1. Information Technology Controls
Presented by:
Brian Christian

2. Introduction Support business management
Provide general and technical controls over the polices, processes, systems, and people that makeup IT infrastructure
Essential for reliability

3. Structure of IT Auditing

4. Understanding Controls
General
Application
Preventive
Detective
Corrective
Governance
Management
Technical
Classified by purpose in overall system of internal controls
Classified by group responsible for ensuring implementation and maintenance

5. IT Controls Hierarchy Define aims and objectives
Define ways of working

6. Organization and Management
Segregation of duties
Initiating, authorizing, inputting, processing and checking data – Separate!
IT Environment: Systems development and operations – Separate!
Financial controls
Identify potential failings early on
Change Management

7. IT Controls Hierarchy Specific application systems Protect from damage
Generic Application Controls:
Input
Processing
Output
Integrity
Management Trail
Protect from damage
or loss
Controlled method for development
Configuration Techniques

8. Security and Importance of Controls
Information Security
Confidentiality
Integrity
Availability
Importance of IT Controls
Controlling costs and remaining competitive
Protecting against information theft
Complying with legislation (i.e. SOX)

9. Analyzing Risks Risk & Response Adequacy of Controls? Risk Mitigation
IT controls are selected and implemented based on risks they are designed to manage
Adequacy of Controls?
Risk Mitigation
Accept
Eliminate
Share
Control

10. Monitoring and Assessing Controls
Choosing a framework
Monitoring IT Controls
Ongoing
Special Reviews
Assessing Controls
Audit Methodology
Testing IT Controls and Continuous Assurance

11. Summary Multiple types of controls
General & Application
PDC Controls
Governance, Management, Technical
Continuous, reliable assurance and trail of evidence
Controlling, Protecting & Complying
Risk assessment
Monitoring is critical

12. Questions?