7-Oct-15 System Auditing

AUDITING Auditing is a systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events ascertain the degree of correspondence between those assertions communicating the results to interested users.

Types of Audits  Financial Audit  Operational Audit  Compliance Audit  Fraud Audit  IT Audit  Security Audit  Can be done both internally or externally by the public certified accountants

IT Audit An information technology audit, or information systems audit, is an examination of the controls within an Information technology (IT) infrastructure. An IT audit is the process of collecting and evaluating evidence of an organization's information systems, practices, and operations.

IT Audit The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively and efficiently to achieve the organization's goals or objectives. This is becoming increasing important as accounting data and the processes are now embedded into the computer based information system

IT Audit  Subject to ethics, guidelines, and standards of the profession (if certified)  CISA  Most closely associated with ISACA  Joint with internal, external, and fraud audits  Scope of IT audit coverage is increasing  Characterized by CAATTs  IT governance as part of corporate governance

Stages of IT Audit Phases 1. Planning 2. Obtaining evidence  Tests of Controls  Substantive Testing  CAATTs  Analytical procedures 3. Ascertaining reliability  MATERIALITY 4. Communicating results  Audit opinion

IT Audit Approach Gather information and Plan Knowledge of business and industry Prior year ‘s audit result Recent financial informationRegulatory statutes Inherent risk assessments Obtain understanding of internal control Control environmentControl procedures Control risk assessmentDetection risk assessment Total risks

IT Audit Approach Perform compliance tests Test policies and proceduresTest segregation of duties Perform substantive tests Analytical proceduresDetailed tests of account balances Other substantive audit procedures Conclude the audit Create recommendationWrite audit report

Tests performed Compliance testing To determine if internal controls are being applied in a manner described in documentation and in accordance with management intent Substantive testing To determine the integrity of the actual processing. Usually done by processed some sample data and see if the same result can be realized.

Security Audit It is a systematic, measurable technical assessment of: how the organization's security policy is employed at a specific site How effectively an entity being assessed meets specific security objectives

Assessment Methodology Should be repeatable and documented Divided into 3 phases: Planning Set goals, scope, timeline, responsibility, resources, deliverables Collect information: assets to be assessed, threats against assets, security controls to mitigate risk Execution Validate controls and identify vulnerabilities Post-execution

Assessment Methodology Post-execution Analyse identified vulnerabilities Determine root cause Recommend mitigation methods Write final report

Assessment methods Examine/review Technical investigation/assessment Interview

Review techniques Documentation review – policies, procedures Log review Rule set review – router, firewall, IDS etc. System configuration review Network sniffing – network traffic File integrity checking

Technical assessment techniques Network discovery Network port and services identification Vulnerability scanning Wireless scanning etc. Password cracking Penetration testing Social engineering

Talk to /interview people Have they read the security policy? What can/ can’t do in their own words? Could they get root/ system privilege? What are the systems used for? What are the critical systems? How do they view the security audit?

Terminology CAATT: Computer Assisted Auditing Tool and Techniques ACL: Audit Command Language IDEAS: Interactive Data Extraction and Analysis Ref on Security Audit: NIST Technical guide to Information Security Testing and Assessment