CA FINAL ISCA SUMMARY

IS Concepts

1. System

2. Types of system

a. Deterministic-Probabilistic

b. Open-Closed

c. Manual-Automated

d. Abstract-Physical

3. System related concepts

a. Boundary

b. Environment

c. Sub-system

d. Decomposition

e. Interface

f. Simplification

g. Decoupling

h. Stress

i. Supra system

j. Entropy/Maintenance

4. Information

5. Information related concepts

a. Characteristics of good information

i. Timeliness

ii. Purpose

iii. Mode & format

iv. Redundancy

v. Accurate

vi. Completeness

vii. Reliability

viii. Quality

ix. Value of information

x. Adequacy

xi. Rate & frequency

b. Role in business

i. Effective DM

ii. Competitive edge

iii. Right decision at right time

iv. Solve critical problems

v. Information gathered uses in unusual situations

c. Factors upon which information requirements of executive depends

i. Operational

ii. Type of decision making

iii. Level of management

d. Types of information (Internal - External)

6. CBIS

a. Components

i. Hardware

ii. Software

iii. Data

iv. Procedures

v. People

b. Characteristics

i. Work towards pre-determined objectives

ii. Interconnected subsystem & components

iii. Different subsystem interacts each other

c. Areas of application

i. Marketing & sales

ii. Production & manufacturing

iii. Inventory management

iv. HRM

7. TPS

a. Components

i. Input (Classification & Recording)

ii. Processing

iii. Storage (Master/Transaction)

iv. Output (Financial/Operational)

b. Features

i. Large volume of data

ii. Automation of basic operation

iii. Benefits are easily measurable

iv. Source of input for other system

8. MIS

a. Concept of MIS

b. Characteristics

i. Management oriented

ii. Management directed

iii. Need based

iv. Exception based

v. Integrated

vi. Common data flows

vii. Common data base

viii. Long term planning

ix. Modularity

x. Computerized

c. Misconception

i. Computerized only

ii. More data more information

iii. Accuracy is primary

d. Pre-Requisites

i. Database

ii. Qualified staff

iii. Support of top management

iv. Control & maintenance

v. Evaluation of MIS

e. Constraints

i. Non Availability of experts

ii. High turnover of expert

iii. Problem of selecting sub system

iv. Lack of co-operation

v. Difficulty in quantifying benefits

f. Effect of using CB-MIS

i. Fast & timely data processing

ii. More comprehensive information

iii. Better integration

iv. Increase effectiveness

v. Increase scope of analysis

vi. Increase complexity of operation

g. Limitation

i. Quality of output depends on input

ii. Constrained by limitations of TPS

iii. Based on internal data only

iv. No ad-hoc reports on external data

v. Lacks tight integration

vi. Cannot substitute effective mgt

vii. Less useful for structured decision

viii. Does not account non-quantitative factors

9. ERP

a. Objectives

i. Adoption of best business practices

ii. Implement BBP to enhance productivity

iii. Customer & suppliers as integral part

b. Limitations

i. Data quality issues

ii. Only past & current status

10. DSS

a. Characteristics

i. Semi-structured & Unstructured problems

ii. Both internal & external databases

iii. Flexible to respond changing needs

iv. What-if analysis feature

v. Utilizes models for problem solutions

vi. Easy to use

vii. Help end user to construct & modify

b. Components

i. User

1. Managers

2. Staff specialist/analyst

ii. User interface/Planning language

1. General purpose

2. Special purpose

iii. Model base

iv. Other databases (Internal-External)

1. Implementation of databases

a. Physical level

b. Logical level

c. External level

c. Uses

i. Capital budgeting

ii. Cost accounting

iii. Budget variance

iv. General accounting

v. Security analysis & portfolio management

11. EIS

a. Characteristics

i. Top executives

ii. Extract summary data and model complex problems

iii. Very user friendly

iv. Rapid access to timely information

v. Internal & external data both

vi. Easily connected to internet

vii. Extensive online analysis tool

viii. DSS support

b. Executive roles and DM

i. Strategic planning

ii. Tactical planning

iii. Fire –fighting

c. Characteristics of information used

i. Lack of structure

ii. Future orientation

iii. Low level of details

iv. Information from informal sources

v. Lack of certainty

d. Content

i. Meet organization objectives

ii. Generate its content automatically

iii. Performance indicators

iv. Adaptable

v. Available to everyone

vi. Encourage the organization’s objectives

12. Expert system

a. Component

i. User interface

ii. Inference engine

1. Backward chaining

2. Forward chaining

iii. Explanation facility

iv. Knowledge base

v. Knowledge acquisition facility

b. Business application

i. Accounting & finance

ii. Marketing

iii. Manufacturing

iv. Personnel

v. General business

c. Need for expert system

i. Expert labour is expensive & scarce

ii. Experts cannot handle all factors at a time

d. Benefits

i. Preserve knowledge

ii. Information in active form

iii. Assist novice think as expert

iv. Not subject to human feelings

v. Effectively used as business tool

e. Characteristics

i. Availability

ii. Complexity

iii. Domain/Subject area

iv. Expertise

v. Structure

f. Business application

i. Accounting & finance

ii. Marketing

iii. Manufacturing

iv. Personnel

v. General business

13. OAS – Activities

a. Document capture

b. Document creation

c. Receipts and distribution

d. Filling, search, retrieval and follow-up

e. Calculations

f. Recording utilization of resources

14. OAS – Benefits

a. Improve communication

b. Reduce cycle time

c. Reduce cost of office communication

d. Ensure accuracy

15. OAS – types

a. Text processors

i. Most commonly used

ii. Automate document creation

iii. Quick production of multiple documents

iv. Supported with printers

b. EDMS

i. Capture, store and communicate

ii. Linked with text processor & E-mail

iii. Remote access of document

iv. Location become irrelevant

c. EMCS

i. E-mail

1. Electronic transmission

2. Online development & editing

3. Reply & multiple forward

4. Integration with other OAS

5. Portability

6. Economical

ii. Facsimile

1. Uses special software and fax servers

2. To send & receive fax message

3. Using communication resources

4. Server automatically re-route

iii. Voice mail

1. Variation of email

2. Transmit as digitized voice

3. Dial a voice mail box service

4. Receiver hear spoken voice

d. Teleconferencing

i. Conduct business meeting

ii. Reducing time and cost

iii. Audio or video

iv. Flexibility

v. Use digital camera, visual communication software, lines, etc

vi. Quite expensive

SDLC methodology

1. Introduction

2. System development process

3. Why SD objectives fail

a. Lack of senior management support

b. Shifting user needs

c. Development of strategic system

d. New technologies

e. Lack of standard SD methodologies

f. Resistance to change

g. Lack of user participation

h. Inadequate testing & user training

4. SD approaches

a. Waterfall

i. Divided into sequential phases

ii. Emphasis on planning, time schedules, etc at one time

iii. Tight control by excessive documentation

b. Prototyping

i. Identify IS requirement

ii. Develop initial plan

iii. Test & revise

iv. Obtain user approval

c. Incremental

d. Spiral

i. Define system requirement

ii. Planning & designing system to identify all risks & alternatives (use prototyping to select)

iii. Develop prototype

iv. Evaluate first prototype & repeat above

e. RAD

i. Fast development

ii. High quality

iii. Active user involvement

iv. Iterative prototyping

v. Computerized development tools

vi. Emphasis on fulfilling business needs

vii. Defining delivery deadlines

viii. Includes JAD

f. Agile

5. SDLC

a. Advantages

i. Better planning

ii. Compliance to prescribed standards

iii. Documentation

iv. Phases as milestones

b. ISA perspective

i. Clear understanding

ii. State compliance in his report

iii. Guide if having technical knowledge

iv. Provide evaluation of methods & techniques

c. Risks

i. Cumbersome

ii. End product not visible

iii. Rigidity approach

iv. Not suitable for small & medium projects

6. Preliminary investigation

a. Identification of problem

b. Identification of objective

c. Delineation of scope

i. Functional requirements

ii. Control requirements

iii. Performance requirements

iv. Reliability requirements

v. Constraints

vi. Interfaces

vii. Data to be processed

d. Feasibility study

i. Technical

ii. Economical

iii. Behavioral

iv. Financial

v. Time

vi. Resource

vii. Operational

viii. Legal

e. Reporting results

7. System requirement analysis

a. Fact finding techniques

i. Documents

ii. Questionnaires

iii. Interviews

iv. Observation

b. Analysis of present system

i. Review historical aspects

ii. Analyze inputs

iii. Review data files maintained

iv. Review methods, procedures & data communications

v. Analyze outputs

vi. Review internal controls

vii. Model existing physical system & logical system

viii. Undertake overall analysis of present system

c. Analysis of proposed system

i. Emphasis on output

ii. Database maintenance

iii. Input from original source

iv. Methods, procedures & data communications

v. Work volumes & timings

d. SRS

i. Information

ii. Information description

iii. Functional description

iv. Behavioral description

v. Validation criteria

vi. Appendix

vii. SRS review

8. System development tools

a. Categories

i. System components & flow (SFC, DFD, SCM)

ii. User interface (LFS, DFD)

iii. Data attributes & relationship (DD, ERD, FLF, GC)

iv. Detailed system process (DT, DT, SC)

b. Tools

i. Pseudo code

ii. Flowcharts

1. Types

2. Benefits

3. Limitations

iii. Data flow diagrams

iv. Decision tree

v. Decision table

vi. CASE tools

vii. System component matrix

viii. Data dictionary

ix. Layout form & screen generator

9. Roles involved in SDLC

a. Steering committee

b. Project manager

c. Project leader

d. System analyst

e. Module/team leader

f. Programmer/Coder/Developer

g. DBA

h. Quality assurance

i. Tester

j. Domain specialist

k. ISA

10. System design

a. Architectural design

b. Design of data/information flow

c. Design of database

d. Design of user interface (Input/output)

i. Factors

1. Content

2. Timeliness

3. Format

4. Media

5. Form

6. Volume

e. Physical design

f. Design of hardware/software platform

11. System acquisition

a. Acquisition standards

b. Acquiring systems components

i. Hardware acquisition

ii. Software acquisition

iii. Contracts, software licenses & copyright violations

iv. Validation of vendors’ proposals

1. Checklist

2. Point-scoring analysis

3. Public evaluation reports

4. Bench marking problem

5. Test problems

12. Program development

a. Characteristics

i. Reliability

ii. Robustness

iii. Accuracy

iv. Efficiency

v. Usability

vi. Readability

b. Program coding standards

c. Programming language

d. Program debugging

e. Test the program

f. Program documentation

g. Program maintenance

13. System testing

a. Unit testing

i. Categories

1. Functional tests

2. Performance tests

3. Stress tests

4. Structural tests

5. Parallel tests

ii. Types

1. Static analysis testing

a. Desk check

b. Structures walk through

c. Code inspection

2. Dynamic analysis testing

a. Black box

b. White box

c. Gray box

b. Integration testing

i. Bottom up

ii. Top down

iii. Regression

c. System testing

i. Recovery

ii. Security

iii. Stress or volume

iv. Performance

d. Final acceptance testing

i. Quality assurance

ii. User acceptance

1. Alpha

2. Beta

14. System implementation

a. Equipment installation

i. Site preparation

ii. Installation of new hardware/software

iii. Equipment check point

b. Training personnel

c. Conversion strategies

i. Direct

ii. Phased

iii. Pilot

iv. Parallel

d. Conversion activities

i. Procedure

ii. File

iii. System

iv. Scheduling personnel & equipment

15. Post implementation review

a. Development evaluation

b. Operation evaluation

c. Information evaluation

16. System maintenance

a. Scheduled

b. Rescue

c. Corrective

d. Adaptive

e. Perfective

f. Preventive

17. Operation manuals

18. Organizational structure of IT department

a. Line management

b. Project management

Control Objective

19. Introduction

20. Need for controls

a. Cost of data loss

b. Incorrect DM

c. Cost of computer abuse

d. Cost of hardware, software & personnel

e. Cost of error

f. Maintenance of privacy

g. ISA

h. Data integrity objectives

i. System effectiveness& efficiency

21. Effect of computers on ICS

a. Personnel

b. Segregation of duties

c. Record keeping

d. Authorization

e. Concentration of programs & data

f. Access to assets & data

g. Management supervision & review

h. Components of IC

i. Control environment

ii. Risk assessment

iii. Control activities

iv. Information & communication

v. Monitoring

22. Effect of computer on audit

a. Changes to evidence collection

i. Data retention & storage

ii. Absence of input documents

iii. Lack of visible audit trial

iv. Lack of visible output

v. Audit evidence

vi. Legal issues

b. Changes to evidence evaluation

i. System generated transactions

ii. Systematic errors

23. Responsibility of controls

a. Develop & implement cost – effective controls

b. Assess adequacy

c. Separately assess & document IC consistent with ISP

d. Identify needed improvements

e. Take corrective actions

f. Report annually

24. ISA process

a. Responsibility of IS auditor

i. Sound knowledge of business operations

ii. Knowledge of standards & best practices

iii. Requisite technical qualification

iv. Knowledge of IT strategies, policies

v. Understanding of risk & controls

vi. Understand technical controls

b. Functions – Check whether

i. Security is inadequate

ii. Adequate IT related policies

iii. IT related frauds

iv. Resources efficiently utilized

v. Controlled SDMP

c. Categories of ISA

i. System & applications

ii. IPF

iii. System development

iv. IT management structure

v. Telecommunications, intranets, extranets

d. Steps

i. Scoping/Pre – Audit survey

ii. Planning

iii. Fieldwork

iv. Analysis

v. Reporting

vi. Closure

e. Standards

f. Cost effectiveness of control procedures

i. Initial cost

ii. Execution

iii. Failure

iv. Correction

v. Maintenance

25. Information system control techniques

a. Objectives of control

b. Based on objective

i. Preventive

1. Understanding vulnerabilities

2. Understanding probable threats

3. Provision of necessary controls

ii. Detective

1. Understanding of lawful activities

2. Established mechanism to report unlawful act

3. Interaction with preventive control

4. Surprise checks

iii. Corrective

1. Minimize impact

2. Identify cause and correct problems discovered

3. Get feedback

4. Modify processing system to minimize future occurrences

iv. Compensatory

c. Based on functions/Component of IC

i. Accounting

ii. Operational

iii. Administrative

d. Based on nature

e. Control techniques

i. Organisational controls

1. Responsibilities & objectives

2. Policies, standards, practices

3. Job description

4. Segregation of duties

ii. Management controls

1. Responsibility

2. Official IT structure

3. IT steering committee

iii. Financial controls

1. Authorization

2. Budgets

3. Cancellation of documents

4. Documentation

5. Dual control

6. Safekeeping

7. Segregation of duties

8. Sequentially numbered documents

9. Supervisory review

10. I/O verification

iv. Data processing

v. Physical access

vi. Logical access

vii. SDLC

viii. BCP

ix. Application control

x. Audit trials

xi. Audit trial objectives

1. Detecting unauthorized access

2. Reconstructing events

3. Personnel accountability

26. User controls

a. Boundary

i. Cryptography

ii. Password

iii. PIN

iv. Identification cards

b. Input

i. Errors

1. Addition

2. Truncation

3. Transcription

4. Transposition

5. Double Transposition

ii. Factors affecting input errors

1. Length

2. Alphanumeric mix

3. Special character

4. Mixing uppercase/lowercase

5. Sequence of characters

c. Processing

i. Run – to – run totals

ii. Reasonableness verification

iii. Edit checks

iv. Field initialization

v. Exception reporting

vi. Existence/recovery controls

d. Output

i. Storage & logging of sensitive/critical forms

ii. Logging of output program execution

iii. Spooling

iv. Controls over printing

v. Report distribution & collection controls

vi. Retention controls

vii. Existence/recovery controls

e. Database

i. Update controls

1. Sequence check in transaction & mater files

2. Ensure all records are processed

3. Process multiple transaction from single record in correct order

4. Maintain suspense account

ii. Report controls

1. Standing data

2. Print run – to – run totals

3. Print suspense account

4. Existence/recovery controls

27. SD & acquisition controls

a. Problem definition

i. Need for IS in business

ii. Support & priority by management

iii. Level of acceptance by stakeholders

iv. Investigation & strategy

b. Change management process

i. Prepare & promote for unrestricted change

ii. Complete changeover

iii. Help user to adapt new system

iv. Review periodically for potential conflicts

c. Entry & feasibility assessment

i. Technical

ii. Operational

iii. Economical

iv. Behavioral

d. Existing system analysis

i. Study of history of systems

ii. Using formal methodology

e. System design (formulation of strategic requirements)

i. Align business requirement with objectives and goals

f. Organizational & job design

i. Defined roles & responsibilities

ii. Clear design of organisation structure

g. IS processing design

i. Requirement elicitation

ii. User interface design

iii. Dataflow design

iv. Database design

v. Platform design

vi. Physical design

h. Application software acquisition

i. IS requirement needs to meet business goals

ii. Feasibility analysis to define constraints

iii. Detailed RFP specifying acceptable requirements

iv. Vendor evaluation process

28. Control over system & program changes

a. Change management process

b. System change controls

c. Program change controls

d. Authorization controls

e. Document controls

f. Testing & quality controls

29. Quality controls

a. Quality standards

b. Quality reviews

c. Copyright violations

d. Contract/Warranties

e. SLA

30. Controls over system implementation

a. Procedures development

b. Conversion

i. Direct

ii. Parallel

iii. Phased

iv. Pilot

c. User final acceptance testing

i. Performance

ii. Volume

iii. Stress

iv. Security

v. Clerical procedures checking

vi. Back-up and recovery

d. User training

31. System maintenance

a. Maintenance

i. Corrective

ii. Adaptive

iii. Perfective

b. Performance measurement

32. Post implementation review

a. Achievement of objectives

i. Business

ii. User expectation

iii. Technical requirements

b. Balance between period of PIR

c. PIR team

d. Activities to be undertaken

33. Control over data integrity, privacy, security

a. Information classification

i. Top secret

ii. Highly confidential

iii. Propriety

iv. Internal use only

v. Public documents

b. Data integrity

i. Source data control

ii. Input validation routines

iii. On-line data entry controls

iv. Data processing and storage controls

v. Output controls

vi. Data transmission controls

c. Data integrity policies

i. Virus signature updating

ii. Software testing

iii. Division of environments

iv. Version zero software

v. Offsite backup

vi. Quarter or Year end backup

vii. Disaster recovery

34. Logical access controls

a. Logical access paths

i. Online terminals

ii. Batch job processing

iii. Dial-up ports

iv. Telecommunication network

b. Logical access exposure

i. Technical

1. Data diddling

2. Logic bomb

3. Time bomb

4. Trojan horse

5. Worms

6. Rounding down

7. Salami techniques

8. Trap doors

ii. Computer crime

1. Financial loss

2. Legal repercussions

3. Loss of credibility

4. Blackmail

5. Disclosure of confidential information

6. Sabotage

7. Spoofing

iii. Asynchronous attacks

1. Data leakage

2. Wire – tapping

3. Piggybacking

4. Denial of service

iv. Remote and distributed data processing controls

1. Remote access through network should be implemented

2. Having terminal lock

3. Applications to be controlled and remotely accessed via modem

4. Monitored carefully

5. Proper control over documentation and manuals

6. Data transmission to be controlled, verify accuracy, genuineness and integrity

7. Replicated copies contain same information, no duplication

v. Physical and environmental protection

c. Logical access controls (also in chapter 8 under ISMS)

i. User access management

1. User registration

2. Privilege management

3. User password management

4. Review of user access rights

ii. User responsibility

1. Password use

2. Unattended user equipment

iii. Network access control

1. Policy on use network services

2. Enforced path

3. Segregation of networks

4. Network connection and routing control

5. Security of network services

iv. Operating system access control

1. Automated terminal identification

2. User identification and authentication

3. Password management system

4. Use of system utilities

5. Alarms system

6. Terminal time out

7. Limitation of connection time

v. Application and monitoring system access control

1. Information access restriction

2. Sensitive information isolation

3. Event logging

4. Monitor system use

5. Clock synchronization

vi. Mobile computing

d. Role of IS auditor

i. Review the relevant documents and RAE techniques

ii. Evaluate potential access paths

iii. Identify deficiencies and redundancies

iv. Verify test control over access paths

v. Analyze test results and verify that objective are achieved

vi. Compare security policy

35. Physical access controls

a. Issues and exposure

b. Access control mechanism

i. Identification

ii. Authentication

iii. Authorization

c. Physical access control

i. Locks on doors

1. Cipher lock

2. Bolting door lock

3. Electronic door lock - Card entry

4. Biometric door lock

ii. Physical identification mechanism

1. PIN

2. Plastic cards

3. Cryptographic controls

4. Identification badges

iii. Logging on utilities

1. Manual logging

2. Electronic logging

iv. Others

1. Video camera

2. Security guards

3. Controlled visitor access

4. Dead man doors

5. Controlled single point entry

6. Alarm system

7. Perimeter fencing

8. Control on employees Out-of-office during office hours

v. Accounting and audit trial

d. Audit and evaluation technique

e. Role of IS auditor

i. Risk assessment

ii. Control assessment

iii. Planning for review of PA controls

iv. Testing

1. Tour of facilities

2. Physical inventory

3. Interview personnel

4. Observation of safeguards (including special consideration)

5. Review of PA procedures

6. Examination of physical logs

36. Environmental controls

a. Categorization

i. Hardware and media

ii. IS supporting infrastructure

iii. Documentation

iv. Supplies

v. People

b. Issues and exposures

c. Controls

i. Water detectors

ii. Fire extinguishers

iii. Manual fire alarms

iv. Smoke detectors

v. Fire suppression system (dry, water, halon)

vi. Strategic location of computer room

vii. Regular inspection by fire department

viii. Fireproof walls, floors, ceilings

ix. Electric surge protectors

x. UPS

xi. Power lead from two stations

xii. Emergency power-off switch

xiii. Wiring placed in fire resistant panels

xiv. Prohibitions on eatables

xv. Fire resistant office material

xvi. Documented and emergency evacuation plans

d. Audit and evaluation technique

e. Role of IS auditor

i. Audit planning and assessment

1. Risk profile should include kinds of risk exposure and periodic updating

2. Controls assessment to ascertain adequacy

3. Security policy review to assess policies and procedures

4. Building and wiring plans needs to be reviewed

5. Interview relevant personnel (awareness, role, incident handling)

6. Administrative procedures like reporting and plans

ii. Audit of technical controls

1. IPF and its construction

2. Activities in the IPF

3. Presence of water and smoke detectors

4. Location of fire extinguishers

5. Evacuation plans and emergency exit markings

6. Documents for compliances of various requirements

7. Power sources and test to assure its quality

8. Environmental control equipment like AC, heater, etc

9. Complaint logs

37. Security concepts and techniques

a. Cryptosystem

b. DES

c. PKI

d. PKI policies

38. Data security and public networks

a. Firewall

i. Packet filter

ii. Stateful inspection

iii. Proxy server

iv. Application – level

39. Unauthorized intrusion

a. Why use IDS

b. Types of IDS

i. Network based

ii. Host based

40. Hacking

a. What damage is done

b. How do they hack

i. NetBIOS

ii. ICMP ping

iii. FTP

iv. RPC statd

v. HTTP

41. Controlling against virus

a. What is virus

b. Antivirus software

i. Scanner

ii. Active monitor and heuristic scanner

iii. Integrity checkers

c. Recommended policy and procedure controls

42. Data privacy

a. Protecting data privacy in IS

i. Policy communication

ii. Policy enforcement

b. Data privacy policies

i. Copyright notice

ii. E-mail monitoring

iii. Customer information sharing

iv. Encryption of data backups

v. Data access

Testing – General & automated controls

1. Introduction

a. Methods

i. Substantive

ii. Compliance

b. Phases

2. Audit planning

a. Use M/S concepts for effective plan

b. Underlying principle is optimum utilization of resources

c. Determine areas of little/no attention

d. M/S include both qualitative & quantitative factors

e. Occurs throughout audit as iterative process

3. Audit testing

a. Devise testing plan & methodology

b. Perform necessary testing

c. Use of GAS for testing

4. ISCA process

a. Obtain understanding of entity, its operations & key business processes

b. Obtain understanding of structure on entity’s networks

c. Identifying key areas of audit interest

d. Assessment of IT risk

e. Identify critical control points

f. Obtain understanding of ISC

g. Performing other audit planning procedures

5. Factors to determine NTE of audit procedures

a. Extent to which significant IC depend on reliability of information processed

b. Availability of evidence from sources other than IS

c. Relationship of ISC to data reliability

d. Assessing effectiveness of ISC

6. Identify key areas of audit interest

7. Obtain preliminary understanding of IS

8. Performing ISCA test

a. Types

i. Test of design

ii. Test of effectiveness

b. Levels

i. Entity wide level

ii. System level

1. Network

2. OS

3. Infrastructure

iii. Business process application level

9. Testing critical control points

10. Test effectiveness of ISC

a. Test on tiered basis

i. Test of general controls at entity & system level

ii. Test of general controls at BPAL

iii. Test of BPAC/UC

b. Evaluate & determine D/I/O

i. Identify general controls

ii. Determine how controls function and actually placed

iii. Evaluate operating effectiveness

11. Appropriateness of controls

a. Inquiry

b. Questionnaire

c. Inspection

d. Observation

e. Re-performance

f. Review documents

g. Analysis of system

h. Data review & analysis of output

12. Multiyear testing plans

13. Documentation

a. Understanding IS

b. ISC objectives & activities

c. Control techniques

d. NTE of test

e. Specific test performed

f. Evidence of effective controls or lack thereof

g. Conclusions about effectiveness

h. If control objective not achieved, compensatory controls

i. For each weakness, material/significant/deficiency

14. Reporting

a. Basic

i. Summarize results

ii. Draws conclusion out of I+A effect of identified ISC weaknesses

iii. Reports results

b. Audit objectives

c. Report audit result

d. Substantive resting

e. Documenting results

i. Audit findings

f. Analysis

i. Reexamination

ii. Standards

iii. Facts

iv. Verification

v. Cause

vi. Materiality & exposure

vii. Recommendations

15. Continuous Audit & embedded modules

a. Types

i. Snapshots

ii. ITF

1. Methods of entering

a. Tagged transaction

b. Specially prepared test data

2. Methods of removing

a. Programmed to ignore apart from test purpose

b. Reversal additional inputs

c. Submit Trivial entries

iii. SCARF

1. Application system errors

2. Policy & procedural variances

3. Profiling data

4. Performance measurement

5. System exception

6. Snapshots & extended records

7. Statistical sample

iv. CIS

b. Benefits

i. Examine data faster & efficiently

ii. Reduce time & cost

iii. Near 100% testing possible

iv. Testing throughout the year

v. Increase quality of audits

c. Advantages

i. Timely, comprehensive & detailed audit

ii. Surprise test capability

iii. Information to system staff on meeting objectives

iv. Training new users

d. Disadvantages

i. Must obtain required resource

ii. Usable if auditors involved in development of system

iii. Knowledge & experience of auditor

iv. Usable where audit trial is less visible & cost of errors are high

v. Stable application system required

16. Hardware testing

17. Review of hardware – Review

a. Capacity management & performance evaluation

b. Hardware acquisition plan

c. Change in management controls

d. Preventive maintenance

18. OS review

a. Interview personnel

b. Review cost-benefit analysis

c. SS installation

d. SS change controls

e. SS implementation

f. SS security

g. System documentation

h. Authorization documentation

i. Database supported ISC

19. Reviewing network

Risk assessment methodologies and applications

20. Introduction

21. Risk concepts

a. Risk

b. Threat

c. Vulnerability

d. Exposure

e. Likelihood

f. Attack

g. Residual risk

22. Threats to computerized environment

a. Power failure

b. Communication failure

c. Technology failure

d. Disgruntled employees

e. Theft or destruction of asset

f. Abuse of access privileges

g. Fire

h. Natural disaster

i. Error

j. Malicious code

23. Threats due to cyber crime

a. Fraud

b. Embezzlement

c. Theft of propriety information

d. Sabotage

e. Virus

f. Denial of service

24. Risk assessment

a. Prioritization

b. Identify critical applications

c. Assess the impact on organization

d. Determine recovery time frame

e. Assess insurance coverage

i. Hardware facilities

ii. Software reconstruction

iii. Extra cost

iv. Business interruption

v. Valuable records and documents

vi. Media transportation

vii. Error and omission

viii. Fidelity coverage

f. Identification of exposures and implications

g. Develop a recovery plan

25. Risk management

a. Types

i. Systematic risk

ii. Unsystematic risk

b. Risk management process

i. Identify technology related risk

ii. Assess identified risk in terms of probability and exposure

iii. Classify into systematic and unsystematic

iv. Identify various managerial actions that can reduce systematic risk and cost of it

v. Look out for technological solution to mitigate unsystematic risk

vi. Identify the contribution of technology across the organization in reducing overall risk exposure

vii. Evaluate technology risk premium and compare with possible value of loss

viii. Match analysis with management policy

c. Risk management cycle

i. Risk identification

ii. Risk assessment

iii. Risk mitigation

26. Risk identification

a. Purpose

i. Identify probability

ii. Calculate exposure

iii. Make control recommendations

b. Techniques

i. Judgment and intuition

ii. Delphi approach

iii. Scoring technique

iv. Quantitative

v. Qualitative

27. Risk ranking

28. Risk mitigation

a. Common techniques

i. Insurance

ii. Outsourcing

iii. Service level agreements

29. Risk and controls

BCP/DRP

1. BCP

a. Concept

b. Areas/Components

i. Business resumption planning

ii. Disaster recovery planning

iii. Crisis management

c. Objectives

i. Provide for the safety and well-being of people

ii. Continue critical business operations

iii. Minimize the duration of serious disruptions to operations and resources (G)

iv. Minimize immediate damage and losses

v. Establish management succession and emergency powers

vi. Facilitate effective co-ordination of recovery tasks (G)

vii. Reduce complexity of recovery effort (G)

viii. Identify critical lines of business & support functions

ix. Identify weakness and implement disaster prevention program (G)

2. Developing a BCP

a. Methodology

i. Provide comprehensive understanding of total efforts required

ii. Obtain commitment to support

iii. Define recovery requirements from business perspective

iv. Document the impact of extended loss

v. Focus on disaster prevention and impact minimization equally

vi. Select BC teams

vii. Develop understandable, easy to use and maintain BCP

viii. Define BCP must be integrated to ongoing business planning & SD

b. Phases

i. Preplanning activities

1. Understanding present & projected system

2. Defining overall scope of BCP

3. Develop policy to support BCP

4. Establish steering committee

5. Launch BCP awareness program

ii. Vulnerability assessment

1. Identify critical business processes

2. Identify all threats and vulnerabilities

3. Evaluate existing security measure and control

4. Evaluate existing emergency plan

5. Document findings

iii. Business impact analysis

1. Identify organisational risk

2. Quantify risk to critical BP in terms of financial and goodwill loss

3. Identify interdependencies of critical BP and time order to restore

4. Maximum allowable downtime

5. Identify type and quantity of resources required

6. Submit BIA report

iv. Detailed definition of requirement

1. Identify recovery alternatives for short, medium, and long term

2. Estimate and determine resources required for critical functions in terms of hardware, software, personnel, facilities, outside support

3. Develop scope, objectives and assumption of BCP

v. Plan development

1. Formulate overall recovery plan and strategy categorized in business and technical

2. Define & document recovery plan and components

3. Define changes to user procedures, data processing procedures

4. Define roles and duties of recovery teams

5. Determine changes made to vendor contracts

vi. Testing program

1. Recovery procedures are complete and workable

2. Staff is adequately trained

3. Resources (H/S/P/F) are adequate

4. Manual recovery and back-up procedures are also working

vii. Plan implementation

1. Implement individual components of plan

2. Assigning job roles and duties to staff

3. Providing emergency guidelines

4. Scheduling test activities

viii. Maintenance program

1. Determine responsibility to maintain BCP

2. Continuous monitoring to look for desired changes

3. Designing change management process

3. Types of plans

a. Emergency plan

b. Backup plan

i. Hardware

ii. Application software

iii. System software

iv. Documentation

v. Data/Information

vi. Personnel

vii. Facilities

viii. Supplies

c. Recovery plan

d. Test plan

4. Threats and risk management

a. Lack of integrity

b. Lack of confidentiality

c. Lack of system availability

d. Unauthorized user attempt to gain access

e. Hostile software

f. Disgruntled employees

g. Hacker and computer crimes

h. Terrorism

i. Minimizing risk in organisation infrastructure

j. Single point of failure analysis

i. Objectives

1. Identify IT risks

2. Determine level of risk

3. Identify risk factors

4. Determine risk mitigation strategies

ii. Benefits

1. Business driven process to identify, manage and quantify risk

2. A framework that governs technological choice and delivery processes

3. Interpretation and communication of potential risk impact and risk reduction

4. Implementation of strict disciplines for active risk management

5. Software and data back-up techniques

a. Full

b. Incremental

c. Differential

d. Mirror

6. Alternate processing facility arrangements

a. Hot site

b. Cold site

c. Ware site

d. Reciprocal arrangements

e. Contract issues

i. How soon

ii. Number of user allowed concurrently

iii. Priority to be given to concurrent users

iv. Period

v. Condition

vi. Facilities and services

vii. Controls in place and working

7. Back-up redundancy

a. Importance

i. Multiple backup media

ii. Off site backup

iii. Where to keep backup

iv. Media rotation tactics

b. Types of media

i. Floppy disk

ii. DVD/CD

iii. Tape drives

iv. Digital audio tape

v. Optical juke box

vi. Autoloader tape system

vii. Disk drives

viii. Removable disk

ix. USB flash drive

x. ZIP drive

c. Fundamental factors

i. Speed

ii. Reliability

iii. Cost

iv. Capacity

v. Extensibility

d. Backup tips

i. Draw simple and easy to understand plan

ii. Keep a record of what, when, which media used

iii. Put proper labels on media

iv. Use software utilities for automatic backup scheduling

v. Verify backup files after process

vi. Create reference points

vii. Restore privilege to administrator only

viii. Create step-by-step guidelines

8. DRP

a. Procedural plan

b. Insurance

i. Coverage

ii. Kinds

1. First party – property damages

2. First party – business interruptions

3. Third party – general liability

4. Third party – errors and omission

9. Testing methodology

a. Types of test

i. Hypothetical

ii. Component

iii. Module

iv. Full

b. Methodology

i. Setting objectives

ii. Defining boundaries

iii. Scenario

iv. Test criteria

v. Assumption

vi. Test prerequisites

vii. Briefing

viii. Checklist

ix. Analysing test

x. Debriefing

10. Audit tools and techniques

a. Automated tools

b. Internal control auditing

c. Disaster and security checklists

d. Penetration testing

ERP

1. Introduction

2. ERP – Definition

a. Evolution

i. Aggressive cost cutting

ii. Need to analyze costs/revenue

iii. Flexibility to respond to changes

iv. Changes in ways to do business

b. Enabling technologies

c. Characteristics

i. Flexibility

ii. Modular & open

iii. Comprehensive

iv. Beyond the company

v. BBP

d. Features

i. Multi-platform, lingual, currency, facility

ii. Function effectively integrated for flow and update by single entry

iii. Company-wide integration

iv. Integration of companies under same management

v. Perform core activities and increase customer services

vi. Eliminates most business problems

vii. Bridge information gap

viii. SCM to optimize demand and supply data

ix. Allow automatic introduction of latest technologies

x. Provides intelligent business tools like DSS, EIS, Data mining

e. Why ERP

i. Integrate financing

ii. Integrate customer order processing

iii. Standardize and speed up manufacturing

iv. Reduce inventory

v. Standardize HR information

f. Benefits

i. Improved business processes

ii. Improves productivity

iii. Improved resource utilization

iv. Reduce inventory levels

v. Improves financial controls

vi. Helps in reducing operating cost

vii. Fast and accurate reports

viii. Unified customer database

ix. Better follow-up on customers

x. Supports strategic planning

xi. Improved decision making capability

xii. Better information access throughout management

3. BPR

a. What is BPR

i. Fundamental rethinking

ii. Radical redesign

iii. Dramatic improvement

b. Business engineering

c. Business management

d. Business modeling

4. ERP implementation

a. Hindrances/Impediments

i. Working together to achieve overall objectives

ii. Properly managed implementation, Workload may not decrease

iii. Customization

iv. Roles and responsibilities

v. Expandable and adaptable

b. Implementation decision

i. ERP or no ERP

ii. Follow software processes or customization

iii. In-house or outsourced

iv. Bing – bang or phased implementation

c. Methodology

i. Identify the needs for implementing ERP

ii. Evaluate “As is” situation

iii. Decide “Would be” situation

iv. BPR

v. Evaluate various ERP packages

1. Flexibility

2. Modular & open

3. Comprehensive

4. Beyond the company

5. BBP

6. Integrates

7. New technologies

vi. Finalise most suitable package

vii. Install required hardware and network

viii. Finalise implement consultants

ix. Implement ERP

d. Guidelines

i. Understand the corporate needs

ii. BPR

iii. Good communication network

iv. Strong and effective leadership

v. Capable project manager

vi. Balanced team of consultants

vii. Good implementation methodology

viii. Training to user

ix. Adapting new system

5. Post implementation

a. Expectation

b. Fears

6. Risk and governance issues

a. Single point failure

b. Structural changes

c. Job roles changes

d. Online real time

e. Change management

f. Broad system access

g. Data content quality

h. Privacy and confidentiality

i. Single sign on

j. Distributes computer experience

k. Program interfaces and data conversion

l. Dependence on external assistance

m. Audit expertise

7. Why ERP fails

a. Resistance in adoption of work methods outlined in ERP

b. Customization of standard software

c. Changing habits is more difficult than customizing

8. ERP and E-commerce

a. Complex and not intended for public use

b. Two new channels – For customers and for supplies/partners

c. Careful planning needed

9. Life after implementation

a. Tasks to performed

i. Develop new job description and organisation structure

ii. Identify skills gap

iii. Assess training requirements and implement training plan

iv. Develop and amend HR, financial and operational policies

b. Post implementation blues

i. Change in business environment – Change in CSF – Change in KPI

ii. A review may indicate change in some processes

iii. New processes require extra business functionality

iv. Continuous improvement in technology and hardware require change in ERP

ISA standards, guidelines, best practices

1. Introduction

a. Common features

i. Every organization using IT, uses set of controls

ii. Set of controls depend on business objective, budget, etc

iii. Set of control objective should be constant

iv. Everyone uses same control framework

2. ISO 27001

a. General

i. Asset to be protected

ii. Approach to risk management

iii. Control objective and control (3)

iv. Degree of assurance required

b. Establishing management framework (1)

i. Define SP (2)

ii. Make appropriate risk assessment

iii. Identify areas of risk

iv. Select appropriate control (4)

v. Prepare SoA (5)

c. Implementation

i. Verification procedures

ii. Review procedures

d. Documentation

i. Management control

ii. 12345

iii. Procedures under implementation control

iv. ISMS control procedure

v. Document control

vi. Records

e. Areas of focus

i. Security policy

1. Definition of information security

2. Statement of management intention

3. Allocation of responsibility

4. Explanation of standards and compliance requirements

5. Defined review procedures and means of assessing

6. Nomination of policy owner

ii. Organizational security

1. IS infrastructure

2. Security to 3rd party access

3. Outsourcing

iii. Asset classification and control

1. Accountability of assets

a. Inventory, ownership, IAR

2. Information classification

a. Classification guidelines

b. Information labeling and handling

iv. Personnel security

1. Security requirement in job definition and employee resourcing

2. User training

3. Responding to security incidents

v. Physical & environmental security

1. Secure areas

2. Equipment security

3. General controls

vi. Communication and operations management

1. Operational procedures & responsibilities

2. Protection against malicious software

3. Housekeeping

4. Network management

5. Media handling & security

6. Exchanges of information & software

vii. Access control

1. Business requirement for access control

2. Monitoring system access & use

3. (Same as in chapter 3 under logical control)

viii. System development and maintenance

1. Security requirement of system

2. Security in application systems

3. Security of system files

4. Security in development & support process

5. Cryptographic control

ix. BC management

x. Compliance

1. Compliance with legal requirement

2. Review of SP and technical Compliance

3. System audit consideration

3. CMM

a. Fundamental concept

b. Software process capability

c. Software process performance

d. Software process maturity

e. Phases

i. Initial

ii. Repeatable (disciplined)

iii. Managed (standard, consistent)

iv. Defined (predictable)

v. Optimizing (continuous improving)

4. COBIT

5. COCO

6. ITIL

7. Systrust & webtrust

a. Principles

i. Security

ii. Availability

iii. Processing integrity

iv. Online privacy

v. Confidentiality

b. Broad areas

i. Policies

ii. Communication

iii. Procedures

iv. Maintenance

8. HIPPA

a. Title I and Title II

b. Security rules

i. Administrative

ii. Physical

iii. Technical

9. SAS 70

a. Type of reports

b. Benefits to SO

c. Benefits to UO

IS Security policy, Audit policy and Audit Reporting

1. Introduction

2. Importance of IS security

a. Widespread use of technology

b. Interconnectivity

c. Unevenness of technology

d. Unconventional electronic attacks

e. Devolution of management and control

f. Legal and regulatory requirement

3. IS security

a. Security objective (CIA)

b. Sensitive information

i. Strategic plans

ii. Business operations

iii. Financial information

c. Establishing better protection

i. Not all data has same value

ii. Know where the critical data resides

iii. Develop an access control methodology

iv. Protect information stored on media

v. Review hard copy output

4. Protecting information

a. Rules

i. What the IS are and where these are located

ii. Value of the information held and how difficult it would be to recreate if it were damaged or lost

iii. Who are authorized to access the information and what they are permitted to do

iv. How quickly information needs to be made available if it become unavailable for whatever reason

b. Types

i. Preventive

ii. Restorative

iii. Holistic

5. ISP

a. Issues to address

i. Definition of information security

ii. Why information security is important

iii. Brief explanation of security policies

iv. Definition of all relevant roles and responsibilities

v. Reference to supporting documents

b. Members of SP

i. Management members

ii. Technical group

iii. Legal experts

6. Types of ISP and hierarchy

a. ISP

b. User SP

c. Acceptable usage policy

d. Organisational ISP

e. Network & system SP

f. Information classification SP

g. Condition of connection

7. Components

a. Security organization structure

b. Document maintenance and compliance

c. Monitoring and audit requirements

d. Purpose and scope

i. Ensure CIA

ii. Restrict and deny access to unauthorized users

iii. How far, to whom and the period of SP

e. Security organisation structure

f. Responsibility allocation

i. Appoint owner

ii. Aware staff the need and responsibility

iii. Task completion and satisfied owner

iv. Contact list if security incident

v. Controlled & Risk assessment for 3rd party access

vi. Condition of connection agreement

vii. New network link to be approved

viii. Outsourcing contract details

g. Asset classification and security classification

i. Maintain inventory

ii. Formal & documented classification scheme

iii. Classification by owner

iv. Protective marking

v. Controlled exchanges of data

vi. Information labeling and handling

vii. Classified waste disposed securely

h. Access control

i. Prevent unauthorized access

ii. Owner responsible for approving, maintain log

iii. Grant access if business requirement

iv. Access upto level required

v. Registration, de-registration, deletion of users

vi. Separate User ID, no sharing

vii. Password policy

viii. PC and terminal not left unattended

ix. Mobile computing

i. Incident handling

i. Consistent reporting approach

ii. Procedure to ensure recording

iii. Reoccurrence analysis to identify weakness

iv. Procedures for collection of evidence

v. Adequate records for inspection

j. Physical and environmental security

i. Maintain check to identify vulnerable area

ii. IT infrastructure physically protected

iii. Secured access

iv. Sensitive information & valuable assets locked away

v. PC and terminal not left unattended

vi. Supplies delivered & loaded at separate place

vii. Equipment, information not taken off-site without authorization

viii. Premises (equipment, data) located away from threats

k. Business continuity management

i. BCP maintained, tested, updated

ii. BIA conducted annually

l. System development and maintenance controls

i. Controls identified prior to development

ii. Controls to ensure CIA

8. Audit policy

a. Purpose

i. Unauthorized access to confidential data and information

ii. Password disclosure

iii. Virus infections

iv. Denial of service attacks

b. Objectives

i. Safeguard IS asset & resources

ii. Ensure data integrity

iii. Ensure system efficiency and effectiveness

iv. Compliance with SP, guidelines, etc

c. Scope

i. Adequacy & effectiveness of ICS

ii. Quality of performance by IS

iii. POD to reasonable assurance for achievement of objectives and goals

iv. Provide information to appraise ICS

d. What audit policy should do

i. Periodicity and authority of reporting

ii. Minimum professional proficiency required

iii. Declaration of fidelity & secrecy

iv. Extent of testing to be done

v. Documented audit program

1. Objectives & scope

2. Nature and degree of testing required

3. Identification of technical aspects, risks, processes

4. Document procedures of audit

5. Prior preparation and subsequent modification of procedures

vi. Define access rights

1. User level or system level access to devices

2. Access to information

3. Access to work areas

4. Access to reports/documents

5. Monitor and log network traffic

vii. Compliance testing

1. Organizational and operational control

2. Security management control

3. Application control

4. Access control

5. Physical and environmental security

6. Business continuity management

7. System development control

viii. Substantive testing

1. Observe weakness

2. High risk exposure

3. Gather additional information

9. Audit working papers

a. Form and content affected by

i. Nature of engagement

ii. Form of audit report

iii. Complexity of client’s business

iv. Condition of records and degree of reliance

b. Permanent audit file

i. Organization structure

ii. IS policies

iii. Historical background

iv. Important legal documents

v. Study and evaluation ICS

vi. Old audit reports

vii. MRL

c. Current audit file

i. Acceptance letter and scope

ii. Evidence of planning process

iii. Record of NTE of procedures and results

iv. Letter and notes concerning audit matters and material weaknesses

v. MRL and confirmation

vi. Conclusion reached on significant aspects and how exceptional matters resolved

vii. Copies of data and system and related audit reports

10. Documentation

a. Planning key factors

i. Knowing your resources

ii. Defining scope

iii. Knowing your audience

b. Rules

i. Gathering information

1. About reader

2. About subject

ii. Organizing

1. Selecting information

2. Dividing into sections and subsections

iii. Writing

1. Writing in active voice

2. Giving consequences

3. Writing from general to specific

4. Consistency

iv. Finalizing

1. Review and test

2. Generating glossary and index

3. Formatting and production

11. IS audit reports

a. Cover and title page

b. Table of content

c. Summary

d. Introduction

i. Context

ii. Purpose

iii. Scope

iv. Methodology

e. Findings

f. Opinion

g. Appendices

h. Level of detail

i. Commentary