Presentation on theme: "Alignment of COBIT to Botswana IT Audit Methodology"— Presentation transcript:
1Alignment of COBIT to Botswana IT Audit Methodology
2Why COBITGives a holistically view of the IT computing environment, starting with management issues to operational issues.Its practical and addresses key IT issuesThe COBIT IT assurance guide provides a clear road map from planning of the audit up to field work execution.
3COBIT IT Assurance Guide The guide is linked to COBIT processes outlining the control objectives, value drivers for the process, risk drivers and tests of controls to be performed by an assurance professional.
4Using IT Assurance Guide For Example for PO 1.2 Business-IT AlignmentTest of Controls questions as suggested by IT Assurance guide;Confirm that the process for communicating business opportunities with IT management is reviewed and the importance of the process is communicated to the business and IT. Consider the update frequency of those processes.
5COBIT IT Assurance Guide Enquire whether and confirm through interviews with the members of the IT management that they helped define enterprise goals. Ask them about their accountability for achieving enterprise goals, determine if they undertook what if analyses and confirm their commitment goals.
6COBIT IT Assurance Guide Enquire with the business management and IT management to identify business processes that are dependent of IT. Consider whether the business and IT share the same view of the systems including their criticality, usage and reporting.
7COBIT IT Assurance Guide Using the guide and with the understanding of your client environment you can now tailor make audit questions for your audit controls.The following is the standard questions that Botswana uses for our clients
8IT Strategy Alignment Questions Extracted from The IT Audit Manual BotswanaIs there a strategic IT plan for the organization based on business needs?Is there a steering committee with well-defined roles and responsibilities?Does the IT department have clear-cut and well defined goals and targets?Is there a system of reporting to top management and review in vogue?
9IT Strategy Alignment Questions Does management provide appropriate direction on end user computing?Are there procedures to update strategic IT plan?
10Type of IT Audits IT Performance Audits Focuses on ensuring that IT systems are procured and implemented effectively, efficiently and economically. These audits were carried out in the years 2008 to Three projects have been successfully complemented namely;
11Type of IT Audits Financial IT Audits Carried out to ascertain that there are sufficient controls within the systems and applications so that financial auditors can place reliance on information processed through the applications.
12Review of the Department of Tertiary Education project General ObjectivesTo assess whether Student Loans Management System assists the DSPW to achieve its mandate.Specific ObjectivesTo assess if the system assists the users in performing their tasks effectively.To assess whether the project scope included all aspects of the department, including identification of stakeholders and key players.
13Review of the Department of Tertiary Education project Specific Objectives continuedTo assess how data integrity is maintained and indentify business continuity measures in place.To identify how the system’s performance is managed and measured.To assess whether was training carried out to assist users to use the system efficiently.
14COBIT areas selected and mapped to the audit questions Is the system assisting the department perform its activities more effectively?PO1.1 IT Value ManagementPO1.2 Business-IT AlignmentPO1.3 Assessment of Current Capability and PerformancePO10 Manage Projects
15COBIT areas selected and mapped to the audit questions Was the project scope comprehensive enough with regards to stakeholder’s identification?AI1 Identify Automated SolutionsAI1.1 Definition and Maintenance of Business Functional and Technical Requirements.AI2 Acquire and Maintain Application Software
16COBIT areas selected and mapped to the audit questions How is data integrity and disaster recovery addressed?DS5 Ensure Systems SecurityDS11 Manage DataDS11.5 Backup and Restoration
17Analysis of recommendation, Value added Management was advised that reports produced by system should be appropriate and relevant to strategic decision making process. The recommendation emphasised that the use of the system should not only be focusing on processing loans but management should be in a position to gather enough information from the system to make strategic decisions. COBIT P0.1.1 IT value management and IT business alignment emphasise on the need for IT resources to be aligned to business strategies.
18Analysis of recommendation, Value added Management was further advised to conform to Government IT Projects Guidelines and requirements. The government of Botswana has established IT project guidelines which guides IT officers on how to manage a project including documentation of user requirements, project initiation report, project memorandum and project end reports. The IT Projects guidelines are aligned to COBIT.
19Analysis of recommendation, Value added The use of and understanding of COBIT has significantly improved our audit methodology. Recommendation provided to clients are based on best standard and therefore if implemented will greatly improve on IT processes. Benchmarking on a recognized framework also gives assurance to the client that the criterion being used is fair.
20Analysis of recommendation, Value added What is important in providing recommendation to the client is having an understanding of the environment in which they work within and its limitations. This can be achieved through discussion of finding with the clients, identification of mitigating controls and finding a cost effective recommendation.
21COBIT 5COBIT 5 which was release early in 2012 aim is to align COBIT to other frameworks such as Val IT, ITIL, ISO and Prince 2.COBIT 5 clearly defines governance and management and separates the duties of two roles.COBIT 5 introduces 5 principles and 7 enablersThe concept of goal cascade from stakeholder needs to operation duties is emphasized. (Considering IT related interests of internal and external shareholders)
22COBIT 5 The control objectives are no longer explicitly defined. The framework processes have increased from 34 to 37. The new processes included areAPO 04Manage InnovationAPO 10Manage SuppliesBAI 06Manage Knowledge