Chapter 10_2 - Operasi Sistem Informasi.pptx

SI2112 – Information
System Control and Audit
11 – Information Systems Operations
Information Systems
Undergraduate

Program and Data Backups
• Laws and regulations may require organizations to maintain or archive their
information and records for a specified period of time.
• Such archives, if containing financial or operational information, allow
management to execute useful analyses and comparisons on which to base
projections of future operations.
• In an IT environment, these archives or backups consist of copies of significant
programs (i.e., operating systems, applications, and databases) and their related
data that are retained and stored in secure storage locations.
• If programs and data are not backed up regularly nor stored in a secure
location, they may not be recoverable in the event of a serious system failure.

Program and Data Backups cont.
• Depending on the type of data file being backed up, the retention period may vary.
• For example, laws and regulations may require organizations to keep backups of
general ledger data for a specified number of years, while internal policy may allow
certain detailed transaction data to be deleted after a shorter period of time.
• Also, if data retention laws and regulations are violated, organizations could be
subject to regulatory penalties and/or fines.
• Establishing backup policies, procedures, standards, and/or guidance ensures the
availability of data significant to the operation of the organization.
• The policies, procedures, standards, and/or guidance should cover areas such as:
• Storage and retention of programs and data
• Backup scheduling and rotation
• Protection of backup media
• Backup monitoring, review, and resolution of exceptions

• Organizations should store backups on-site (in a tape library, for example)
and off-premises.
• Typically, backups of programs and data files are stored on-site and off-site.
• The organization’s policies and procedures should require that backup
copies of programs and data reflect the latest and updated versions.
• Organizations should use cycle retention systems to provide backup of
current data.
• Master files and transaction files that are sufficient to recreate the current
day’s master files should be stored both on and off premises.
• New backup files should be rotated to the off-premises location before the
old files are returned back to the data center.

• Backups should be scheduled to run automatically during backup cycles (i.e., daily,
weekly, monthly, yearly, quarterly, and/or semiannually) depending on the type of data.
• Data can be classified as sensitive data, operational and financial data, general and
public data, etc.
• For instance, an organization may schedule partial incremental or differential backups of
all financial data on a daily basis, and a full system backup of all organization data every
Friday and every last day of the month.
• The same organization may schedule additional partial or full backups of sensitive and
confidential data every quarter and every year.
• Backups should also be rotated (ideally on a daily basis) and stored off-site.
• Normally, backup tapes that have been stored on-site in a safe or a secure vault for some
time are taken to the off-site facility.
• The organization should maintain information on which tapes are located on-site and off-
site.

• The protection of backup media (e.g., tape cartridges, disk packs containing
data and software, etc.) should be part of the organization’s backup policies.
• Onsite backups should be stored at a computer center vault, which should be
restricted to authorized personnel only (e.g., computer operators, librarians,
computer center supervisor, security officer, etc.).
• Unauthorized personnel must sign a visitor’s log and be accompanied by
authorized personnel before obtaining access.
• The computer center vault should be protected with adequate physical and
access controls.
• Similarly, off-site backups should be stored in an area that is restricted to
authorized personnel only.
• The off-site location should also have adequate physical and access controls.

• Backups stored on-site and off-site should be frequently checked for premature
loss due to deterioration of the media.
• Backup media is susceptible to gradual degradation as the physical material
decays.
• Procedures should be performed to identify possible media degradation or
improper creation of backups to prevent loss of data.
• Periodic scanning of the media, verification of the backup creation, or restoration
of the data, will usually indicate whether the data can be read.
• When media degradation is discovered, the stored data should immediately be
transferred to new media.
• When backups are improperly written, a procedure should exist to correct and
reperform the process.

• Backups should be monitored frequently and logs should be completed supporting such monitoring
and successful completion of the backup.
• Management should also review these logs per company policy.
• For example, each morning an IS operator should be responsible for checking his/her computer in
order to confirm backup completion, or identify any error messages displayed by the system that
prevented the backup from completion.
• Additionally, system generated logs should be examined by IS operations personnel in order to
identify files that might not have been backed up by the system.
• When exceptions to the backup process are identified, the IS operator should attempt to perform
restart procedures in order to resolve them.
• If the operator is unable to do so, he/she should escalate the problem for resolution.
• Finally, if unable to correct the exceptions, an external consultant or vendor should be contacted for
support.
• The IT or IS manager must review and maintain control logs of all backups, as well as provide
documentation, when necessary, regarding recovery procedures performed and backup results.

Cloud Backups
• Cloud backups may offer the perfect and ideal scenario for the future organization.
• With a cloud backup, files are available everywhere and are no longer dependent on
any single computer or server, allowing for a quick and smooth restoring of the data in
the event of a disaster.
• Additional advantages of cloud backups include saving money on storage costs, and
the ability to back up more frequently as well as enjoy off-site, redundant storage of
critical data.
• A further advantage is that organizations can outsource cloud backup services from
third-party entities that specialize in data backup and protection.
• Organizations can then eliminate many of the headaches involved in data backup
without surrendering control of their most important asset, information.
• These specialized “outsource” entities also offer the latest advances in security,
encryption, disaster recovery, and continuous real-time data protection, among other
services.

Cloud Backups cont.
• A research conducted by Forrester Consulting in 2014 concluded that more
and more organizations are relying on cloud backups to assist with their
continuity and disaster recovery tasks.
• According to the research, an approximate 44% of the organizations
surveyed have already either transferred the majority of their continuity and
disaster recovery tasks into the cloud (including backups), or have plans to
do so in the near future.
• Other respondents expressed concern that moving their information in the
cloud would still open up opportunities for privacy and security issues, and
would therefore remain with their current data environments.
• All respondents agree that the ultimate goal, whether backing up to the
cloud or not, is to have the confidence of knowing that, in the case of
catastrophe, the information will be protected and available.

Business Continuity Plan
• The objective of a business continuity plan (BCP) is to describe processes, steps,
and/or procedures to be carried out in the event of an emergency (i.e., natural
disaster or an unplanned interruption to normal business operations) to achieve a
timely recovery and availability of all essential business processes, including the
information systems.
• The BCP normally addresses:
• Key computer processing locations
• Application systems and user requirements for key business processes
• End-user activities for key business processes
• Telecommunications and networks
• Key databases, information warehouses, etc.
• Human resources
• Personal safety of employees and others

Business Continuity Plan cont.
• The plan assists organizations to respond to emergencies while continuing core activities and
operating critical business processes at a level acceptable to management.
• The lack of a comprehensive BCP in the event of an emergency may translate into delayed
restoration of business processes and information systems.
• This may result in the inability of the organization to continue operations; loss of revenues and
incurring in unnecessary expenses; loss of competitive advantage; loss of customer confidence and
market share; and fines and sanctions; among others.
• In the event of an emergency, degraded services may be acceptable for some period of time.
• Nonetheless, the goal is to restore the affected systems and services to their optimum levels as
immediate as possible.
• A common control activity tested by IT auditors within this area involves whether the organization’s
BCP has been prepared and approved by management, based on a business impact assessment.
• Other controls evaluate if the plan is regularly tested and updated to reflect the results of such
tests.

Disaster Recovery Plan
• Disasters, whether natural (e.g., earthquakes, tsunamis, hurricanes, tornados, flood,
fires, etc.) or unnatural (e.g., cyberattacks, disruption of service, fraud, terrorism,
market collapse, etc.) create economic chaos and severe business interruptions.
• This is why having a Disaster Recovery Plan (DRP) in place is such an important tool
for businesses.
• A DRP is a survival tool that helps businesses respond to threats and recover in the
wake of an event that disrupts normal business operations.
• Provided the plan is supported by management, updated frequently, and tested and
maintained accordingly, it offers the chance for businesses to survive.
• Should a disaster occur, the payoff is to recover without significant business or
operations downtime and loss.
• Disasters can occur to businesses at any time and can impact them significantly.

Disaster Recovery Plan cont.
• The impact of these and many other related disasters are felt not only by the
business, but also by suppliers and customers who relied on that business
for their products and sales.
• One of the early critical steps in DRP is identifying who is responsible for
distributed disaster recovery.
• Is recovery of all technology the sole responsibility of IT or the business
units?
• The answer depends on who has control over the hardware, software, and
data.
• In most cases, IT and users must work together to identify critical
information and resources that will need to be recovered in the event of a
disaster.

• A DRP should address both partial and total destruction of computing resources.
• Distributed systems and microcomputer systems should be included within the
plan.
• Critical functions that are performed on these platforms should be identified and
procedures established for restoring operations.
• Microcomputers are an important tool for daily work processing, and the
recovery of these tools should not be overlooked.
• Information on the basic microcomputer configuration, including hardware and
software, should be maintained for ease of recreating the processing
environment.
• In addition, a backup of critical data files should be kept off-site along with
operating and recovery procedures.

• A DRP must be based on the assumption that any computer system is subject to several
different types of failures.
• In particular, procedures must exist and be tested for recovery from failures or losses of
equipment, programs, or data files.
• In the case of equipment failures, each installation might have a contractual agreement
covering the use of an alternate site with a comparable computer configuration.
• Examples of these are cold sites and hot sites.
• A cold site is an empty building that is prewired for necessary telephone and Internet
access, plus a contract with one or more vendors to provide all necessary equipment
within a specified period of time.
• A hot site, on the other hand, refers to a facility that is not only prewired for telephone
and Internet access, but also contains all the computing and office equipment the
organization needs to perform its essential business activities.

• Before assembling a DRP, the assets of the organization (e.g., hardware,
software, facilities, personnel, administrative, data, etc.) and their
replacement values should be identified.
• Specific risks that would result in temporary or permanent loss of assets (say
from fire, flood, sabotage, viruses, etc.) should also be recognized.
• Next, the impact of these losses (e.g., modification, destruction, DoS, etc.)
must be assessed.
• Finally, the value of the asset should be compared against the frequency of
loss to justify the disaster recovery solution.
• Following completion of the above, a DRP can be assembled.

DRP Components
• The DRP should identify various levels of recovery, from an isolated event to
a widespread disaster.
• The timeliness of recovery will depend on the loss of exposure for the
particular program or system.
• When the plan is completed, it should be tested to identify potential
problems.
• Testing should be conducted on a periodic basis to validate assumptions,
and to update the plan based on the constantly changing environment.
• Testing also provides the opportunity to practice the recovery procedures
and identify missing elements that may need to be added.

DRP Components cont.
• The DRP should address components, such as:
1. Objectives and mission statement
2. Key personnel involved
3. Full and incremental program and data backups
4. Tests and drills
5. Program and data backups stored off-site
6. Disaster recovery chairperson and committee appointed
7. Emergency telephone numbers
8. List of all critical hardware and software applications
9. Insurance coverage
10. Communication plans
11. Up-to-date system and operation documentation
12. Employee relocation plans to alternate work sites

DRP Components cont.
• All members of the organization should be familiarized with the DRP.
• If an emergency occurs, it would be easy for staff members to execute their
roles in the plan.
• Exercising the plan confirms that efforts are not duplicated and all the
necessary steps are taken.
• It is important to have a written DRP with detailed steps as individuals
unfamiliar with the process may need to perform the disaster recovery
process in a real emergency.

Auditing End-User Computing
• EUC groups have grown rapidly in pervasiveness and importance.
• The knowledge worker’s application of technology to help business solve problems has
been one of the major forces of change in business today.
• User dominance will prevail. Auditors, as knowledge workers and users, can assist
departments in identifying sensitive or critical PC applications that require special
attention.
• In organizations where controls are inadequate or nonexistent, auditors can play a key
role in developing these controls for EUC groups.
• Once controls are in place, auditors can examine them for adequacy and effectiveness.
• Auditing EUC groups can encompass the entire spectrum of IS reviews from systems
development to disaster recovery.

Audit Involvement in Information Systems
Operations
• An audit of an organization’s IS operations, for instance, would provide IT auditors assurance
that operations, including processing of data, are adequately designed and ensure the
complete, accurate, and valid processing and recording of financial transactions, for instance.
• Such examination would also provide assurance that financial information and relevant
components of the IT infrastructure are appropriately stored and managed.
• Insufficient or inadequate IS operations and controls, however, may result in the following risks:
• Incomplete or inaccurate processing of financial transactions whether executed online or
through a batch.
• Inability to reconstruct (or restore) financial data from source documentation following an
emergency or a serious systems incident or failure.
• Unauthorized personnel being able to access facilities, which may result in loss or
substitution of data, programs, and output or malicious damage to the computer facility
and equipment.

Operations cont.
• Common objectives of an IS operations audit include ensuring that:
• IT operations support adequate scheduling, execution, monitoring, and
continuity of systems, programs, and processes to ensure the complete,
accurate, and valid processing and recording of financial transactions.
• Backups of financial information are appropriately scheduled, managed,
and monitored, ensuring information is accurate and complete. Backed
up information is also readable and restored effectively without major
implications.
• Physical access is appropriately managed to safeguard relevant
components of the IT infrastructure and the integrity of financial
information.

Operations cont.
• Without the implementation of appropriate controls, unnecessary damage or disruption to the
organization’s data processing could occur.
• Such damage could result in failure of the organization’s critical processes.
• Control activities should be implemented to address risks such as the above.
• For example, control activities would typically address the completeness of transactions input
for processing, including, among others, whether on-line transactions process to normal
completion, all necessary batch jobs are processed, processing is performed timely and in the
appropriate sequence, and whether inputting and processing transactions is valid and effective.
• Examples of controls and procedures normally employed by IT auditors when examining data
processing include:
• Batch and/or online processing is defined, timely executed, and monitored for successful completion.
• Exceptions identified on batch and/or online processing are timely reviewed and corrected to ensure
accurate, complete, and authorized processing of financial information.

Operations cont.
• To ensure backups are effective and information is accurate, complete, and restored without major implications,
IT auditors may evaluate and test control activities such as whether:
• Procedures for the restoration and recovery of financial information from backups have been implemented in the event of
processing disruption, shut-down, and restart procedures.
• Automated backup tools have been implemented to manage retention data plans and schedules.
• Backups are controlled, properly labeled, stored in an off-site secured environmentally location, and rotated to such facility on a
periodic basis.
• Management plan and schedule (1) backup and retention of data and (2) erasure and release of media when retention is no
longer required.
• Management periodically reviews retention and release records.
• Backups are archived off-site to minimize risk that data is lost.
• Management periodically reviews completion of backups to ensure consistency with backup and retention plans and schedules.
• Tests for the readability of backups are performed on a periodic basis. Results support timely and successful restoration of
backed up data.
• Procedures for the restoration and recovery of financial information from backups have been implemented in the event of
processing disruption, shut-down, and restart procedures consistent with IT policies and procedures.

Operations cont.
• To ensure whether physical access is appropriately managed to safeguard relevant components of
the IT infrastructure and the integrity of financial information, IT auditors may evaluate and test
whether:
• Physical access is authorized, monitored, and restricted to individuals who require such access
to perform their job duties.
• Users have access to the data center or computer room. If so, which users.
• A physical access control mechanism (e.g., access cards, biometrics, traditional lock and key,
security guards, etc.) is used to restrict and record access to the building and to the computer
room, and authority to change such mechanism is limited to appropriate personnel.
• Biometrics authentication is employed through fingerprint, palm veins, face recognition, iris
recognition, retina scans, voice verification, etc.
• Entry of unauthorized personnel is supervised and logged, and such log is maintained and
regularly reviewed by IT management.
• Policies and procedures exist for granting access to the data center.
• Requests and approvals are required and completed before physical access is granted.

Audit of Data Centers
• Data center audits are performed to evaluate the administrative controls over data
center resources and data processing personnel (IS operations, systems analysis, and
programming).
• The scope of the audit may include an evaluation of the planning, staffing,
policies/procedures, assignment of responsibilities, budgets, management reports, and
performance measures in areas, such as:
• hardware management, software management, resource protection and recovery,
access controls, operations management, and network/communications
management.
• A data center audit may focus on any one of these accountabilities, or may include all of
them depending on the size of the data center, operations staff, and time budget.
• For example, for a large data center with multiple computers and a large number of
users, the audit may focus only on access controls and security administration.
• For a small data center, the audit might include all of the accountabilities.

Audit of Data Centers cont.
• Common objectives for data center audits relate to the identification of audit risks in the
operating environment and the controls in place to mitigate those audit risks in accordance
with management’s intentions.
• The IT auditor must evaluate control mechanisms and determine whether objectives have
been achieved.
• Preaudit preparation is required for effective data center audits.
• These include meeting with IT management to determine possible areas of concern.
• At this meeting, the following information should be obtained:
• Current IT organization chart
• Current job descriptions for IT data center employees
• List of application software supported and the hardware hosting them
• IT policies and procedures
• Systems planning documentation and fiscal budget
• Business continuity and disaster recovery plans

Audit of Data Centers cont.
• IT audit personnel should review the preceding information and become
familiar with the way the data center provides IT services.
• In addition, auditors should become familiar with basic terminology and
resource definition methodology used in support of the operations
environment.
• Audit engagement personnel should review the audit program and become
familiar with the areas assigned for the completion of an audit task.

Audit of a DRP
• A DRP is a plan established to enable organizations and their IT
environments to quickly restore operations and resume business in the event
of a disaster.
• The plan must be updated on a regular basis to reduce the likelihood of
incorrect decisions being made during the recovery process, and decrease
the level of stress that may be placed on the disaster recovery team
members during this process.
• From an audit standpoint, the DRP to be evaluated and tested by the IT
auditor must include a mission statement and objectives.
• These objectives should be realistic, achievable, and economically feasible.
• The objectives provide direction in preparing the plan and in continually
reevaluating its usefulness.

Audit of a DRP cont.
• Documentation supporting disaster simulation drills or tests conducted must be available
to assess technical and non-technical procedural aspects of the organization’s DRP.
• Tests reduce the opportunity for miscommunication when the plan is implemented during
a real disaster.
• They also offer management an opportunity to spot weaknesses and improve procedures.
• Some of the control activities the IT auditor can evaluate and test would relate to whether:
• All media (tapes, manuals, guides, etc.) are stored in a secured environmentally-
controlled location.
• Adequate insurance coverage has been acquired and maintained.
• On-going readability of backup and retained data is tested periodically through
restoration or other methods.
• Removable media are labeled to enable proper identification.

• Unfortunately, organizations are often unwilling to carry out a test because
of the disruption that occurs to daily operations and the fear that a real
disaster may arise as a result of the test procedures.
• Therefore, a phased approach to testing would be helpful in building up to a
full test.
• A phased test approach would, for example, consider giving personnel prior
notice of the test so that they are prepared.
• The approach would also simulate the disaster with warning (i.e., at a
convenient time and during a slow period) and without warning.

• Unless a DRP is tested, it seldom remains usable.
• A practice test of the plan could very well be the difference between its
success or failure.
• The process is parallel to the old adage about the three things it takes for a
retail business to be successful: location, location, location.
• What is needed for an organization’s DRP to allow it to continue to stay in
business is testing, testing, and more testing.
• The audit of a DRP is an important check for both the IT auditor and
management.
• The major elements and areas of the plan should be validated and assessed
to ensure that in the event of a disaster, essential business processes and
information systems can be recovered timely.

Audit Tools
• Depending on the size and complexity of the organization, control objectives
and activities may need to be revised or expanded to obtain adequate audit
coverage of the change control management function.

Lesson Overview
• This chapter presents an overview of IS operations as a relevant component
of the IT infrastructure.
• The chapter discusses the aforementioned, and provides sample objectives
and control activities the IT auditor should focus on when examining IS
operations.
• The chapter also describes end-user computing (EUC) groups, and provides
guidelines when auditing such groups.
• Lastly, IT audit involvement and procedures are described when examining
IS operations.

Summary
• Within an IT environment, controls related to information systems (IS)
operations provide a structure for the day-to-day management of operations
and maintenance of existing systems.
• IS operations is also one of the three major general computer controls used to
assess organizations’ policies and procedures related to application systems in
order to support the effective functioning of application controls.
• Examples of general controls within IS operations address activities such as job
monitoring and tracking of exceptions to completion, access to the job
scheduler, and data backups and offsite storage, among others.

Chapter 10_2 - Operasi Sistem Informasi.pptx

More Related Content

Similar to Chapter 10_2 - Operasi Sistem Informasi.pptx

Recently uploaded

Chapter 10_2 - Operasi Sistem Informasi.pptx