IT Audit for non-IT auditors Cornell Dover Assistant Auditor General 31 March 2013

2 Overview Objectives of IT auditing Standards Types of audits The IT audit environment Controls IT Governance Facilities Networks Operating systems Databases Applications Computing Trends

3 Objective of IT auditing To obtain evidence to support an opinion or conclusion that IT controls are designed, implemented and operating effectively

4 Standards AICPA/CICA – Assurance Standards ISACA – IT Audit and Assurance Standards COBIT – IT Control Framework ISO27K – Information Security Management ISF – Information Security Guidelines ITIL – Service Management PMBOK – Project Management Standards PCI DSS – Data Security Standards

5 Types of audits Compliance A review of an organizations adherence to regulatory guidelines E.g. SOX, HIPAA, PCI DSS Process An examination of the effectiveness of an organizations procedures Generally done by internal audit Outcome An examination to determine if programs/projects are generating intended benefits

6 Understanding the environment Risk What is the risk of using IT? How is automation different? No paper trail No human interaction System generated transactions Errors can be pervasive Remote access to data

7 Components of the environment IT GovernanceFacilitiesNetworksOperating SystemsDatabasesApplications

8 Controls Objectives of controls To mitigate risk of organization not meeting its goals and objectives Types of controls Preventative Detective Corrective

9 Controls Areas of controls IT general controls Environmental Financial Operational

10 Controls Examples of controls All users must be authenticated All changes must be approved and verified

11 IT Governance Where most organizations have problems Should be included in overall business goals and objectives Risk management Strategic planning Inventory of IT resources Classification of data Proper policies and procedures

12 Facilities Used to house computer systems, associated components, e.g.: Telecommunications Storage systems

13 Facilities Generally includes: Redundant/backup power supplies Redundant data communications connections Environmental controls (e.g. air conditioning, fire suppression) Security devices

14 Facilities Purpose: Central processing area Restrict access to computing resources Protect computing resources

15 Facilities Risks: Loss of processing due to damage Unauthorized access to computer systems and devices

17 Facilities Controls: Authentication Logging of user access Environmental control systems

18 Networks Allow communication between users, resources, etc. Consists of an intricate design of hardware and wires Hubs, switches, routers, etc.

19 Networks Purpose: Share information and resources Internal communications Distributed computing power Ease of administration Data protection and redundancy

20 Networks Risks: Do the right users have access to the right information and resources? Potential for unauthorized access Potential for unauthorized disclosure

21 Networks Controls: Authentication (preventive) Firewalls (preventive) Proper configuration of devices, e.g. port blocking (preventive) Intrusion detection systems (detective) Logging and monitoring (detective, corrective)

22 Operating systems Software that manages computer hardware resources and provides common services for programs and applications Vital component of the processing system

23 Operating systems Purpose: Memory management User interaction Components communication File management Securing files

24 Operating systems Risks: Unauthorized access to system functions Malware Inappropriate use of resources Damage to files Loss of system resources

25 Operating systems Controls: Authentication Operating systems policies Logging and monitoring Change management

26 Databases An organized collection of records having a standard format designed for efficient retrieval of information, e.g.: Access SQL Oracle Most common type is a relational database

27 Databases Purpose: Organize Store Retrieve information

28 Databases Risks: Do the right users have access to the right information? Unauthorized access to records Information is not accurate Information is missing

29 Databases Controls: Database management system Authentication Integrity controls Accuracy Completeness Uniqueness Logging and monitoring Backups

30 Applications Program or group of programs designed for end users Range from accounting to web apps Sits on top of the operating system Utilizes networks and databases

31 Applications Purpose: Provide a user interface to perform a specific task

32 Applications Risks: Unauthorized access to the application Unauthorized access to specific functions Collection of inaccurate information Inaccurate processing of information Omission of key information

33 Applications Controls: Authentication Change management Software updates Logging and monitoring Backups

34 Computing trends Web applications Mobile computing Cloud computing Bring your own device

35 Questions and contact Auditor General of British Columbia 8 Bastion Square, Victoria, BC V8V 1X