Institute of Internal Auditors COBIT Presentation October 9, 2001

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 2 Confidential and Proprietary - Internal Audit Consulting Group Use Only For More Information on COBIT Phone Websites

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 3 Confidential and Proprietary - Internal Audit Consulting Group Use Only Cost ISACA Member$115 Non-Member$225

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 4 Confidential and Proprietary - Internal Audit Consulting Group Use Only Background C ontrol OB jectives for I nformation and related T echnology –Originally released in 1996 by the Information Systems Audit and Control Foundation (ISACF) –Current primary publisher is the IT Governance Institute - formed by the Information Systems Audit and Control Association (ISACA) in 1998 –COBIT was formed through research of sources such as the technical standards from ISO, codes of conduct issued by the Council of Europe and ISACA, professional standards for internal control and auditing issued by COSO, AICPA, GAO, etc. –The above sources were used to formulate COBIT to “be both pragmatic and responsive to business needs while being independent of the technical IT platforms adopted in an organization.”

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 5 Confidential and Proprietary - Internal Audit Consulting Group Use Only The COBIT Mission To research, develop, publicize and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to- day use by business managers and auditors

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 6 Confidential and Proprietary - Internal Audit Consulting Group Use Only Objectives of COBIT To provide a framework to bridge gaps between business risks, control needs and technical issues in order to maximize benefits, capitalize on opportunities and gain competitive advantage

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 7 Confidential and Proprietary - Internal Audit Consulting Group Use Only Components Executive Summary Framework Control Objectives Audit Guidelines Management Guidelines

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 8 Confidential and Proprietary - Internal Audit Consulting Group Use Only Executive Summary Provides a synopsis of COBIT’s objectives and processes

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 9 Confidential and Proprietary - Internal Audit Consulting Group Use Only Framework A tool to be used as a comprehensive guidance for users, auditors, management & business process owners

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 10 Confidential and Proprietary - Internal Audit Consulting Group Use Only Control Objectives Generically defined high-level business needs organized by process/activity used to facilitate the implementation of a process

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 11 Confidential and Proprietary - Internal Audit Consulting Group Use Only Audit Guidelines A template used to facilitate the obtaining, evaluating, assessing and substantiating of of information needed to evaluate overall control

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 12 Confidential and Proprietary - Internal Audit Consulting Group Use Only Management Guidelines Set of action oriented guidelines developed to assist management in answering: –Does the benefit outweigh the cost? –What are the indicators of good performance? –What are the critical success factors? –What are the risks of not achieving our objectives? –What do others do? –How do we measure and compare?

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 13 Confidential and Proprietary - Internal Audit Consulting Group Use Only COBIT Family of Products

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 14 Confidential and Proprietary - Internal Audit Consulting Group Use Only Framework (see handout) 4 Domains –Planning & Organization –Acquisition & Implementation –Delivery & Support –Monitoring 34 Control Objectives 318 Detailed Control Objectives

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 15 Confidential and Proprietary - Internal Audit Consulting Group Use Only

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 16 Confidential and Proprietary - Internal Audit Consulting Group Use Only Audit Guidelines 4Obtain Understanding –Interviewing –Obtaining 4Evaluate Controls –Considering 4Assess Compliance –Testing 4Substantiate Risk –Performing –Identifying

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 17 Confidential and Proprietary - Internal Audit Consulting Group Use Only Management Guidelines Ô Critical Success Factors Ô Key Goal Indicators Ô Key Performance Indicators Ô Maturity Model

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 18 Confidential and Proprietary - Internal Audit Consulting Group Use Only Example SManage Changes

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 19 Confidential and Proprietary - Internal Audit Consulting Group Use Only Domain 4Acquisition & Implementation

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 20 Confidential and Proprietary - Internal Audit Consulting Group Use Only Control Objective 4AI6

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 21 Confidential and Proprietary - Internal Audit Consulting Group Use Only Detailed Control Objectives ÜChange Request Initiation and Control ÜImpact Assessment ÜControl of Changes ÜEmergency Changes ÜDocumentation and Procedures ÜAuthorized Maintenance ÜSoftware Release Policy ÜDistribution of Software

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 22 Confidential and Proprietary - Internal Audit Consulting Group Use Only Audit Guidelines 4Obtain Understanding –Interviewing –Obtaining 4Evaluate Controls –Considering 4Assess Compliance –Testing 4Substantiate Risk –Performing –Identifying

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 23 Confidential and Proprietary - Internal Audit Consulting Group Use Only Management Guidelines  Non-existent  Initial/Ad Hoc 2Repeatable but Intuitive  Defined Process  Managed & Measurable  Optimized

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 24 Confidential and Proprietary - Internal Audit Consulting Group Use Only Findings t Issues t Benchmarking

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 25 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 26 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 27 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 28 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 29 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 30 Confidential and Proprietary - Internal Audit Consulting Group Use Only Adopting COBIT Tool Set

Internal Audit Consulting Group Assurance and Consulting on Business Risk Management, Controls, and Governance9/26/01 31 Confidential and Proprietary - Internal Audit Consulting Group Use Only COBIT Case Studies Cedel Group Office of the State Auditor of Massachusetts PWC Fidelity Investments Department of Defense Boston Gas Company Santa Barbara Bank and Trust Society for Worldwide Interbank Financial Telecommunication