BC OAG Maturity of Computer Controls in5slides
Download as PPTX, PDF0 likes433 views
The British Columbia Auditor General's audit assessed the maturity of computing controls in government agencies, recommending a target maturity level of 3. Although self-assessments were generally optimistic, the audit found that 69% of agencies overstated their maturity levels. The report emphasizes the importance of validation in self-assessments and highlights risks associated with outsourced IT projects.
BC OAG Maturity of Computer Controls in5slides
- 1. British Columbia Auditor General audit of Maturity of Computing Controls… Strong general computing controls are government’s first line of defence against potential threats. The Auditor General looked at how good government’s general computing controls were, and how good 148 agencies thought they were. FEBRUARY 2016
- 2. The current COBIT 4.1 maturity model worked superbly for this audit of IT management systems. The AG recommended that BC government adopt a target maturity level of 3. This means that each perspective of the management system is defined and staff are trained. WHAT DOES IT SAY. FEBRUARY 2016
- 3. Self-assessments were generally optimistic. No surprises. Most agencies rated themselves at a maturity level of 3 or above. Central agencies and health sector agencies rated themselves well into the 4s and 5s. The AG found that 69% of the validated agencies overstated their maturity level. WHAT ELSE DOES IT SAY. FEBRUARY 2016
- 4. The audit identified more than 600 outsourced IT projects, which raises the importance of general computing controls. This raises the risks of: fraud, human error and down-time. I didn’t see analysis of instances where outsourcing has led to higher maturity levels, and lower risks. WHAT ELSE DOES IT SAY. FEBRUARY 2016
- 5. • This report justifies general computing controls better than most. • Perhaps central agencies, and the health sector, have gone beyond a cost-effective optimum, self-assessing controls well above maturity level of 3. • Always seek to validate self-assessments to gain more insight. The comments on these slides are the views of Tim Kirby, Sydney. You should always read the report itself before putting any money on the line. WHAT DOES IT MEAN. Tim Kirby, Sydney CA, CIA, LA-EMS au.linkedin.com/in/timkirbysydney FEBRUARY 2016