Lecture 14: ICT Audit
Context of ICT Audit Question: What role is ICT playing in driving your business. Playing? Could Play? Should Play? ICT Audit
ICT Audit ICT Audit is the processes of ensuring that you are getting the best out of your assets adequate protection of your system adequate protection from your system prepared for impending upgrades of the system Conformance to statutory requirements ICT Audit
Potential complications of ICT Systems The way they are put together (Adhoc) The way they are resourced The hiring of the personnel The positioning of the personnel in the company organization The fact that they are viewed as ICT systems Lack of understanding of ICT Systems by business ICT Audit
What to Audit The Network The systems The procedure The backup The personnel The technology The business continuity ICT Audit
What to Audit – on The Network Technology used Topology of the network Entry points Rules within the network Virtual Local Area Networks Access Lists Perform various kinds of Penetration tests ICT Audit
What to audit – on the systems The systems security Passwords Access levels Audit trails Logs detail Logs safety Usage of the logs – Proactive rather than just Reactive use of logs Get evidence of all these from the system ICT Audit
What to audit on -systems Application Systems External security Access Access Rights Internal security Business fit Decoupling of the processes from the application Stability of the organization selling the application ICT Audit
What to audit - Procedures Procurement Procedures Repair and maintenance procedures Change management Introduction of new systems Altering of existing systems Systems retirement procedures Equipment retirement procedures Who has your old data When social responsibility turns nasty (The Nigerian Recycling nightmare) http://news.bbc.co.uk/2/hi/business/4790293.stm ICT Audit
What to audit – the systems backup Is the system being backed up? What do you do to your most valuable assets? Quality of backup Testing of backup Testing of recovery procedures Disaster recovery site Hot site Cold site ICT Audit
What to audit – Personnel Organogram test Do you have the correct personnel Do you have adequate personnel How knowledgeable are they How specialized are they Have they been undergoing training Who hires your personnel What do they know and how do they know it ICT Audit
What to audit – technology Does your current technology fit your business How are you preparing for future technology Who is watching the technology for you Who calls the shots in moving over to new technologies Are you reactive or proactive ICT Audit
What to audit – Business continuity Fire drills phenomenon Have to be ready for unforeseen eventualities Succession plan phenomenon Do you have sufficient backup and redundancy within the essential business processes Discussion point What aspects need to be considered to guarantee business continuity? ICT Audit
Business Continuity – What to consider Big data analytics to gain insights Software upgrade Customer or clients database Data Recovery Plan Agility of hard and soft in terms of upwards and backwards compatibility Business Continuity Plan, manual for computerized systems Connectivity to enhance visibility Adoption of new technologies Data security Succession plan in terms of key personnel ICT Audit