We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byDevin Madden
Modified over 3 years ago
Ashutosh Pednekar, FCA, CISA, ISA (ICA), LLB (Gen), B.Com. Partner, M P Chitale & Co. November 6, 2007 IRDA – ICAI Round Table Meeting on Insurance Industry IS Audit & IT systems in Insurance Industry
© Ashutosh Pednekar, M.P.Chitale & Co. 2 Acknowledgements Material published by Information Systems Audit & Control Association (ISACA) – the leading association of professionals in Information Systems (IS) Audit, Control, Security & Governance Thoughts of Mr.Samir Shah, CFO, HDFC General Insurance Co. Ltd. & Ms.Anagha Thatte, Partner, M P Chitale & Co.
© Ashutosh Pednekar, M.P.Chitale & Co. 3 Disclaimers No representation or warranties are made by the ISACA with regard to this presentation by Ashutosh Pednekar. ISACA has no responsibility for its contents. These are my personal views and can not be construed to be the views of M/s. M. P. Chitale & Co., Chartered Accountants or IRDA or ICAI. These views do not and shall not be considered as professional advice. This presentation should not be reproduced in part or in whole, in any manner or form, without my written permission.
© Ashutosh Pednekar, M.P.Chitale & Co. 4 IT systems in Insurance Industry Need to cater to two broad segments Policy Management Premium / Commission / Claims / Opex Fund (Investment) Management Needs of the industry Flexibility & scalability to handle complexities of existing & new products various delivery channels Regulatory compliances and its reportings Integration capabilities between multiple systems Robustness a labour intensive industry with wide geographical spread Availability
© Ashutosh Pednekar, M.P.Chitale & Co. 5 Growing Complexities & Pressures are Increasing Risks... Increased Operationa l Risk Market Convention Regulatory Demands Increased Transaction Volumes Complex Instruments and Strategies Increasing HR Complexities Reliance on Technology & Information Systems
© Ashutosh Pednekar, M.P.Chitale & Co. 6 Business Process & Information Assets These two are inextricably linked. Each Business Process leads to Creation of Information at every stage Storing it Updating on real-time basis Using it Protecting from misuse – intentional or otherwise
© Ashutosh Pednekar, M.P.Chitale & Co. 7 = Data and information embedded/stored in Data Information and IT Resource Management Enterprise-wide Information Assets Knowledge Management (Digitizing Knowledge) Knowledge Management (Digitizing Knowledge) ComputersPeople
© Ashutosh Pednekar, M.P.Chitale & Co. 8 IS Risk Management Objective : likelihood intensity Minimizing likelihood (frequency) and intensity (business impact) of loss of : confidentiality C integrity I availability A of information. CIA …. the CIA Principle
© Ashutosh Pednekar, M.P.Chitale & Co. 9 CIA - Vulnerabilities & Exposures Confidentiality Information Manipulating processes Competitors Integrity Availability HackersSystems Bugs Acts of God Users Human errors
© Ashutosh Pednekar, M.P.Chitale & Co. 10 IS Audit Initial Steps Assess reliance placed by the Management on the system efficacy & the reliance placed by them on IT systems to take managerial decisions take operating level decisions conduct operations Get a feel of the IS Risk as perceived by the Top Management
© Ashutosh Pednekar, M.P.Chitale & Co. 11 IS Risk Mitigation : Building Blocks Building Blocks Business Process Reengineering Management, Planning & Organization of IS Business Application Systems & Controls Systems Development Life Cycle Disaster Recovery & Business Continuity Protection of Information Assets Technical Infrastructure & Operational Practices
© Ashutosh Pednekar, M.P.Chitale & Co. 12 IS Audit Areas Compliance with IS Security Policy & Procedures Includes an assessment of the understanding of the policy & procedure requirements across the organization Hardware Monitoring Sizing Upgradations
© Ashutosh Pednekar, M.P.Chitale & Co. 13 IS Audit Areas… Software – core as well as end-user applications Licensing Version Control Upgradations Patch implementation
© Ashutosh Pednekar, M.P.Chitale & Co. 14 IS Audit Areas… Logical Controls Need to do basis Controls have to be for data as well as programs Authorization protocols Conflict of interest, if any to be identified Physical Controls Network management
© Ashutosh Pednekar, M.P.Chitale & Co. 15 IS Audit Areas… Operations Management Within data center At Ops level At corporate level At branches & outlets With field staff Controls over outsourced agencies have to be equally stringent, if not more Focus on vulnerabilities at the agency level Adequacy of SLAs BCP / DRP
© Ashutosh Pednekar, M.P.Chitale & Co. 16 IS Audit Methodology is achieved by Key Controls by focusing on Summary of IT Goals that satisfies the Business Requirements for IT Control over the IT Processes is measured by Key Metrics C OBI T ® Technique
© Ashutosh Pednekar, M.P.Chitale & Co. 17 IS Audit value adds Vetting the IS Policy & Procedures for their adequacy Functionality Reviews Pre Implementation Reviews Post Implementation Reviews Source Code Audit Ethical Hacking / Penetration Testing
© Ashutosh Pednekar, M.P.Chitale & Co. 18 Thank you : email@example.com
0 May 2013 Internal Control–Integrated Framework.
HIPAA Security Presentation to The American Hospital Association Dianne Faup Office of HIPAA Standards November 5, 2003.
Systems Security Engineering An Updated Paradigm INCOSE Enchantment Chapter November 8, 2006 John W. Wirsbinski.
Bank Audit. Internal Audit Internal audit is an independent, objective assurance activity and can give valuable insight in providing assurance that major.
© Prentice-Hall of India Private Limited, All rights reserved.1 Financial Accounting: A Managerial Perspective Second Edition Prepared by R. Narayanaswamy.
Win Phillips, Ph.D Win Phillips, Ph.D. Clinical Assistant Professor University of Missouri Columbia, MO.
REVENUE IMPACT OF OPTIMIZED NETWORKS Egbert Clarke Vice President International Business.
The New Regulatory Policy Landscape Dr Dianne Orr Australian Skills Quality Authority.
Copyright © 2006 CyberRAVE LLC. All rights reserved. 1 Virtual Private Network Service Grid A Fixed-to-Mobile Secure Communications Framework Managed Security.
IT Web Application Audit Principles Presented by: James Ritchie, CISA, CISSP….
1 Chapter Three IT Risks and Controls. 2 Lecture Outline Identifying IT Risks Identifying IT Risks Assessing IT Risks Assessing IT Risks Identifying IT.
Looking beyond the obvious!! HOW SECURE IS BANKS’ CORE DATA? Prashant Pande Head Professional Services IDBI Intech Ltd.
Copyright 2007 EcoSys Management LLC All Rights Reserved. Confidential and Proprietary Information. 1 Integrating Financial Management with Project Management.
1 Dr. Ashraf El-Farghly SECC. 2 Level 3 focus on the organization - Best practices are gathered across the organization. - Processes are tailored depending.
1 Chapter Nine Conducting the IT Audit Lecture Outline Audit Standards IT Audit Life Cycle Four Main Types of IT Audits Using COBIT to Perform an Audit.
© May not be reproduced without permission of Financial Ombudsman Service Ltd 1 what is “information risk” and what should we be doing about it? Christina.
Code of Conduct for Mobile Money Providers 6 November 2014 All material © GSMA The policy advocacy and regulatory work of the GSMA Mobile Money team.
1 Texas Association of State Systems for Computing and Communications August 10, 2011 Employee Benefits Today and Tomorrow.
PRESENTATION ON MONDAY 7 TH AUGUST, 2006 BY SUDHIR VARMA FCA; CIA(USA) FOR THE INSTITUTE OF INTERNAL AUDITORS – INDIA, DELHI CHAPTER.
EMS Checklist (ISO model) EPA Regions 9 & 10 and The Federal Network for Sustainability 2005.
ETHICAL HACKING A LICENCE TO HACK
Centre of Excellence The Housing Authority Network HUB National Policy Forum on Housing and Water Sheraton Centre Hotel – Toronto, Ontario February 6-8,
System Testing 2 Effective March 3, 2014, new requirements for system testing were implemented State Agencies are now required to provide to FNS:
AUDIT COMMITTEE FORUM TM ACF Roundtable IT Governance – what does it mean to you as an audit committee member July 2010 The AUDIT COMMITTEE FORUM TM is.
© 2009 IDBI Intech, Inc. All rights reserved.IDBI Intech Confidential 1 Information (Data) Security & Risk Mitigation.
Network Security Policy Anna Nash MBA 737. Agenda Overview Goals Components Success Factors Common Barriers Importance Questions.
Outsourcing Policy & Procedures An Overview for Staff Prepared by MSM Compliance Services Pty Ltd.
Features Governmental organization Critically important ICT objects Distributed infrastructure Three levels of confidentiality Dozens of subsidiary organizations.
ISO17799 Maturity. Confidentiality Confidentiality relates to the protection of sensitive data from unauthorized use and distribution. Examples include:
David N. Wozei Systems Administrator, IT Auditor.
Internal Audit Agency Integrity + Professionalism INTERNAL AUDIT AGENCY ISACA Presentation 15 July, 2013 Alisa Hotel, ACCRA.
Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 1 Security Architecture.
New Products for © 2009 ANGEL Learning, Inc. Proprietary and Confidential, 2 Update Summary Enrich teaching and learning Meet accountability needs.
IT Service Delivery And Support Week Eleven – Auditing Application Control IT Auditing and Cyber Security Spring 2014 Instructor: Liang Yao (MBA MS CIA.
SEC835 Database and Web application security Information Security Architecture.
A © 2001 Arthur Andersen. All rights reserved. The Accountants Role in the New Economy Robert A. Johnson February 5, 2001.
Citrix Solutions in Financial Services Joseph Alexander Delgado Business Development Manager, Citrix Wordtext Systems, Inc.
© UNCTAD ASYCUDA Overview … a summary of the objectives of ASYCUDA implementation projects and features of the software for the Customs computer.
Auditing Governance Functions. Page 2 Agenda ► Defining Corporate Governance ► Internal Audit’s Role in Corporate Governance ► Areas of Audit Focus ►
Database Security Security Architecture. 2 Objectives Define security Describe an information system and its components Define database management system.
ES Sales Learning & Performance Processing Options.
The relationship between HEIs and suppliers of content how does e-commerce change the game? Mark Bide Mark Bide & Associates Assistant Technical Co-ordinator,
Measuring the effectiveness of government IT systems Current ANAO initiatives to enhance IT Audit integration and support in delivering Audit outcomes.
©2008 Prentice Hall Business Publishing, Auditing 12/e, Arens/Beasley/Elder The Impact of Information Technology on the Audit Process Chapter 12.
Mid-market server campaign – thru partner presentation: Slide for presenter only: do not show Speaker: Partner Title of Presentation: Giving you the power.
Effective Contract Management Planning For Performance-Based Contracting.
© 2017 SlidePlayer.com Inc. All rights reserved.