# Presentation: 233018

## Enterprise Computing (EC) Systems Internal Controls

**Diana Brown**
**Terry Hamilton**

## System Internal Controls

** **
**Costly to add after system implementation**
**Best Practices: **
**Control review and issue resolution take place through out the System Development Life Cycle (SDLC)**
**Internal Audit participates as a team member but maintains its independence**

**   **

** ****Roles and Responsibilities **
** ****Functional Management**

** **
**Select and implement appropriate internal controls**
**Assure that internal controls are adequate and functioning as intended**

## Roles and Responsibilities Project Manager

**Review proposed controls with Project Sponsor and Project Director **
**Work with Business Specialists to ensure that:**
**Only authorized users can access the system**
**A user’s level of access does not exceed the user’s role and responsibility**
**Adequate controls are in place to enforce separation of duties in high risk areas**
**Balancing and reconciliation can be achieved from one system to another**

## Roles and Responsibilities  Internal Audit

**Evaluate functional management’s plans to maximize the benefits from:**
**Existing application controls**
**Supplemental controls**

**Roles and Responsibilities  ****Internal Audit**

## Roles and Responsibilities  Internal Audit

***  ******Internal Audit’s advisory role does not preclude Internal Audit Services from performing post-implementation audits of the subject application or related processes as part of its normal audit activity***

## Internal Audit Services Deliverables  

**Status reports on internal controls**
**Final report to Laboratory management providing:**
**An overall assessment of the internal controls**
**A summary of recommendations**
**Functional management’s action plan on issues**
**Post-implementation audit of the effectiveness of the application if deemed necessary  **

**Internal Audit Services Deliverables  **

##         Issue Resolution Process

**Discuss system internal control recommendations with Project Manager ****– Internal Audit**
**Document and escalate to Project Director and Project Sponsor, if issues arise and are not satisfactorily resolved ****– Internal Audit**
**Provide action plan to Internal Audit ****– Project Manager**
**Include the action plan in final report to Laboratory management with IAS opinion as to whether control issues were adequately addressed ****– Internal Audit**

## System Internal Controls Review

- Issue
- Scope
- Memo

- Internal
- Audit

- Develop
- Test Plan

- Business/
- Technical
- Specialists

- Build
- Controls

- Technical
- Specialist

**Plan**

- Identify
- Needed
- Controls

- Business
- Specialist

- Review
- Identified
- Controls

- Internal
- Audit

- Design
- Controls

- Technical
- Specialist

**Analyze**

**Analyze**

- Adequate
- Controls and
- Test Plan?

**Design**

- Yes

- No

**Build**

**Build**

- Review
- Controls
- and Test Plan

- Internal
- Audit

**Build**

- Perform
- Testing

- Business/
- Technical
- Specialists

**Build**

- All
- Controls
- Identified?

- Yes

- No

- Go Live

- Technical
- Specialist

**Implement**

- Adequate
- Test
- Results?

- Yes

- Consider
- Post
- Audit

- Internal
- Audit

**Support and**
**Maintain**

- Issue
- Report to
- Management

- Internal
- Audit

- No

**Build**

- Adequate
- Controls?

- Yes

- No

- Review
- Controls

- Internal
- Audit

**Design**

- Assess Risks
- and Suggest
- Controls

- Internal
- Audit

**Plan**

**Notes:**

Overview:
At management’s request, and subject to resource availability, Internal Audit will act as advisor to assist management in identifying system risks and their associated mitigating internal control options.  Internal Audit will evaluate management’s plans to maximize benefits from:
Available application controls
Supplemental manual compensating controls

Plan: Scope memorandum could be expanded to include review of Project Management. 
Build: Final report to management will provide advice and opinions on whether controls are in place and are operating as intended. 
Post Implementation: A post-implementation audit of the effectiveness of the application in operation, if Management and Internal Audit agree that it is a necessary part of the overall system implementation.  Post implementation audit is a separate process, which is not included on this flow chart. A post-implementation audit would have its own scope memorandum and report.  

##   Internal Controls Deliverables  

- Project Request
- Project Charter

- Project Plan
- Communication Plan
- Project Risk Management Plan
- Change Management Plan
- Issues Log
******* ****Internal Audit Scope Memorandum**
*******Risk Assessment**

- Code
- All Test Results
**** Security, Backup and Recovery Plan**
- Go Live Plan
- ***Internal Control Review and Final Report to Lab Management**

- Go Live   Client Acceptance Sign-Off
- Training Materials
- User Procedures
- System Document-ation
- Support Model

- Project Lessons Learned
- * **Post Implementation Audit if Needed**

- Essential Data Model
- Essential Process Model
- ** **Internal Controls Checklist **
- Essential State Change Model
- Data Dictionary
- Design Specifications
- Data Storage Schema
- Prototype
- Test Plans
- Service Level Agreements

**** Internal Audit Deliverable***    ***** ******Project Manager Deliverable***

**Notes:**
Internal Audit deliverables include: Participation in risk management plan, issue scope memorandum, internal control review and issue final report to management, and post implementation if needed.

All phases are subject to Internal Audit control review.  However, we will conduct reviews based on highest risk areas, including security and backup and recovery.