1. Updating ISSAI 5310 - Project Proposal SAI India Comptroller and Auditor General of India1

2. Background ISSAI 5310- Information Systems Security Audit – only ISSAI in 5300 series of ISSAIs on IT Audit Adopted in October 1995; due for review in 2013 Comptroller and Auditor General of India2

3. Findings of Preliminary Review Generational changes in the field of Information Technology – Technological e.g. Internet, computing capabilities, user interfaces, frameworks (ISO 27000, etc.) – Maturity of users and also auditors! – Spread (large no of interconnected databases linked through networks; users) – Service Potential (large no. of Information Systems providing services to citizens) Existing ISSAI focuses more on management aspects of security of Information Systems Above add to the vulnerabilities of Information Systems, particularly in the public sector Comptroller and Auditor General of India3

4. Proposal Updating ISSAI 5310 on priority basis Focus Areas – Desirable to have clear and distinct audit orientation to audit of Information Systems’ Security bringing out compliance and substantive audit issues – Focus on audit methodology with references to CoBIT, etc. for standardisation – Provision for development of next level of ISSAIs dealing with specific issues concerning Information Systems’ Security Audit – Updating list of threats and countermeasures in light of new developments in the field – Outlining the audit process Comptroller and Auditor General of India4

5. Proposal Steps suggested – Identify Review Team – Identify modifications to be carried out SAI India has prepared a Draft ISSAI which can be considered by the Review Team for the purpose – Update ISSAI 5310 as per the Due Process Comptroller and Auditor General of India5

6. Timelines Stage-1: The Project Proposal – The project proposal is proposed to be approved by the KSC Steering Committee by 10th May 2013. Stage-2: The Exposure Draft – The project group would prepare the exposure draft of the ISSAI-5310 by 30th June 2013 and thereafter, the exposure draft would be open for comments for 90 days i.e. up to 30th September 2013. Stage-3: The endorsement version – The draft ISSAI would be approved in the 64th Governing Board meeting to be held on 21st October 2013 for endorsement to XXI INCOSAI. Stage-4: Final ISSAI – The ISSAI would be approved by XXI INCOSAI to be held from 22-27 October 2013 and available for the entire INTOSAI community. Comptroller and Auditor General of India6

7. THANKS Comptroller and Auditor General of India7