For example, through system-integrated capability, financial institutions can offer a wider range of services including bill payment and tax payment. Electronic money (E-money) is a new product that is now offered by many institutions, both banks and non-banks. All of the aforementioned products and services delivered with the help of IT and the effort on core-banking system integration require much more complex technology infrastructure which raises tendency to the use of IT Outsourcing services from external expertise. As a consequence, financial institutions can fully focus on core activities and become less concerned with not having a sophisticated level of IT expertise. However, financial institutions must be aware that risks from outsourced operations still fall under their responsibility even though they may not undertake IT operations by themselves.   As the use of IT becomes widespread, it appears that most Thai financial institutions are adopting international best practices as a framework to create a controlled environment and manage risks that might occur from IT related operations. As new security threats emerge, it becomes necessary to have adequate control mechanism to protect banks' information assets including hardware, software and data.   As we all know, after 9/11, this issue has become a global concern. Most financial institutions are aware of the need to have Business Continuity Management. The business continuity plan has to be established on an enterprise-wide basis with a thorough business impact analysis and risk assessment. It is more than just the recovery of technology; it is the recovery and continuity of business.

Lack of adequate logical security may be prone to technical exposure to unauthorized implementation or modification of data and program at either the network, platform, database or application level. A classic example of this type of controls is the use of user ID and password. Supervisor should be able to analyze and evaluate the effectiveness of both physical and logical access control in accomplishing financial institution's information security objectives. Integrity Supervisory objective An objective of IT supervision in an integrity area is to ensure reliability and completeness of system functionality in order to verify that data is processed in an accurate and timely manner. Supervisory areas Therefore, supervisors need to review and assess whether financial institutions have sound application control in place. In this regard, they should have control built in the procedure and programmed in the system to ensure the integrity of input, process and output. In a large financial institution using various applications, a sample of applications including core banking applications and management information system (MIS) would be examined for control adequacy. Data and system integrity can reflect the effectiveness of system development, acquisition and change control procedure. Therefore, it is necessary to cover those areas in the scope of supervision. Availability Supervisory objective An objective of IT supervision in an availability area is to ensure financial institutions' readiness for being able to run business without interruption during an occurrence of disruption.