Compliance measures adherence to defined policies and procedures through auditing, monitoring, and investigating at multiple organizational levels. Level one focuses on component owners ensuring appropriate access controls. Level two involves auditing functions assessing internal controls. Level three is the security team responsible for organization-wide implementation of security. Effective compliance requires coordination across these levels.

1. Compliance

2. Compliance
• Compliance measures the extent to which
defined policies, standards, and procedures
are being followed.
• Compliance includes auditing, monitoring, and
investigating at several different levels of the
organization.

3. First level
• Detection of security violations minimizes the damage
done to the organization.
• The information owner or individual assigned
responsibility for the component must ensure that
appropriate preventative and detective controls are in
place and are being utilized effectively.
• Controls at this level include establishing and
maintaining access, implementing monitoring and alert
tools, administration of audit trail reports,
management review of log-in attempts, implementing
security parameters, and investigation of lockouts.

4. Second level
• Audit function.
• The audit function can be performed by the
internal audit department, external auditors, or a
combination of both according to industry
standards.
• Audit objectives include ensuring compliance
with corporate policies, standards, and
procedures as well as developing programs to
understand the control environment, perform
risk assessment, and establish control
procedures.

5. Third level
• Security Team or Committee level.
• This is investigative in nature and, instead of
focusing on a particular application or
component, the Security Team is responsible
for ensuring that security is implemented
organization wide.

6. LEVEL ONE COMPLIANCE: THE
COMPONENT OWNER
• To ensure appropriate access, a procedure
should be established to have component
owners, network and application
administrators run a listing of specified access
by user on a quarterly basis, at a minimum.
• These reports are then submitted to the
security liaison of each business function to
review for appropriateness.

7. Additional responsibilities of the security coordinators/
liaisons are to:
• Ensure that application access forms are
initiated for existing and new users within the
respective departmental area
• Ensure that access is modified or deleted
when employees and nonemployees
(consultants, contractors, business partners)
operating within their business function or
site are transferred or terminated

8. • Conduct user security awareness within their
departmental function
• Ensure that the enterprise Confidentiality
Agreement and exit interview forms are
signed by all users operating within their
department or area of responsibility
• Actively participate as a member of the
Security Team
• Coordinate with the Security Officer on all
security-related matters

9. • Network and application administrators are
technically responsible for the operation of
the network or application.
• The administrators set security defaults on the
system and establish the baseline control
standards upon completion of a risk
assessment and identification of
vulnerabilities.

10. LEVEL TWO COMPLIANCE: THE AUDIT
FUNCTION
• The audit function is concerned with obtaining
an understanding of and evaluating an
organization’s internal control.
• Internal control refers to the processes
established by an organization’s board of
directors, management, and technical staff to
provide effective and efficient operations,
reliable financial reporting, and compliance
with applicable laws and regulations.

11. The components of internal control
include:
• The control environment
• Risk assessment
• Control procedures
• Monitoring activities
• Information and communication

12. • The integrity, ethical values, and fitness of the
people within the organization establish the
control environment.
• Audit seeks to ensure that the control
environment is effective by assessing the
stability and consistency of the factors
mentioned above.
The control environment

13. Risk assessment
• Risk assessment provides identification and
analysis of realistic and associated risks in
achieving the organization’s business objectives.
• The audit function seeks to establish information
security controls that are proportionate to the
value, sensitivity, and criticality of the systems
and information being protected.
• This includes the probability, frequency, and
severity of loss or damage that can occur.

14. Control procedures
• Control procedures ensure that management
directives are implemented.
• Control procedures include authorization,
verification, approval, reconciliation, analysis
of the efficiency of operations,
implementation of access controls, physical
security of assets, and segregation of duties.

15. Monitoring activities
• Monitoring activities include well-defined and
scheduled management and supervisory activities to
determine whether control procedures are performed
effectively and consistently.
• Auditors monitor the control processes and procedures
for indications of weakness in the control environment
that has been established, while security, network, and
application administrators monitor specific
implementations for errors, damage, or indications of
unauthorized access to systems and applications.

16. Information and communication
• Information and communication in the audit
environment includes the timely processing
and dissemination of operational, financial,
and compliance- related information to
manage the business effectively.

17. • Auditing is most often coupled with the
reliability of financial reporting.

18. • The second portion of a computer audit
encompasses understanding and evaluating
the general computer controls for an
operating environment.

19. • When testing general computer controls,
there are four areas of consideration:
– Information security
– System acquisition, development, and
maintenance
– Computer operations
– Information systems support

20. • Information security includes testing for
logical security of online and batch access
controls.
• System acquisition, development, and
maintenance include the quality of new
systems design and implementation, as well as
program change control.
• Computer operations entail media library
management, job scheduling, physical control
of devices, information and data, report
distribution, backup, and recovery.

21. • Information systems support includes all of
the peripherals that support an application
and processing environment such as controls
related to operating system software,
database administration, network operations,
and end-user computing.

22. Financial audit
• The auditors must determine what level of
reliance they place on key controls.
• When reliance is high — which means that
they trust the output data to be true and
correct — a test of the key controls must be
performed for completeness, accuracy,
validity, and restricted access.

23. • Controls are a combination of monitoring
controls, and both manual and automated
application controls.
• Application controls and related control
objectives are procedures designed to ensure
the integrity of the accounting records.

24. Control objectives include:
• Completeness : all transactions are recorded,
entered into the system, and accepted for
processing once and only once. All
transactions input are updated to the
appropriate files, and once updated remain
correct and current.

25. • Accuracy : data and information are recorded
and accurately input to the computer. Changes
made to data files are accurately input, and all
input transactions are accepted for processing
and updated to the appropriate data files.
• Validity: transactions are authorized and
represent true and valid transactions related
to the appropriate client. Changes to existing
data are not made without appropriate
authorization.

26. • Restricted access : only individuals by virtue of
their job function can access data files for
changes or updates. Controls protect the
confidentiality of the data and physical
controls protect cash and inventory.

27. • When testing the general computer controls,
the auditor is looking for potential errors in
completeness, accuracy, validity, and
restricted access.
• Tests of validity ensure that for a process that
is taking place, whether it is a calculation or
allowing a user to gain access to a system, it is
a relevant and legitimate process.

28. • A risk-based approach to auditing determines
how often a particular application or
operating system is audited and will depend
on the assessed risk to the organization as
well as the strength of the control
environment for a particular application or
operating system.

30. LEVEL THREE COMPLIANCE: THE
SECURITY TEAM
• The Security Team or Committee is
responsible for ensuring that security is
implemented organization wide.
• An ISA that has been developed and
implemented needs to be continuously
assessed for effectiveness, changes to the
environment that will require changes to the
ISA, and modifications for improvement to the
overall architecture.

31. • The Security Team is looking for something
different than that of the system auditors.
• The Security Team is looking for implementation
of the policies, standards, and procedures that
have been developed under its direction.
• Auditors are looking for the effectiveness of
controls as they are implemented for critical
programs and applications.
• The network administrator is concerned with the
specific implementation details for a particular
component.

32. How does the Security Team assess
the effectiveness of the ISA?
• The Security Team should be involved in
reviewing the results of all audit, control, or
security reviews that occur within the
organization.
• The Security Team is tasked with
understanding why the results may not have
been so spectacular and what was the
systemic reason for lax or ineffective controls.

33. • The Security Team also acts as the
investigative arm to security issues and
incidences.

34. LINE OF BUSINESS (LOB) SECURITY
PLAN
• The LOB Security Plan should provide an
overview of the operational environment,
identify key controls within the organization,
and provide the basis for measuring
compliance to the corporate security policies,
standards, and procedures.

35. • The LOB Security Plan is designed to provide a
baseline document for understanding the
processing environment, performing baseline
security assessments of that environment, and
seeking to make improvements to meet the
corporate goals and objectives for security.

36. ENTERPRISE MANAGEMENT TOOLS
• Account integrity : to identify and prevent users
from having security privileges that exceed the
security policy
• Backup integrity : to identify files that are not
being backed up
• File access : to examine files to verify security
settings that are established in the security policy
• File attributes : to identify files whose attributes
have changed from the baseline

37. • File find : to check files for viruses and other
corruption that could lead to data loss
• Log-in parameters : to scan for log-in
parameters that fall outside the security policy
• Object integrity : to identify changes in
ownership and permissions for software
objects
• Password strength : to check the password
parameters for validation against the security
policy

38. • Startup files : to examine startup files for
potential security breaches
• System auditing : to monitor audit trails and
system accounts
• System mail : to check known problem areas
for security lapses

39. Pitfalls to an Effective ISA Program
• Lack of project sponsorship and executive management
support
• Executive management’s lack of understanding of
realistic risk
• Lack of resources
• Impact of mergers and acquisitions on disparate
systems
• Independent operations throughout business units
• Discord between mainframe versus distributed
computing cultures

40. • Corporate cultures with the objective to foster
trust in the organization that contradict an
environment requiring more stringent controls
• Fortune 500 enterprises that have grown from
mom-and-pop shop beginnings and do not
completely support the constraints conducive
to secure operations
• Third-party and remote network management
• The rate of change in technology