1. Session 11 Other Assurance Services
Sys Trust
Payment Card Industry security standard compliance
EECS David Chan 1

2. SysTrust
A system assurance service developed by American Institute of Certified Public Accountants (AICPA) and Chartered Professional Accountants Canada (CPA Canada).
Audits have been on new systems in an organization or systems shared by a number of partner organizations
High control assurance
EECS David Chan

3. SysTrust Principles
The Availability Principle addresses accessibility to the defined system, products, or services as advertised or committed by contract, service-level, or other agreements.
The Security Principle requires an entity to meet high standards for the protection of the system components from unauthorized access, both logical and physical.
EECS David Chan

4. Main Trust Principles
Processing Integrity Principle requires an entity to meet high standards for the completeness, accuracy, timeliness, and authorization of system processing including the processing of electronic commerce transactions.
All three principles must be satisfied.
EECS David Chan

5. Optional Trust Principles
Confidentiality – no unauthorized viewing
Privacy – confidentiality of personal info
EECS David Chan

6. Sys Trust Audit
The auditor has to be licensed by AICPA or CPA Canada specifically for SysTrust engagements.
The outcome of the audit consists of a report and an unqualified opinion on the internal controls to support the system.
High control assurance.
EECS David Chan

7. Control Criteria
Operating organization of the system selects criteria (objectives) from the list provided by CPA Canada or AICPA to satisfy each main principle and each selected optional principle. Unless a criterion does not apply to the environment, it must be selected. There is no wording change to criteria.
Each control criterion is supported by control activities (procedures), which can be manual or automated, developed by management.
EECS David Chan

8. Difference Between SysTrust and CSAE 3416
Each stated criterion in the report must be met by controls in order to get an unqualified SysTrust report.
CSAE 3416 report has restricted distribution.
Sys Trust addresses system reliability, whereas CSAE 3416 addresses financial statement assertions.
CSAE 3416 is more flexible, as it uses control objectives instead of principles prescribed by CPA Canada and AICPA.
EECS David Chan

9. SysTrust Users Hosting organization User organizations
Trading partners, e.g., automated vendor inventory replenishment
Financial statement auditors
EECS David Chan

10. SysTrust Report An opinion on management’s asserted controls.
Opinion does not cover system description, although system description is often included in the report. But if the auditor knows that system description is misleading, s/he should not issue an opinion on the controls.
Opinion covers the reporting period of not more than one year.
EECS David Chan

11. Drivers for SysTrust Audit
The potential conflict of interest between the system operator and system user or owner.
The complexity of systems, requiring expertise to conduct an audit that would provide a reasonable degree of assurance about their conformity with system reliability principles and criteria.
EECS David Chan

12. Drivers for SysTrust Audit
The remoteness of users from systems requiring an independent objective representative to observe the system on their behalf.
The consequences of system unreliability.
The four conditions above may contribute individually to the need for assurance services related to the reliability of an entity’s key information system(s) and they may also interact to increase the need for such assurance.
EECS David Chan

13. Process of a Sys Trust Audit
System hosting organization decides to pursue a Sys Trust audit.
System hosting organization hires an accounting firm.
System hosting organization selects optional principles as well as criteria for the mandatory and optional principles.
Management develops control activities for each criterion.
EECS David Chan

14. Process of a Sys Trust Audit
Accounting firm assesses the adequacy of control criteria and procedures.
Accounting firm conducts testing.
Accounting firm provides report to system hosting organization.
System hosting organization shares report with user organizations.
EECS David Chan

15. Options to Address Control Deficiency
Fix the control if there is still time.
Replace the control with another existing control.
Remove an optional principle.
Cancel the engagement.
EECS David Chan

16. Payment Card Industry (PCI) Security Standard
Developed by the PCI Security Council formed by major card issuers: Visa, MasterCard, American Express, Diners Club, JCB International and Discover Card.
All issuing financial institutions and merchants that take credit card transactions on the Internet have to comply.
Failure to comply may lead to financial penalty.
EECS David Chan
Chan 16

17. PCI Security Standard
Visa and MasterCard require major merchants and IT service organizations (over 1 million transactions annually or over 20,000 eTransactions annually) to have an annual external validation for compliance.
EECS David Chan

18. PCI Standards
1.Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data, including encryption.
4. Encrypt transmission of cardholder data across the Internet
EECS David Chan 18

19. PCI Standards 5. Use regularly updated anti-virus software
6. Develop and maintain secure systems and applications
7. Restrict access to cardholder data by business on a need-to-know basis
8. Assign a unique ID to each person with computer access
EECS David Chan 19

20. PCI Security Standard 9. Restrict physical access to cardholder data
10. Track and monitor all access to network
resources and cardholder data
11. Regularly test security systems and
processes
12. Maintain a policy that addresses
information security
EECS David Chan 20

21. Conclusion
SysTrust engagements are increasing because of increasing use of externally hosted systems.
PCI is gaining prominence because the PCI Council (credit card companies) are now starting to enforce this standard.
EECS David Chan

22. Review Questions
Map the SysTrust principles to the control matrix we discussed in Chapter Six.
What are the management options to avoid a qualified SysTrust audit opinion when a control deficiency is identified by the auditor?
What parties can benefit from a SysTrust audit report?
EECS David Chan

23. Review Questions
4.What kinds of organizations are held to comply with the Payment Card Industry Security Standard?
5. What kinds of organizations are required to provide an annual external validation of
compliance with the PCI Security Standard?
EECS David Chan

24. Review Questions
6.According to the PCI Security Standard, what kind of access has to be monitored?
7. How does the PCI Security Standard affect the financial statement audits of large retail merchants?
8. How does the PCI Security Standard affect the profit of large retail merchants?
EECS David Chan

25. MC Question Which of the following is an optional SysTrust principle?
A. Confidentiality
B. Security
C. Processing integrity
D. Availability
EECS David Chan

26. MC Question Who is the primary audience of a SysTrust report?
A. Service organization management
B. Shareholders’ auditors of service organization
C. User organization(s) management
D. Shareholders’ auditors of user organization(s)
EECS David Chan

27. MC Question
Who is responsible for developing control procedures in a SysTrust audit?
A. External auditors
B. Service organization management
C. Internal auditors
D. User organization management
EECS David Chan

28. MC Question Which SysTrust principle addresses application controls?
A. Security
B. Confidentiality
C. Processing integrity
D. Availability
EECS David Chan

29. MC Question
What kind of access to cardholder data must be monitored by a bank?
A. All
B. Update
C. External
D. Create
EECS David Chan