Users, managers, and auditors are required to participate in the project which generally provides approvals, often called signoffs, at pre-established management control points. Signoffs signify approval of the development process and the system being developed. The system must be tested thoroughly prior to implementation to ensure that it meets users’ needs. A training plan is developed for those who will operate and use the new system. A post-implementation review of all developed systems must be performed to assess the effectiveness and efficiency of the new system and of the development process. Different approaches Approach Framework Concept Traditional Approach Linear Step by step Prototyping Iterative First module created with no controls etc - Then controls improved and first module completed in totality - Then other modules The Incremental Model Combination of Linear and Iterative Here also we start with first module, which is a Prototype (Like in Prototyping) - But within that module, all stages of SDLC are tested (Like in Traditional approach) Spiral Model Combination of Linear and Iterative Development is started with first two stages (Like in Traditional), but if it is felt going on next stages maybe risky, shift is made to Prototyping (Like in Prototyping) Rapid Application Development (RAD) Iterative Faster version of Prototyping where planning of software developed using RAD is interleaved with writing the software itself Agile Methodologies Combination of Linear and Iterative All stages of SDLC are followed up, and the project is delivered to the customer. Then new subproject is developed and integrated in to the already delivered system. Traditional Approach/ Water Fall Approach/ Sequential Approach Introduction and definition Introduction and definition The waterfall approach is a traditional development approach in which activities are performed in sequence. When the traditional approach is applied, an activity is undertaken only when the prior step is fully completed. Framework type : Linear (Linear means relating to, or resembling a line, having only one dimension) Basic Principles Project is divided into sequential phases, with some overlap. Emphasis is on planning, time schedules, target dates, budgets and implementation of an entire system at one time. Tight control is maintained over the life of the project through the use of extensive written documentation, as well as through formal reviews and approval/signoff by the user and information technology management occurring at the end of most phases before beginning the next phase. Stage of System development life cycle
size, where they are located, who uses them and the number of times per given time interval these are used. Information on common data files and their size will be an important factor, which will influence the new information system. This information may be contained in the systems and procedures manuals. The system analyst should also review all on-line and off-line files which are maintained in the organization as it will reveal information about data that are not contained in any outputs. The related cost of retrieving and processing the data is another important factor that should be considered by the systems analyst Review methods, procedures and data communications Review of methods and procedures Methods and procedures transform input data into useful output. A method is defined as a way of doing something; a procedure is a series of logical steps by which a job is accomplished. A procedure review is an intensive survey of the methods by which each job is accomplished, the equipment utilized and the actual location of the operations. Its basic objective is to eliminate unnecessary tasks to perceive improvement opportunities in the present information system. Review of data communications A system analyst also needs to review and understand the present data communications used by the organisation. He must review the types of data communication equipments including data interface, data links, modems, dial-up and leased lines and multiplexers. The system analyst must understand how the data-communications network is used in the present system so as to identify the need to revamp the network when the new system is installed. Analyse outputs The outputs or reports should be scrutinized carefully by the system analysts in order to determine how well they will meet the organisation's needs. The analysts must understand what information is needed and why, who needs it and when and where it is needed. Additional questions concerning the sequence of the data, how often the form reporting it is used, how long it is kept on file, etc. must be investigated. Often many reports are a carry-over from earlier days and have little relevance to current operations. Attempt should be made to eliminate all such reports in the new system. Review internal controls A detailed investigation of the present information system is not complete until internal control is reviewed. Locating the control points helps the analyst to visualize the essential parts and framework of a system. An examination of the present system of internal controls may indicate weaknesses that should be removed in the new system. The adoption of advanced methods, procedures and equipments might allow much greater control over the data.
Timeliness Timeliness refers to when users need outputs, which may be required on a regular, periodic basis - perhaps daily, weekly, monthly, at the of quarter or annually. Data needs to be inputted to computer in time because outputs cannot be produced until certain inputs are available. Hence, a plan must be established regarding when different types of inputs will enter system. A sales manager, may be requiring a weekly sales report. Other users, such as airline agents, require both real- time information and rapid response times in order to render better client service. Format Input format refers to the manner in which data are physically arranged. Output format refers to the arrangement referring to data output on a printed report or in a display screen. After the data contents and media requirements are determined, input formats are designed on the basis of few constraints like - the type and length of each data field as well as any other special characteristics (number decimal places etc.). Format of information reports for the users should be so devised that it assists in decision-making, identifying and solving problems, planning and initiating corrective action and searching. Media Input-output medium refers to the physical device used for input, storage or output. This includes the choice of input media and subsequently the devices on which to enter the data. Various user input alternatives may include display workstations, magnetic tapes, magnetic disks, key-boards, optical character recognition, pen- based computers and voice input etc. A suitable medium may be selected depending on the application to be computerized. A variety of output media are available in the market these days which include paper, video display, microfilm, magnetic tape/disk and voice output.
Contents – Part B Chapter Chapter Name 6 Control Objectives 7 Audit Test of General and Automated Controls 8 Business Continuity Planning and Disaster Recovery Planning 9 Information Systems Auditing Standards, Guidelines, Best Practices 10 Drafting of IS Security Policy, Audit Policy, IS Audit Reporting - A Practical Perspective CONTROL OBJECTIVES Chapter 6 – Control Objectives : Information systems concepts : Information systems control techniques : Controls over information and data integrity controls : Physical Access Controls : Environmental Controls : Logical Access Controls : Organizational Controls : Management Controls : Business Continuity Planning Controls : User Controls : Controls over Unauthorized Intrusion
Control category Definition and purpose Threats/ Risks Examples of Controls Source data control Controls which control data entry at the initial level Invalid, incomplete, or inaccurate source data input Sequentially prenumbered forms Segregation of duties Visual scanning Check-digit verification. Input controls/ Input validation routines Responsible for ensuring the accuracy and completeness of data and instructions input into an application system. Invalid or inaccurate data Edit programs check key data fields using these edit checks. For instance, sequence, field, sign, validity, limit, range, reasonableness checks. Prompting operators during data entry Completeness test. Data Processing controls Data processing controls perform validation checks to identify errors during processing of data. Responsible for computing, sorting, classifying and summarizing data. Inaccurate or incomplete Reconciliation of database totals with externally maintained totals (Batch totals) Exception reporting Database controls Responsible to provide functions to define, create, modify, delete and read data in an information system. Weak database Chronological recording of transactions. Output controls To provide functions that determine the data content available to users, data format, timeliness of data and how data is prepared and routed to users Inaccurate or incomplete computer output Reconciliation of batch totals Proper distribution of output Confidential outputs being delivered are protected from unauthorised access, modification, and misrouting Data transmission controls To ensure controls over data transmission Unauthorised access to data being transmitted or to the system itself; system failures; errors in data transmission Monitor network to detect weak points Multiple communication paths between network components Preventive maintenance Data encryption Data integrity policies Virus-Signature Updating: Virus signatures must be updated immediately when they are made available from the vendor. Software Testing: All software must be tested in a suitable test environment before installation on production systems.
The policy shall be reviewed regularly to ensure it remains appropriate. Organizational Security Objective To manage information security within the organization Code of practice A management framework needs to be established to initiate, implement and control information security within the organization. This needs proper procedures for approval of the information security policy, assigning of the security roles and coordination of security across the organization. Specification (i.e. Detailed controls and objectives) The detailed controls and objectives are as follows: Information System Infrastructure should be in place to manage information security within the organization Third party access needs to be secure to maintain the security of organisational information processing facilities and information assets accessed by third parties Controls over Outsourcing need to be in place to maintain the security of information when the responsibility for information processing has been outsourced to another organisation Asset Classification and Control Objective To maintain appropriate protection of information assets. Code of practice One of the most laborious but essential task is to manage inventory of all the IT assets, which could be information assets, software assets, physical assets or other similar services. These information assets need to be classified to indicate the degree of protection. An Information Asset Register (IAR) should be created, detailing every information asset within the organisation. For example Databases, Personnel records, Scale models, Prototypes, Test samples, Contracts, Software licenses and Publicity material The Information Asset Register (IAR) should also describe who is responsible for each information asset and whether there is any special requirement for confidentiality, integrity or availability. Specification (i.e. Detailed controls and objectives) Accountability for assets to be established to maintain appropriate protection of organizational assets Information Classification to be done to ensure that information assets receive an appropriate level of protection Personnel Security Objective To reduce the risk of human error, theft, fraud or misuse of facilities Code of practice
The depth of coverage for issues should normally reflect the significance of the findings. Situations representing a high degree of risk or indicating shortcomings that are serious enough to justify a recommendation should be treated extensively. Specific initiatives that the auditors wish to mention as examples should be described in detail, while issues where the department meets the expectations and there is nothing specific to mention should be dealt with briefly. Commentary Where a recommendation and a compliment are made under the same issue, they should be in separate paragraphs, otherwise, they may confuse the reader and reduce the impact of one or the other. Statistics need to be used consistently throughout the report. Sample size and error rate mean more when they are given in context. The size of the population, the number of transactions and the period of time provide that context. AUDIT TESTS OF GENERAL AND AUTOMATED CONTROLS Chapter 10 – Testing – General and Automated Controls : Introduction : Audit Planning for Testing : Testing of Controls : Reporting : Concurrent Audit/ Continuous Audit and Embedded Audit Modules INTRODUCTION Testing is a scientific process performed to determine whether the controls ensure the system design effectiveness as well as the implemented system controls operational effectiveness. It involves, understanding a process and the expected results. Testing of large amounts of transactions or data is usually not possible due to time and cost constraints. Hence, sampling is done on the population (system resource) and ensures a sufficient quality and quantity to extrapolate the results of the testing into a reliable conclusion on the entire population (system resource). The Information System (IS) controls audit involves the following three phases: Planning: The auditor determines an effective and efficient way to obtain the evidential matter necessary to achieve the objectives of the IS controls audit and the audit report. For financial audits, the auditor develops an audit strategy and an audit plan. For performance audits, the auditor develops an audit plan. Testing: The auditor tests the effectiveness of IS controls that are relevant to the audit objectives. Reporting: The auditor concludes on the effect of any identified IS control weaknesses with respect to the audit objectives and reports the results of the audit, including any material weaknesses and other significant deficiencies.
Understanding the above information should enable the reviewer to make an assessment of the significant threats to the LAN, together with the potential impact and probability of occurrence of each threat. Having assessed the risks to the LAN, the reviewer should evaluate the controls used to minimise the risks. To test physical security, a reviewer should perform the following: Inspect the LAN wiring closet and transmission wiring and verify they are physically secured. Observe the LAN file server computer and verify it is secured in a manner to reduce the risk of removal of components and the computer itself. Obtain a copy of the key logs for the file server room and the wiring closet, match the key logs to actual keys that have been issued an determine that all keys held are assigned to the appropriate people, for example, the LAN Administrator and support staff. Select a sample of keys held by people without authorised access to the LAN file server facility and wiring closet and determine that these keys do not permit access to these facilities. Look for LAN operating manuals and documentation not properly secured. To test environmental controls, a reviewer should visit the LAN file server facility and verify: Temperature and humidity are adequate. Static electricity guards are in place. Electric surge protectors are in place. Fire extinguishers are nearby. Observe the LAN file server facility, looking for food and beverage containers and tobacco products in the area and in the garbage cans. Observe the storage methods and media for backup and verify they are protected from environmental damage. To test logical security, a reviewer should interview the person responsible for maintaining LAN security to ensure that person is: Aware of the risks associated with physical and logical access that must be minimised. Aware of the need to actively monitor logons and to account for employee changes. Knowledgeable in how to maintain and monitor access. REPORTING Evaluation by Auditor After completing the testing phase, the auditor summarizes the results of the audit, draws conclusions on the individual and aggregate effect of identified IS control weaknesses on audit risk and audit objectives and reports the results of the audit. The auditor evaluates the individual and aggregate effect of all identified IS control weaknesses on the auditor’s conclusions and the audit objectives. The auditor evaluates the effect of any weaknesses on the entity’s ability to achieve each of the critical elements and on the risk of unauthorized access to key systems or files. Also, the auditor evaluates potential control dependencies. Audit Findings