gray_audit_presentation.ppt
- 1. Policy Development & The 4 COBIT Domain Processes Policy Development based on COBIT Implementation Craig R. Gray, Director of IS&T cgray@leeuniversity.edu
- 2. Agenda Policy Development: Basis & Application The Mechanics of Control COBIT-What? COBIT-4 Domains High Level Control Examples?
- 4. Traditional Tools of the Trade
- 5. Control Statements Control Practices is enabled by and considers IT Processes The control of Business Requirements which satisfy Policy Development Flow
- 6. Control Cycle Adjust as Necessary Standards Measurement System Measure Control Focus Identify Key Controls
- 7. What is COBIT? COBIT (Control Objectives for Information and Related Technology) is globally accepted as being the most comprehensive work for IT governance, organization, as well as IT process and risk management COBIT provides good practices for the management of IT processes in a manageable and logical structure, meeting the multiple needs of enterprise management by bridging the gaps between business risks, technical issues, control needs and performance measurement requirements. The COBIT mission is to research, develop, publicize and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to-day use by business managers and auditors.
- 8. Starts from the premise that IT needs to deliver the information that the enterprise needs to achieve its objectives. Promotes process focus and process ownership Divides IT into 34 processes belonging to four domains and provides a high level control objective for each Looks at fiduciary, quality and security needs of enterprises,providing seven information criteria that can be used to generically define what the business requires from IT Is supported by a set of 318 detailed control objectives Effectiveness Efficiency Availability Integrity Confidentiality Reliability Compliance Planning Acquiring & Implementing Delivery & Support Monitoring
- 9. EFFECTIVENESS Deals with information being relevant and pertinent to the business process as well as being delivered in a timely, correct, consistent and usable manner EFFICIENCY Concerns the provision of the information through the optimal use of resources CONFIDENTIALITY Concerns the protection of sensitive information from unauthorized disclosure INTEGRITY Relates to the accuracy and completeness of information as well as to its validity in accordance with business values and expectations AVAILABILITY Relates to the information being available when required by the business process now and in the future COMPLIANCE Deals with complying with laws, regulations and contractual arrangements. RELIABILITY OF INFORMATION Relates to the provision of appropriate information for the workforce of the organization
- 10. EVENTS Business Operations Business Opportunities External Requirements Regulations PROCESS TECHNOLOGY ORGANIZATION DATA RISK CRITERIA Effectiveness Efficiency Confidentiality Integrity Availability Compliance Reliability MESSAGE INPUT SERVICE OUTPUT Events can be defined in terms of the processes, technology (systems) and organization (people) that compose them Information Risk Criteria
- 11. The 4 COBIT Domains Planning & Organization Acquisition & Implementation Delivery & Support Monitoring
- 12. Planning and Organization This domain covers strategy and tactics, and concerns the identification of the way IT can best contribute to the achievement of the business objectives. Furthermore, the realization of the strategic vision needs to be planned, communicated and managed for different perspectives. Finally, a proper organization as well as technological infrastructure must be put in place.
- 13. Acquisition and Implementation To realize the IT strategy, IT solutions need to be identified, developed or acquired, as well as implemented and integrated into the business process. In addition, changes in and maintenance of existing systems are covered by this domain to make sure that the life cycle is continued for these systems.
- 14. Delivery and Support This domain is concerned with the actual delivery of required services, which range from traditional operations over security and continuity aspects to training. In order to deliver services, the necessary support processes must be set up. This domain includes the actual processing of data by application systems, often classified under application controls.
- 15. Monitoring All IT processes need to be regularly assessed over time for their quality and compliance with control requirements. This domain thus addresses management’s oversight of the organization's control process and independent assurance provided by internal and external audit or obtained from alternative sources.
- 16. Executive Summary There is a method… Framework The method is… Control Objectives Minimum controls are… Audit Guidelines Here is how you audit… Implementation Toolset Here is how you implement… Management Guidelines Here is how you measure… COBIT Components
- 17. COBIT History Technical Standards ISO, EDIFACT Codes of Conduct Council of Europe, ISACA, OECD Qualification Criteria for IT Systems and Processes ITSEC, TCSEC, ISO 9000, SPICE, TICKIT, Common Criteria Professional Standards COSO, IFAC, AICPA, CICA, ISACA, IIA, PCIE, GAO Industry Practices and Requirements Industry forums (ESF, 14), Government-sponsored platforms (IBAG, NIST, DTI, BS7799)