Iiav7ce Part3
Iiav7ce Part3
STUDENT MATERIALS
Copyright
These materials are copyrighted; it is unlawful to copy all or
any portion. Sharing your materials with someone else will
limit the program’s usefulness. The IIA invests significant
resources to create quality professional opportunities for its
members. Please do not violate the copyright.
Acknowledgments
The IIA would like to thank the following dedicated subject
matter experts who shared their time, experience, and
insights during development and subsequent updates.
Key Point
Organizational structure plays an important role in how
controls may or may not work. The key consideration is
what impact the structure would have on an auditable
area. What strengths and weaknesses does the structure
create?
Key Point
Structure type is important to internal auditors because it
has a strong impact on management oversight.
Strengths:
Economies of scale (e.g., shared services)
Better control of expenses, preferred vendors, etc.
Consistency of decisions such as for information system
choices
Strengths:
Better cross-functional teamwork (less of a “silo”
mentality)
More organizational flexibility and adaptability
Easier communication (e.g., an “open door” policy)
Key Point
In geographically dispersed organizations or those that
grow by mergers and acquisitions, a decentralized
structure can provide timely and responsive decision
making that can leverage local expertise and minimize
management complexity.
Departmentalization
Departmentalization is a structure for grouping
organizational work into specialized units and jobs. Both
centralized and decentralized organizations use
departmentalization but in different ways and to different
degrees. Grouping classifications may include product,
geographic, process, and customer departmentalization as
well as functional, divisional, and matrix.
Key Point
Reviewing or creating process workflows is vital because
they can reveal where one process or sub-process
interacts with or impacts other processes (including
processes in other functional areas) from a risk and control
standpoint.
For each process, internal auditors also enlist the help of the
process owner to determine:
Why the process exists.
What functional area objective(s) it supports.
Whether it can be linked to achievement of overall
organizational objective(s).
What policies and procedures exist to direct how people
involved are supposed to act.
What its inputs and outputs are and whether these result
in difficulties due to the need for cooperation and
communication with other functional areas.
Whether the process provides other important benefits to
management.
If the process owner is having difficulty describing these
elements, one way to get to the important parts of the
process is to ask “What part of your job gives you the most
satisfaction?” Another question to ask is “What would most
endanger organizational success if it were done wrong?”
Key Point
Because not every risk can—or should—be included in a
single engagement, proper planning helps internal
auditors focus their efforts on the most significant risks to
the area.
Key Point
Management must—as the owners of organizational risk—
identify, assess, manage, and monitor the risks associated
with each third-party relationship on an ongoing basis.
Project Management
Project management is the process of planning,
organizing, directing, and controlling an organization’s
resources (people, equipment, time, and money) for a
temporary endeavor so that project objectives can be met
within defined scope, time, and cost constraints. Internal
auditors typically have excellent project management skills,
since both assurance and consulting engagements are
examples of projects. It is therefore incumbent upon newer
internal auditors to acquire project management skills and
for all internal auditors to continue developing these skills.
Exhibit 3-14 shows the project life cycle and the tasks
associated with each phase.
Project Teams
Project plans and their execution are only as successful as
the manager and the team who implement them. Building
effective teams is critical to the success of any project.
Gantt Chart
The Gantt chart (also known as a horizontal bar chart, a
milestone chart, or an activity chart) is a project scheduling
technique that divides each project into sequential activities
with estimated start and completion times. It allows the
decision maker to visually review a schematic presentation
of the project time budget and compare it with the actual
times.
A Gantt chart:
Helps plan tasks that need to be completed.
Provides a basis for scheduling when tasks will be
executed.
Helps plan the allocation of resources necessary to
complete the project.
Helps determine the critical path for a project with a hard
deadline.
Is appropriate for internal audit scheduling because the
audit process does not often require sequence revisions.
Data Analytics
Data analytics is the process of gathering and analyzing
data and then using that data and the results gathered to
provide business information for making better
organizational decisions and implementing more relevant
policies and procedures. It can also refer to data mining—
gathering information from multiple sources to acquire
results that management can use to make better-informed
decisions.
Key Point
Internal audit activities that leverage data analytics better
fulfill their responsibilities to evaluate and improve the
organization’s governance, risk management, and control
processes. They do this by freeing up internal auditor time
due to fewer manual, time-consuming procedures. The
internal audit activity can broaden the scope of its services
when it uses less staff per engagement.
Data Types
While there are many data types at the detail level (this
speaks to the V for variety of data), a broad way to
categorize data types is structured versus unstructured.
Big Data
Big data describes the exponential growth and availability
of data created by people, applications, and smart machines
as well as large, complex data sets or unstructured data
that is beyond the capabilities of traditional data-processing
applications. Organizations that invest in the required data
collection, storage, processing power, and analytic tools can
leverage big data for competitive advantage if they also
bolster their data governance and information security
governance (including privacy protection).
Source: Global Technology Audit Guide (GTAG) 16, “Data Analysis Technologies.”
Analyze the data. After the data has been cleansed and
normalized, it should be analyzed. The analysis process
used may differ depending on the type of data being
analyzed. A preliminary analysis can provide initial results
and assist in determining if anomalies reflect errors,
violations of company policies, or red flags for fraud.
Targeted, detailed analysis can follow. Once analyzed, all
data should be interpreted:
Have patterns emerged?
Are identified anomalies errors in the feature or system
or process?
Is senior management aware of the feature and its
consequence?
Source: Global Technology Audit Guide (GTAG) 16, “Data Analysis Technologies.”
Maturity Description
Information Security
Information security is the set of policies, processes, and
procedures used to protect the organization’s intellectual
property by ensuring the confidentiality, integrity, and
availability of the organization’s data and information in any
format (electronic, print, or other media).
Confidentiality is enabling only authorized persons to
access or view the information.
Integrity is assurance that the data has not been
improperly altered, is correct, and is reliable.
Availability is ensuring that authorized roles and
individuals have access to the information and information
systems required to perform their duties without
unreasonable outages.
Report on Compliance
The internal audit activity can report to management and
the board on the level of compliance with security rules,
significant violations, and their disposition.
IT Operational Controls
IT operational controls are part of ITGCs and include:
IT organizational structure.
Segregation of IT duties.
Financial and budgetary IT controls.
Operational change management.
Operational data security controls.
Security level management.
IT Organizational Structure
Examples of controls that can be built into IT organizational
structure include:
Minimizing the number of users with administrative
privileges.
Using software tools and direct observation by supervisors
to monitor the activities of users with administrative
privileges.
Setting policy guidelines for all employees to take a
certain minimum number of consecutive days off at least
annually, with special emphasis and/or required job
rotations for persons with sensitive roles or access
privileges such as systems controllers.
Segregation of IT Duties
Segregation of IT duties can occur at the ITGC level or the
application level. Segregation of duties at the ITGC level
relates primarily to restrictions to the roles of individuals,
while application-level segregations are primarily automated
controls within systems. Segregation of duties at the ITGC
level includes:
Encryption
Encryption uses a mathematical algorithm to scramble
data. The data cannot be unscrambled without a numeric
key code, which can be designated as a public key (able to
encrypt but not decrypt messages) or a private key (able to
both encrypt and decrypt messages). Public keys add a
layer of security because the private key does not need to
be distributed. Encryption is used on stored data, physically
transmitted data (e.g., on a flash drive), and electronically
transmitted data. Server access control is the use of
internally encrypted passwords to keep technical persons
from browsing password files. Wireless data can also be
encrypted to prevent compromise if it is intercepted.
Key Point
While there are various forms and levels of encryption, the
key point is that organizations wishing to maintain good
encryption may need to avoid the “easy” routes and
commit to a level of investment and effort sufficient for the
targeted level of security.
Auditing Issues
Evaluating encryption includes evaluating physical controls
over computers that have password keys, testing policies to
see if they are being followed, and implementing and
monitoring logic controls. Protection of private keys from
disclosure to outside parties is paramount. Each security
domain should be able to share its local identity and
security data without compromising its internal directories.
Firewalls
Perpetually available broadband connections need constant
monitoring. A firewall is a hardware/software combination
through which all communications to or from the outside
world are routed. The firewall compares access rules
(controlled by network administrators) against the IP
addresses, names, files, and applications attempting to
enter the system and blocks unauthorized traffic. Firewalls
can:
Improve security by blocking access from certain servers
or applications.
Reduce vulnerability to external attacks (e.g., through
viruses) and ensure IT system efficiency by limiting user
access to certain sites.
Provide a means of monitoring communication and
detecting external intrusions (through intrusion detection
systems, described below) and internal sabotage.
Provide encryption internally (within an enterprise).
Corporate firewalls are often multi-tiered:
A firewall is placed before the web server and any other
public access servers.
A firewall is placed between the public access servers and
the private network areas.
Additional firewalls can be used to protect sensitive data
such as payroll.
Antivirus Software
Antivirus software exists to block known cybersecurity
threats. This type of preventive control is effective only if it
is regularly updated to address emerging threats.
Data Privacy
Privacy is essentially the right to be left alone and to be
free from surveillance by individuals, organizations, or the
government. Data privacy is the individual’s right to have
a voice in how his or her personally identifiable information
is collected, handled, and used, to control who has access to
that information, and to amend, change, or delete the
information. The “Auditing Smart Devices” Global
Technology Audit Guide cites the following U.S. Department
of Labor definition of personally identifiable information
(PII):
Key Point
While many countries (and even some regions, such as
California in the United States) have privacy laws or
regulations, the best way to study for the exam is to learn
the principles behind these laws since they share many
principles.
Assessing Risk
Categories of privacy risk include the following:
Legal and organizational risk. Internal auditors ensure
that relevant privacy laws and other regulations are
communicated to clearly designated responsible parties.
Personnel are told what is expected of them and what
the individual and organizational penalties are for
noncompliance.
Auditors assess personnel competency levels and
whether they have a process to keep current with new
laws, regulations, and technologies (e.g., cloud
computing).
Proof of compliance is required, not just compliance, so
documentation must be addressed.
Auditors determine if management is spending too
much on privacy controls (e.g., expensive encryption for
routine data).
Emerging Technology
Technology is constantly advancing, as is the rate and
variety of malicious attacks. How to keep up with new
technology and get ahead of threats? A good place to start
is to provide assurance regarding IT general controls
including physical security, logical access controls, and
operational controls.
Smart Devices
Smart devices enable working in a truly mobile way.
Examples include cell phones, tablets, wearable devices
(e.g., watches, glasses), and specialized devices such as for
warehouse picking. Smart devices have operating systems,
data storage, and security mechanisms, and they connect to
cellular and/or Wi-Fi networks for data, voice, and/or video.
They may include GPS or specialized sensors such as for
radio frequency identification (RFID).
Cybersecurity Risks
Cybersecurity, also referred to as computer or IT security,
is the protection of computers, networks, programs, and
data from attack, unauthorized access, damage, change, or
destruction. Cyber risks (or cyber threats) involve persons or
entities that seek unauthorized access to a system,
network, or device, either remotely or via inside access. A
hacker is a person who accesses systems and information,
often illegally and without authorization. Unethical
organizations employ hackers to perform industrial
espionage. Hackers could harm the organization’s
employees, contractors, customers, and other stakeholders
and its competitive advantage. They could cause direct
monetary loss as well as reputation damage if certain
information were made public.
Malware
Malware is malicious software designed to gain access to a
computer system without the owner’s permission for the
purpose of controlling or damaging the system or stealing
data. The types of attacks that are increasing are
ransomware (see below), attacks that gain unrestricted
access to user systems and data, and attacks that gather
network passwords and financial data. Zero-day attacks use
malware that is not yet known by the anti-malware software
companies.
Other malware.
Adware is malware intended to provide undesired
marketing and advertising, including pop-ups and
banners on a user’s screen.
A key logger records keystrokes to steal passwords,
etc.
A dialer automatically dials a 900 number (a high-fee
line) to generate huge debts.
Risk Assessment
Exhibit 3-27 reviews common insider threats that are
generally based on the use of IT to commit the crimes.
Cybersecurity Policies
Cybersecurity policies and related training and testing are
designed by IT risk management and IT compliance
functions (second line roles) and administered by IT
operations management roles (first line roles). Internal audit
(third line roles) provides independent ongoing evaluations
of cybersecurity policy effectiveness. Since many
cybersecurity policies are based on cybersecurity
frameworks, a common cybersecurity framework is
presented next.
The first and second line roles that include risk, control, and
compliance functions help assess whether the controls are
functioning adequately and whether they are complete. First
and second line roles need qualified, talented, and certified
individuals who can conduct cyber risk assessments and
gather intelligence on cyber threats. The roles need
adequate policies, including for ongoing training. They may
be involved in helping to:
Design roles to have least-privilege access.
Assess external business relationships.
Plan and test business continuity and disaster recovery.
Ongoing Monitoring
The second line role is expected to implement a monitoring
strategy designed to generate behavioral change.
Successful behavior change can include the following
results.
Users who do critical processes or access sensitive data
are monitored at the access level.
A systematic process to find IT vulnerabilities and
remediate them is developed, including by regularly
scanning systems.
For external-facing systems, first and second line roles
help define and agree on service level agreements (SLAs),
service organization controls (SOCs), and other risk
assessment and oversight programs such as technical
architecture evaluations and compliance monitoring.
The second line roles do announced and unannounced
penetration testing.
A method of ongoing monitoring and remote updating of
smart devices for malware security should be in place.
Goals of IT
Access to relevant and reliable information is key to
business decision making. Relevance includes timeliness of
information and an appropriate level of detail. Successfully
applied information technology speeds the availability of
information, automates aggregation and sorting of data, and
ensures information accuracy. IT is successfully applied
when the organization is able to use it to:
Fulfill business objectives.
Measure and address risks appropriately.
Grow and adapt fluidly.
Communicate effectively internally and externally.
React quickly to business opportunities as they arise.
Management of IT Auditing
The IIA’s Global Technology Audit Guide (GTAG) 4,
“Management of IT Auditing,” 2nd Edition is summarized in
brief here. Internal audits of IT use the same basic process
as any audit, per Standard 2200 and the steps in the
“Engagement Planning: Establishing Objectives and Scope”
Practice Guide (understand context, gather information,
assess risks, form objectives, establish scope, allocate
resources, and document the plan). Considerations for each
step are provided next.
Allocate Resources
According to The IIA
Implementation Standard 1210.A3 (Assurance
Engagements)
Internal auditors must have sufficient knowledge of key
information technology risks and controls and available
technology-based audit techniques to perform their
assigned work. However, not all internal auditors are
expected to have the expertise of an internal auditor
whose primary responsibility is information technology
auditing.
Risks Specific to IT
IT and auditing are primarily concerned with information
risk, which includes the risk that inaccurate information is
used to make a business decision. However, widespread use
of IT for all business processes has led internal auditing
away from a focus on assurance regarding historical data at
a specific point in time to assurance about the reliability of
processes. If the process is wrong, the data will be, too, and
vice versa. Therefore, internal auditing can help mitigate
information risk. Note that this does not preclude auditing
transactions to determine the impact on the business.
IT Auditing Challenges
To identify and assess the control of IT risks properly, an
internal auditor must:
Assessing IT Controls
Assessing IT Controls
Understanding Governance,
IT controls management, technical
General, application
Preventive, detective
Information security
Importance of Reliability and
IT controls effectiveness
Competitive advantage
Legislation and
regulation
Roles and Governance
responsibilities Management
Audit
Risk Risk analysis
Risk response
Baseline controls
Monitoring and Control framework
techniques Frequency
Assessment Methodologies
Audit committee
interface
The internal audit activity can add value to this process. For
example, during the feasibility study, internal audit can
provide assurance that the team is adequately staffed,
control deficiencies are remedied, the system can
accommodate growth, budgets are reasonable, and users
agree to the change.
SDLC Steps
A development methodology is a vital tool because it forces
management to be involved rather than relegating IT to
specialists. Requiring a feasibility study, policies, objectives
and standards, and testing forces IT to be treated as a
resource that must be managed. Formal processes help
managers understand how they can be involved. In fact, all
stakeholders for a system should be involved in the formal
process.
Systems Analysis
While systems planning is used to identify problems or
challenges that are worth addressing in the design and
development of new systems, systems analysis is used to
point out deficiencies and opportunities in existing IT
systems. Systems analysis could indicate that existing
system modification is more cost-effective than a new
system, or vice versa. The result of systems analysis is a
request for systems design or selection. This is a written
request submitted either to the steering committee (for
large projects) or to IT management (for smaller projects). If
approved, the committee allocates money for a feasibility
study.
Feasibility studies:
Systems Design/Selection
Systems design occurs in two phases: high-level design and
detailed design. In between these steps, sometimes
prototyping (rapid creation of an experimental bare-bones
system) is performed. Prototyping makes a functioning
model for users to interact with; they can then suggest
improvements. The prototype may have more than one
revision.
SDLC: Development
Typically organizations purchase off-the-shelf software or a
subscription to a cloud-based software service. Purchased
software should be configured rather than customized due
to cost, time, and licensing considerations as well as the risk
of incompatibility with newer versions of the systems.
Software that is hosted on a cloud-based service is
automatically kept up to date with the latest version.
Customization is not an option for cloud-based software, but
some degree of configuration may be available. Off-the-
shelf and cloud-based systems also incorporate best
practices and well-developed controls and have complete
documentation.
Programmers must get sign-off from superiors at
appropriate milestones. Programmers should follow a
detailed systems road map when writing or reusing code,
debugging code, converting existing data and processes to
the new system, reconfiguring and acquiring hardware as
needed, and training staff. Source code must be protected
during the project by a librarian. Online programming allows
programmers to write and compile code using real data. It
also speeds development time. However, it does introduce
risks that must be controlled:
Creation of multiple versions of programs
Unauthorized access
Overwriting of valid code
SDLC: Delivery/Deployment
Conversion is the process of migrating any data to the new
system and going “live.” This area is of particular concern to
audits, because errors can be introduced at this point (after
testing) and not detected until they cause material harm.
Errors include incorrectly converting code, truncating fields,
use of the wrong decimal place in calculations, and loss of
records. Manual conversion is physical data entry of old
records and should be avoided if possible. To reduce data
entry errors, hash totals, record counts, and visual
inspections should be used. Both automated and manual
data migration should include a data cleansing step.
SDLC: Maintenance
Operations and maintenance are ongoing activities that
continue for the life of the software. It is important that
management schedule and communicate the need for
system downtime for routine maintenance.
SDLC Documentation
The change log is only part of the documentation produced
by the SDLC. Large amounts of other documentation and
formal specifications—covering, among other things, the
software, the related business process, security features,
and backup processes—are also produced.
What does this all mean for internal auditors? Despite the
many advantages of this set-up, control issues abound.
Internal governance models that were created for traditional
software will need to be reengineered. This is especially true
if the organization must comply with the rules of Section
404 of the U.S. Sarbanes-Oxley Act or an international
equivalent on internal controls. The openness of SOA
creates new risks to internal controls.
IT Change Management
The Global Technology Audit Guide, “IT Change
Management: Critical for Organizational Success,” 3rd
Edition, defines change management broadly as “the
technology changes that affect an organization’s systems,
programs, or applications.”
Source: Global Technology Audit Guide, “IT Change Management: Critical for
Organizational Success,” 3rd Edition.
Basic IT Controls
Key Point
A key concept is that IT controls must provide continuous
assurance for internal controls. A related concept is that
auditors must provide independent assurance of this
coverage.
IT Control Objectives
IT internal control objectives include:
Protecting assets/resources/owners’ equity.
Ensuring that information is available, reliable, and
appropriately restricted.
Holding users accountable for functions performed.
Protecting customer privacy and identity.
Providing support and evidence of employee job
performance. (Employees can prove that they did the
right things.)
Maintaining data and system authenticity and integrity.
Assuring management that automated processes are
controlled.
Providing an audit trail for all automated and user-initiated
transactions.
Control Classification
The hierarchy of IT controls in Exhibit 3-36 is discussed next.
Note that systems software controls and application-based
controls were discussed in more detail elsewhere.
Exhibit 3-36: Hierarchy of IT Controls
Components
The components are the aspects or functions of the
organization that are needed individually and collectively to
create and sustain a governance system. Generally self-
explanatory, they are as follows:
Processes
Organizational structures
Principles, policies, and frameworks
Information
Culture, ethics, and behavior
People, skills, and competencies
Services, infrastructure, and applications
Principles
Exhibit 3-39 illustrates the three principles for a governance
framework and six principles for a governance system that
form the COBIT 2019 framework. Each set of principles is
explained next.
Exhibit 3-39: COBIT’s Governance System Principles and
Framework Principles
ISACA, www.isaca.org.
trails [1]
B
baseline controls [1]
big data [1]
bring-your-own-device (BYOD) policies [1]
BYOD (bring-your-own-device) policies [1]
C
centralized organizational structure [1]
change control [1]
change management [1] , [2]
COBIT [1] , [2]
Committee of Sponsoring Organizations Internal Control—
Integrated Framework [1]
compliance [1]
control(s)
baseline [1]
control(s):malicious software [1]
information technology [1]
internal [1] , [2] , [3] , [4] , [5]
IT general [1]
operational [1]
program change management [1]
control frameworks
ISO 27000 series [1]
ITIL [1]
COSO Internal Control—Integrated Framework [1]
cosourcing [1]
CPM (critical path method) [1]
critical path method [1]
cybersecurity [1]
D
data
E
encryption [1]
ethics in data storage [1]
F
fair information practices [1]
FIPs (fair information practices) [1]
firewalls [1]
functional organizational structure [1]
G
Gantt charts [1]
GDPR (General Data Protection Regulation), European Union
[1]
General Data Protection Regulation, European Union [1]
Global Technology Audit Guides
data [1]
information security [1]
GTAGs
Guides
H
HR (human resources) [1]
human resources [1]
I
identity theft [1]
IDSs (intrusion detection systems) [1]
information risk [1]
information security [1] , [2] , [3] , [4]
information technology
1210.A3 [1]
1220.A2 [1]
2110.A2 [1] , [2]
intrusion detection/prevention systems [1]
IPSs (intrusion prevention systems) [1]
ITGCs (information technology general controls) [1]
ITIL [1]
L
logistics [1]
M
malicious software [1]
malware [1]
marketing and sales [1]
matrix organizational structure [1]
N
network analysis [1] , [2]
O
objectives [1]
operational controls [1]
operations objectives [1]
organizational structure
centralized [1]
decentralized [1]
departmentalization [1]
divisional [1]
functional [1]
matrix [1]
outsourcing [1]
P
patches [1]
PERT (program evaluation review technique) [1]
piracy, software [1]
Practice Guides
R
reporting objectives [1]
risk
assessment [1]
information [1]
information technology [1]
risk and control matrix [1]
risk by process matrix [1]
S
sales and marketing [1]
scope
control [1]
SDLC (systems development life cycle) [1] , [2] , [3] , [4] ,
[5] , [6]
security
cybersecurity [1]
information [1] , [2]
levels of [1]
service-oriented architecture [1]
smart devices [1]
SOA (service-oriented architecture) [1]
software
T
text analysis [1]
Three Lines Model [1]
Trojan horses [1]
V
VirWare [1]
W
web services [1]