Downloaded 250 times
Uploaded byBharath Rao
IS Audit and Internal Controls
The document discusses various aspects of audits and internal controls, emphasizing the importance of legislative frameworks like Sarbanes-Oxley and ISO standards. It outlines components of internal controls, including risk assessment, control activities, and application controls, detailing their significance in maintaining organizational integrity and operational effectiveness. Furthermore, it highlights the necessity of general computer controls to support application controls in ensuring the proper functioning of information systems.
More Related Content
Similar to IS Audit and Internal Controls
IS Audit and Internal Controls
- 1. IS Audit and InternalControls BHARATH RAO
- 2. Professional Audit CA blog.bharathraob.com • • • • • Audit Tax Company Matters Legal Complicances Accounts •Statutory Audit • Internal Audit • Tax Audit (44AB, VAT etc) • Special Audits 2 10/19/2013
- 3. • • • • • • IS Audit Design ofAccess, Process Controls Implementation of ERP Implementation of GRC Forensic Audit Legal Compliances and Frameworks for IT Governance: • • • • • • Sarbanes - Oxley Act 2002 – Section 302 and 404 Companies Act 2013 – Section 134 and 143 ISO 27001 ISO 27002 ISO 27031 COBIT 5/COSO Framework More work more pay blog.bharathraob.com 3 10/19/2013
- 4.
- 5. It means policiesframed by the management in order to have stronger and adequate control within the organization, which can be checked by the internal or stat auditor in order to ensure that the goals and objectives are duly met. Internal Controls blog.bharathraob.com 5 10/19/2013
- 6.
- 7.
- 8. IS Controls Application Controls IS Controls blog.bharathraob.com ITGeneral Controls 8 10/19/2013
- 9. Maintaining Confidentiality Preserving Integrity EnsuringAvailability Objective of IS Controls blog.bharathraob.com 9 10/19/2013
- 10. Application software isthe software that processes business transactions. The application software could be a payroll system, a retail banking system, an inventory system, a billing system or, possibly, an integrated ERP. Controls, which relate to the business applications thereby leading to judicial use of the application and are enforced through the application itself to the end user. Applications Controls blog.bharathraob.com 10 10/19/2013
- 11. • • • • • • • General Ledger Fixed Assets InventoryControl Sales Manufacturing Resource Planning (MRP) Human Resources And, everyone’s favorite – Payroll… Examples of Applications blog.bharathraob.com 11 10/19/2013
- 12. Input Controls Processing Controls Output Controls Integrity Controls Management Trail Data Checks and Validation s Duplicate Checks, File Identificati ons and validations Update Authorizat ion Data Encryptio n, Input Validation Snapshots, Time Stamps Typesof Application Controls blog.bharathraob.com 12 10/19/2013
- 13. ITGCs may alsobe referred to as General Computer Controls which are defined as: Controls, other than application controls, which relate to the environment within which computer-based application systems are developed, maintained and operated, and which are therefore applicable to all applications. These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems. General Controls blog.bharathraob.com 13 10/19/2013
- 14. Physical Access Data Center ISSecurity SDLC and Change Management (CM) Logical Controls Backup and Recovery End User Computing Areas of IT General controls blog.bharathraob.com 14 10/19/2013
- 15. Checking the Documentation of Policies,Processes Reviewing Logs that are generated by applications Understanding the solutions that are present other than business applications and their role The IS audit blog.bharathraob.com Testing and gathering of evidences based on Sampling • Screen shots, Photos, Email Conversations, Scans 15 10/19/2013
- 16. • Link RCM –Risk control matrix blog.bharathraob.com 16 10/19/2013
- 17. Suggested Sample Size Frequencyof Performance Number of Items to Test per Annual Number of Items to Test per Quarter Manual General Controls Many times per day 25 6-7 Manual General Controls Daily 20 5 Manual General Controls Weekly 10 2-3 Manual General Controls Monthly 3 1 Manual General Controls Quarterly 2 0-1 Manual General Controls Annually 1 Nature of Control Programmed General Controls Test one instance of each programmed control activity. Sampling blog.bharathraob.com 17 10/19/2013
- 18. • BHARATH RAOB • +91 96113 19421 | bharath@bharathraob.com • www.bharathraob.com blog.bharathraob.com /bharathraob Thank you blog.bharathraob.com 18 10/19/2013
Editor's Notes
- #5 Control: It literally means Internal Controls that is present in an business environment. It can be IT Controls or non IT Controls.Design: It refers to the working part of the control which is a summary on paper/blue print. Basically a working model of the control on paper.Operation: Actual performance of the Control is assessed here.Risk: It is the rate at which there is a threat to the business which has arisen from a specific happening/non happening.Process: A set of tasks make a work flow. A set of work flows make a process. A process is controlled by a “Process owner” or “ Function head”. Eg. HR Process, Procurement Process
- #7 Control Environment The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors. Risk Assessment Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change. Control Activities Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. Information and Communication Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.Monitoring Internal control systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.
- #15 Examples of controls in the areas:Physical Access – Security Personnel, Physical Locks, Bio Metric LocksData Center – Biometric locks, Presence of server racks, Presence of AC, Fire ExtinguishersIS Security – Firewall, Antivirus, Anti Spyware, Timely Updataion of patches and updates of AV and other softwaresSDLC and CM – Documetned Process for procuring software. Documented Process of incorporating changes to the acquired software.Logical Controls – Disabling of USB Ports, Automatic screen lockBackup and Recovery – Daily Backup of data and environment (OS), Restoration Practice trialEnd User computing – Logging of user activity, Review