1 chapter three it risks and controls. 2 the risk management process identify it risks assess it...
TRANSCRIPT
1
Chapter ThreeChapter Three
IT Risks and ControlsIT Risks and Controls
2
The Risk Management ProcessThe Risk Management ProcessIdentify IT
Risks
Assess IT Risks
Identify IT Controls
Document IT Controls
Monitor IT Risks and Controls
3
Types of IT RisksTypes of IT Risks
Business riskBusiness risk Audit risk = IR * CR * DRAudit risk = IR * CR * DR
– inherent risk (IR)inherent risk (IR)– control risk (CR)control risk (CR)– detection risk (DR)detection risk (DR)
Security riskSecurity risk Continuity riskContinuity risk
4
Assessing IT RiskAssessing IT Risk
Threats and vulnerabilitiesThreats and vulnerabilitiesRisk (residual risk) =Risk (residual risk) =+ Expected value of risk (Expected value of risk (Asset Value * Risk LikelihoodAsset Value * Risk Likelihood) ) – Percentage of risk mitigated by the current controlsPercentage of risk mitigated by the current controls+ Uncertainty of knowledge about the vulnerabilityUncertainty of knowledge about the vulnerability
Risk indicators and risk measurement Risk indicators and risk measurement – Risks relative to IT processesRisks relative to IT processes
5
Valuation of AssetValuation of Asset
Assets: People, Data, Hardware, Software, Assets: People, Data, Hardware, Software, Facilities, (Procedures)Facilities, (Procedures)
Valuation MethodsValuation Methods– Criticallity to the organization’s successCriticallity to the organization’s success– Revenue generatedRevenue generated– ProfitabilityProfitability– Cost to replaceCost to replace– Cost to protectCost to protect– Embarrassment/LiabilityEmbarrassment/Liability
6
Internal Control (IC)Internal Control (IC)
COSO – 5 components of IC COSO – 5 components of IC – Control environmentControl environment– Risk assessmentRisk assessment– Control activitiesControl activities– Information and communicationInformation and communication– MonitoringMonitoring
International IC StandardsInternational IC Standards– CadburyCadbury– CoCoCoCo– Other country standardsOther country standards
7
Quality Control StandardsQuality Control Standards
ISO 9000 series – certifies that ISO 9000 series – certifies that organizations comply with documented organizations comply with documented quality standardsquality standards
Six Sigma – an approach to process and Six Sigma – an approach to process and quality improvementquality improvement
8
Statements on Statements on Auditing StandardsAuditing Standards
Issued by AICPA’s Accounting Standards Issued by AICPA’s Accounting Standards BoardBoard
SAS 78 SAS 78 Consideration of IC in a Financial Consideration of IC in a Financial Statement Audit: An Amendment to SAS Statement Audit: An Amendment to SAS No. 55No. 55
SAS 94 SAS 94 The Effect of IT on the Auditor’s The Effect of IT on the Auditor’s Consideration of IC in a Financial Consideration of IC in a Financial Staetment AuditStaetment Audit
New standards related to risk assessmentNew standards related to risk assessment
9
ISACA’s CobiTISACA’s CobiT Integrates IC with information and ITIntegrates IC with information and IT Three dimensions: information criteria, IT Three dimensions: information criteria, IT
processes, and IT resourcesprocesses, and IT resources Requirements (information criteria) of quality, Requirements (information criteria) of quality,
fiduciary, and securityfiduciary, and security Organizes IT internal control into domains and Organizes IT internal control into domains and
processesprocesses– Domains: planning and organization, acquisition and Domains: planning and organization, acquisition and
implementation, delivery and support, and monitoringimplementation, delivery and support, and monitoring
– Processes detail steps in each domainProcesses detail steps in each domain
10
IT Control Domains and IT Control Domains and ProcessesProcesses
11
IT ControlsIT Controls COSO identifies two groups of IT controls:COSO identifies two groups of IT controls:
– Application controls – Application controls – apply to specific apply to specific applications and programs, andapplications and programs, and ensure data ensure data validity, completeness and accuracyvalidity, completeness and accuracy
– General controls – General controls – apply to all systems and apply to all systems and address IT governance and infrastructure, security address IT governance and infrastructure, security of operating systems and databases, and of operating systems and databases, and application and program acquisition and application and program acquisition and development development
A574 Internal Controls For Business
12
Segregation of DutiesSegregation of Duties
Transaction authorization is separate from Transaction authorization is separate from transaction processing.transaction processing.
Asset custody is separate from record-keeping Asset custody is separate from record-keeping responsibilities.responsibilities.
The tasks needed to process the transactions are The tasks needed to process the transactions are subdivided so that fraud requires collusion.subdivided so that fraud requires collusion.
A574 Internal Controls For Business
13
Separation of Duties within ISSeparation of Duties within IS
14
Classification of ControlsClassification of ControlsPreventive Controls: Issue is prevented from Preventive Controls: Issue is prevented from
occurring – cash receipts are immediately occurring – cash receipts are immediately deposited to avoid lossdeposited to avoid loss
Detective Controls: Issue is discovered – Detective Controls: Issue is discovered – unauthorized disbursement is discovered unauthorized disbursement is discovered during reconciliationduring reconciliation
Corrective Controls: issue is corrected – Corrective Controls: issue is corrected – erroneous data is entered in the system and erroneous data is entered in the system and reported on an error and summary report; a reported on an error and summary report; a clerk re-enters the dataclerk re-enters the data
15
Application Control GoalsApplication Control Goals For business event inputs, ensureFor business event inputs, ensure
– Input validityInput validity– Input completenessInput completeness– Input accuracyInput accuracy
For master data, ensureFor master data, ensure– Update completenessUpdate completeness– Update accuracyUpdate accuracy
16
Application Control GoalsApplication Control Goals Input validityInput validity
– Input data approved and represent actual Input data approved and represent actual economic events and objectseconomic events and objects
Input completenessInput completeness– Requires that all valid events or objects be Requires that all valid events or objects be
captured and entered into the systemcaptured and entered into the system Input AccuracyInput Accuracy
– Requires that events be correctly captured and Requires that events be correctly captured and entered into the systementered into the system
17
Systems Reliability AssuranceSystems Reliability Assurance
SysTrustSysTrust WebTrustWebTrust New AICPA Trust PrinciplesNew AICPA Trust Principles
18
Documenting IT ControlsDocumenting IT Controls
Internal control narrativesInternal control narratives Flowcharts – internal control flowchartFlowcharts – internal control flowchart IC questionnairesIC questionnaires
19
Risk Control StrategiesRisk Control Strategies AvoidanceAvoidance
– Policy, Training and Education, or TechnologyPolicy, Training and Education, or Technology
TransferenceTransference – – shifting the risk to other assets, shifting the risk to other assets, processes, or organizations (insurance, processes, or organizations (insurance, outsourcing, etc.)outsourcing, etc.)
MitigationMitigation – – reducing the impact through reducing the impact through planning and preparationplanning and preparation
AcceptanceAcceptance – – doing nothingdoing nothing if the cost of if the cost of protection does not justify the expense of the protection does not justify the expense of the controlcontrol
20
Monitoring IT Risks Monitoring IT Risks and Controlsand Controls
CobiT control objectives associated with CobiT control objectives associated with monitoring and evaluationmonitoring and evaluation
Need for independent assurance and audit Need for independent assurance and audit of IT controlsof IT controls
21