Session 11 Other Assurance Services Sys Trust Payment Card Industry security standard compliance EECS4482 2015 David Chan 1

SysTrust A system assurance service developed by American Institute of Certified Public Accountants (AICPA) and Chartered Professional Accountants Canada (CPA Canada). Audits have been on new systems in an organization or systems shared by a number of partner organizations High control assurance EECS4482 2015 David Chan

SysTrust Principles The Availability Principle addresses accessibility to the defined system, products, or services as advertised or committed by contract, service-level, or other agreements. The Security Principle requires an entity to meet high standards for the protection of the system components from unauthorized access, both logical and physical. EECS4482 2015 David Chan

Main Trust Principles Processing Integrity Principle requires an entity to meet high standards for the completeness, accuracy, timeliness, and authorization of system processing including the processing of electronic commerce transactions. All three principles must be satisfied. EECS4482 2015 David Chan

Optional Trust Principles Confidentiality – no unauthorized viewing Privacy – confidentiality of personal info EECS4482 2015 David Chan

Sys Trust Audit The auditor has to be licensed by AICPA or CPA Canada specifically for SysTrust engagements. The outcome of the audit consists of a report and an unqualified opinion on the internal controls to support the system. High control assurance. EECS4482 2015 David Chan

Control Criteria Operating organization of the system selects criteria (objectives) from the list provided by CPA Canada or AICPA to satisfy each main principle and each selected optional principle. Unless a criterion does not apply to the environment, it must be selected. There is no wording change to criteria. Each control criterion is supported by control activities (procedures), which can be manual or automated, developed by management. EECS4482 2015 David Chan

Difference Between SysTrust and CSAE 3416 Each stated criterion in the report must be met by controls in order to get an unqualified SysTrust report. CSAE 3416 report has restricted distribution. Sys Trust addresses system reliability, whereas CSAE 3416 addresses financial statement assertions. CSAE 3416 is more flexible, as it uses control objectives instead of principles prescribed by CPA Canada and AICPA. EECS4482 2015 David Chan

SysTrust Users Hosting organization User organizations Trading partners, e.g., automated vendor inventory replenishment Financial statement auditors EECS4482 2015 David Chan

SysTrust Report An opinion on management’s asserted controls. Opinion does not cover system description, although system description is often included in the report. But if the auditor knows that system description is misleading, s/he should not issue an opinion on the controls. Opinion covers the reporting period of not more than one year. EECS4482 2015 David Chan

Drivers for SysTrust Audit The potential conflict of interest between the system operator and system user or owner. The complexity of systems, requiring expertise to conduct an audit that would provide a reasonable degree of assurance about their conformity with system reliability principles and criteria. EECS4482 2015 David Chan

Drivers for SysTrust Audit The remoteness of users from systems requiring an independent objective representative to observe the system on their behalf. The consequences of system unreliability. The four conditions above may contribute individually to the need for assurance services related to the reliability of an entity’s key information system(s) and they may also interact to increase the need for such assurance. EECS4482 2015 David Chan

Process of a Sys Trust Audit System hosting organization decides to pursue a Sys Trust audit. System hosting organization hires an accounting firm. System hosting organization selects optional principles as well as criteria for the mandatory and optional principles. Management develops control activities for each criterion. EECS4482 2015 David Chan

Process of a Sys Trust Audit Accounting firm assesses the adequacy of control criteria and procedures. Accounting firm conducts testing. Accounting firm provides report to system hosting organization. System hosting organization shares report with user organizations. EECS4482 2015 David Chan

Options to Address Control Deficiency Fix the control if there is still time. Replace the control with another existing control. Remove an optional principle. Cancel the engagement. EECS4482 2015 David Chan

Payment Card Industry (PCI) Security Standard Developed by the PCI Security Council formed by major card issuers: Visa, MasterCard, American Express, Diners Club, JCB International and Discover Card. All issuing financial institutions and merchants that take credit card transactions on the Internet have to comply. Failure to comply may lead to financial penalty. EECS4482 2015 David Chan Chan 16

PCI Security Standard Visa and MasterCard require major merchants and IT service organizations (over 1 million transactions annually or over 20,000 eTransactions annually) to have an annual external validation for compliance. EECS4482 2015 David Chan

PCI Standards 1.Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor supplied defaults for system passwords and other security parameters. 3. Protect stored cardholder data, including encryption. 4. Encrypt transmission of cardholder data across the Internet EECS4482 2015 David Chan 18

PCI Standards 5. Use regularly updated anti-virus software 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business on a need-to-know basis 8. Assign a unique ID to each person with computer access EECS4482 2015 David Chan 19

PCI Security Standard 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security EECS4482 2015 David Chan 20

Conclusion SysTrust engagements are increasing because of increasing use of externally hosted systems. PCI is gaining prominence because the PCI Council (credit card companies) are now starting to enforce this standard. EECS4482 2015 David Chan

Review Questions Map the SysTrust principles to the control matrix we discussed in Chapter Six. What are the management options to avoid a qualified SysTrust audit opinion when a control deficiency is identified by the auditor? What parties can benefit from a SysTrust audit report? EECS4482 2015 David Chan

Review Questions 4.What kinds of organizations are held to comply with the Payment Card Industry Security Standard? 5. What kinds of organizations are required to provide an annual external validation of compliance with the PCI Security Standard? EECS4482 2015 David Chan

Review Questions 6.According to the PCI Security Standard, what kind of access has to be monitored? 7. How does the PCI Security Standard affect the financial statement audits of large retail merchants? 8. How does the PCI Security Standard affect the profit of large retail merchants? EECS4482 2015 David Chan

MC Question Which of the following is an optional SysTrust principle? A. Confidentiality B. Security C. Processing integrity D. Availability EECS4482 2015 David Chan

MC Question Who is the primary audience of a SysTrust report? A. Service organization management B. Shareholders’ auditors of service organization C. User organization(s) management D. Shareholders’ auditors of user organization(s) EECS4482 2015 David Chan

MC Question Who is responsible for developing control procedures in a SysTrust audit? A. External auditors B. Service organization management C. Internal auditors D. User organization management EECS4482 2015 David Chan

MC Question Which SysTrust principle addresses application controls? A. Security B. Confidentiality C. Processing integrity D. Availability EECS4482 2015 David Chan

MC Question What kind of access to cardholder data must be monitored by a bank? A. All B. Update C. External D. Create EECS4482 2015 David Chan