Isa 2
- 1. Information Security & Assurance Information Security & Assurance – An Overview
- 2. Introduction • Decision making process of legacy organization, • Now computerized • The inputs now are not easily available • Depends on certain computer-savvy employees to provide desired information • Now called DATA • Apprehensive about taking decision as doubts creep up like:
- 3. Introduction • Do I need to know the technology to justify my role? • How do I know that I am not being misguided by people - who some time takes me for granted?
- 4. Introduction • Is power generally to the hands of those who have access to information? What will happen to my domain knowledge that I have painstakingly acquired? • And finally, am I sitting on the fence because of these apprehensions?
- 5. Introduction • Picture a situation where you want to purchase a commodity from a website • It requires you to pay through credit card before you receive the goods • A host of apprehensions surface in your mind, like: – Are the goods authentic? – Are they in a working order – If I send the money, what option will I have if I never receive the goods, or if they are not of the standard or quality as represented?
- 6. Introduction – Is it safe to disclose my credit card information on the website? – Will my name, credit card information, and other particulars be passed on to telemarketing agencies? • First three reflects your apprehension about the organization, • Last two reflects your conscious as a customer. • There are no any concrete answers to these questions. • What you really need is assurance!
- 7. Assurance services • The AICPA’s (American Institute of Certified Public Accountants) special committee on assurance services defines assurance as: – Independent professional services that improve the quality of information, or its context for decision makers – The word Independent – unbiased
- 8. Need for Assurance • In general, the need for assurance services arises because of: – Potential bias in providing information; that is the party providing the information may want to convey a better impression than real circumstances merit – Remoteness between a user and the organization or trading partner – Complexity of the transactions, information or processing system – Risk management – Voluminous data
- 9. Bias in Providing Information • Let us take example of lending activity – Considerable likelihood that borrower may submit an inaccurate statement to increase the chances of obtaining loan. • Likewise, the seller of goods and services has a vested interest in convincing you that product being sold is worth more than a similar product you could obtain from elsewhere.
- 10. Bias in Providing Information • The management of the company can also give misinformation about its financial position to attract investment. • In all the above cases, assurance will help provide reliable information to decision makers.
- 11. Remoteness of User • Thanks to Internet • Online buying and selling has certain concomitant disadvantages • For instance, there is a absence of personal interaction with the seller
- 12. Remoteness of User • Unable to physically examine the product before its purchase. • This remoteness creates the need for assurance, regarding – Trustworthiness of the individual seller – Quality of the product – Authenticity of the information received
- 13. Complexity of the system • The complexity and dynamism of the IT system has undergone a dramatic change during last decade • Today, domain knowledge alone may not be sufficient to understand the various ways in which controls are implemented. • Probably need to have the knowledge of technology that drives the process. • In such scenario, it is comforting to the management to know that they can seek assurance services whenever needed.
- 14. Risk Management • Consider a bank manger’s decision to grant a loan to a business concern. • If the bank decides to give the loan, it will charge a rate of interest determined primarily by three factors: – Cost of the fund – Business risk for the borrower – Information risk to the lender
- 15. Voluminous Data • As organization grow and the volume of the organizational information and data increases, • The chances of misstating facts also rises • Sometimes, there may be a need to get an independent third party to identify and give an opinion about such misstatements.
- 16. Characteristics of Assurance Services • Assurance services have three critical components: – An assurance provider – Information or process on which the assurance is provided – A user or group of users/beneficiaries who derive value from the assurance service provided
- 17. Types of Assurance Services • Assurance services can be classified into – Attestation services • Involve the evaluation of an assertion made by one party to a third party. • Traditional statutory audit – Non-attestation services • Do not involve a third party • Internal and control self assessment audits are mainly self-imposed and do not involve any third party.
- 18. AAuudditit Compliance Review ISIS A Auudditit Compliance Review Attestation Services InInteternrnaal la auudditit Control self assessment audit Control self assessment audit Management consulting Non-attestation services Management consulting Types of Assurance Services
- 19. Evolution of Information System Audit • IS auditing, formerly called Electronic Data Processing (EDP) auditing • Evolved as an extension of traditional auditing • The need for IS Audit arose due to several reasons, some of which are: – Auditors realized that a lack of knowledge of computers had adversely affected their ability to perform attestation functions
- 20. Evolution of Information System Audit – The information processing management recognized that using computer systems was vital to compete effectively with other concerns in the business environment and like other valuable business resources within the organization, had a critical need to possess control and audit ability – With the growing digitization of information, it was felt that evidence-collection, evaluation, and entire process of traditional audit needed a paradigm shift.
- 21. Evolution of Information System Audit – Professional associations, organizations, government bodies, and regulators recognized the need for IT control and audit.
- 22. The IS – Lifecycle in the organization • For any legacy organization, the IS deployment follows three phases – Pervasion • Initial phase where the objective of organization is popularization of IT – Consolidation • Second stage where the organization, widespread use of IT, tries to consolidate the IS • Involve ascertaining who uses what, which technology is popular, any constraint in the use of resources, etc. – Control • Tries to put in a place an appropriate mechanism of control and security
- 23. Pervasion Consolidation •Uncontrolled use •No restriction •Popularization •Uncontrolled use •No restriction •Popularization •Consolidation •Standardization •Consolidation •Standardization Control •Restriction •Control •Information Security Framework •Audit •Restriction •Control •Information Security Framework •Audit The lifecycle of IT absorption in an organization
- 24. The Knowledge Requirement of an IS professional(Auditor) • Auditor should be a better at business than the client. • IS auditor should be more familiar with the Information System than IS manager in the organization. • To understand the role of IS auditor, it is important to first understand what IS audit is.
- 25. The Knowledge Requirement of an IS Auditor • Ron Weber defines it thus: – Information System auditing is the process of collecting and evaluating evidences to determine whether a computer system safeguards assets, maintains data integrity, allows organizational goals to be achieved effectively, and uses resources efficiently.
- 26. The Knowledge Requirement of an IS Auditor • According to definition on previous slide, the job of IS auditor is to give assurance to the company that the computer system helps achieve the following objectives: – Safeguarding assets – Maintaining data integrity – Fulfilling the organizational goal effectively – Consuming resources efficiently
- 27. The Knowledge Requirement of an IS Auditor • Data integrity has no meaning in the organization if the assets are not safeguarded. • Effectiveness has no meaning unless there is integrity of data and • Efficiency (doing things right) is futile in the absence of efficacy (doing right things)
- 28. The Knowledge Requirement of an IS Auditor • Assets Safeguarding – IT Governance Institute (USA), in its Governance model i.e. COBIT (Control Objectives for Information and related Technology) has defined IT resources as being comprised of: • Data: objects in their widest sense – external and internal, structured and non-structured, graphics, sound, etc. • Application Software: Sum of manual or programmed procedures • Technology: Hardware, Operating System, Database Management Systems, Network, Multimedia, etc. • Facilities: Resources to house and support Information System • People: Includes staff skills, awareness and productivity in planning, organizing, acquiring, delivering, supporting and monitoring IS and services.
- 29. The Knowledge Requirement of an IS Auditor • Data Integrity – It refers to the accuracy and completeness of data, very important from assurance point of view • Effectiveness – Doing right things – From the IS point of view, it implies possession of knowledge of user needs – Auditor must know the needs of the user and the nature of the decision-making environment
- 30. The Knowledge Requirement of an IS Auditor • Efficiency – From auditor’s perspective, is doing a job effectively, using minimum resources or using minimal resources to achieve the desired objectives
- 31. Internal Control Project management Philosophy documentation IS Audit Computer Organizational domain behavior Computer Science IS Management Behavioral Science Traditional Auditing The Knowledge requirement for an IS auditor
- 32. Benefits of IS Audit For an Organization • Some of the benefits organization receive are: – Mapping business control with IT application – Business Process Re-engineering – The IT Security Policy – Security awareness – Better return on Investment (ROI) – Risk Management
- 33. Changing Role of IS Auditors and the Relevance of COBIT • Rapid technology changing. • Development of new business models. • Outsourcing, downsizing, decentralization. Traditional Role New role Detection Prevention Policemen Business partner Focus on audit Focus on business Focus on cost Focus on customer Focus on function Focus on process Auditor Risk manager Hierarchical Team Quill pen Technology