reuse for specific
period of time
○ Unsuccessful logon attempts are limited

3. Implement effective authorization controls
○ Resource owners identified authorized users and the access
they are authorized to have
○ Security managers review access authorizations and discuss
questionable authorizations with resource owners
○ All changes to security access authorizations are
automatically logged and periodically reviewed by
management independent of the security function
○ Resource owners periodically review access for continuing
appropriateness
○ Access is limited to individuals with valid business purpose
(least privilege)
○ Inactive accounts and accounting for terminated individuals
are disabled or removed in a timely manner

4. Adequately protect sensitive system resources
○ Assess to sensitive/privileged accounts is restricted
to individuals having a legitimate business need
○ Use of sensitive/privileged accounts is adequately
monitored
○ Passwords/authentication services and directories
are appropriately controlled and encrypted
○ Information system partitions or separates user
functionality from information system management
functionality
○ Information system isolates security functions from
non-security functions

5. Implement an effective audit and monitoring capability
○ An effective incident response program has been implemented
○ An effective intrusion detection program has been implemented
○ Events that will be audited have been identified based on risk
assessment
○ All auditable events, including access to and modifications of
sensitive or critical system resources, are logged.
○ Audit records contain sufficient information to establish what
events occurred, when they occurred, the source and outcome of
the events.
○ Audit logs are reviewed regularly
○ Audit logs are retained long enough to support after-the-fact
investigations
○ Security violates are reported and investigated, results are
reported to management

○ Risk management approach used to identify level of
physical security needed
○ Ongoing monitoring of physical security program and
independent assessments
○ Critical systems have emergency power
○ Employees are authorized and credentials are issued to
allow access, access limited to individuals that routinely
need access
○ Employee access reviewed regularly
○ Physical access logs reviewed regularly
○ Entry codes changed periodically
○ Visitors are prescreened, formally signed in, badged and
escorted

● Controls provide reasonable assurance that
changes to information system resources are
authorized and systems are configured and
operated securely and as intended

CM Key Terms
● Change Control Board –
● Software Development Lifecycle
● Solutions Delivery Lifecycle

Software/System Development Life Cycle

1. Develop and document CM policies, plans and
procedures
2. Maintain current configuration identification
information
3. Properly authorize, test, approve, track and control
all configuration changes
4. Routinely monitor the configuration
5. Update software on a timely basis to protect
against known vulnerability
6. Appropriately document and approve emergency
changes to the configuration

CM Critical Elements
1. Develop and document CM policies, plans and
procedures
○ An effective CM process is documented and implemented.
○ Includes:
■ A CM plan that identifies roles, responsibilities, procedures and
documentation requirements
■ Permitting only essential capabilities and restricting the use of
dangerous functions
■ Regular review and approval of changes by management (CCB)
■ Appropriate representation on CCB from across the entity
■ A formal SDLC methodology that includes system-level security
engineering principles to be considered in the design,
development and operation of an information system
■ Appropriate systems documentation

2. Maintain current configuration identification information
○ Current and comprehensive baseline inventory of hardware,
software and firmware is documented, backed up and protected,
Information system documentation describes security controls in
sufficient detail to permit analyss and testing of controls
○ Hardware, software and firmware are mapped to the application it
supports

3. Properly authorize, test, approve, track and control all
configuration changes
○ Configuration changes are authorized by management
○ Detailed specifications are prepared by the programmer and
reviewed by a programming supervisor for system and application
software changes
○ Test plans are documented and approved that define responsibilities
for each party involved (users, system analysts, programmers,
auditors, quality assurance, library control), include appropriate
consideration of security
○ Program changes are moved into production only when approved by
management and by persons independent of programmer
○ CM tools produce audit trails of program changes, record and report
program changes, maintain copies of previous versions
○ Configuration changes to network devices (i.e. routers, switches,
firewalls) are properly controlled and documented

4. Routinely monitor the configuration
○ Routinely validate that the current configuration information is up-to-date and working as
intended for networks, operating systems and infrastructure applications

5. Update software on a timely basis to protect against
known vulnerabilities
○ Information systems are scanned periodically to detect
known vulnerabilities
○ An effective patch management process is documented
and implemented, prioritization of patches by category
and risk, appropriate installation of patches on a timely
basis
○ Software is up-to-date
○ An effective virus, spam and spyware protection process
is documented and implemented
○ Noncurrent software releases are adequately secure
given the risk

6. Appropriately document and approve emergency changes to the
configuration
○ Procedures for emergency changes are documented and implemented.
○ Emergency changes are appropriately documented and approved, Appropriate
personnel are notified for analysis and follow-up

● Controls provide reasonable assurance that incompatible duties are
effectively segregated

1. Segregate incompatible duties and establish related policies
2. Control personnel activities through formal operating procedures,
supervision and review

SD Critical Elements
1. Segregate incompatible duties and establish related policies
○ Policies and procedures for segregating duties exist and are
up-to-date
○ Distinct system support function are performed by different
individuals (information security management, programming,
testing, change management, production control, data
security)
○ No individual has complete control over incompatible
transition processing functions
○ Data processing personnel are not users of information
systems, They and security managers do not initiate, input or
correct transactions
○ Access controls enforce segregation of duties
○ Job descriptions accurately reflect assigned duties and
responsibilities and segregation of duties principles

SD Critical Elements
2. Control personnel activities through formal operating procedures,
supervision and review
○ Access authorizations are periodically reviewed for incompatible functions
○ Management reviews are performed to determine that control techniques for segregating
incompatible duties are in place and are maintaining risk with acceptable levels
○ Supervisors routinely review user activity logs for incompatible actions and investigate any
abnormalities

● Controls provide reasonable assurance that contingency
planning (1) protects information resources and minimizes
the risk of unplanned interruptions and (2) provides for
recovery of critical operations should interruptions occur

CP Key Terms
● Disaster Recovery Plan (DRP) – Provided detailed
procedures to facilitate recovery of capabilities at an
alternate site; Often IT focused
● Business Continuity Plan (BCP) – Provide procedures for
sustaining essential business operations while recovering
from a significant disruption; addresses business
processes; IT addressed based on its support for business
process
● Continuity of Operations Plan (COOP) – Provide
procedures and capabilities to sustain an organization’s
essential, strategic functions at an alternate site for up to
30 days; Addresses the subset of an organization’s mission
that are deemed most critical; usual written at the
headquarters level; not IT focused

CP Critical Elements
1. Assess the criticality and sensitivity of computerized operations and
identify supporting resources
2. Take steps to prevent and minimize potential damage and interruption
3. Develop and document a comprehensive contingency plan
4. Periodically test the contingency plan and adjust it as appropriate

1. Assess the criticality and sensitivity of computerized
operations and identify supporting resources
○ Critical data and operating are identified and prioritized
○ Resources supporting critical operations are identified and analyzed
○ Emergency processing priorities are established

2. Take steps to prevent and minimize potential damage and
interruption
○ Data and program backup procedures have been implemented
○ Adequate environmental controls have been implemented
○ Staff have been trained to respond to emergencies
○ Effective hardware maintenance, problem management and change management
help prevent unexpected interruptions

3. Develop and document a comprehensive contingency plan
○ An up-to-date contingency plan is documented
○ Arrangements have been made for alternate data processing, storage and
telecommunications facilities

4. Periodically test the contingency plan and adjust it as
appropriate
○ The plan is periodically tested
○ Test results are analyzed and the contingency plan is adjusted
accordingly

Auditing information systems

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Auditing information systems

Similar to Auditing information systems (20)

Recently uploaded

Recently uploaded (20)

Auditing information systems