Risk Management

IT Controls Risk management process Risk management process IT controls IT controls IT Governance Frameworks IT Governance Frameworks 2

3 The Risk Management Process Identify IT Risks Assess IT Risks Identify IT Controls Document IT Controls Monitor IT Risks and Controls

4 IT and Transaction Processing The IS collects transaction data The IS collects transaction data The IS turns data into information The IS turns data into information Computerized transactions systems increase some risks and decrease others Computerized transactions systems increase some risks and decrease others

5 AIS Threat Examples Fraud Fraud Computer crimes Computer crimes Nonconformity with agreements & contracts between the organization & third parties Nonconformity with agreements & contracts between the organization & third parties Violations of intellectual property rights Violations of intellectual property rights Noncompliance with other regulations & laws. Noncompliance with other regulations & laws.

6 Types of IT Risks Business risk Business risk Audit risk = IR * CR * DR Audit risk = IR * CR * DR –inherent risk (IR) –control risk (CR) –detection risk (DR) Security risk Security risk Continuity risk Continuity risk

7 Valuation of Asset What do we stand to lose? Assets: People, Data, Hardware, Software, Facilities, (Procedures) Assets: People, Data, Hardware, Software, Facilities, (Procedures) Valuation Methods Valuation Methods –Criticallity to the organization’s success –Revenue generated –Profitability –Cost to replace –Cost to protect –Embarrassment/Liability

8

9 IT Controls COSO identifies two groups of IT controls: COSO identifies two groups of IT controls: –Application controls – apply to specific applications and programs, and ensure data validity, completeness and accuracy –General controls – apply to all systems and address IT governance and infrastructure, security of operating systems and databases, and application and program acquisition and development

10 Application Control Goals Input validity Input validity –Input data approved and represent actual economic events and objects Input completeness Input completeness –Requires that all valid events or objects be captured and entered into the system Input Accuracy Input Accuracy –Requires that events be correctly captured and entered into the system

11 Classification of Controls Preventive Controls: Issue is prevented from occurring – cash receipts are immediately deposited to avoid loss Preventive Controls: Issue is prevented from occurring – cash receipts are immediately deposited to avoid loss Detective Controls: Issue is discovered – unauthorized disbursement is discovered during reconciliation Detective Controls: Issue is discovered – unauthorized disbursement is discovered during reconciliation Corrective Controls: issue is corrected – erroneous data is entered in the system and reported on an error and summary report; a clerk re-enters the data Corrective Controls: issue is corrected – erroneous data is entered in the system and reported on an error and summary report; a clerk re-enters the data

12 Segregation of Duties Transaction authorization is separate from transaction processing. Transaction authorization is separate from transaction processing. Asset custody is separate from record-keeping responsibilities. Asset custody is separate from record-keeping responsibilities. The tasks needed to process the transactions are subdivided so that fraud requires collusion. The tasks needed to process the transactions are subdivided so that fraud requires collusion.

13 Separation of Duties within IS

14 Documenting IT Controls Internal control narratives Internal control narratives Flowcharts – internal control flowchart Flowcharts – internal control flowchart IC questionnaires IC questionnaires

15 Risk Control Strategies Avoidance Avoidance –Policy, Training and Education, or Technology Transference – shifting the risk to other assets, processes, or organizations (insurance, outsourcing, etc.) Transference – shifting the risk to other assets, processes, or organizations (insurance, outsourcing, etc.) Mitigation – reducing the impact through planning and preparation Mitigation – reducing the impact through planning and preparation Acceptance – doing nothing if the cost of protection does not justify the expense of the control Acceptance – doing nothing if the cost of protection does not justify the expense of the control

16 Monitoring IT Risks and Controls CobiT control objectives associated with monitoring and evaluation CobiT control objectives associated with monitoring and evaluation Need for independent assurance and audit of IT controls Need for independent assurance and audit of IT controls

17

18 IT Governance …the process for controlling an organization’s IT resources, including information and communication systems, and technology. …using IT to promote an organization’s objectives and enable business processes and to manage and control IT related risks. IT Auditors ensure IT governance by assessing risks and monitoring controls over those risks

19 COSO and Internal Control (IC) COSO – 5 components of IC COSO – 5 components of IC –Control environment –Risk assessment –Control activities –Information and communication –Monitoring International IC Standards International IC Standards –Cadbury –CoCo –Other country standards

20 ISACA’s CobiT Integrates IC with information and IT Integrates IC with information and IT Three dimensions: information criteria, IT processes, and IT resources Three dimensions: information criteria, IT processes, and IT resources Requirements (information criteria) of quality, fiduciary, and security Requirements (information criteria) of quality, fiduciary, and security Organizes IT internal control into domains and processes Organizes IT internal control into domains and processes –Domains: planning and organization, acquisition and implementation, delivery and support, and monitoring –Processes detail steps in each domain

21 IT Control Domains and Processes

22 What do IT auditors do? Ensure IT governance by assessing risks and monitoring controls over those risks Ensure IT governance by assessing risks and monitoring controls over those risks Works as either internal or external auditor Works as either internal or external auditor Works on many kind of audit engagements Works on many kind of audit engagements