Professional Standards Committee and Frameworks for IT Audits ISACA Professional Standards Committee and Frameworks for IT Audits

Steve Sizemore, CISA, CIA, CGAP Texas Health and Human Services Commission – Internal Audit Division IIA Austin Chapter ISACA Past President of Austin Chapter Government and Regulatory Agencies Subcommittee – North America Professional Standards Committee

Professional Standards Committee - Charge Develop, maintain, and support professional ethics, standards, and guidelines for the IT assurance, security and control professions.

Standards Board Members 2010/11 John Ho Chi, CISA, CISM, CBCP, CFE, Ernst & Young LLP, Singapore, Chair Manuel Aceves, CISSP, CGEIT,CISM,CISA, Cerberian Consulting, Mexico Rick De Young, CISA,MBA,CISSP, USA Murari Kalyanaramani, CISM,CISA,CISSP, British American Tobacco GSD, Malaysia Edward J. Pelcher, CGEIT,CISA, Office of the Auditor General, South Africa Rao Hulgeri Raghavendra, CISA,CQA,PGDIM, Oracle Financial Services Software Ltd., India Steven E. Sizemore, CISA,CIA,CGAP, Texas HHSC, USA Meera Venkatesh, CISA, CISM, CISSP, CWA, ACS, Microsoft Corp., USA

Professional Standards Committee Objectives 1. Refresh, consolidate, and retire IS auditing guidance issued by ISACA to ensure consistency with other material issued by ISACA and ITGI, such as COBIT 4.1 and the Information Technology Assurance Framework (ITAF).

Professional Standards Committee Objectives 2. Continue development of security principles and the Business Model for Information Security (BMIS).

Professional Standards Committee Objectives 3. IT Assurance Framework (ITAF) Ensure all current ISACA guidance is reflected. Identify Gaps with our current guidance. Develop guidance as determined to be a priority by the gap analysis.

IS Auditing Guidance Code of Professional Ethics is a mandatory requirement Standards are mandatory requirements Guidelines are guidance in applying standards Procedures are examples

ITAF Standards Guidelines Tools and techniques General Performance Reporting Guidelines Tools and techniques

ITAF (cont) Standards – 3 categories General standards are the guiding principles under which the IT assurance profession operates Performance standards establish baseline expectations in the conduct of IT assurance engagements Reporting standards address the types of reports, the means of communication, and the information to be communicated

COBIT COBIT 4.1 COBIT 5 In development Will consolidate and integrate  COBIT 4.1, Val IT 2.0 and Risk IT frameworks Draw significantly from the Business Model for Information Security (BMIS) and ITAF.

COBIT - among top four IT Governance Frameworks

Val IT – A Governance Framework IT-enabled investments will: 1. Be managed as a portfolio of investments 2. Include the full scope of activities required to achieve business value 3. Be managed through their full economic life cycle Value delivery practices will: Recognize different categories of investments to be evaluated and managed differently Define and monitor key metrics and respond quickly to any changes or deviations Engage all stakeholders and assign appropriate accountability for delivery of capabilities and realisation of business benefits Be continually monitored, evaluated and improved

Risk IT – Risk Management Framework Risk Governance Establish and Maintain a Common Risk View Integrate with Enterprise Risk Management (ERM) Make Risk-aware Business Decisions Risk Evaluation Collect Data Analyze Risk Maintain Risk Profile Risk Response Articulate Risk Manage Risk React to Events

Information Security Principles Partnership of ISACA Information Security Forum (ISF) International Information Systems Security Certification Consortium (ISC)2

Business Model for Information Security (BMIS) Uses a business-oriented approach Can be used regardless of an enterprise’s size or the information security framework it has in place Focuses on people and processes in addition to technology. Is independent of any particular technology and is applicable across all industries, countries, and regulatory and legal systems. Includes traditional information security, as well as links to privacy, risk, physical security and compliance. Enables information security professionals to align the security program with business objectives by helping to widen the view to the enterprise

BMIS (cont)

How is IS auditing guidance developed? Members and CISAs Chapter Presidents General public Other standard setting bodies Area Rep Standards Board

How is IS auditing guidance issued? Selected professionals Other standard setting bodies (through the exposure process) Members and CISAs (through the Internet ) General public (through the internet) Copies of all Standards are available on the ISACA web site www.isaca.org Standards Board

Working with Other Organisations Work with other international standard setting bodies (IIA, IFAC, AICPA, etc.) Comment on Exposure Drafts

Future Pronouncements

Guidelines to be Refreshed in 2011 SDLC G24 Internet Banking G25 Review of VPNs G26 Business Process Reengineering G27 Mobile Computing

Guidelines to be Refreshed in 2011 Computer Forensics G29 Post Implementation Reviews G30 Competencies G31 Privacy G32 Business Continuity Planning

Gap Analysis Identified gaps between ITAF and the Standards and Guidelines Plan to address gaps through development of new standards and guidelines, and consolidation and reorginization of existing standards and guidelines.

Conclusion Questions?