Ch2 2009 cisa

3,098 views

Published on

Certified Information System Auditor

Published in: Business, Technology
0 Comments
5 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
3,098
On SlideShare
0
From Embeds
0
Number of Embeds
41
Actions
Shares
0
Downloads
767
Comments
0
Likes
5
Embeds 0
No embeds

No notes for slide
  • Instructor Directions: Advise participants that the course will be interactive and will include “audience participation”, breakout sessions, practice questions, assignments and references to additional study resources. Exam Preparation resources: CISA Review Manual 2009 CISA QAE 2009 CISA QAE Supplement 2009
  • Content to Emphasize: The content area in this chapter will represent approximately 15% of the CISA examination   Review Manual Reference Pages: p. 77 
  • Instructor Directions: Task and knowledge statements represent the basis from which exam items are written. The learning objectives are what the IS auditors/CISA candidates are expected to know to perform their job duties. In order to perform all of the tasks, the IS auditor/CISA candidate should have a firm grasp of all the knowledge statements found in the CISA Review Manual. Content to Emphasize: For more detailed information on how each knowledge statement maps back to the task statements, please refer to Exhibit 2.1—Tasks and Knowledge Statements Mapping. Review Manual reference pages: pgs. 77-80
  • Instructor Directions: The learning objectives are what IS auditors/CISA candidates are expected to know to perform their job duties. In order to perform all of the tasks, the IS auditor/CISA candidate should have a firm grasp of all the knowledge statements found in the manual.   Content to Emphasize: For more detailed information on how each knowledge statement maps back to the task statements, please refer to Exhibit 2.1—Tasks and Knowledge Statements Mapping. Review Manual Reference Pages: pgs. 77-80
  • Instructor Directions: The learning objectives are what IS auditors/CISA candidates are expected to know to perform their job duties. In order to perform all of the tasks, the IS auditor/CISA candidate should have a firm grasp of all the knowledge statements found in the manual.   Content to Emphasize: For more detailed information on how each knowledge statement maps back to the task statements, please refer to Exhibit 2.1—Tasks and Knowledge Statements Mapping. Review Manual Reference Pages: pgs. 77-80
  • Instructor Directions: Discuss the overall concept of corporate governance.     Content to Emphasize: The Organisation for Economic Co-operation and Development (OECD) states: "Corporate governance involves a set of relationships between a company’s management, its board, its shareholders and other stakeholders. Corporate governance also provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined. Good corporate governance should provide proper incentives for the board and management to pursue objectives that are in the interests of the company and its shareholders and should facilitate effective monitoring..” (OECD 2004, OECD Principles of Corporate Governance , p.11) With respect to public governance, the OECD states: “Good, effective public governance helps to strengthen democracy and human rights, promote economic prosperity and social cohesion, reduce poverty, enhance environmental protection and the sustainable use of natural resources, and deepen confidence in government and public administration.” (OECD website on Public Governance and Management ).   Review Manual Reference Pages: p. 80
  • Review Manual Reference Pages: p. 81
  • Content to Emphasize: Information technology is now regarded as an integral part of that strategy. C-suite executives agree that strategic alignment between IT and enterprise objectives is a critical success factor. Information technology is so critical to the success of enterprises that it cannot be relegated to either IT management or IT specialists, but must receive the attention of both, in coordination with senior management. IT governance is the responsibility of the board of directors and executive management. A key element of IT governance is the alignment of business and IT, leading to the achievement of business value. The key IT governance practices are IT strategy committee, risk management and standard IT balanced scorecard.   Review Manual Reference Pages: p. 81
  • The correct answer is A IT governance ensures that the organization aligns its IT strategy with the enterprise/business objectives. Choices B, C and D are too limited. Review Manual Reference Pages: p. 133
  • Content to Emphasize:   IT governance structure IT governance purpose and integration Corporate governance Review Manual Reference Pages: p. 82
  • Review Manual Reference Pages: p. 82
  • Content to Emphasize: The IS auditor should confirm that the terms of reference state the: • Scope of the work • Reporting line to be used • IS auditor’s right of access to information    Review Manual Reference Pages: p. 83
  • Content to Emphasize: The organizational status and skill sets of the IS auditor should be considered for appropriateness with regard to the nature of the planned audit.   Review Manual Reference Pages: p. 83
  • Review Manual Reference Pages: p. 83
  • Content to Emphasize: Discuss the three-layered structure used in addressing the four perspectives for an IT Balanced Scorecard: Mission Strategies Measures   Review Manual Reference Pages: pgs. 83-85
  • Instructor Directions: Discuss the roles and responsibilities of the IT Steering and Strategy Committees. Review Manual Reference Pages: p. 84
  • Review Manual Reference Pages: p. 85
  • Content to Emphasize: One of the major trends: outsourcing of in-house processes. Note: Information security coverage extends beyond the geographic boundary of the organization’s premises in onshoring and offshoring models being adopted by organizations. This trend has changed the way in which information security is managed.   Review Manual Reference Pages: pgs. 85-86
  •   Review Manual Reference Pages: p. 87
  • Review Manual Reference Pages: p. 87
  • Content to Emphasize: The governance framework will generally consist of: • A comprehensive security strategy intrinsically linked with business objectives • Governing security policies that address each aspect of strategy, controls and regulation • A complete set of standards for each policy to ensure procedures and guidelines comply with policy • An effective security organizational structure void of conflicts of interest   Review Manual Reference Pages: p. 88
  • Review Manual Reference Pages: pgs. 88-89
  • Instructor Directions:   The exhibit (2.4) on Relationships of Security Governance Outcomes to Management Responsibilities is not specifically tested in the CISA exam but is information a CISA should be aware of. Content to Emphasize: The current focus on EA is a response to the increasing complexity of IT, the complexity of modern organizations, and an enhanced focus on aligning IT with business strategy and ensuring IT investments deliver real returns. Review Manual Reference Pages: p. 89
  • Content to Emphasize: The ultimate objective is to complete all cells of the matrix. The idea is to provide guidance on issues such as: whether and when to use advanced technical environments how to better connect intra- and interorganizational systems how to “web enable” legacy and enterprise resource planning (ERP) applications whether to insource or outsource IT functions   Review Manual Reference Pages: pgs. 90-91
  • Content to Emphasize: The FEA has a hierarchy of five reference models: • Performance reference model—A framework to measure the performance of major IT investments and their contribution to program performance • Business reference model—A function-driven framework that describes the functions and subfunctions performed by the government, independent of the agencies that actually perform them • Service component reference model—A functional framework that classifies the service components that support business and performance objectives • Technical reference model—A framework that describes how technology supports the delivery, exchange and construction of service components • Data reference model—While still being developed, this will describe the data and information that support program and business line operations   Review Manual Reference Pages: p. 91
  • Content to Emphasize:   The importance of developing strategic plans What makes a plan effective Who creates the plan   Review Manual Reference Pages: p. 92
  • Content to Emphasize: Discuss the IS auditor’s role in evaluating the strategic plan, process and framework Consider how the CIO or senior IT management are involved in the creation of the overall business strategy Repercussions of poor strategic plans/processes   Review Manual Reference Pages: p. 92
  • The correct answer is B IS strategic plans must address the needs of the business and meet future business objectives. Hardware purchases may be outlined, but not specified, and neither budget targets nor development projects are relevant choices. Choices A, C and D are not strategic items. Review Manual Reference Pages: p. 133
  • The correct answer is C Long-range planning for the IT department should recognize organizational goals, technological advances and regulatory requirements. Typically, the IT department will have long-range and short-range plans that are consistent and integrated with the organization’s plans. These plans must be time- and project-oriented, as well as address the organization’s broader plans toward attaining its goals. Review Manual Reference Pages: p. 133
  • Instructor Directions: Consider that the responsibilities will vary from organization to organization and that these responsibilities listed are the most common of the steering committee. The CISA candidate should know the purpose of the IS steering committee and it’s major responsibilities.   Content to Emphasize: Primary functions performed by this committee include: • Review the long- and short-range plans of the IS department to ensure that they are in accordance with the corporate objectives. • Review and approve major acquisitions of hardware and software within the limits approved by the board of directors. • Approve and monitor major projects and the status of IS plans and budgets, establish priorities, approve standards and procedures, and monitor overall IS performance. • Review and approve sourcing strategies for select, or all, IS activities, including insourcing or outsourcing, and the globalization or offshoring of functions. • Review adequacy of resources and allocation of resources in terms of time, personnel and equipment. • Make decisions regarding centralization vs. decentralization and assignment of responsibility. • Support development and implementation of an enterprisewide information security management program. • Report to the board of directors on IS activities.     Review Manual Reference Pages: p. 93
  • Instructor Directions: Discuss advantages and disadvantages to top-down and bottom-up approaches to developing policies.   Content to Emphasize: Policies represent the corporate philosophy of an organization and the strategic thinking of senior management and the business process owners. individual divisions and departments should define lower-level policies. The lower-level policies should be consistent with the corporate-level policies. These would apply to the employees and operations of these units, and would focus at the operational level. Review Manual Reference Pages: p. 94
  • Content to Emphasize: IS auditors should: reach an understanding of policies as part of the audit process test policies for compliance consider the extent to which the policies apply to third parties or outsourcers, the extent to which they comply with the policies, or if the third parties or outsourcers’ policies are in conflict with the organizations’ policies. Review Manual Reference Pages: p. 94
  • Review Manual Reference Pages: p. 95
  • Review Manual Reference Pages: p. 95
  • Content to Emphasize: High-level Information Security Policy: This policy should include statements on confidentiality, integrity and availability. Data Classification Policy: This policy should describe the classifications, levels of control at each classification and responsibilities of all potential users including ownership. Acceptable Usage Policy: There must be a comprehensive policy that includes information for all information resources (HW/SW, Networks, Internet, etc.) and describes the organizational permissions for the usage of IT and information-related resources. End User Computing Policy: This policy describes the parameters and usage of desktop tools by users. Access Control Policies: This policy describes the method for defining and granting access to users to various IT resources Review Manual Reference Pages: pgs. 95-96
  • Instructor Directions: The IS auditor should be aware of what needs to be reviewed during an assessment of an Information Security Policy.   Content to Emphasize:   The input to the management review should include: • Feedback from interested parties • Results of independent reviews • Status of preventive and corrective actions • Results of previous management reviews • Process performance and information security policy compliance • Changes that could affect the organization’s approach to managing information security, including changes to the organizational environment; business circumstances; resource availability; contractual, regulatory and legal conditions; or technical environment • Usage of the consideration of outsourcers or offshore of IT or business functions • Trends related to threats and vulnerabilities • Reported information security incidents • Recommendations provided by relevant authorities   Review Manual Reference Pages: p. 96
  • Content to Emphasize: An independent review is necessary to ensure that policies and procedures have been properly documented, understood and implemented   Review Manual Reference Pages: p. 97
  • Review Manual Reference Pages: p. 97
  • Review Manual Reference Pages: p. 98
  • Content to Emphasize: Examples of typical assets associated with information and IT include: • Information and data • Hardware • Software • Services • Documents • Personnel   Common classes of threats are: • Errors • Malicious damage/attack • Fraud • Theft • Equipment/software failure Review Manual Reference Pages: p. 98
  • Content to Emphasize: Final acceptance of residual risks takes into account: • Organizational policy • Risk identification and measurement • Uncertainty incorporated in the risk assessment approach • Cost and effectiveness of implementation Review Manual Reference Pages: p. 99
  • Instructor Directions: Discuss the different risk management levels.   Review Manual Reference Pages: p. 99
  • Review Manual Reference Pages: p. 100
  • Review Manual Reference Pages: p. 101
  • Instructor Directions: The IS auditor should be aware of personnel management issues but this information is not tested in the CISA exam due to its subjectivity and organizational-specific subject matter. Review Manual Reference Pages: pgs. 101-104
  • Instructor Directions: Discuss how IS functions can be delivered.   Content to Emphasize: Delivery of IS functions can include: • Insourced—Fully performed by the organization’s staff • Outsourced—Fully performed by the vendor’s staff • Hybrid—Performed by a mix of the organization’s and vendor’s staff; can include joint ventures/supplemental staff IS functions can be performed across the globe, taking advantage of time zones and arbitraging labor rates, and can include: • Onsite—Staff work onsite in the IS department • Offsite—Also known as nearshore, staff work at a remote location in the same geographical area • Offshore—Staff work at a remote location in a different geographic region Review Manual Reference Pages: p. 104
  • Content to Emphasize:   Reasons for outsourcing include: • A desire to focus on core activities • Pressure on profit margins • Increasing competition that demands cost savings • Flexibility with respect to both organization and structure The services provided by a third party can include: • Data entry • Design and development of new systems in the event that the in-house staff does not have the requisite skills or is otherwise occupied in higher-priority tasks, or in the event of a one-time task in which case there is no need to recruit additional in-house skilled staff • Maintenance of existing applications to free in-house staff to develop new applications • Conversion of legacy applications to new platforms. For example, a specialist company may web-enable the front end of an old application. • Operating the help desk or the call center • Operations processing Review Manual Reference Pages: Pgs. 104-105
  • Review Manual Reference Pages: pgs. 105-106
  • Instructor Directions: Discuss how risks can be reduced   Content to Emphasize: SLAs: are a contractual means of helping the IS department to manage information resources under the control of a vendor. stipulate and commit a vendor to a required level of service and support options. should serve as an instrument of control. Where the outsourcing vendor is from another country, the organization should be aware of cross-border legislation. Review Manual Reference Pages: p. 106
  • Review Manual Reference Pages: p. 107
  • Review Manual Reference Pages: p. 108
  • Review Manual Reference Pages: pgs. 109-110
  • Review Manual Reference Pages: p. 111
  • Instructor Directions: The IS auditor should be aware of quality management. However, the CISA exam does not test specifics on any ISO standards. Review Manual Reference pgs. 111-113
  • The correct answer is A A data security officer’s prime responsibility is recommending and monitoring data security policies. Promoting security awareness within the organization is one of the responsibilities of a data security officer. But, it is not as important as recommending and monitoring data security policies. The IT department, not the data security officer, is responsible for establishing procedures for IT security policies recommended by the data security officer and for the administration of physical and logical access controls. Review Manual Reference p. 133
  • The correct answer is D Maintaining access rules over data and IT resources is one of the primary functions of the security administrator. Approving the security policy is the responsibility of senior management. Maintaining and implementing this is the responsibility of the security administrator. Testing application software is the function of the programmer or user. Ensuring data integrity is the responsibility of the user and processing controls built into the application. Review Manual Reference p. 133
  • Content to Emphasize: The broad phases of performance measurement are: • Establishing and updating performance measures • Establishing accountability for performance measures • Gathering and analyzing performance data • Reporting and using performance information Caveats of performance measurement include: • Model—A model is built or established first to evaluate the performance and alignment with the business objectives. • Measurement error—Conventional measures do not properly account for the true inputs and outputs. • Lags—Time lags between expense and benefit are not properly accounted for in current measures. • Redistribution—IT is used to redistribute the source of costs in firms; there is no difference in total output, only in the means of getting it. • Mismanagement—The lack of explicit measures of the value of information makes resources vulnerable to misallocation and overconsumption by managers. As a result, proper performance measurement techniques will play an increasing role for program managers and investment review boards. Review Manual Reference Pages: pgs. 114-115
  • Content to Emphasize: COBIT management guidelines are primarily designed to meet the needs of IT management for performance measurement. Goals and metrics and maturity models are provided for each of the 34 IT processes. These are generic and action-oriented for the purpose of addressing the following types of management concerns: • Performance measurement—What are the indicators of good performance? • IT control profiling—What is important? What are the critical success factors for control? • Awareness—What are the risks of not achieving our objectives? • Benchmarking—What do others do? How are they measured and compared? From a control perspective, the management guidelines address the key issue of determining the right level of control for IT such that it supports the objectives of the enterprise. Review Manual Reference Pages: p. 115
  • The correct answer is A Evaluating the activities of boards and committees providing oversight is an important aspect of governance and should be measured. Choices B, C and D are all irrelevant to the evaluation of IT governance performance measures. Review Manual Reference Pages: p. 133
  • Instructor Directions: The CISA exam does not test specific job responsibilities since they might vary within organizations. However, universally known responsibilities such as the business owners, information security functions and executive management might be tested, especially when testing access controls and data ownership. The IS auditor should be familiar with separation of duties. Review Manual Reference Pages: p. 116
  • Instructor Directions: Explain the responsibilities of each role. Review Manual Reference Pages pgs. 116-117
  • Content to Emphasize: Quality assurance manager—Responsible for negotiating and facilitating quality activities in all areas of information technology With the increase in outsourcing, including the use of multiple vendors, dedicated staff may be required to manage the vendors and outsourcers, including performing the following functions: • Act as the prime contact for the vendor and outsourcer within the IS function. • Provide direction to the outsourcer on issues and escalate internally within the organization and IS function. • Monitor and report on the service levels to management. • Review changes to the contract due to new requirements and obtain IS approvals. Review Manual Reference Pages: pgs. 116-117
  • Review Manual Reference Pages: pgs. 117-118
  • Review Manual Reference Pages: pgs. 118-119
  • Review Manual Reference Pages: pgs. 119-120
  • Content to Emphasize: Duties that should be segregated include: • Custody of the assets • Authorization • Recording transactions If adequate segregation of duties does not exist, the following could occur: • Misappropriation of assets • Misstated financial statements • Inaccurate financial documentation (i.e., errors or irregularities) • Improper use of funds or modification of data could go undetected Review Manual Reference Pages: pgs. 120-121
  • Instructor Directions: The segregation of duties control matrix (exhibit 2.9) is not an industry standard, but a guideline indicating which positions should be separated and which require compensating controls when combined. The matrix is illustrative of potential segregation of duties issues and should not be viewed or used as an absolute. Rather, it should be used to help identify potential conflicts so proper questions may be asked to identify compensating controls. Review Manual Reference Pages : p. 121
  • The correct answer is D It is common for system development and maintenance to be undertaken by the same person. In both, the programmer requires access to the source code in the development environment, but should not be allowed access in the production environment. Choice A is not correct because the roles of security administration and change management are incompatible functions. The level of security administration access rights could allow changes to go undetected. Computer operations and system development (choice B) are incompatible, since it would be possible for an operator to run a program that he/she had amended. Choice C is incorrect because the combination of system development and change control would allow program modifications to bypass change control approvals. Review Manual Reference Pages : p. 133
  • The correct answer is B Segregation of duties will prevent combination of conflicting functions. This is a preventive control, and it is the most critical control over database administration. Approval of DBA activities does not prevent the combination of conflicting functions. Review of access logs and activities is a detective control. If DBA activities are improperly approved, review of access logs and activities may not reduce the risk. Reviewing the use of database tools does not reduce the risk, as this is only a detective control and does not prevent combination of conflicting functions. Review Manual Reference Pages : p. 133
  • Review Manual Reference Pages: pgs. 122-123
  • Instructor Directions: Describe each of the compensating controls listed on the slide Review Manual Reference Pages: pgs. 123-124
  • The correct answer is B Authorization should be separated from all aspects of record keeping (origination, recording and correction). Such a separation enhances the ability to detect the recording of unauthorized transactions. Review Manual Reference Pages: p. 133
  • The correct answer is C In smaller organizations, it generally is not appropriate to recruit additional staff to achieve a strict segregation of duties. The IS auditor must look at alternatives. Of the choices, C is the only practical one that has an impact. The IS auditor should recommend processes that detect changes to production source and object code, such as code comparisons, so the changes can be reviewed by a third party on a regular basis. This would be a compensating control process. Choice A, involving logging of changes to development libraries, would not detect changes to production libraries. Choice D is in effect requiring a third party to do the changes, which may not be practical in a small organization. Review Manual Reference Pages: p. 134
  • Review Manual Reference Pages: pgs. 124-125
  • Review Manual Reference Pages: p. 125
  • Instructor Directions: An IS auditor should be familiar with the RFP process and know what needs to be reviewed in an RFP. It is also important to note that a CISA should know, from a governance perspective, the evaluation criteria and methodology of an RFP, and the requirements to meet organizational standards. Content to Emphasize: In reviewing a sample of contracts, the IS auditor should evaluate the adequacy of the following terms and conditions: • Service levels • Right to audit or third party audit reporting • Software escrow • Penalties for noncompliance • Adherence to security policies and procedures • Protection of customer information • Contract change process • Contract termination and any associated penalties Review Manual Reference Pages: pgs. 125-126
  • Instructor Directions: Discuss case study Review Manual Reference Pages: p. 129
  • Review Manual Reference Pages: p. 129
  • The correct answer is A Three business days to remove the account of a terminated employee would create an unacceptable risk to the organization. In the intervening time, significant damage could be done. In contrast, some degree of advance notice prior to an onsite visit is generally accepted within the industry. Also, not every outsourcer will have its own internal audit function or IS auditor. Software escrow is primarily of importance when dealing with custom application software, where there is a need to store a copy of the source code with a third party. Operating system software for generally available commercial operating systems would not require software escrow. Review Manual Reference Pages: p. 135
  • The correct answer is A Since connectivity to the servers is over the Internet, the prohibition against strong encryption will place any transmitted data at risk. The limitation of liability is a standard industry practice. Although the failure to perform background checks for employees hired more than three years ago is of importance, it is not as significant an issue. Upgrading system software once every six months does not present any significant exposure. Review Manual Reference Pages: p. 135
  • Ch2 2009 cisa

    1. 1. ISACA ® The recognized globalleader in IT governance, control, security and assurance
    2. 2. 2009 CISA® Review Course Chapter 2IT Governance
    3. 3. Course Agenda• Learning Objectives• Discuss Task and Knowledge Statements• Discuss specific topics within the chapter• Case studies• Sample questions
    4. 4. Exam RelevanceEnsure that the CISA candidate…Understands and can provide assurance that the organization hasthe structure, policies, accountability mechanisms and monitoringpractices in place to achieve the requirements of corporategovernance of IT. % of Total Exam QuestionsThe content area in this chapter will Chapter 6 Chapter 1represent approximately 15% of 14% 10% Chapter 2the CISA examination 15%(approximately 30 questions). Chapter 5 31% Chapter 3 16% Chapter 4 14%
    5. 5. Chapter 2 Learning Objectives• Evaluate the effectiveness of IT governance structure to ensure adequate board control over the decisions, directions and performance of IT, so it supports the organizations strategies and objectives• Evaluate IT organizational structure and human resources (personnel) management to ensure that they support the organizations strategies and objectives• Evaluate the IT strategy and process for their development, approval, implementation and maintenance to ensure that they support the organizations strategies and objectives
    6. 6. Chapter 2 Learning Objectives (continued)• Evaluate the organizations IT policies, standards, procedures and processes for their development, approval, implementation and maintenance to ensure that they support the IT strategy and comply with regulatory and legal requirements• Evaluate management practices to ensure compliance with the organizations IT strategy, policies, standards and procedures• Evaluate IT resource investment, use and allocation practices to ensure alignment with the organizations strategies and objectives
    7. 7. Chapter 2 Learning Objectives (continued)• Evaluate IT contracting strategies and policies and contract management practices to ensure that they support the organizations strategies and objectives• Evaluate risk management practices to ensure that the organizations IT-related risks are properly managed• Evaluate monitoring and assurance practices to ensure that the board and executive management receive sufficient and timely information about IT performance
    8. 8. 2.2 Corporate Governance• Ethical corporate behavior by directors or others charged with governance in the creation and presentation of value for all stakeholders• The distribution of rights and responsibilities among different participants in the corporation, such as board, managers, shareholders and other stakeholders• Establishment of rules to manage and report on business risks
    9. 9. 2.3 Monitoring and Assurance Practices for Board and Executive Management• Enterprises are governed by generally accepted good or best practices, the assurance of which is provided by certain controls. From these practices flows the organization’s direction, which indicates certain activities using the organization’s resources. The results of these activities are measured and reported on, providing input to the cyclical revision and maintenance of controls.• IT is also governed by good or best practices that ensure that the organization’s information and related technology support its business objectives, its resources are used responsibly, and its risks are managed appropriately.
    10. 10. 2.3 Monitoring and Assurance Practices for Board and Executive Management (continued)• Effective enterprise governance focuses individual and group expertise and experience on specific areas where they can be most effective• IT governance is concerned with two issues: that IT delivers value to the business and that IT risks are managed• IT governance is the responsibility of the board of directors and executive management
    11. 11. Practice Question2-1 IT governance ensures that an organization aligns its IT strategy with: A. enterprise objectives. B. IT objectives. C. audit objectives. D. control objectives.
    12. 12. 2.3.1 Best Practices for IT Governance
    13. 13. 2.3.1 Best Practices for IT Governance (continued)IT governance has become significant due to:• Demands for better return from IT investments• Increases in IT expenditures• Regulatory requirements for IT controls• Selection of service providers and outsourcing• Complexity of network security• Adoptions of control frameworks• Benchmarking
    14. 14. 2.3.1 Best Practices for IT Governance (continued)Audit role in IT governance• Audit plays a significant role in the successful implementation of IT governance within an organization• Reporting on IT governance involves auditing at the highest level in the organization and may cross division, functional or departmental boundaries
    15. 15. 2.3.1 Best Practices for IT Governance (continued)• In accordance with the defined role of the IS auditor, the following aspects related to IT governance need to be assessed: – The IS function’s alignment with the organization’s mission, vision, values, objectives and strategies – The IS function’s achievement of performance objectives established by the business (effectiveness and efficiency) – Legal, environmental, information quality, and fiduciary and security requirements – The control environment of the organization – The inherent risks within the IS environment
    16. 16. 2.3.2 IT Strategy Committee• The creation of an IT strategy committee is an industry best practice• Committee should broaden its scope to include not only advice on strategy when assisting the board in its IT governance responsibilities, but also to focus on IT value, risks and performance
    17. 17. 2.3.3 Standard IT Balanced Scorecard• A process management evaluation technique that can be applied to the IT governance process in assessing IT functions and processes• Method goes beyond the traditional financial evaluation• One of the most effective means to aid the IT strategy committee and management in achieving IT and business alignment
    18. 18. 2.3.4 Information Security Governance• Focused activity with specific value drivers – Integrity of information – Continuity of services – Protection of information assets• Integral part of IT governance• Importance of information security governance
    19. 19. 2.3.4 Information Security Governance (continued)Importance of information security governance• Information security (Infosec) covers all information processes, physical and electronic, regardless of whether they involve people and technology or relationships with trading partners, customers and third parties.• Infosec is concerned with all aspects of information and its protection at all points of its life cycle within the organization.
    20. 20. 2.3.4 Information Security Governance (continued)Effective information security can add significantvalue to an organization by: • Providing greater reliance on interactions with trading partners • Improving trust in customer relationships • Protecting the organization’s reputation • Enabling new and better ways to process electronic transactions
    21. 21. 2.3.4 Information Security Governance (continued)Outcomes of security governance• Strategic alignment—align with business strategy• Risk management—manage and execute appropriate measures to mitigate risks• Value delivery—optimize security investments• Performance measurement – measure, monitor and report on information security processes• Resource management—utilize information security knowledge and infrastructure efficiently and effectively• Process integration – integration of management assurance processes for security
    22. 22. 2.3.4 Information Security Governance (continued)Effective information security governance• To achieve effective information security governance, management must establish and maintain a framework to guide the development and management of a comprehensive information security program that supports business objectives• This framework provides the basis for the development of a cost-effective information security program that supports the organization’s business goals.
    23. 23. 2.3.4 Information Security Governance (continued)Information security governance requires strategicdirection and impetus from: • Boards of directors / senior management • Executive management • Steering committees • Chief information security officers
    24. 24. 2.3.5 Enterprise Architecture• Involves documenting an organization’s IT assets in a structured manner to facilitate understanding, management and planning for IT investments• Often involves both a current state and optimized future state representation
    25. 25. 2.3.5 Enterprise Architecture (continued)The Basic Zachman Framework Data Functional Network People Process StrategyScopeEnterprise ModelSystems ModelTechnology ModelDetailedRepresentation
    26. 26. 2.3.5 Enterprise Architecture (continued)The Federal Enterprise Architecture (FEA)hierarchy: • Performance • Business • Service component • Technical • Data
    27. 27. 2.4.1 Strategic Planning• From an IS standpoint, strategic planning relates to the long-term direction an organization wants to take in leveraging information technology for improving its business processes• Effective IT strategic planning involves a consideration of the organization’s demand for IT and its IT supply capacity
    28. 28. 2.4.1 Strategic Planning (continued)• The IS auditor should pay attention to the importance of IT strategic planning• Focus on the importance of a strategic planning process or planning framework• Consider how the CIO or senior IT management are involved in the creation of the overall business strategy
    29. 29. Practice Question2-2 Which of the following would be included in an IS strategic plan? A. Specifications for planned hardware purchases B. Analysis of future business objectives C. Target dates for development projects D. Annual budgetary targets for the IS department
    30. 30. Practice Question2-3 Which of the following BEST describes an IT department’s strategic planning process? A. The IT department will have either short-range or long-range plans depending on the organization’s broader plans and objectives. B. The IT department’s strategic plan must be time- and project-oriented, but not so detailed as to address and help determine priorities to meet business needs. C. Long-range planning for the IT department should recognize organizational goals, technological advances and regulatory requirements. D. Short-range planning for the IT department does not need to be integrated into the short-range plans of the organization since technological advances will drive the IT department plans much quicker than organizational plans.
    31. 31. 2.4.2 Steering Committee• An organization’s senior management should appoint a planning or steering committee to oversee the IS function and its activities• A high-level steering committee for information technology is an important factor in ensuring that the IS department is in harmony with the corporate mission and objectives
    32. 32. 2.5.1 Policies• High-level documents• Represent the corporate philosophy of an organization• Must be clear and concise to be effective
    33. 33. 2.5.1 Policies (continued)• Management should review all policies carefully• Policies need to be updated to reflect new technology and significant changes in business processes• Policies formulated must enable achievement of business objectives and implementation of IS controls
    34. 34. 2.5.1 Policies (continued)Information security policies• Communicate a coherent security standard to users, management and technical staff• Must balance the level of control with the level of productivity• Provide management the direction and support for information security in accordance with business requirements, relevant laws and regulations
    35. 35. 2.5.1 Policies (continued)Information security policy document• Definition of information security• Statement of management intent• Framework for setting control objectives• Brief explanation of security policies• Definition of responsibilities• References to documentation
    36. 36. 2.5.1 Policies (continued)Policy groups to be addressed• High-level information security policy• Data classification policy• Acceptable usage policy• End user computing policy• Access control policies
    37. 37. 2.5.1 Policies (continued)Review of the information security policydocument• Should be reviewed at planned intervals or when significant changes occur to ensure its continuing suitability, adequacy and effectiveness• Should have an owner who has approved management responsibility for the development, review and evaluation of the security policy• Review should include assessing opportunities for improvement to the organization’s information security policy
    38. 38. 2.5.2 ProceduresProcedures are detailed documents that:• Define and document implementation policies• Must be derived from the parent policy• Must implement the spirit (intent) of the policy statement• Must be written in a clear and concise manner
    39. 39. 2.6 Risk ManagementThe process of identifying vulnerabilities and threatsto the information resources used by an organizationin achieving business objectives
    40. 40. 2.6.1 Developing a Risk Management ProgramTo develop a risk management program:• Establish the purpose of the risk management program• Assign responsibility for the risk management plan
    41. 41. 2.6.2 Risk Management Process• Identification and classification of information resources or assets that need protection• Assess threats and vulnerabilities and the likelihood of their occurrence• Once the elements of risk have been established they are combined to form an overall view of risk
    42. 42. 2.6.2 Risk Management Process (continued)• Evaluate existing controls or design new controls to reduce the vulnerabilities to an acceptable level of risk• Residual risk
    43. 43. 2.6.2 Risk Management Process (continued)IT risk management needs to operate atmultiple levels including:• Operational—Risks that could compromise the effectiveness of IT systems and supporting infrastructure• Project—Risk management needs to focus on the ability to understand and manage project complexity• Strategic—The risk focus shifts to considerations such as how well the IT capability is aligned with the business strategy
    44. 44. 2.6.3 Risk Analysis Methods• Qualitative• Semiquantitative• Quantitative – Probability and expectancy – Annual loss expectancy method
    45. 45. 2.6.3 Risk Analysis Methods (continued)Management and IS auditors should keep inmind certain considerations:• Risk management should be applied to IT functions throughout the company• Senior management responsibility• Quantitative RM is preferred over qualitative approaches• Quantitative RM always faces the challenge of estimating risks• Quantitative RM provides more objective assumptions• The real complexity or the apparent sophistication of the methods or packages used should not be a substitute for commonsense or professional diligence• Special care should be given to very high impact events, even if the probability of occurrence over time is very low.
    46. 46. 2.7.1 Personnel Management• Hiring• Employee handbook• Promotion policies• Training• Scheduling and time reporting• Employee performance evaluations• Required vacations• Termination policies
    47. 47. 2.7.2 Sourcing Practices• Sourcing practices relate to the way an organization obtains the IS function required to support the business• Organizations can perform all IS functions in-house or outsource all functions across the globe• Sourcing strategy should consider each IS function and determine which approach allows the IS function to meet the organization’s goals
    48. 48. 2.7.2 Sourcing Practices (continued)Outsourcing practices and strategies• Contractual agreements under which an organization hands over control of part or all of the functions of the IS department to an external party• Becoming increasingly important in many organizations• The IS auditor must be aware of the various forms outsourcing can take as well as the associated risks
    49. 49. 2.7.2 Sourcing Practices (continued)Possible advantages:• Commercial outsourcing companies likely to devote more time and focus more efficiently on a given project than in- house staff• Outsourcing vendors likely to have more experience with a wider array of problems, issues and techniquesPossible disadvantages:• Costs exceeding customer expectations• Loss of internal IS experience• Loss of control over IS• Vendor failure
    50. 50. 2.7.2 Sourcing Practices (continued)Risks can be reduced by:• Establishing measurable, partnership-enacted shared goals and rewards• Using multiple suppliers or withholding a piece of business as an incentive• Performing periodic competitive reviews and benchmarking/bench trending• Implementing short-term contracts• Forming a cross-functional contract management team• Including contractual provisions to consider as many contingencies as can reasonably be foreseen
    51. 51. 2.7.2 Sourcing Practices (continued)Globalization practices and strategies• Requires management to actively oversee the remote or offshore locations• The IS auditor can assist an organization in moving IS functions offsite or offshore by ensuring that IS management considers the following: – Legal, regulatory and tax issues – Continuity of operations – Personnel – Telecommunication issues – Cross-border and cross-cultural issues
    52. 52. 2.7.2 Sourcing Practices (continued)Governance in outsourcing• Mechanism that allows organizations to transfer the delivery of services to third parties• Accountability remains with the management of the client organization• Transparency and ownership of the decision-making process must reside within the purview of the client
    53. 53. 2.7.2 Sourcing Practices (continued)Third-party service delivery management• Every organization using the services of third parties should have a service delivery management system in place to implement and maintain the appropriate level of information security and service delivery in line with third-party service delivery agreements• The organization should check the implementation of agreements, monitor compliance with the agreements and manage changes to ensure that the services delivered meet all requirements agreed to with the third party.
    54. 54. 2.7.3 Organizational Change ManagementWhat is change management?• Managing IT changes for the organization – Identify and apply technology improvements at the infrastructure and application level
    55. 55. 2.7.5 Quality Management• Software development, maintenance and implementation• Acquisition of hardware and software• Day-to-day operations• Service management• Security• Human resource management• General administration
    56. 56. Practice Question2-4 The MOST important responsibility of a data security officer in an organization is: A. recommending and monitoring data security policies. B. promoting security awareness within the organization. C. establishing procedures for IT security policies. D. administering physical and logical access controls.
    57. 57. Practice Question2-5 Which of the following is MOST likely to be performed by the security administrator? A. Approving the security policy B. Testing application software C. Ensuring data integrity D. Maintaining access rules
    58. 58. 2.7.7 Performance Optimization• Process driven by performance indicators• Optimization refers to the process of improving the productivity of information systems to the highest level possible without unnecessary, additional investment in the IT infrastructure
    59. 59. 2.7.7 Performance Optimization (continued)Five ways to use performance measures: • Measure products/services • Manage products/services • Assure accountability • Make budget decisions • Optimize performance
    60. 60. Practice Question2-6 An IS auditor should ensure that IT governance performance measures: A. evaluate the activities of IT oversight committees. B. provide strategic IT drivers. C. adhere to regulatory reporting standards and definitions. D. evaluate the IT department.
    61. 61. 2.8 IS Organizational Structure and Responsibilities
    62. 62. 2.8.1 IS Roles and Responsibilities• Systems development manager• Help desk• End user• End user support manager
    63. 63. 2.8.1 IS Roles and Responsibilities (continued)• Data management• Quality assurance manager• Vendor and outsourcer management• Operations manager
    64. 64. 2.8.1 IS Roles and Responsibilities (continued)• Control group• Media management• Data entry• Systems administration
    65. 65. 2.8.1 IS Roles and Responsibilities (continued)• Security administration• Quality assurance• Database administration
    66. 66. 2.8.1 IS Roles and Responsibilities (continued)• Systems analyst• Security architect• Applications development and maintenance• Infrastructure development and maintenance• Network management
    67. 67. 2.8.2 Segregation of Duties Within IS• Avoids possibility of errors or misappropriations• Discourages fraudulent acts• Limits access to data
    68. 68. 2.8.2 Segregation of Duties Within IS (continued)
    69. 69. Practice Question2-7 Which of the following tasks may be performed by the same person in a well- controlled information processing computer center? A. Security administration and change management B. Computer operations and system development C. System development and change management D. System development and systems maintenance
    70. 70. Practice Question2-8 Which of the following is the MOST critical control over database administration? A. Approval of DBA activities B. Segregation of duties C. Review of access logs and activities D. Review of the use of database tools
    71. 71. 2.8.3 Segregation of Duties ControlsControl measures to enforce segregation of dutiesinclude: • Transaction authorization • Custody of assets • Access to data – Authorization forms – User authorization tables
    72. 72. 2.8.3 Segregation of Duties Controls (continued)Compensating controls for lack of segregationof duties include: • Audit trails • Reconciliation • Exception reporting • Transaction logs • Supervisory reviews • Independent reviews
    73. 73. Practice Question2-9 When a complete segregation of duties cannot be achieved in an online system environment, which of the following functions should be separated from the others? A. Origination B. Authorization C. Recording D. Correction
    74. 74. Practice Question2-10 In a small organization, where segregation of duties is not practical, an employee performs the function of computer operator and application programmer. Which of the following controls should an IS auditor recommend? A. Automated logging of changes to development libraries B. Additional staff to provide segregation of duties C. Procedures that verify that only approved program changes are implemented D. Access controls to prevent the operator from making program modifications
    75. 75. 2.9 Auditing IT Governance Structure and ImplementationIndicators of potential problems include:• Unfavorable end-user attitudes• Excessive costs• Budget overruns• Late projects• High staff turnover• Inexperienced staff• Frequent hardware/software errors
    76. 76. 2.9.1 Reviewing DocumentationThe following documents should be reviewed:• IT strategies, plans and budgets• Security policy documentation• Organization/functional charts• Job descriptions• Steering committee reports• System development and program change procedures• Operations procedures• Human resource manuals• Quality assurance procedures
    77. 77. 2.9.2 Reviewing Contractual CommitmentsThere are various phases to computer hardware,software and IS service contracts, including:• Development of contract requirements and service levels• Contract bidding process• Contract selection process• Contract acceptance• Contract maintenance• Contract compliance
    78. 78. Case Study A ScenarioAn IS auditor has been asked to review the draft of anoutsourcing contract and SLA and recommend anychanges or point out any concerns prior to these beingsubmitted to senior management for final approval. Theagreement includes outsourcing support of Windows andUNIX server administration and network management to athird party.Servers will be relocated to the outsourcer’s facility that islocated in another country, and connectivity will beestablished using the Internet. Operating system softwarewill be upgraded on a semiannual basis, but it will not beescrowed. All requests for addition or deletion of useraccounts will be processed within three business days.
    79. 79. Case Study A Scenario (continued)Intrusion detection software will be continuously monitoredby the outsourcer and the customer notified by e-mail if anyanomalies are detected. New employees hired within thelast three years were subject to background checks. Priorto that, there was no policy in place.A right to audit clause is in place, but 24-hour notice isrequired prior to an onsite visit. If the outsourcer is found tobe in violation of any of the terms or conditions of thecontract, it will have 10 business days to correct thedeficiency. The outsourcer does not have an IS auditor, butit is audited by a regional public accounting firm.
    80. 80. Case Study A Question1. Which of the following should be of MOST concern to the IS auditor? A. User account changes are processed within three business days. B. Twenty-four hour notice is required prior to an onsite visit. C. The outsourcer does not have an IS audit function. D. Software escrow is not included in the contract.
    81. 81. Case Study A Question2. Which of the following would be the MOST significant issue to address if the servers contain personally identifiable customer information that is regularly accessed and updated by end users? A. The country in which the outsourcer is based prohibits the use of strong encryption for transmitted data. B. The outsourcer limits its liability if it took reasonable steps to protect the customer data. C. The outsourcer did not perform background checks for employees hired over three years ago. D. System software is only upgraded once every six months.
    82. 82. Conclusion• Chapter 2 Quick Reference Review – Pages 127-128 of CISA Review Manual 2009• Additional Case Studies – Case Study B – page 130 of CISA Review Manual 2009 – Case Study C – page 131 of CISA Review Manual 2009 – Case Study D – page 132 of CISA Review Manual 2009

    ×