Management of IT Auditing (GTAG 4)

lOMoARcPSD|15941127
GTAG 4 management of it auditing
Decision Making Techniqes (İstanbul Üniversitesi)
Scan to open on Studocu
Studocu is not sponsored or endorsed by any college or university

Downloaded by Tumi Chili ([email protected])
lOMoARcPSD|15941127
IPPF – Practice Guide
Management of IT Auditing

lOMoARcPSD|15941127
Global Technology Audit Guide

Author
Michael Juergens, Principal, Deloitte & Touche LLP
Contributing Author
David Maberry, Senior Manager, Deloitte & Touche LLP
Contributing Editors
Eric Ringle, Senior Manager, Deloitte & Touche LLP
Jeffrey Fisher. Senior Manager, Deloitte & Touche LLP
March 2006
This guide has been produced and distributed through

the sponsorship by Deloitte & Touche LLP.
Copyright © 2006 by The Institute of Internal Auditors, 247 Maitland Avenue, Altamonte Springs, Florida 32701-4201.
All rights reserved. Printed in the United States of America. No part of this publication may be reproduced, stored in a
retrieval system, or transmitted in any form by any means — electronic, mechanical, photocopying, recording,
or otherwise — without prior written permission of the publisher.
The IIA publishes this document for informational and educational purposes. This document is intended to provide information,
but is not a substitute for legal or accounting advice. The IIA does not provide such advice and makes no warranty as to
any legal or accounting results through its publication of this document. When legal or accounting issues arise,
professional assistance should be sought and retained.

lOMoARcPSD|15941127
GTAG — Table of Contents
1. Summary for the Chief Audit Executive … … … … … … … … … … … … … … … … … … … … … … … … …1

2. Introduction … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …2
3. Defining IT … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …3
3.1 IT Management … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …4
3.2 Technical Infrastructure … … … … … … … … … … … … … … … … … … … … … … … … … … … … …4
3.3 Applications … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …4
3.4 External Connections … … … … … … … … … … … … … … … … … … … … … … … … … … … … …5
4. IT-related Risks … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …6
4.1 The Snowflake Theory … … … … … … … … … … … … … … … … … … … … … … … … … … … … …6
4.2 Risk Evolution … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …6
4.3 IT-related Risk Proliferation … … … … … … … … … … … … … … … … … … … … … … … … … … …7
4.4 Types of IT-related Risks … … … … … … … … … … … … … … … … … … … … … … … … … … … …7
4.5 IT Risk Assessment … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …7
5. Defining the IT Audit Universe … … … … … … … … … … … … … … … … … … … … … … … … … … …10
5.1 Tips for the CAE … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …10
5.2 Budgeting for IT Audit … … … … … … … … … … … … … … … … … … … … … … … … … … … …10
6. Executing IT Audits … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …12
6.1 Frameworks and Standards … … … … … … … … … … … … … … … … … … … … … … … … … … …12
6.2 IT Audit Resource Management … … … … … … … … … … … … … … … … … … … … … … … … …14
7. IT Audit Accelerators … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …17
7.1 Audit Facilitators … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …17
7.2 Testing Accelerators … … … … … … … … … … … … … … … … … … … … … … … … … … … … …17
8. Questions for the CAE … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …19
A. Appendix A - Emerging Issues … … … … … … … … … … … … … … … … … … … … … … … … … … … …20
A.1 Wireless Networks … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …20
A.2 Mobile Devices … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …20
A.3 Interfaces … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …21
A.4 Data Management … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …21
A.5 Privacy … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …22
A.6 Segregation of Duties … … … … … … … … … … … … … … … … … … … … … … … … … … … … …22
A.7 Administrator Access … … … … … … … … … … … … … … … … … … … … … … … … … … … … …23
A.8 Configurable Controls … … … … … … … … … … … … … … … … … … … … … … … … … … … … …24
A.9 Piracy … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …24
Other Resources … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …25
About the Authors … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … …26

lOMoARcPSD|15941127
GTAG — Executive Summary for the Chief Audit Executive — 1
Information technology (IT) is changing the nature of the

internal audit function. As new risks emerge, new audit pro-
cedures are required to manage these risks adequately. This
guide, which was created to help the chief audit executive
(CAE) plan and manage the IT audit function more effec-
tively and efficiently, covers how to:
Define IT – What areas should be considered for inclu-
sion in an IT audit plan? The CAE should be able to
measure his or her planned IT audit scope against the
guidelines presented here to help ensure that the scope
of IT audit procedures is adequate.
Evaluate IT-related Risk – It is clear that the evolution
of IT introduces new risks into an organization. This
guide will help the CAE understand how to best iden-
tify and quantify these IT-related risks. Doing so will
help ensure that IT audit procedures and resources are
focused on the areas that represent the most risk to the
organization.
Define the IT Audit Universe – IT audit resources are
typically scarce, and IT audit demands are substantial.
A section on defining the IT audit universe will help
the CAE understand how to build an IT audit plan
that effectively balances IT audit needs with resource
constraints.
Execute IT Audits – The proliferation and complexity of
IT dictates the need for new IT audit procedures.
Auditing by checklist or by inquiry is likely to be insuf-

ficient. This book offers specific guidance for the CAE
on how to execute IT audit procedures and how to
understand what standards and frameworks exist in
the marketplace that can support required procedures.
Manage the IT Audit Function – Managing the IT audit
function may require new management techniques
and procedures. This guide provides helpful hints and
techniques for maximizing the effectiveness of the IT
audit function and managing IT audit resources.
Address Emerging Issues – IT evolves rapidly. This evo-
lution can introduce significant new risks into an
organization. The world class CAE focuses IT audit
attention on not just the basic building blocks of IT,
but also new and emerging technologies. A section on
emerging issues will provide specific information on a
number of emerging technologies, evaluate the risks
that these technologies pose to an organization, and
provide recommendations for how the CAE should
respond to these risks.
The focus of this guide is on providing pragmatic infor-

mation in plain English, with specific recommendations that
a CAE can implement immediately. Further consideration is
given to providing questions that a CAE can ask to help
understand whether his or her IT audit function is a high
performer.
1
lOMoARcPSD|15941127
GTAG — Introduction — 2
There is no question that IT is changing the nature of the produce 100 pallets, and automatically send off
internal audit function. The risks companies face, the types purchase orders for raw materials via Electronic Data
of audits that should be performed, how to prioritize the Interchange (EDI). Potentially, this error may not get
audit universe, and how to deliver insightful findings are all caught until the customer receives the goods — far too
issues with which CAEs must grapple. Without a deep tech- late.
nical background, however, it may be challenging to find
answers to these and other questions. Clearly, to mitigate these types of risks, organizations need
This GTAG is designed for CAEs and internal audit to execute well-designed IT plans that consider these issues.
management personnel who are responsible for overseeing Unfortunately, most organizations have only migrated to high-
IT audits. The purpose of the guide is to help sort through ly automated environments in the last 10 years or fewer. Thus,
the strategic issues regarding planning, performing, and traditionally, there may not have been a deep focus on audit
reporting on IT audits. Consideration will be given to the technology, nor deep sources of thought leadership regarding
fundamentals as well as emerging issues. how to audit technology. Part of that is due to the rapid rate of
IT auditing is increasing in importance, primarily technological advances. There have not been any radical
because organizations are becoming increasingly dependent developments in the three-way match process in many years;
on IT. Key processes are automated, or enabled by technolo- however, the applications used to support these processes
gy. It is possible for a sales order to come in through a Web evolve annually.
site, be transmitted to the warehouse floor, and be shipped to One additional issue that often comes up when planning
the customer without anyone other than the warehouse the IT audit universe is truly understanding how the IT con-
worker seeing or touching the order. trols relate to financial reporting, fraud, and other key issues.
As organizations increase their reliance on IT, two This is relatively easy to grasp when you are evaluating con-
primary issues emerge: trols within an application system (e.g. the three-way match
• A large percentage of the key internal controls settings discussed above). However, it is much more difficult
on which the organization relies are likely to be tech- when evaluating supporting technologies. Assume the organi-
nology driven. Example: Corporate policy states that zation maintains an Internet connection, but does not have a
before any payment is made to a vendor, a three-way firewall to protect the internal network. Are the financials
match is performed. Historically, that match was misstated? Are operations impacted? It becomes harder to draw
likely performed by a clerk, who physically matched the direct correlation as the technology is further removed
pieces of paper, stapled them, and filed them. Now, all from the business operations.
matches may be performed by the organization’s enter- Given this, many CAEs often provide less audit attention
prise resource planning (ERP) system. The system to these supporting technologies, which can represent a rather
automatically performs the match based on myopic view of IT risk. The fact of the matter is that control
pre-configured rules and tolerance levels and automat- deficiencies in supporting technologies can have a far greater
ically posts variances to defined variance accounts. impact on the organization than IT controls specific to a sin-
To audit that control effectively, an auditor must go gle process.
into the configuration settings of that ERP system and For example, let’s assume that an organization creates
evaluate the rules and settings. This requires a far electronic payments that it sends to its vendors. These pay-
different skill set and audit program than the historical ments are routed electronically to bank accounts based on
process did. To perform an effective audit, the automated clearing house (ACH) routing numbers for each
historical audit approach needs to be re-engineered to vendor account. All those ACH numbers are stored some-
address the new risks. This requires a focus on — and where in a table in the organization’s database system. A data-
understanding of — audit technology. base administrator, or anyone with the right access to the
• Systems that lack integrity or have control deficien- database, could merely change every entry in that table to his
cies will have a larger impact on the organization’s or her own bank account ACH route. The next time the
operations and competitive readiness, thereby organization did an electronic check run, the entire run would
increasing the need for effective IT controls. be deposited into the perpetrator’s bank account. This would
Example: Consider the automated process described completely circumvent all security, control, and audit trail
above, where a sales order comes in via a Web site and mechanisms that exist within the business process and the
is directly transmitted through the ERP system to the business application — including positive pay.
warehouse floor. Now consider what happens when a In the above scenarios, it is easy to see how a control
customer accidentally orders 100 pallets instead of 100 deficiency at the database level could have a far greater impact
units. If the organization has fully optimized its than a deficiency with the three-way match settings. It is for
processes with an ERP system, it is possible that the this reason that CAEs must carefully consider all layers of
system will check inventory, note that 100 pallets are the IT environment when planning the IT audit universe for
not available, update the production schedule to the year.
2
lOMoARcPSD|15941127
GTAG — Defining IT — 3
One of the initial challenges a CAE faces when developing over multiple years on a rotational basis) rather than cover-
the IT audit plan for the year is defining the IT boundaries. ing all layers within a single year. Private companies or
Are the phone and voice mail systems part of IT? Should organizations that do not need to comply with the U.S.
facilities badging and physical security systems be included? Sarbanes-Oxley Act of 2002 or other controls regulations or
What if those are outsourced to the property management legislation, such as the Federal Deposit Insurance
company? These are some of the issues that CAEs grapple Corporation Improvement Act, may wish to establish a plan
with when trying to determine how to allocate IT audit that covers the IT universe over a period of two to three
resources. years. Rotational plans that extend beyond three years are
The reality is that IT means different things to different probably inadequate due to the high rate of change in the IT
organizations. Even two companies in the same industry may environment.
have radically different IT environments. Unfortunately, How many resources should be allocated to each layer?
what IT is, or should be, is not clearly or universally defined. Where within the layer should they be allocated? Answers to
This section will help CAEs address how to think about these challenging questions should be the natural outcome
IT within an organization. Recognizing that there is a high of the risk assessment processes, combined with the auditor’s
amount of heterogeneity in IT environments, one way a judgment and strategic thinking. Regardless of the specific
CAE can approach the definition of IT is by thinking about resource allocation, all layers should be considered.
it in layers, like a parfait. Each layer is different and impor-
tant. Risks exist at each layer of the environment, and the What Are the Layers?
risks vary greatly. Hacking the corporate Web site, for exam- Figure 1 below, is a simple depiction of an IT environment.
ple, is a very different risk to the organization than stealing Obviously, each organization is different, but this graphic
the aforementioned electronic check run. should cover the majority of critical systems for most organ-
izations. The key layers to consider are:
Consider Each Layer • IT management.
For an IT audit function to be effective, the risks of each • Technical infrastructure.
layer need to be considered and prioritized, and audit • Applications.
resources should be allocated to each layer. If the IT audit • External connections.
plan does not include audits for each layer of the environ-
ment, odds are that the audit plan taken as a whole is not Note that this graphic doesn’t define the categories of
going to address the organization’s IT risk adequately. the IT audit plan. When specific IT audits are planned, they
It should be noted that, in some cases, it may be appro- may be organized into categories based on the organization’s
priate to consider all the layers over a period of time (i.e. processes, or by standardized frameworks, etc. This graphic is
Figure 1 – IT Environment
3
lOMoARcPSD|15941127
designed to get the CAE thinking about the IT environment files eventually reside somewhere on the operating sys-
and making sure that audit resources are allocated to each tem. Actions performed at the operating system level
layer. Organizing the specific audits is left to the judgment of generally circumvent most security and controls that
the CAE. exist at the process level. For example, consider an exec-
utive’s laptop. If the executive wants to delete an e-mail,
3.1 IT Management he or she would log in to the e-mail application and
This layer comprises the set of people, policies, procedures, delete that e-mail. The program would probably ask,
and processes that manage the IT environment. Technologies “Are you sure?” Then, the deleted e-mail would be
can be deployed — for example, an organization can imple- stored in a special folder for a period of time so that it
ment SAP ERP in a Unix environment — but the integrity of could be recovered. However, the same executive could
the systems and data are highly contingent on specific tasks also open Windows Explorer and delete all directories in
that administrative personnel perform on a regular basis. the C: drive. The effect would be the same; the e-mail
Therefore, this layer includes: would be gone. In the latter example, though, there are
System Monitoring – Monitoring involves identifying clearly fewer controls.
transactions that failed to post due to a processing error, Databases – All business data, critical or otherwise, ends
or identifying when a database becomes corrupted. up residing in some sort of database somewhere in the
Programming – Many organizations perform internal pro- environment. Databases are comprised of tables con-
gramming for various systems. Programming needs to taining data, which, among other things, form the
be managed and overseen so that programs with errors basis for all business reports. Examples include Oracle,
do not impact the integrity of key systems. MS SQL Server, and DB2. Actions performed at the
Planning – The IT department should be developing database level also tend to circumvent most controls
both long-term and short-term IT strategic plans. that exist at the process level — vis-à-vis the earlier
These should align with the organization’s long- and accounts payable fraud example.
short-term plans. The absence of good IT strategic Networks – For data to flow through an organization, it
planning all but guarantees that IT will not support must have a method of traveling, whether across a
the organization’s objectives, taken as a whole. wire, a fiber optic cable, or wireless system. The net-
Management of Outsourced Vendors – Many organiza- work consists of physical components such as cables;
tions outsource various components, or all, of the IT devices that manage the movement of network traffic
environment to an external vendor. In these situa- such as switches, routers, or firewalls; and programs
tions, managing the outsourced relationship effective- that control the movement of data. The integrity of
ly is a critical piece of ensuring the integrity of the the network plays a large role in ensuring the com-
computing environment. pleteness and accuracy of the organization’s business
IT Governance – Setting a strong tone at the top for data. For example, if a warehouse worker preparing to
designing, building, and operating IT systems with ship a product scans it with a barcode scanner, how
integrity; communicating that culture throughout the does that transaction get recorded back on the gener-
IT function; overseeing the development and deploy- al ledger (G/L)? Answer: It travels across the network
ment of policies and procedures; and assessing per- and is processed. But what if it doesn’t travel across the
formance are key components of running an IT network? What if it is changed along the way, or dis-
function. appears altogether? How would the organization
know?
Note that audits of these functions will be similar to process
audits. The IT auditor is looking at people and tasks as Technical infrastructure audits tend to focus more on review
opposed to a technical system setting. Tests of controls will be of technical configuration settings than processes.
quite different and will require a certain amount of judgment.
3.3 Applications
3.2 Technical Infrastructure Business applications are programs that perform specific
This layer is referred to by many different names, such as tasks related to business operations. These generally can be
general computer controls, pervasive controls, or supporting classified into two categories: transactional applications
technologies. It essentially refers to the systems that under- and support applications.
lie, support, and enable the primary business applications. In
general, this includes: Transactional Applications
Transactional applications consist primarily of software
Operating Systems – The set of programs that instruct the that processes and records business transactions. Examples
computer systems on how to function. Examples include include sales order processing, general ledger recording,
Unix, Windows 2003, and OS/400. All programs and and warehouse management. Transactional applications
4
lOMoARcPSD|15941127
typically fall into one of the following categories:

Buy Side – enables procurement and supply chain
processes.
Sell Side – enables sales and distribution processes.
Back Office – enables financial accounting, payables,
receivables, and human resources processes.
ERP – integrated software that does one or more of the
above.
Support Applications
Support applications are specialized software programs that
facilitate business activities but generally do not process
transactions. Examples include e-mail programs, fax soft-
ware, document imaging software, and design software.
The bulk of the IT audit attention should be oriented
toward transactional applications. However, depending on
certain industries, some support applications may be high
risk as well. Example: Company XYZ makes a consumer
product and has a highly recognizable brand. It continuous-
ly loses money due to product knock-offs being sold by cor-
porate pirates. Its creative team designs new products on an
integrated computer design software package. In this case,
the company should evaluate the controls around this sup-
port application, as it could represents a bottom-line risk to
the company if new designs are stolen prior to new products
hitting the street.
3.4 External Connections

The corporate network does not operate in isolation. It is
most certainly connected to many other external networks.
The Internet, of course, is the one that most readily comes
to mind, but many times CAEs make the mistake of stopping
there. In fact, it is highly likely that the corporate network
is connected to many other networks. For example: Does the
organization do business via EDI? If so, the corporate net-
work is probably connected to an EDI provider network, or
perhaps directly connected to the network of a trading part-
ner. Does the organization use any third-party warehouse
providers? If so, the two networks are probably linked
together.
Furthermore, as organizations continue to automate key
processes, more access to the corporate network is granted to
outsiders, often via the Internet. Consider, for example, the
ability to look up the account status of a credit card or the
shipping status of a FedEx package. Customers who perform
those activities are likely entering those companies’ internal
networks via the Internet.
The issue here is that external networks are not under
the control of the organization and therefore should not be
trusted. All communication to and from external networks
should be tightly controlled and monitored. It can be chal-
lenging to define IT audit procedures to address this risk,
because the organization can only audit what it can control.
Thus, it is critical to audit the entry and exit points, at a
minimum.
5
lOMoARcPSD|15941127
GTAG — IT-related Risks — 4
4.1 The Snowflake Theory An Array of Variables

Every IT environment is unique and, accordingly, represents Other variables that impact the snowflake theory are:
a unique set of risks, says the snowflake theory. The differ- • Degree of system centralization.
ences in IT environments make it increasingly difficult to • Degree of geographic centralization.
take a generic or checklist approach to IT auditing. To be • Number of servers.
effective, each organization should define an IT audit • Choice of infrastructure technologies.
approach and create IT audit work plans that are specific to • Degree of customization.
the needs of that particular environment. • IT department organizational structure.
This is very different from the financial or operational • Versions of specific technology used (e.g. Windows
audit areas, where certain risks are endemic to a given indus- 2000 versus Windows 2003).
try or size of company. Consider the following: Company • Degree and method of outsourcing.
ABC and Company XYZ are both media and entertainment • Corporate policies (e.g. saving all e-mails forever ver-
companies. Both companies face risk in calculating ultimate sus saving no e-mails).
accounting entries for movies that have been released. This
process would be something that the internal audit function The net result of all these variables is the snowflake theory:
would definitely audit. No two IT environments are alike. Therefore, it is very diffi-
On the IT side, however, Company ABC is using cult — if not impossible — to take a checklist approach to
Oracle Applications as the primary business system, running planning and executing IT audits. Each company should have
on Windows 2000 and using an Oracle database. There is an entirely unique IT audit plan based on its specific IT risks.
one centralized Oracle system. Company XYZ has a decen- The challenge, of course, is adequately identifying the
tralized IT function, with each business unit using its own business and IT risks specific to the organization’s particular
system on a variety of platforms. Each business unit reports IT environment. This is why the IT risk assessment process
into a consolidation system, which the company has out- is critical, perhaps even more so than the overall risk assess-
sourced to a third-party provider. Clearly, the IT audits that ment. Additionally, the risk assessment should be performed
would be planned and executed for Company ABC would by knowledgeable resources — such as those who understand
vary greatly from those for Company XYZ. how the company’s usage of Active Directory will impact the
IT audits that need to be performed.
The Configuration Factor
Another primary factor in the snowflake theory is configura- 4.2 Risk Evolution
tion. When a company deploys a given technology, it config- The snowflake theory dictates that each company will have
ures the technology to support its particular objectives. There a risk profile that is unique to that organization only.
can be a high degree of variability from environment to envi- However, there is another dimension of risk that is impor-
ronment. One company using Windows 2003 as the primary tant to consider as well, and that is risk evolution. Risk evo-
operating system may have set up multiple domains, with lution is based on Moore’s Law. Moore’s Law, which was
trusted relationships among all the domains. Another may initially proposed in 1965, states that every 18 months, the
have only a single domain, using Windows Active Directory data density on an integrated circuit doubles. What this
to manage all user access. Although both companies are means pragmatically is that technology is increasing rapidly,
using the same technology, the risks are very different; con- which should come as no surprise to anyone.
sequently, the performance of IT audits is also very different. Consequently, IT-related risk is not static. Given the high
Configuration also impacts the business applications. growth and expansion of technology, IT-related risks will
Company ABC and Company XYZ both implemented SAP change — sometimes dramatically — from year to year. It is
as the primary business system and enabled the payables even possible have a situation where the IT audit schedule was
process with SAP. Company ABC has configured SAP to based on an effective IT risk assessment process, but by the
perform a three-way match, matching price, quantity, and time the actual audits are to be performed, that risk profile had
date. It has set over and under tolerance levels of $50 or 5 evolved, and the planned IT audits are no longer sufficient.
percent, whichever is lower. Company XYZ has configured To combat this issue of IT-related risk evolution, the
SAP to perform “evaluated receipt settlement,” where the CAE should:
payment is automatically generated based on whatever was • Recognize the dynamic nature of IT-related risk and
received, regardless of what was ordered or billed. No three- perform independent IT risk assessments every year.
way match is performed, and no tolerance limits are estab- • Develop an understanding of the IT department’s
lished. Once again, although both companies are using SAP, short-term plans for a given year and analyze how
the risks of each of those configurations are quite different, those initiatives may impact the IT risk assessment.
and the IT audits that should be performed at each compa- • Begin each actual IT audit by refreshing the risk assess-
ny are also different. ment component of that particular audit.
6
lOMoARcPSD|15941127
GTAG — IT-related Risks — 4
• Be flexible with respect to the IT audit universe; mon- Pervasive Risk

itor the organization’s IT-related risk profile and be Certain IT-related risks are not limited to one specific system
willing to adapt audit procedures as it evolves. or process. These risks impact the enterprise as a whole, and
therefore are referred to as pervasive risks. Example:
4.3 IT-related Risk Proliferation Company XYZ is connected to the Internet and does not
A third dimension to consider when evaluating IT-related maintain a firewall. What account balance does that impact?
risk is the concept of proliferation, which refers to the addi- Potentially all account balances or potentially no account
tive nature of IT-related risks. Assume that the organization balances. Another example might be the presence of water
has identified IT risk A and IT risk B. Independently, each sprinklers in the data center. If those accidentally go off and
risk may be low, but when the two risk-related processes douse all the servers with water, which operational process-
work together, they create IT risk C which is far greater than es would be impacted? It could be all processes, no process-
the sum of the individual risks. es, or anything in between.
Example: Company XYZ is running Oracle
Applications. There is no process in place for monitoring Specific Risk
system activity. Also, the system administrators all have full Specific risk, on the other hand, can be attributed directly
access to the system. Independently, each of these items rep- to a specific process or account balance. Consider the
resents risk, but together they represent a situation where a three-way match configuration settings mentioned in the
number of people can do whatever they want on the system introduction of this guide. If those settings are set incorrect-
(approve invoices, cut checks, set up new payroll accounts) ly, the risk will specifically relate to payables and cash.
with no detective checks and balances. In this case, under- CAEs often struggle with the fact that pervasive risks
standing the IT management and monitoring processes, represent far greater risks to the enterprise than specific
along with the specific security of the system, is important to risks. However, it is very difficult to quantify a pervasive risk.
understanding the true risk. Moreover, when reporting a control deficiency related to a
For this reason, it is important to consider IT-related pervasive risk, it is far more difficult to link it to the business
risk holistically, rather than discretely. The CAE should impact due to the deficiency.
consider IT-related risk at the enterprise level, assessing not The importance here is balance. The CAE should
just each individual risk, but also how the individual risks remember that both pervasive and specific risks are impor-
impact each other. Remember that the IT environment has tant and focus audit attention on both types of risk. If a
layers. Imagine that one is trying to sift sand through a num- review of the planned IT audit universe doesn’t reveal audits
ber of screens piled on top of each other. Although each that cover both kinds of risk, it is likely that the IT audit
screen has holes in it, the layers of screens will prevent any universe will not cover the organization’s risks adequately.
sand from getting all the way through. Now imagine that
each screen has a small hole in it, directly aligned with a 4.5 IT Risk Assessment
small hole in the layer beneath it. In this case, sand can fall The auditor should use an appropriate risk assessment tech-
all the way through the screens without impediment. nique or approach in developing the overall plan for the
The world class CAE is always considering all the layers effective allocation of IT audit resources. Risk assessment is
of the IT environment when planning or executing IT a technique used to examine auditable units in the audit uni-
audits. Evaluating the impact of risks at one layer against verse and select areas for review that have the greatest risk
risks at other layers is very important when performing the exposure. The risks associated with each IT layer cannot be
IT risk assessment. determined by reviewing the IT-related risks in isolation, but
must be considered in conjunction with the organization’s
4.4 Types of IT-related Risks processes and objectives.
The first step in understanding the risks associated with IT
is to identify what can go wrong, including: Impact Versus Likelihood
• Availability – when the system is unavailable for use. The assessment of IT-related risk must also consider the
• Security – when unauthorized access to systems occurs. impact and likelihood of occurrence. The impact of IT-relat-
• Integrity – when the data is incomplete or inaccurate. ed risk events is often high, particularly for pervasive risks.
• Confidentiality – when information is not kept secret. Likelihood may be harder to determine because it is a pre-
• Effectiveness – when the system does not deliver an diction value (e.g. What is the likelihood that a hacker will
intended or expected function. break into the organization’s Web site?). Past experience and
• Efficiency – when the systems cause a sub-optimal use general best practices may be used to support these esti-
of resources. mates. The product of impact and likelihood helps to define
The various IT-related risks generally can be grouped into the severity of the risk, which provides a basis for comparing
two main categories: pervasive risk and specific risk. and prioritizing IT-related risks.
7
lOMoARcPSD|15941127
GTAG — IT-Related Risks — 4
Consider Company XYZ, which has implemented When assessing static risk, inquiry and interview
Windows 2003. Should this be audited as part of this year’s techniques are, in many cases, adequate. Also, these
IT audits? The answer, like many other answers regarding IT, assessments tend to need a little updating each year,
is “It depends.” In this case, there are multiple factors based on new conditions, but generally hold true year
impacting the decision. The key consideration is the risk to after year. Unless Company XYZ decides to get out of
the business and the impact the technology has on the oper- the online book business and open up a brick-and-
ations of the organization. If the only application running on mortar solution, the Web servers will continue to be
Windows 2003 is the application that updates zip codes an area of high risk.
when the post office changes them, then clearly the technol- Dynamic Risk – Dynamic risk is risk that is constantly
ogy has very little impact on the overall integrity of the orga- changing. It tends to be less driven by the industry and
nization’s operations. Consequently, it would be a waste of more driven by the evolution of technology (remem-
IT audit resources to bother auditing this system. ber Moore’s Law). The discovery of a new flaw in
Conversely, if the organization’s primary supply chain sys- Windows 2003 is a great example of a dynamic risk.
tems run on Windows 2003, then the technology definitely Last year’s risk assessment would not have identified
impacts the achievement of the organization’s objectives that risk; it didn’t exist at that time. Dynamic risk also
and should be included in the IT audit plan. impacts how the IT risk assessment process should be
Many times, though, the answers are not quite so self conducted. In this case, the IT risk assessment process
evident. It is for this reason that an effective IT audit func- should be focused on the process that IT management
tion is highly dependent on the performance of a robust IT has in place to monitor patches and measure their
risk assessment. The IT risk assessment helps address the timely implementation.
issues posed by the snowflake theory and allows organiza- Legal and regulatory issues are also large dynamic
tions to determine which areas warrant audit attention. risks. These issues impact all areas of the business,
but given the evolution of technology, there are far
Traditional Risk Assessments Aside greater new legal and regulatory issues relating to
It is important to note that traditional risk assessment technology that arise each year. Consider, for exam-
processes and activities may not support an effective IT risk ple, all of the new rules and regulations relating to
assessment. These processes and tasks should be re-engi- the privacy of consumer information that have been
neered to address the needs of an IT risk assessment ade- promulgated in the recent past.
quately. Specifically, most legacy risk assessment processes
are highly interview-based. Interviews alone are likely insuf- Assessing Dynamic IT Risk
ficient to assess IT risk, because a good deal of the IT risk is When performing an assessment of dynamic IT risk, inquiry
based on how technology is configured specifically at the procedures alone are probably insufficient. There are two
organization. Moreover, a good part of risk in the IT arena is key steps that must be taken: discovery and analysis.
dictated by emerging issues. For example, assume a hacker Discovery – Discovery is the process of determining
discovers a new flaw in Windows 2003 and builds a tool that which technologies have been deployed, how they
exploits this flaw. Microsoft identifies the issue and releases have been configured, and what business processes
a patch that removes the flaw. An IT auditor would likely they support and align with. n many cases, tools are
need to understand information about what patches have used to support the discovery process. For example, an
been installed before they could adequately assess the true organization with a decentralized IT function may not
risk around that technology. know how many servers and versions of operating sys-
tems are in use enterprise-wide. A network discovery
Static Versus Dynamic Risk and mapping tool could help gather this data quickly
In Section 4.4, consideration was given to the concept and accurately.
of pervasive versus specific risk. Understanding those Analysis – Analysis is based on the evaluation of the data
dynamics is important. However, when performing an IT once it has been collected. Once again, this would
risk assessment, it’s also important to consider static versus likely not be driven via inquiry procedures, but would
dynamic risk. be more based on the IT auditor analyzing the collect-
Static Risk – Static risk does not change from year to ed data against emerging issues and new technology
year and is typically driven by the industry within risks.
which the organization operates. For example,
Company XYZ is an online retailer of books and has One other concept that emerges in the analysis phase is
risk associated with its Web servers that run the online the concept of risk dependency. This concept was touched
ordering system. If those servers go down, the compa- on earlier using an analogy of sifting sand through a pile of
ny’s revenue stream is shut down until the servers screens (Section 4.3 IT-related Risk Proliferation). If there is
come back up again. a hole in each screen, then sand could fall all the way
8
lOMoARcPSD|15941127
GTAG — IT-Related Risks — 4
through them. This is the essence of risk dependency. The

impact of a given risk may depend on the presence of other
risks. For example, Company XYZ has not segregated the
corporate network and is using a number of wireless net-
works. The engineering team electronically collaborates on
design documents for new products. In this case, the business
risk is that a competitor could sit outside with an antenna
and gather information on new product designs. This risk is
created by the combination of network design, process
design, and new technology, and each risk is dependent on
the existence of the other two risks. The total risk is greater
than the sum of each individual risk.
It is for this reason that many organizations utilize a “lay-
ers of defense” strategy, which provides multiple layers of
security and control. It is important that during the analysis
process, the CAE evaluates the design and effectiveness of
all the layers of defense before concluding on the impact of
an IT risk or weakness.
Robust IT Risk Assessment

Given these issues, the CAE should plan accordingly and
ensure that the IT risk assessment process:
• Is performed in depth every year and isn’t just an
update of the prior year.
• Considers all the layers of the IT environment.
• Considers both static and dynamic risks.
• Is not strictly based on interviews, but uses other dis-
covery techniques.
• Is supplemented with the appropriate level of analysis
after discovery.
• Is performed by the appropriate personnel.
This last bullet is one that may pose one of the larger chal-
lenges to CAEs, because IT is a very broad term and compris-
es many layers. The skills required to understand each layer
are dramatically different. A networking specialist with deep
technical skills has a very different skill set than an SAP
application specialist with deep technical skills. To perform
an effective IT risk assessment, specialists who understand all
layers of the IT environment need to be involved. These are
rarely, if ever, evident in a single person. What is far more
likely is that a team of IT audit specialists with skills across
all layers will need to be involved. This team will also have
to work together closely through the process, primarily
because of the issue of risk dependency.
9
lOMoARcPSD|15941127
GTAG — Defining the IT Audit Universe — 5
Once the IT risk assessment has been performed with the tation review. This answer is that wasn’t evaluated.
appropriate level of accuracy, the next step is to determine But the nomenclature of the audit was deceiving.
which IT audits should be performed. If the IT risk assess- With that in mind, CAEs should make sure that the
ment was performed effectively, the organization should definition of each IT audit is a fair and accurate
have a reasonable idea of what IT risks exist. However, this description of what is being reviewed.
also poses a number of challenges, not the least of which is • The audit universe for the year should touch on all
defining IT audits. the layers in the IT environment. Although each IT
In the previous example (page 8), the company had environment is different, the layers tend to be the
identified a business risk of transmitting important product same. If the IT audit plan does not include some review
design information outside of the organization. What audit for each of the layers, odds are that the plan, as a
should be performed to address this risk? Should an audit of whole, is deficient.
wireless networks be performed; an audit of network archi- • IT audits should be structured in such a way as to
tecture and design; or an application review of the electron- provide for effective and logical reporting. Application
ic design application? And if the audits are broken up in that reviews, for example, are rarely optimally effective
fashion, the odds are that the reporting of audit findings will when they are broken out independently (e.g. an Oracle
be related to technical settings for each individual technol- accounts payable review). Applications should be inte-
ogy. That’s fine, but the audit committee likely does not care grated from an execution and reporting process with
about detailed technical settings and probably wants IT process/operational/financial audits. IT audits of perva-
audit findings to be tied to the business issues. sive technologies (e.g. networks, processes, etc.) tend to
Consequently, the way in which IT audits are defined be more effective when audited at the enterprise level.
plays a large role in the overall effectiveness of the IT audit In other words, don’t perform a network audit at the
function. This is exacerbated by the need for the IT audit Pittsburgh facility and another network audit at the
function to integrate with the process/operational/financial Phoenix facility. Perform one enterprise network audit.
auditors and the procedures they are performing, particular- Geography matters less than process.
ly in environments with large integrated ERP applications, • IT audits should cover the appropriate risks. In many
where a high number of key process controls are contained cases, IT audit budgets are determined before the IT
with the systems. risk assessment is performed. This inevitably leads to
Although there is no right way to define IT audits, there one of two situtions:
are certainly degrees of wrong. For example, many CAEs 1. An inadequate number of audit hours is
make the mistake of scoping an “IT general controls” audit. spread over too many audits, which results in
This is so broad that it’s almost meaningless, especially in a consistently poor quality IT audits because
large organization. Are telephone switches included? How there is not enough time to do any of them
about desktop configuration? Environmental controls in the correctly.
data center? All of the above? If so, the audit will require a 2. Audits that should be performed are not
substantial amount of time to complete. performed because the budget does not allow
for them to be performed.
5.1 Tips for the CAE IT audit planning and budgeting should be an outcome of the
The challenge is to provide the right level of granularity in IT risk assessment process, not done before the IT risk assess-
the definition of the IT audit universe so as to make it effec- ment. Also, the IT risk assessment should be considered in the
tive and efficient. This will be different for every IT audit context of the risk assessment for the company as a whole. It
function (an extension of the snowflake theory), but some may well be that in a particular organization, the IT environ-
considerations for the CAE when defining IT audits are: ment presents so much risk to the company that all internal
• Using overly broad definitions for IT audits (e.g. IT audit procedures performed for the year should be IT audit pro-
general controls) will almost ensure that there will cedures — a hyperbolic situation to be sure, but not unfeasible.
be scope creep in audit procedures. Furthermore,
there may also be a gap between what management 5.2 Budgeting for IT Audit
thinks is being audited and the true audit procedures One of the common mistakes a CAE makes when defining
being performed. For example, Company XYZ imple- the IT audit universe is underestimating the amount of time
ments SAP for financial accounting processes. The IT required to do an IT audit. The issue, in many cases, is the
audit function performs a post implementation review snowflake theory. Example: Company ABC is running a
of accounts payable configurable controls, but calls it financials application on an AS/400. The IT auditor wants to
an “SAP post implementation review.” After the assess the security around the AS/400, and he or she spends
audit, the company has a major issue with the SAP 100 hours performing the review. Company XYZ is also run-
user security setup. The audit committee is likely to ning a similar application on an AS/400. Should the review
ask why that wasn’t caught in the SAP post implemen- take the same amount of time?
10
lOMoARcPSD|15941127
GTAG — Defining the IT Audit Universe — 5
The answer, of course, is that it depends. If Company

ABC has 100 users and Company XYZ has 1000 users, it
may be more appropriate to assume that it would take 10
times longer for Company XYZ, if the audit must evaluate all
users. If the audit approach is to merely evaluate the access
rights of a sample of 10 users, then the audits might take the
same amount of time, but would offer different levels of
assurance.
That example illustrates the danger of estimating IT
audit budgets. It is easily possible to misjudge the effort
required by orders of magnitude, which is not usually seen on
the operational or financial side of the audit house. Those
estimates may be wrong, but not by orders of magnitude.
Another example might be the audit of an SAP system.
A security review of an SAP system with two production
clients will take twice as long as a security review of an SAP
system with one production client. Woe betides the CAE
who estimated the budget without fully understanding the
IT environment (refer to the IT risk assessment section). If
estimates had been generated without knowing how many
production clients there were, the budget estimates could be
significantly incorrect.
How should a CAE address this issue? Certainly one cru-
cial element is understanding the IT environment, which
should naturally evolve from performing an adequate IT risk
assessment. Another critical component is accurately esti-
mating the time required to perform IT audit tasks. Certain
IT audit tasks, such as reviewing a configuration setting, may
be done quickly and efficiently. Other tasks, such as auditing
a complicated user security architecture, may take a substan-
tial amount of time. Tactically, a CAE should challenge the
budget estimates on planned audits, ensure that enough front-
end planning has been done to justify an estimate, and ensure
that IT audit staff and management concur with the estimate.
Be aware that under very few circumstances can an IT audit
of fewer than 80 hours be effective for any technology.
11
lOMoARcPSD|15941127
GTAG — Executing IT Audits — 6
The process for executing an IT audit is, in theory, no dif- COSO and COBIT
ferent than the process for executing an operational audit. Where can a CAE find a comprehensive set of IT control
The auditor plans the audit, identifies and documents con- objectives? The Committee of Sponsoring Organizations of the
trols, tests the design and operating effectiveness of the con- Treadway Commission’s (COSO’s) Internal Control–Integrated
trols, concludes, and reports. Because most CAEs are Framework and Enterprise Risk Management — Integrated
familiar with this overall process, it will not be covered in Framework are excellent sources of information, but are not
detail in this GTAG. However, there are certain elements focused on IT. Moreover, IT has greatly evolved since 1992,
of an IT audit that do vary somewhat from more tradition- when the initial COSO framework was published, which
al audits. Therefore, this section will identify some of those makes the COSO IT control objectives less effective in man-
areas and provide CAEs with some perspective and ideas on aging today’s technologies. A COSO-based control environ-
how to manage them. See Figure 2, Audit Process ment should be augmented with more detailed IT control
Overview, below. objectives to assess the IT control environment effectively. A
number of options are available for this.
6.1 Frameworks and Standards One IT control framework is Control Objectives for
One challenge auditors face when executing an IT audit is Information and related Technology (COBIT), which was orig-
knowing what to audit against. Many organizations have not inally published by the Information Technology Governance
fully developed IT control baselines for all applications and Institute in 1994, with the support of the Information
technologies. The rapid evolution of technology would like- Systems Audit and Control Association (ISACA). Version
ly render any baselines useless after a short period of time. 4.0 of COBIT was released in November 2005. COBIT is not
The snowflake theory dictates that each IT environ- intended to compete with the COSO frameworks, but it can
ment is different. However, this does not detract from the be used to compliment them by augmenting them with more
concept of control objectives. Control objectives, by defini- robust IT-specific control objectives. COBIT 4.0 contains
tion, should remain more or less constant from environment 214 detailed IT control objectives organized around 34 IT
to environment. Consider the objective that all critical busi- processes. Clearly, COBIT provides a more detailed approach
ness data and programs should be backed up and recover- than COSO’s internal control or ERM frameworks, which
able. Now, each environment may do that very differently; provide a good starting point for identifying control objec-
backups could be manual, or automated, or a tool can be tives relevant to the environment being audited.
used. They could be incremental only, or there may be com-
plete backups of everything. Backups could be done daily, Policies, Standards, and Procedures
weekly, monthly, etc. Storage of backups could be onsite in A framework such as COBIT offers a generally accepted set
a fireproof safe, offsite at another company facility, or out- of IT control objectives that helps management to conceptu-
sourced to a third party. The method used by the organiza- alize an approach for measuring and managing IT risk.
tion to manage backups would certainly impact the audit Management would generally use such a framework to guide
procedures and the budget for the audit, but the control the development of a comprehensive set of IT policies, stan-
objective would not change. Given this, a CAE should be dards, and procedures.
able to start with a set of IT control objectives, and although For example, a functional IT control framework would
it would not provide 100 percent specificity to that particu- typically include a control objective on securing information
lar environment, select an appropriate framework. systems from unauthorized access. An organization could
accomplish this objective by defining a policy that specifies
Figure 2 – Audit Process Overview
12
lOMoARcPSD|15941127
that all production systems must be accessed by a unique user Six Sources for Standards
ID and password. This policy would then be augmented by an Some standards for consideration are:
organizational standard that defines the ID and password ISO27001 / ISO17799 – The International
requirements (e.g. IDs are the first letter of the user’s first Organization for Standardization published this
name, followed by their last name; passwords must be at least internationally recognized generic information securi-
eight characters long and contain a mix of letters and other ty standard, which began as a British Standard
characters; etc.). Such a standard would then by augmented (BS7799), evolved into an ISO standard (ISO17799),
by procedures that would define how the standards are imple- and is now known as ISO27001. It contains generally
mented on a platform-by-platform basis and would specify accepted best practices on information security man-
the “evidence of control” created and retained via successful agement and is useful as a baseline for IT auditors to
performance of the procedure. This cascading approach from audit against. http://www.iso.org
control framework to policy, standard, and procedures is the Capability Maturity Model Integration – Carnegie
essence of ensuring that IT controls correspond effectively to Mellon University’s Software Engineering Institute
the business and the enterprise control environment. (SEI) has published Capability Maturity Models
Assume that in the example above, the organization has (CMMs) for various processes within an organization,
not defined a standard that provides specifics around password primarily related to the deployment of software.
length, etc. In that case, the CAE will face some challenges Examples include Systems Engineering CMM and
in determining what to audit against, and will often end up Software Acquisition CMM. These CMMs provide a
engaged in a debate with IT management over what consti- model for building sustainable controlled processes
tutes a sufficient control. Which is more secure: a password within an organization and are useful to IT auditors
with a minimum length of six characters that expires every 30 performing audits of system development processes. In
days, or a password with a minimum length of eight characters 2005, the SEI integrated the existing CMMs into the
that expires every 90 days? There are often references made to Capability Maturity Model Integration (CMMI).
“best practices” but a specific link is not always drawn. http://www.sei.cmu.edu/cmmi/general/general.html
In the absence of organization-specific IT control stan- National Institute of Standards and Technology
dards, there are various public marketplace and industry IT (NIST) – The Computer Security Resource Center is
control standards. These can help support IT audit procedures a division of NIST that provides a comprehensive
by offering a set of “best practice” recommendations where series of publications that offer detailed information
specific details are laid out (e.g. password must be at least on information security control topics. Sample publi-
eight characters and must be set to expire every 60 days). An cations include Biometric Data Specification for Personal
IT auditor can use these standards as a baseline to audit Identity Verification and Guidance for Securing Microsoft
against. This is also useful when reporting deficiencies, as it XP for IT Professionals. These standards, a must-have
takes the subjectiveness out of the deficiency. Compare for any IT auditor working in the public sector or in
“Password security can be enhanced” with “Passwords do not the aerospace and defense industry, provide best prac-
conform with ISO27001 information security standards.” tices that can be used in other industries as well.
Obviously, the second wording will invite less debate. http://csrc.nist.gov/publications/nistpubs/index.html
The challenge with using public standards to audit SysAdmin, Audit, Network, Security (SANS)
against is that there are a lot of different standards, and they Institute – One of the most trusted sources for infor-
do not always recommend the same thing. The purpose of this mation security education and training in the world
GTAG is not to debate the merits of various standards, but (and by far the largest), the SANS Institute publishes
simply to encourage the CAE to consider supporting IT audits numerous documents on various aspects of security for
by using a standard — whichever standard makes the most various technologies. SANS publications provide a
sense for the organization and is acceptable to IT manage- number of specific requirements that an IT auditor can
ment. In most cases, a standard relates to a very specific ele- audit against. http://www.sans.org/aboutsans.php
ment of the IT environment, such as security or custom The IT Infrastructure Library (ITIL) – Supported by
program development. In most cases, the CAE is not in a the British Standards Institute, ITIL provides best
position to dictate the specific standard used by the organiza- practices for supporting IT services. ITIL publications
tion. This decision should be made by IT or executive man- are focused on supporting the management of IT
agement. If a standard already has been agreed upon and services. As such, they are a valuable support tool for
deployed, the CAE should identify that standard and audit an internal auditor performing any audits of the IT
against it. The CAE also has an obligation to assess the over- management layer. http://www.itil.co.uk/
all sufficiency of the standards chosen by IT management to Vendor-specific Standards – Many technology vendors
ensure they are responsive to the organization’s risk profile, issue security and control guidelines for the technology
business requirements, and regulatory requirements. they produce. SAP, for example, issues a three-volume
13
lOMoARcPSD|15941127
security guide that provides detailed recommendations Below are some areas in which the CAE can support retention
for securing and controlling the SAP ERP application. goals by leveraging the IT auditor’s desire for technology
These vendor-released standards often do not take exposure:
security and control considerations to the same level Certifications – There are a number of technology
that perhaps a NIST publication might, but they certifications available. These include technical
provide a good start. They may also help limit debate certifications — such as various certifications in Cisco
around findings (e.g. “SAP password restrictions are routers and database technologies — and certification in
not set in accordance with vendor-documented specific modules of SAP. ISACA offers a Certified
security requirements”). CAEs should check with the Information Systems Auditor (CISA) certification. ITIL
vendors of mission-critical systems to see if specific Foundation Certification provides a basic understanding
standards are available. In many cases, the vendor may of the various ITIL processes for service management
not have released anything, but the user group associ- and service delivery. This is a must for IT auditors
ated with that technology has (e.g. Americas’ SAP reviewing IT departments using ITIL processes.
Users’ Group). The CAE may want to consider bonuses that are
tied to specific “hot skills” certifications — i.e. an IT
6.2 IT Audit Resource Management auditor receives a bonus for becoming a Cisco
The resources assigned to execute planned audits play a crit- Certified Network Associate (CCNA). This allows
ical role in the efficiency and effectiveness of the audits. IT the organization to provide additional compensation
encompasses a wide range of technology — the skill set without raising base salaries. Moreover, many certifi-
needed to audit a firewall configuration is vastly different cations take a fair bit of time to accomplish, which
from the skill set needed to audit accounts payable three-way ensures that an IT auditor will stay at least the length
match configuration tables in Oracle Applications. It is crit- of time required to get certified. A word to the wise,
ical to match the skills needed to perform a particular IT however, sometimes IT auditors will be collecting IT
audit with the appropriate IT auditor. certifications to move out of the audit function. It is
One of the challenges today’s CAEs face is identifying, necessary to carefully examine whatever certifications
hiring, and retaining competent IT audit professionals. the IT auditor wishes to pursue and make sure that
Inevitably, any discussion on this topic will coalesce around those fit within the scheduled IT audit universe.
the issue of hiring an IT person and teaching that person how Rotation – Consider a rotation program between the IT
to audit versus hiring an auditor and teaching him or her IT. department and the IT audit function. This can help
There is no perfect solution, and there will always be excep- increase IT audit capacity, as well as strengthen audit-
tions, but directionally, the CAE should consider that no IT ing’s relationships with the IT department. Be aware of
auditor will be able to do all IT audits. Thus, any IT audit potential independence concerns when deploying this
function will need to have some IT auditors more aligned type of strategy. Also, be sure that the IT audit func-
with applications and some IT auditors more aligned with tion can provide some audit expertise to the deployed
infrastructure technologies. In terms of sourcing IT auditors IT “rotatees.”
who will be more aligned with applications, generally it is Continuing Education – IT auditors will need more train-
more effective to find financial, process, or audit people and ing than process or operational auditors. There have
teach them a particular application. In terms of sourcing IT been relatively few quantum leaps in three-way match-
auditors who will be more aligned with auditing infrastruc- ing processes in the last 10 years, but there certainly
ture technologies, generally it is more effective to hire IT have been great strides in IT. For IT auditors to stay
people and teach them how to audit. Consequently, a CAE abreast, they need to be trained early and often. The
who has a strong understanding of the current IT audit uni- CAE should recognize this and build a training strate-
verse and the current IT audit skill sets on staff should be gy for the department that considers the needs of the
able to focus his or her recruiting efforts accordingly. IT auditors. Consideration should be given to develop-
ing expertise in a broad range of important topics. This
IT Auditor Retention Strategy can be accomplished by assigning certain IT auditors to
Once IT auditors have been hired, the next key challenge is become subject matter experts in a given technology
retention. IT auditors tend to be more mobile than tradi- (e.g. one IT auditor is the Microsoft specialist, another
tional auditors due to the current lack of skilled IT auditors is the database specialist, and a third is the SAP spe-
in the marketplace. One way for a CAE to address this issue cialist). This will provide for better audits than if all IT
is to improve compensation. In many cases, budgets do not auditors are trained in all subjects. However, it requires
allow for this; therefore, the CAE may need to be creative more diligence and planning when constructing an IT
when devising a retention strategy. audit training plan for the year.
Many IT auditors are motivated by exposure to technol- User Groups – Most technology vendors maintain a
ogy. They enjoy playing with new and exciting technologies. user group, which consists of customers who use the
14
lOMoARcPSD|15941127
technology and get together to share ideas, concerns, guide is not meant to be a primer on it. However, CAEs gen-
and hopefully influence future developments of the erally struggle with how much to co-source and what IT audits
technology. Although traditionally user groups have to co-source. The optimal mix varies from organization to
been the domain of IT professionals and business organization (the snowflake theory applies again), but CAEs
users, in many cases, these groups can be valuable to may find it useful to benchmark their organization against the
the IT auditor as well. The Americas’ SAP Users’ following data from The Institute of Internal Auditors’ (IIA’s)
Group, for example, maintains a subgroup that is 2004 Global Audit Information Network (GAIN) report:
focused on security and controls. IT auditors should • 39 percent of all purchased internal audit services are
seek out the user groups for the critical technologies IT audit related.
used by the organization and join them. In many • Percentage of IT audit work outsourced:
cases, there may be no incremental cost to the organ- - 8.1 percent of organizations outsource 100
ization. Most user groups are managed by company; percent of their IT audit work.
all employees of the company are welcome to join. - 7.1 percent of organizations outsource most
of their IT audit work.
Adequate Staffing - 8.3 percent of organizations outsource between
Many IT audit functions have budgetary constraints that 25 percent and 50 percent of their IT audit
prevent them from maintaining a staff with the range of IT work.
audit skills needed to audit the IT audit universe effectively. - 33.1 percent of organizations outsource “some”
The organization would not expect the IT department to of their IT audit work.
operate without on-staff expertise in operating systems, data- - 41.6 percent of organizations do not outsource
bases, networks, and application systems. Yet, it sometimes any of their IT audit work.
expects the IT audit function to operate without sufficient • Strategy for the next three years:
resources. Inevitably, this leads to auditing by checklist and - 18.9 percent of organizations plan to increase
using inquiry techniques as the primary source of audit evi- their IT audit outsourcing.
dence. As indicated throughout this document, for an IT - 64.9 percent of organizations plan no changes
audit function to be effective, a specific audit plan must be to their amount of IT audit outsourcing.
driven by a robust risk assessment and backed up with audit - 13.3 percent of organizations plan to decrease
procedures that are designed specifically to the nuances of their IT audit outsourcing.
that particular environment. The CAE should justify the
budgetary need to support a range of IT audit skill sets to Additional suggestions with respect to co-sourcing include:
senior management and the audit committee. Co-source the Technical Audits – In this case, “techni-
One primary reason for the CAE to advocate sufficient cal audits” refers to audits that are performed in the
resources stems from Paragraph 140 of the U.S. Public technical infrastructure and application layers of the
Company Accounting Oversight Board’s Auditing Standard IT environment. Generally, these audits require a
No. 2, An Audit of Internal Control Over Financial much higher level of specific technical expertise,
Reporting Performed in Conjunction with An Audit of which is more likely to be found in the marketplace
Financial Statements, which states: than internally. IT audits of the management layer are
“… the following [circumstance] should be regarded much more focused on IT processes (e.g. systems
as at least a significant deficiency and as a strong indi- development) and therefore require less in-depth
cator that a material weakness in internal control technical skills.
over financial reporting exists … The internal audit
function or the risk assessment function is ineffective Consider Using Two Providers – It may be useful to
at a company for which such a function needs to be maintain contracts with a primary provider of co-
effective for the company to have an effective moni- sourced services as well as a secondary provider. In cer-
toring or risk assessment component, such as for very tain cases, one firm may have conflict of interest in a
large or highly complex companies.” potential audit for some reason; it may be useful to
have a backup provider waiting and ready to step in. A
The absence or limited presence of an IT internal audit word of caution: the primary provider should perform
function in an organization with a large or complex IT envi- at least 80 percent of the co-sourced activities.
ronment could present a situation in which the organiza- Anything less than that and the drop in efficiency
tion’s external auditor could conclude that Paragraph 140 (e.g. twice as many meetings and increased adminis-
may apply. trative overhead) will outweigh the benefits. To ensure
In some circumstances, the CAE may want to explore the that the providers learn the organization’s business
possibility of co-sourcing some or all of the IT audit function. well and treat the organization as an important client,
Most CAEs understand the pros and cons of co-sourcing; this no more than two firms should be used. If Firm ABC
15
lOMoARcPSD|15941127
provides most or all of the IT audit services to an

organization, it will have a different relationship with
the organization than if Firm ABC is one of two or
three firms providing 30 percent of the IT audit
services to the organization.
Co-source Globally Distributed Audits – Most firms

maintain employees in all major global regions, and
many firms operate on different pricing structures for
local resources. Thus, if an organization wanted to
audit its operations in Kuala Lumpur, it may be able to
use a firm with local Malaysian resources at a reduced
cost, as opposed to sending resources to Malaysia. The
one exception to this recommendation is when the
internal audit charter dictates that the internal audit
function provide a certain amount of consultative
services to the business units around controls. In such
a case, it may be more useful to have one team audit
around the globe so that internal best practices can be
observed by the team and shared among business units.
16
lOMoARcPSD|15941127
GTAG — IT Audit Accelerators — 7
As noted above, IT audit budgets can be difficult to estimate Oxley compliance purposes. Functionality typically includes
and manage. CAEs should look for opportunities to use the ability to assign responsibility for remediation proce-
accelerators — tools and/or techniques that help support the dures, assign due dates and deliverables, and track and report
procedures IT auditors will be performing — to increase the on progress. Open issue tracking software is currently used by
efficiency and effectiveness of the audit. CAEs can use an 47 percent of 2004 GAIN survey respondents.
accelerator to do the same audit in less time or do more
detailed audit procedures in the same amount of time. Audit Department Web Site
Many audit accelerators require an investment, so the A number of audit departments have established departmen-
CAE should carefully consider the cost/benefits of any solu- tal Web sites. These are generally intranet-based, but can be
tion prior to investing in an accelerator. Audit accelerators Internet-based. Internet-based solutions offer global sharing
can be divided into two general categories: audit facilitators, of information across organizations, but raise confidentiality
which help support the overall management of the audit concerns. Either type of solution provides an internal audit
(e.g. an electronic workpaper management tool), and testing function with the ability to have central information sharing
accelerators, tools that automate the performance of audit and communication. These solutions can be custom-devel-
tests (e.g. data analysis tools). oped or purchased from vendors. Audit department Web
sites are currently used by 42 percent of 2004 GAIN survey
7.1 Audit Facilitators respondents.
Electronic Workpapers
Although not specific to just IT audits, electronic workpaper 7.2 Testing Accelerators
management can be very useful. These solutions provide cen- Testing accelerators can automate time-consuming audit
tralized management and retention of workpapers, audit tasks, such as reviewing large populations of data. Also,
workflow, version tracking, electronic sign off, etc. There are using a tool to perform audit procedures helps establish con-
a number of vendors in the marketplace that offer these tools. sistency. For example, if a tool is used to assess server securi-
It’s important to consider the functionality of the tool. For ty configuration, all servers tested with that tool will be
example, can it support multiple simultaneous audits? Prior to assessed along the same baselines. Performing these proce-
implementing any tool, the audit functional requirements dures manually allows for a degree of interpretation on the
should be defined. Perhaps more important, however, is the part of the IT auditor. Lastly, the use of tools enables IT audi-
content that is provided with the tool. Does it contain sug- tors to test an entire population of data, rather than just a
gested audit procedures or control activities? CAEs will cer- sample of transactions. This provides for a much higher
tainly need to customize whatever knowledge base is included degree of audit assurance.
with the tool, but it can provide a significant head start. CAEs should be aware of the following considerations
with respect to IT audit accelerators:
Project Management Software • Tools cost money. The CAE should be sure that the
Not specific to auditing necessarily, project management benefits outweigh the costs before embarking on any
software schedules work plans, assigns responsibility for tool implementation.
tasks, tracks project milestones and deliverables, and can be • The IT auditors will need to be trained on the new
used by the IT audit function to provide additional consis- tool. It is not uncommon that a tool sits unused in an
tency and reporting in IT audits. Project management soft- internal audit department because no one knows how
ware is currently used by 35 percent of 2004 GAIN survey to use it. This clearly reduces the return on investment
respondents. of any tool.
• The tool will also need support, patch management,
Flowcharting Software and upgrades. Depending on the tool, it may require a
Software that can graphically document transaction flows, standalone server as well. For this reason, any tool
control points, and key process steps is very useful — almost selection should be managed with the IT department’s
necessary — when documenting process walkthroughs, par- assistance.
ticularly for Sarbanes-Oxley compliance purposes. Storing • In some cases, IT management or third-party service
graphical process documentation electronically supports the providers may not allow the tools to access the produc-
ease of updating flowcharts as processes change and provides tion environment directly. Any use of tools and/or
for easy storage and sharing. Flowcharting software is cur- scripts should be thoroughly discussed with, and
rently used by 59 percent of 2004 GAIN survey respondents. approved by, IT management and be tested fully before
deploying.
Open Issue Tracking Software
This software allows for tracking of outstanding audit issues Data Analysis Software
or deficiencies and is often integrated with document man- These tools allow an IT auditor to perform robust statistical
agement software, especially those designed for Sarbanes- analysis of large data sets. They can also be used to support
17
lOMoARcPSD|15941127
GTAG — IT Audit Accelerators — 7
process or operational audits (e.g. accounts payable fraud review the planned usage of any of these tools with the
reviews), and they can support many types of testing, such as security officer and coordinate the testing with IT man-
Benford’s analysis, cumulative sampling, etc. One considera- agement to ensure the timing of testing will not impact
tion when using a data analysis tool is that it may be difficult production processing. In some cases, the security officer
to extract the data from the original source. It is critical that or systems administrators may already be running some of
audit procedures be performed to ensure the completeness and these tools on a regular basis as part of the systems man-
accuracy of the source data. Some of the key vendors in this agement processes. If so, the results may be able to be
arena are: leveraged to support IT audits, if properly designed and
• ACL: http://www.acl.com/Default.aspx?bhcp=1 executed. A list of the top 75 tools can be obtained at
• Idea: http://www.audimation.com/product_feat_ www.insecure.com.
benefits.cfm Application Security Analysis Tools – If an organiza-
• Monarch: http://monarch.datawatch.com/ tion is using any large integrated business application
• SAS: http://www.sas.com/ (like an ERP system such as SAP or Oracle), many of
the key internal controls are highly security dependent.
Security Analysis Tools For example, perhaps Company XYZ has a corporate pol-
These are a broad set of tools that can review a large popula- icy that all checks over $10,000 require management
tion of devices and/or users and identify security exposures. approval before issuing. That’s certainly a good control.
There are many different types of security analysis tools, but Now, assume that Company XYZ has configured its
generally they can be categorized as follows: Oracle system so that any check created over $10,000
Network Analysis Tools – These tools consist of soft- automatically is placed in a holding queue for someone
ware programs that can be run on a network and gather to approve and release. This example is another solid use
information about the network. Hackers would typically of IT controls to support corporate policies. Now, assume
use one of these tools on the front end of an attack to that all users on the Oracle system have full access to the
determine what the network looked like. IT auditors can system. Obviously, any user could go into the holding
use these tools for a variety of audit procedures, includ- queue and approve and release the check. It is for this
ing: reason that application level security must be well
• Verifying the accuracy of network diagrams by designed and built in conjunction with the application’s
mapping the corporate network. processes and controls. Also, this is an example of why
• Identifying key network devices that may warrant any type of audit (financial, process, operational, or IT)
additional audit attention. in a large integrated application environment needs to
• Gathering information about what traffic is include a user security component to be effective.
permitted across a network (which would directly Unfortunately, building functionality to support application
support the IT risk assessment process). user security audits is not necessarily a priority for many ven-
A list of the top 75 tools can be obtained at dors, who tend to be more operationally focused.
www.insecure.com. Consequently, it is often extremely cumbersome and time-con-
Hacking Tools – Most technologies have a number of suming to perform application user security audits. These
standard vulnerabilities, such as the existence of audits may be accelerated by using an application security
default IDs and passwords or default settings when the analysis tool, many of which tend to be specialized for various
technology is installed out-of-the-box. Hacking tools application systems (PeopleSoft, SAP, or Oracle) and analyze
provide for an automated method of checking for these user security against preconfigured rules. These tools may also
standard vulnerabilities. Such tools can be targeted evaluate segregation of duties within the application. The
against firewalls, servers, networks, and operating sys- CAE should be aware that most of these tools come with a set
tems. Many provide for plug-and-go usage; the IT audi- of preconfigured rules or vendor-touted “best practices.” Due to
tor plugs in a range of what it wants the tool to search the snowflake theory, any implementation of one of these tools
for, leaves, and comes back in a few hours, or the next will need to be accompanied by a substantive project to create
day. By then, the tool has developed a report of all vul- a rule set that is relevant for that particular organization.
nerabilities identified in that range. Failure to do so will result in audit reports that contain a num-
These tools are important for an IT auditor to run for ber of either false-positives or false-negatives.
several reasons, not the least of which is that these are Some key vendors in this arena are:
the tools that a hacker would use to mount an attack • Approva: http://www.approva.net/
against the organization. The organization should at least • LogicalApps: http://www.logicalapps.com/
have the same information that a hacker would have. It’s • Virsa: http://www.virsa.com/
important to note that some of these tools are potentially • Q Software: http://www.qsoftware.com/index.htm
dangerous to run, because they can impact the integrity • Control Solutions International:
of the systems they are scanning. The IT auditor should http://www.csi4sap.com/en/home/
18
lOMoARcPSD|15941127
GTAG — Questions for the CAE — 8
IT auditing has been around for many years. However, it is IT audit workpapers reviewed for quality and
constantly evolving and changing. Consequently, the CAE adequacy?
must continually adapt and evolve the IT audit approach • Has a training strategy been established for IT
and the IT audit universe to perform IT audit procedures auditors? Does it consider all the layers of the IT
that are needed to meet compliance requirements adequate- environment?
ly and help manage the overall business risk of • Are emerging IT issues and risks evaluated each year
the organization. to determine the relevance within the organization?
Although this guide does not have all the solutions and, How does the organization identify these emerging
in some cases, may raise more questions than it answers, issues?
hopefully the CAE can use it as a tool to assist with this evo- • Has the audit function benchmarked the IT audit
lution. The following questions are provided to help CAEs function against industry best practices? Was the
as they consider these issues in the context of their organiza- GAIN survey or other data repositories used to
tion: facilitate this?
• Has the organization clearly defined what IT means • Do all process audits contain procedures that evaluate
in their particular organization? Are the chief infor- application configuration settings for the applications
mation officer’s areas of responsibility documented? that automate the processes? How are these coordinat-
Does the IT audit approach consider all of those ed between audit resources (process versus IT)?
areas when evaluating risk and defining the IT audit
universe?
• Does the audit function perform an effective IT risk
assessment annually? Are knowledgeable specialists
in infrastructure technologies, application systems,
and IT processes all involved in that assessment?
• Does the IT risk assessment consider the specific
technological architecture and configuration
employed by that organization?
• How are IT risks quantified? Are both impact and
likelihood of occurrence estimated? What industry
benchmarks and best practices are used to support
these estimates?
• Does the IT audit universe plan for audits at each
layer of the IT environment? If not, why not? Are
there special circumstances that apply, or is the IT
audit plan sub-optimal?
• How are budgets for IT audits estimated? Was
enough information gathered on the front end of the
audit to support an accurate estimation? Was the
specific configuration of the technology considered?
• How are IT audit procedures defined? Are they
developed internally for the organization’s specific
environment, or are marketplace checklists used?
• Has the organization implemented any IT control
frameworks or standards? If so, which ones? If not,
have security and control baselines been established
internally? If not, has the CAE recommended the
implementation of an IT control framework and
security and control baselines as part of the audit of
IT governance and management?
• Are any tools used to accelerate IT audits (e.g. test-
ing accelerators or facilitators)? If not, why not? If
so, have they been tested fully and approved by IT
management?
• How are IT audits staffed? Are specialists used for
various technologies (e.g. applications versus infra-
structure technologies)? If not, why not? How are
19
lOMoARcPSD|15941127
GTAG — Appendix A — Emerging Issues
Moore’s Law predicts the continued evolution of technolo- these networks exist and take appropriate action. This
gy. This appendix covers some emerging technologies of is more difficult than ensuring that networks are
which CAEs should be aware, and the potential impact on secured and controlled and will likely entail an IT
the organization and the IT audit function. By no means is auditor physically going through business unit loca-
this a comprehensive list of all emerging technologies, but tions with an antenna, trying to detect the presence of
it’s indicative of some of the more prevalent issues in the wireless devices.
marketplace.
These issues will certainly vary from environment to At a minimum, the IT auditor should obtain and review
environment (the snowflake theory) and may present a listing of all wireless networks approved by the organiza-
greater or lesser risk depending on industry, technology, or tion. Corporate policies and procedures should be estab-
business processes. The issues, along with their risks and rec- lished for wireless networks and should provide guidelines
ommendations, are presented in no particular order, but are for securing and controlling these networks, including the
designed to get CAEs thinking about their environment and use of data encryption and authentication to the wireless
whether currently scheduled IT audit procedures will evalu- network. The IT auditor should review the configuration of
ate these issues. the known wireless networks to ensure compliance with
developed policies and procedures. The IT auditor should
A.1 Wireless Networks also detect unapproved wireless networks and take appropri-
Wireless networks are proliferating throughout organiza- ate corrective action.
tions, because they are useful and can support business
objectives directly. However, they are also easy to set up (as A.2 Mobile Devices
any person who has set up a home wireless network can like- Most organizations have recognized the value of wireless
ly attest to) and provide a potential entry point into the cor- devices such as Blackberrys, Personal Digital Assistants
porate network. CAEs should be concerned both with the (PDAs), smart phones, or TELXON units and have prolifer-
security of wireless networks that are authorized by the ated these devices to support business objectives. However,
organization as well as rogue wireless networks that users not all organizations have grasped the risk of using these
have established without authorization. devices.
Wireless Network Risks Mobile Device Risks

Intrusion – Wireless networks may allow unauthorized Many of these devices store critical business data on the
entry into the corporate network. device itself. If the device is not configured in a secure fash-
Eavesdropping – Wireless networks may allow unautho- ion, the confidentially of this data may be impacted if the
rized personnel to access confidential information that device is lost or stolen. Also, the transmission of data to the
is transmitted across wireless networks. device itself may not be secure, potentially compromising
Hijacking – An unauthorized user may hijack the session the confidentiality or integrity of that data. Because these
of an authorized user connected to a wireless network devices are often used by upper management, this could be
and use that session to access the corporate network. company. Furthermore, these devices may allow remote
Radio Frequency (RF) Management – The wireless net- access into corporate networks, and in the case of TELXON
work may send transmissions into unwanted areas, or similar devices, they may intiate the processing of trans-
which may have other impacts. For example, hospitals actions. Consider, for example, a beverage distribution com-
may have equipment that reacts poorly to radio wave pany that equips route drivers with wireless devices that are
transmissions and therefore should not be exposed to used to book inventory transactions as they deliver product
wireless networks. to each customer.
Recommendations for Wireless Networks Recommendations for Mobile Devices

Perform a thorough wireless network audit that includes the The IT auditor should review mobile device management.
following two components: At a minimum, consideration should be given to:
• The organization most likely has wireless networks Provisioning – The process for a user to procure a device.
that have been approved and implemented for a spe- Standardization – Are devices standardized?
cific business reason. The IT function should assess Security Configuration – What policies and procedures
these networks and help ensure that they are secured have been established for defining security baselines
and controlled in accordance with management’s for devices?
objectives. Data Transmission – How is data transmission controlled?
• The organization may have unapproved wireless Access Into Corporate Networks – Do devices provide
networks that users have established. The IT audit access into the corporate network? If so, how is that
function should perform procedures to detect if any of controlled?
20
lOMoARcPSD|15941127
Lost or Stolen Devices – How would the company iden- processing? If so, does the directory also contain data
tify lost or stolen devices and terminate service to used in wire transfers or outbound electronic pay-
them? ments? How is the clerk restricted from these data sets?
Interface Software – If these devices initiate business Is data potentially co-mingled?
transactions, how is that information interfaced into Interface Types – What types of interfaces are used? Are
the corporate applications? they real-time or batch-oriented? What transactions
do they support? Do they initiate the processing of
A.3 Interfaces other transactions (e.g. interfaced sales orders initiat-
Complex IT environments often require complex interfaces ing the shipment of goods).
to integrate their critical business applications. Even large
integrated ERP environments often require complicated A.4 Data Management
interfaces to other distributed applications, like Internet sys- Organizations are automating more and more business
tems. These interfaces may be enabled with middleware processes and functions. At the same time, the cost of data
technology, which acts a central point of communication storage is becoming cheaper and cheaper. Even today’s per-
and coordination for interfaces. Although interfaces and sonal computers can have hard drives that store 250GB or
middleware play an important role in end-to-end processing more data, much more than even large servers could store
of transactions, in many cases they are not included in audit five years ago. These issues have led to the proliferation of
plans. This may be because interfaces are difficult to classify. large corporate data storage solutions. It is not uncommon
They are similar in function to an infrastructure, or support- for a mid-sized organization to store and manage terabytes of
ing technology, yet they are software applications that may business data. As organizations begin to manage these large
actually process transactions. repositories of data, many issues emerge.
Interface Risks Data Management Risks

Interfaces, and middleware in particular, are a critical link in Failure to manage data repositories, or storage area networks
the end-to-end processing of transactions. At a minimum, (SANS), may result in the loss of critical business data avail-
they move data from one system to another. At a maximum, ability. Organizations must ensure that the integrity of these
they may be responsible for transforming the data, perform- storage solutions is maintained adequately. However, it may
ing some calculation or modifying the data based on some be difficult to back up, or reorganize a data storage network
algorithm. Interfaces may also pose a single point of failure that contains six terabytes of business data. New manage-
to the organization. Consider Company XYZ, which is ment and maintenance technologies must be deployed, and
running an ERP system for financial consolidation. The dis- new management processes must be defined. Moreover, the
tributed business units all maintain interfaces from a variety growth in data storage also coincides with the promulgation
of disparate systems up to the central corporate system. of many new laws, statutes, and regulations regarding the
There are approximately 200 of these interfaces, all running management of data. Therefore, the data management
through a single middleware server and application. That requirements of an organization must also adhere to numer-
middleware server suddenly stops functioning. This would ous new legal and industry requirements.
have a substantial impact on the operations of the company.
Recommendations for Data Management
Recommendations for Interfaces Perform a thorough data management review. At a mini-
The CAE should ensure the IT risk assessment and audit mum, consideration should be given to:
universe considers interfaces and middleware. Specific items Data Classification – Has the organization gone through
that should be considered are: a data classification exercise? What types of data
Use of Software to Manage Interfaces – Does the categories have been established, and what were the
software transform data or merely move it from place criteria for organizing data into those categories?
to place? Data Ownership – Has the organization formally
Interface IDs – The interface software will probably need assigned ownership of data to specific data owners?
access into the systems to/from which it is moving Have the responsibilities of these data owners been
data. How is this access managed? Are generic IDs documented?
used? What access are these IDs granted, and who has Data Retention – Has a data retention strategy been
access to use these IDs? developed? Even large data storage solutions can fill
Interface Directories – Are all data moved through a up, at which point the organization needs to either
single interface directory? Who has access to that delete data or move data to some other storage
directory? How is it secured and controlled? For solution, such as archiving it. What is the current
instance, does a clerk in one of the business units have archiving/retention policy? How does this impact or
access to the directory to upload a file for transaction support the organization’s objectives? If an audit needs
21
lOMoARcPSD|15941127
to be performed, will the data be there to audit? Or role? What is the role of general counsel with respect
will it have been archived or deleted? If it has been to privacy?
archived, can it be recovered easily? Policies and Procedures – Have policies and procedures
Archiving and Retention Tools – If a data retention been established for creating, storing, and managing
strategy has been defined, it may require tools to sup- business data? How are these implemented, and how
port it, such as archiving software, or archiving media. does the organization ensure compliance?
These tools may need to be audited to evaluate how Compliance Tasks – What specific compliance tasks are
effectively they are performing required procedures. performed? Does the organization require data encryp-
Data Management – How are data managed? What are tion? If so, what methods are used? Are Web develop-
the daily/weekly/other tasks that need to be performed ment methodologies updated to include items such as
to help ensure the integrity of data? Who performs opt-in policies?
those tasks, and how are they procedurized?
A.6 Segregation of Duties
A.5 Privacy As organizations integrate their environments into larger,
Data privacy and consumer rights are highly visible topics more complex applications, segregation of duties is less a
today. A large number of data privacy laws with which large function of job role and more a function of what transactions
companies must comply have been promulgate. In some the user can perform in the system. Consequently, appropri-
cases, these laws may have substantially different require- ate segregation of duties is largely dependent on application
ments, even to the point of incompatibility with one anoth- level security.
er. For example, a large organization that does business in At the same time, however, application level security is
Europe and North America is subject to the EU Privacy becoming increasingly complex and requires a greater level
Directive on Data Protection, Canada’s Personal of expertise to administer appropriately. As a result, many
Information Protection and Electronic Documents Act of organizations are experiencing deficiencies related to segre-
2000, any number of U.S. state-level regulations, and per- gation of duties. Lastly, the complexity of application level
haps industry-specific requirements such as the U.S. Health security makes it more difficult to audit segregation of duties
Insurance Portability and Accountability Act of 1996 or the effectively and efficiently.
Gramm-Leach-Bliley Act of 1999. These are all different. If
an organization wants to put up a Web site that provides Segregation of Duty Risks
games or media that children might access, they need to be Inadequate segregation of duties could expose the organiza-
aware of child-protection data privacy laws as well. tion to theft, fraud, or unauthorized use of information
resources. Moreover, deficiencies in segregation of duties
Privacy Risks could affect compliance with Sarbanes-Oxley adversely. A
Failure to comply with certain privacy laws could result in number of the material weaknesses in internal control
fines and/or criminal prosecution. In addition, there could reported by publicly traded companies in 2004 were related
be a significant impact to brand equity. Consider a cereal to segregation of duties.
manufacturer who puts games promoting its cereal on the
corporate Web site. A number of children register on the site Recommendations for Segregation of Duties
and play the games. A hacker then compromises the list of Perform a segregation of duties audit, which should include:
registered users, which contains some personally identifiable Understanding How Segregation of Duties is Being
information about the children who are registered on the Managed and Controlled – What processes, people, and
site. The Wall Street Journal then publishes a story about how tools are used to support the management of segregation of
the cereal company let personally identifiable information duties?
about children leak on the Internet. What would be the Defining Conflicts – Has the organization developed a com-
impact of that situation? It is difficult to quantify the impact prehensive listing of all job functions that are deemed to be
on the organization, but it is likely that the result would not incompatible? How has this list been modified for business
be a positive impact on shareholder value. unit locations that have a significantly smaller staff? Who
was involved in developing the list? Were all key stake-
Recommendations for Privacy holder involved in establishing and approving conflicts?
Perform a privacy audit. At a minimum, the organization Determining Specific Deficiencies – Has the organization
should consider: used the list of conflicts to identify either specific security
What Privacy Laws Apply to the Organization – Has roles, or specific individuals who have been granted access
the organization identified all various laws, regula- that presents a violation of segregation of duties? Is a tool
tions, and statutes with which it must comply? being used to facilitate this process? If so, how has the tool
Responsibility for Privacy – Has a chief privacy officer been configured? Does the tool process and monitor con-
role been created? What are the responsibilities of that flicts in real time?
22
lOMoARcPSD|15941127
Assigning Responsibility – Has the organization formal- Recommendations for Administrative Access
ly assigned responsibility for managing and controlling In every environment, administrative access is required to
segregation of duties to a specific individual or job operate the systems. However, the IT audit function should
role? If so, what tasks does this responsibility entail, help ensure that systems administrators only have access to
and what is the period of performance? Have policies data and functions required to perform job responsibilities.
and procedures been established to guide this role? Note that this does not include functional transactions.
Performing a Cross-application Analysis – Have tools, Systems administrators would never, as part of their job
policies, and procedures been established to manage duties, post a transaction to the G/L, cut a check, or main-
analyzing segregation of duties across applications? tain a vendor master record. As such, they should not have
Example: Company XYZ is using SAP for financial access to perform these transactions. Another typical argu-
accounting and PeopleSoft for human resources. A ment is that administrators need functional access to trou-
user has access to both systems, and the combined bleshoot. However, most troubleshooting and testing should
access creates a segregation of duties conflict. Analysis be done in the test environment, not in production. If the
of either the SAP system or the PeopleSoft system test environment is not an adequate representation of pro-
would not reveal the conflict. Only a cross-application duction, that indicates a flaw in the systems development
analysis of both systems would reveal the conflict. process, not a need for increased production access.
The IT auditor should also consider:
A.7 Administrative Access Splitting Access – Splitting the access to perform a func-
Systems administration personnel are generally granted high tion so that two people are needed to perform the
levels of access to IT resources. This is explained away function.
because they are presumed to be administrators who need Generic IDs – In certain cases, an administrative team
this access to perform their job. may be sharing an administrative ID. The IT auditor
reviewing an access report would only see a single user,
Administrative Access Risks but the reality may be that multiple users are using
Users with administrative-level access potentially can per- that ID. This increases the risk because now the audit
form many functions above and beyond their core job trail is compromised.
responsibilities. A user with full access to a business applica- Number of People With Administrator Access – Access
tion, for example, potentially could create an invoice, to administrative functions should be limited to a
receive goods, and cut a check. This same administrative small number of administrators only. Not everyone in
user could also delete all audit trail records. A user with the IT department needs administrative access.
administrative access to the database could misappropriate Audit Trail Management – Given that administrative
the entire electronic payment run. users have a high level of access to the systems, one of
As organizations continue to automate and integrate the only mitigating controls available is the periodic
their IT environments, the administrative accounting risks independent review of audit trails. This review can be
increase. A systems administrator with unlimited access to a performed by IT audit personnel or by other independ-
full-scope SAP system has much more power than a systems ent resources (e.g. an IT director in another IT func-
administrator with unlimited access to a warehouse system. tion). It’s critical to make sure that, if possible, systems
Failure to restrict administrative access adequately is a signif- administrative personnel cannot delete audit trail
icant exposure, and for publicly traded companies could data. This step often can be performed either through
impact their external auditor’s Sarbanes-Oxley Section 404 security or systems configuration.
opinion. For companies that outsource some or all of the IT Use of Firecall IDs – Firecall IDs and passwords also can
environment, this risk is even greater for two reasons: be used to help mitigate the risk of granting adminis-
• In many cases, the outsourced provider may serve mul- trative access. A firecall ID is an account set up with
tiple organizations with a large team. Typically, this administrator-level access. This account is kept
means that instead of a team of five administrators locked, and the password is known only to an inde-
supporting one organization, there may be a team of 25 pendent person within the organization. When an
administrators who collectively support five organiza- emergency situation arises, the IT support personnel
tions. If so, all 25 administrators likely will be granted retrieves the password for the firecall ID, and this
a significant level of access. retrieval is logged. The support person uses the ID to
• Contractual arrangements notwithstanding, it is perform the required tasks and returns the ID to the
always a greater risk when someone who is not an independent person, who then locks the account.
employee of the organization has administrative access There are some new tools available on the market
to systems. today that automate this process.
23
lOMoARcPSD|15941127
A.8 Configurable Controls assets may, for certain companies, be more critical to the
As discussed in the introduction to this GTAG, many of company’s success than protecting physical assets. The
today’s key controls are technology-based, or configured into Internet has created a global distribution network that
business applications. Consider the automated three-way allows quick and anonymous distribution of pirated digital
match example explored in the Introduction. The function- assets.
ality of this matching process is controlled by a number of
configurable settings within the application (e.g. tolerance Piracy Risks
levels, type of match by quantity or value, what to do with As the value of digital assets increases, the risk associated
transactions that fail the match, what accounts to book vari- with piracy also increases.
ances to, etc.). Certain organizations and industries view piracy as one of
In many cases, these configurable controls are the pri- the greatest risks they face today. Obviously, the recent bat-
mary controls that manage and control the processing of tles between the recording industry and the various digital
transactions through a given process. However, these con- music swapping sites (e.g. Napster) are just one example of
trols are often overlooked when performing a process audit. this.
The direct monetary impact of piracy is hard to quanti-
Configurable Controls Risks fy, but many organizations estimate that piracy has a bottom-
Failure to consider configurable application controls when line impact of tens, if not hundreds, of millions of dollars.
performing a process audit may result in ineffective audit
procedures or inaccurate audit conclusions. In addition, it is Recommendations for Piracy
often much quicker to review a configured setting online Perform an audit of digital asset management, which should
than to perform and review a sample of 60 transactions. include:
Therefore, failure to focus on configurable controls may also Inventory of All Digital Assets Maintained by the
result in inefficient audit procedures. Organization – Does the organization have a current
list of all digital assets and their respective physical
Recommendations for Configurable Controls and logical locations?
Evaluating configurable controls should not be performed as Classification – Has the organization gone through a dig-
a standalone IT audit. Rather, all process-oriented audits ital asset classification exercise? If so, what criteria
should evaluate the configurable settings that control that were used for the exercise? What strata were defined?
particular process as part of the overall audit. This may pose Storage – Where are digital assets stored? How are they
a coordination challenge because IT auditors likely will need stored? Are appropriate backups kept? If backups are
to work hand-in-glove with process auditors to determine stored somewhere else, how are they secured and con-
which settings are important and to perform the required trolled?
technical audit procedures. Data Encryption – Are digital assets subject to encryp-
The CAE should review the audit plan for all planned tion technologies? If so, which technologies? Do the
process audits. If the plan does not include any tests of con- encryption methods make sense for those types of
figurable controls, it should be challenged to determine why assets?
no configurable controls are being reviewed. The fact that Administrative and Third-party Access – If digital assets
they are not being reviewed is not necessarily a weakness; are secured, what other people have access to those?
there may be any number of valid reasons why configurable Example: Company XYZ is making its latest summer
controls are not relevant for that particular audit. blockbuster movie. It has spent $200 million on devel-
If configurable controls are relevant to a particular opment and marketing. The film is stored in digital
process audit, it is important to consider how tests of these form on large editing servers, as any prudent company
controls will be performed. Going into a configuration table would do. This data is backed up and stored offsite.
and evaluating the settings requires a vastly different skill set One of the people in the storage chain (e.g. the driver
than reviewing a sample of 60 transactions. Effective CAEs or off-site storage manager) takes a copy of the backup
craft an audit plan that utilizes the right skill sets in the right and releases the unfinished movie on the Internet sev-
places. For process audits, this may mean coordinating audit eral weeks before its theater release, resulting in a sig-
procedures among multiple auditors on a single audit. This nificantly reduced box office gross for that particular
type of coordination may create some logistical challenges, movie. Unfortunately, the whole fiasco is the result of
but should result in a better audit. the initial desire to have good IT controls (e.g. back-
ups). This paradox forces the IT auditor to consider
A.9 Piracy new ways of securing and controlling bits and bytes.
Computer piracy activities are more prevalent today then Transportation and Transmission – The same issues that
ever before. As organizations automate their enterprises, applied above also apply to the transportation and trans-
more assets are converted to digital form. Managing digital mission of digital assets. Certainly, any unencrypted
24
lOMoARcPSD|15941127
digital file sent via e-mail is exposed and potentially Software and User Groups
could be exploited. Has the organization developed • Freeware tools.
robust policies and procedures that provide for the – Business Software Alliance promotes a safe and
transportation and/or transmission of digital assets? legal digital world –
http://www.bsa.org/usa/antipiracy/Free-Software-
Other Resources Audit-Tools.cfm
Professional Organizations – AuditNet® is a network of resources available for
• Information Systems Audit and Control Association auditors –
(ISACA) – www.isaca.org http://www.auditnet.org
– Offers the Certified Information Systems Auditor • User groups.
(CISA) and Certified Information Systems – Americas’ SAP Users’ Group – www.asug.com
Manager (CISM) designations. – Independent Oracle Users Group – www.ioug.org
• Institute of Internal Auditors (IIA) – www.theiia.org – Quest International User Group (for
– Offers the Certified Internal Auditor (CIA) PeopleSoft/JD Edwards) –
designation. http://www.questdirect.org
– Offers ITAudit, a free electronic newsletter that – SQL Server Worldwide Users Group –
includes a Reference Library. http://www.sswug.org
• Information Systems Security Association (ISSA) – – Yahoo’s directory of user groups –
www.issa.org http://dir.yahoo.com/Computers_and_Internet/
– Supports Certified Information Systems Security Organizations/User_Groups
Professionals.
– ISC2 administers the certification process, but it is
not a professional organization in itself.
• American Institute of Certified Public Accountants
(AICPA) – www.aicpa.org
– Sponsors Certified Public Accountant (CPA)
designation.
Helpful Web Sites

• http://www.csoonline.com
– Offers useful resources, including security articles,
for security executives.
• http://www.whatis.com
– Great for quick technology definitions and quick
links to other IT sites.
• http://csrc.nist.gov
– Computer Security Research Center, sponsored by
the National Institute of Standards and
Technology.
• http://www.cyberpartnership.org
– The National Cyber Security Partnership, a
public-private partnership established to develop
shared strategies and programs to better secure and
enhance America’s information infrastructure.
• http://www.infosecuritymag.com/
– Information security magazine that covers timely
security topics.
• http://www.itgi.org
– Exists to assist enterprise leaders in their responsi-
bility to make IT successful in supporting the
enterprise’s mission and goals.
25
lOMoARcPSD|15941127
GTAG — About the Authors
Michael Juergens, primary author, has more than 15 and provides services to clients operating around the globe.
years of professional experience and has been with Deloitte Ringle specializes in information systems and business
since 1996. He currently serves as the leader of Deloitte’s process audits and assessments, project management, and
Control Assurance practice for the Pacific Southwest region. Sarbanes-Oxley Section 404 assessments. He has assisted
Juergens specializes in assessment of information technology many clients in preparing for, and successfully implement-
controls. He is a nationally recognized speaker on internal ing, Sarbanes-Oxley assessment processes. Ringle graduated
controls and has spoken to many audiences, including The from Michigan State University with a B.A. and M.B.A. in
IIA, ISACA, Americas’ SAP Users’ Group, MIS Training accounting. He is a Certified Public Accountant (CPA),
Institute, and attendees of numerous national and interna- Certified Information Technology Professional (CITP), and
tional conferences. He sits on The IIA’s Professional Certified Information Systems Auditor (CISA).
Conferences Committee and oversees all the IT audit train-
ing courses offered by The IIA. Juergens currently serves as Reviewers
the lead internal controls principal for a number of large The IIA Advanced Technology Committee, IIA global affil-
multi-national companies. In that regard, he has overseen iates, American Institute of Certified Public Accountants,
the delivery of numerous internal control projects, Sarbanes- Center for Internet Security, Carnegie-Mellon University
Oxley readiness projects, and attestation audits. Juergens has Software Engineering Institute, Information System
a B.A. in economics from the University of California Security Association, IT Process Institute, National
Irvine, and an M.B.A. from the University of California Association of Corporate Directors, and SANS Institute
Irvine. joined the review process. The following individuals and
organizations provided valuable comments to this guide:
David Maberry, contributing author, is a senior manag- – American Institute of Certified Public Accounts
er in Deloitte’s Audit and Enterprise Risk Services Control – The Institute of Internal Auditors in Australia
Assurance practice in Los Angeles. He has extensive experi- – The Institute of Internal Auditors in United Kindom
ence in risk management, compliance, and internal audit- – Christopher Fox – PricewaterhouseCoopers, USA
ing, with specializations in Sarbanes-Oxley compliance – David Bentley – Consultant, United Kingdom
assessments, IT risk assessments, pre- and post- implementa- – E.W. Sean Ballington – PricewaterhouseCoopers,
tion reviews, and technical audits on a variety of systems and USA
platforms. Maberry’s significant operational experience pro- – Jay R Taylor – General Motors Corp., USA
vides a unique ability to analyze processes in virtually any – Larry Brown – The Options Clearing Corporation,
environment and provide maximum benefit. Prior to joining USA
Deloitte, he worked for more than 11 years in advanced – Lars Erik Fjortoft – Deloitte, Norway
operational management positions in the health care indus- – Lily Bi – The Institute of Internal Auditors
try. Maberry currently supports multiple Fortune 500 compa- – Stig J. Sunde – Office of the Auditor General Norway
nies in their audit compliance and business assessment
strategies.
Jeff Fisher, contributing editor, is a senior manager in

Deloitte and Touche’s Audit and Enterprise Risk Services
practice. Fisher has been with the firm for more than eight
years and serves as the project manager and in a technical
quality assurance role for some of Deloitte’s largest clients.
He specializes in information systems security audits and
assessments, project management, and Sarbanes-Oxley
Section 404 assessments. Fisher has assisted many of
Deloitte’s clients in preparing for, and successfully imple-
menting, Sarbanes-Oxley assessment processes on a global
basis. Fisher graduated from Ferris State University with a
B.S. in accounting and computer information systems. He is
a Certified Information Systems Security Professional
(CISSP) and a Certified Information Systems Auditor
(CISA).
Eric Ringle, contributing editor, is a senior manager in

Deloitte and Touche LLP’s Audit and Enterprise Risk
Services practice. He has more than 11 years of experience
26
lOMoARcPSD|15941127
Are you on a collision course

with IT-related risks?
Here’s how to face them
with confidence.
Information technology controls are critical for businesses. As you automate more processes, share more
data, and outsource more functions, IT controls are a key line of defense against IT related risks. Having
the resources and experience to address these risks is the challenge. Deloitte & Touche LLP can help.
We can help you perform risk and impact assessments, develop IT audit plans and assist with performing
the audits. We offer a national team of IT audit and controls professionals with extensive experience, as
well as subject matter specialists in a range of technologies and industries.
IT-related challenges and risks will only increase over time. Our Enterprise Risk Services professionals
can help you meet them head on. Contact us at [email protected], 800-871-2586 or visit us
at www.deloitte.com/us/internalaudit
www.deloitte.com/us
About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, its member firms and their respective subsidiaries and affiliates. As a Swiss Verein (association), neither
Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other’s acts or omissions. Each of the member firms is a separate and independent legal entity
operating under the names “Deloitte,” “Deloitte & Touche,” “Deloitte Touche Tohmatsu,” or other related names. Services are provided by the member firms or their subsidiaries
or affiliates and not by the Deloitte Touche Tohmatsu Verein.
Deloitte & Touche USA LLP is the US member firm of Deloitte Touche Tohmatsu. In the US, services are provided by the subsidiaries of Deloitte & Touche USA LLP (Deloitte & Touche LLP,
Deloitte Consulting LLP, Deloitte Financial Advisory Services LLP, Deloitte Tax LLP and their subsidiaries), and not by Deloitte & Touche USA LLP.
Member of Deloitte Touche Tohmatsu

Copyright © 2006 Deloitte Development LLC. All rights reserved.

lOMoARcPSD|15941127
Information technology (IT) is changing the nature of the internal audit function.
As new risks emerge, new audit procedures are required to manage these risks
adequately. The purpose of the guide is to help chief audit executives and internal
audit managers responsible for overseeing IT audits sort through the strategic
issues involved during the planning, performance, and reporting of IT audits.
Consideration is given to IT audit fundamentals and emerging issues.
What is GTAG?
Prepared by The Institute of Internal Auditors, each Global Technology Audit
Guide (GTAG) is written in straightforward business language to address a
timely issue related to information technology management, control, and security.
The GTAG series serves as a ready resource for chief audit executives on different
technology-associated risks and recommended practices. The following guides were
published in 2005.
Guide 1: Information Technology Controls
Guide 2: Change and Patch Management Controls: Critical for
Organizational Success
Guide 3: Continuous Auditing: Implications for Assurance, Monitoring, and
Risk Assessment
Check The IIA technology Web site at www.theiia.org/technology
Order Number: 1012

IIA Member US $25
Nonmember US $30
IIA Event US $22.50
ISBN 0-89413-590-2
www.theiia.org

Management of IT Auditing (GTAG 4)

Uploaded by

Copyright:

Available Formats

Management of IT Auditing (GTAG 4)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Management of IT Auditing (GTAG 4)

Uploaded by

Copyright:

Available Formats

lOMoARcPSD|15941127

GTAG 4 management of it auditing

Decision Making Techniqes (İstanbul Üniversitesi)

Scan to open on Studocu

Studocu is not sponsored or endorsed by any college or university

IPPF – Practice Guide

Downloaded by Tumi Chili ([email protected])

Global Technology Audit Guide

This guide has been produced and distributed through

Downloaded by Tumi Chili ([email protected])

GTAG — Table of Contents

1. Summary for the Chief Audit Executive … … … … … … … … … … … … … … … … … … … … … … … … …1

Downloaded by Tumi Chili ([email protected])

GTAG — Executive Summary for the Chief Audit Executive — 1

Information technology (IT) is changing the nature of the

Auditing by checklist or by inquiry is likely to be insuf-

The focus of this guide is on providing pragmatic infor-

typically fall into one of the following categories:

3.4 External Connections

GTAG — IT-related Risks — 4

4.1 The Snowflake Theory An Array of Variables

GTAG — IT-related Risks — 4

• Be flexible with respect to the IT audit universe; mon- Pervasive Risk

GTAG — IT-Related Risks — 4

GTAG — IT-Related Risks — 4

through them. This is the essence of risk dependency. The

Robust IT Risk Assessment

GTAG — Defining the IT Audit Universe — 5

GTAG — Defining the IT Audit Universe — 5

The answer, of course, is that it depends. If Company

GTAG — Executing IT Audits — 6

Figure 2 – Audit Process Overview

GTAG — Executing IT Audits — 6

GTAG — Executing IT Audits — 6

GTAG — Executing IT Audits — 6

GTAG — Executing IT Audits — 6

provides most or all of the IT audit services to an

Co-source Globally Distributed Audits – Most firms

GTAG — IT Audit Accelerators — 7

GTAG — IT Audit Accelerators — 7

GTAG — Questions for the CAE — 8

GTAG — Appendix A — Emerging Issues

Wireless Network Risks Mobile Device Risks

Recommendations for Wireless Networks Recommendations for Mobile Devices

GTAG — Appendix A — Emerging Issues

Interface Risks Data Management Risks

GTAG — Appendix A — Emerging Issues

GTAG — Appendix A — Emerging Issues

GTAG — Appendix A — Emerging Issues

GTAG — Appendix A — Emerging Issues

Helpful Web Sites

GTAG — About the Authors

Jeff Fisher, contributing editor, is a senior manager in

Eric Ringle, contributing editor, is a senior manager in

Are you on a collision course

Member of Deloitte Touche Tohmatsu

Downloaded by Tumi Chili ([email protected])

Order Number: 1012

You might also like