1. CHARTERED ACCOUNTANTS
IS AUDIT
DR. MITIL CHOKSHI
CHOKSHI & CHOKSHI
CHARTERED ACCOUNTANTS

2. Contents Introduction Guidelines Need for controls
Internal Control Framework
Security Threats
Information Systems Risks
IS Audit Process

3. Introduction
“The process of collecting and evaluating evidence to determine whether:
Computer system safeguards assets
Maintains data integrity, confidentiality and availability
Allows organizational goals to be achieved
Determines the efficient use of resources”
Gain understanding of the organisation
Understand Risks and evaluate Controls
Test Controls

5. Guidelines ISACA Guidelines IS Auditing Standards
IS Auditing Guidelines
IS Auditing Procedures
COBIT (Control objectives for information and related technology)
ISO 27001
Guidelines by Institute of Internal Auditors

6. Guidelines COSO’s Internal Control – Integrated Framework
(the COSO Framework) published by the Committee of Sponsoring Organisations of the Treadway Commission
COCO (Criteria of Control) Framework published by the Canadian Institute of Chartered Accountants

7. COSO Framework
Monitoring Applied to the Internal Control Process

8. Need for Controls The Organization must protect itself from:
Corruption of Data and Database.
Poor decision making due to poor quality of MIS.
Losses due to abuse of controls.
Loss of hardware, software and personnel.
Maintenance of Privacy .
Malicious Internet Content.
Authentication and Privilege attacks

10. Security Threats Attacks on physical systems USB devices
Removable media
Internal attack
Network monitoring
Laptop theft
Storage theft
Hardware loss
Unprotected Endpoints
Insecure network points
Insecure server rooms
Attacks on physical systems

11. Security Threats Authentication and Privilege Attacks
Disgruntled Employees
Password
High Privileged Accounts
Privilege Creep
Authentication and Privilege Attacks
Inappropriate Password Policies
Weak Passwords

12. Single Point of failure Excess reliance on one person
Security Threats
Denial of Service
Natural Disasters
Targeted DOS
Single Point of failure
Power cuts
Connection downtime
Bandwidth Exhaustion
Vulnerable Servers
Excess reliance on one person
Lack of documentation

13. Malicious Internet Content Web Application Attacks
Security Threats
Malicious Internet Content
Social Engineering
Phishing
Drive – by downloads
Malware
Web Application Attacks
Viruses
Trojans
Worms

14. Security Threats
Example: Phishing

15. Example: Drive-by downloads
Security Threats
Example: Drive-by downloads
Unintended Software

16. Security Threats
Example: Virus Scan

17. Security Threats
Example: Trojan Horse

18. Security Threats
Example: Spoofing

19. Security Threats
Example: Spoofing

21. Risk of unauthorized change to application software
Relationship Between General and Application Controls
Cash receipts
application
controls
Sales
Payroll
Other cycle
GENERAL CONTROLS
Risk of unauthorized change
to application software
Risk of system crash
Risk of unauthorized
master file update
processing

22. Information Systems Risks
Access controls :
Non-detection of Compromised passwords. 
Unauthorized users can access systems.
Inappropriate access allowing recognised users greater access than necessary. 
Unauthorized changes to data in master files.
Unauthorized changes to systems or programs. 
Denial to access systems, DBMS’s and servers in the event of a system interruption or disaster.

23. Information Systems Risks
Controls to Mitigate Risks arising from unauthorized Accesses :
Authentication (identification) controls need to be strong.
Roles and privileges should be granted on need-to-know basis only to authorized users.
Job scheduling procedures and stored procedures need to be secure.
An alternate method to identify and register users needs to be tested and made available when needed.

24. Information Systems Risks
Input Controls
Unauthorized data received for computer processing. 
Loss of data or duplication of data.
Automated segregation of duties and access rights.
Automated authorization approval
Incorrect output due to wrong input (GIGO)

25. Information Systems Risks
Mitigating Risks arising from Input Controls:
Review access rights that set and amend configurable approval and authorization limits.
Accesses with super user rights.
Maker Checker Controls
Range check
Completeness check
Duplicate check

26. Information Systems Risks
Process Controls
Wrong Validation of data
Risks arising out of Editing Procedures
Incorrect processing of data
Absence of Data File Control Procedures

27. Information Systems Risks
Mitigating Risks arising from Process Controls:
Parity checking
Transaction logs
Version Usage
File updating and maintenance authorization
Sequence check
Reasonableness check
Table lookups
Existence check
Key verification
Logical Relationship check
Limit check

28. Information Systems Risks
Output Controls
Non-integrity of output
Untimely distribution of output
Availability of output to unauthorized users
Data processing results are unreliable

29. Checklist for mitigating Risk
Information Systems Risks
Mitigating Risks arising from Output Controls:
Checklist for mitigating Risk

31. Statistics

32. Issues Involved

34. Preliminary Steps
Understanding of the Organisational Structure to identify CIO, CISO, etc.
Understanding of the System Architecture.
Understanding components of the systems (number of servers, routers, users, desk users, on/offsite users)
Reviewing the IS Security Policy
Performing systems walk - throughs.
Assessment of the risks and understanding of the related controls.

35. IS Audit Process

37. Procedures Interviews.
Interviews are a useful audit tool to gather information about internal system controls and risks.
Employees involved in the day - to - day operations of a functional area possess the best knowledge of that area.
They are in a position to identify the weak internal system controls and risks.

38. Procedures Preparation of Checklist & Questionnaire
A detailed checklist should be prepared after having an understanding of the architecture of the system.
Checklist should be comprehensive.

40. Access Controls testing-
Procedures
Verifying access rights allotted vis-à-vis organizational policy for need to know
Implementation of Password controls
Process of review of logs of super users, database administrator
Logs of active users vis-à-vis HR records for exit, leave, etc.
License control processes
Virus control procedures

41. Access controls testing- Procedures
Vulnerability testing through internal resources
Internal Security Vulnerability Assessment (ISVA) is a comprehensive analysis of all of the workstations and servers on your network.
The ISVA detects and identifies Trojan horses, hacker tools, DDoS (Distributed Denial-of-Service) agents, and spyware through code analysis and signature matching, in much the same way as anti-virus.
It also identifies specific vulnerabilities such as configuration problems in FTP servers, exploits in Microsoft IIS or problems in NT security policy configuration.

42. Access controls testing- Procedures
Vulnerability testing through external resources
One of the most common vulnerability assessment activities for companies of all sizes is an external penetration testing scan, typically targeting internet-facing websites.
Once you set yourself outside of the company, you immediately are given an untrusted status. The systems and resources available to you externally are usually very limited.

43. VIDEO CLIP

44. Input Controls -Procedures
Verification by entering invalid data
Verification by entering incomplete data
Testing Arithmetic Accuracy

45. Integrated Test Facility (ITF) Approach
Processing Controls -Procedures
Integrated Test Facility (ITF) Approach
Parallel Simulation

46. Integrated Test Facility (ITF) Approach
Processing Controls -Procedures
Integrated Test Facility (ITF) Approach
A dummy ITF center is created for the auditors.
Creation of transactions to test the controls.
Creation of Working papers showing expected results from manually processed information.
Running of Auditor transactions with actual transactions.
Comparing of ITF results to working papers.

47. Processing Controls -Procedures
Parallel Simulation
Processing of real client data on an audit program similar to the client’s program.
Comparison of results of processing with the results of the processing done by the client’s program.

48. Parallel Simulation- Flowchart
Processing Controls -Procedures
Parallel Simulation- Flowchart
Computer Operations
Auditors
Actual
Transactions
Computer
Application
System
Auditor’s
Simulation
Program
Actual Client
Report
Auditor
Auditor Compares

50. Application Controls -Procedures
Black Box Testing
Black box testing
Method of software testing 
Examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings.
Can be applied to virtually every level of software testing: unit, integration, system and acceptance.
Typically comprises most if not all higher level testing, but can also dominate unit testing as well.

51. Application Controls -Procedures
White Box Testing
White-box testing 
Also known as clear box testing, glass box testing, transparent box testing, and structural testing.
Method of testing software that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing).
Internal perspective of the system, as well as programming skills, are used to design test cases.
The tester chooses inputs to exercise paths through the code and determine the appropriate outputs. 

52. Output Controls -Procedures
Checking whether output contain key control information necessary to validate the accuracy and completeness of the information contained in the report such as last document reference period, etc.?
If the data has to be transferred from one process to another process, verify if no manual intervention is possible and no unauthorized modification to data can be made.
Verify physical controls over hardcopy printouts.

54. Format of IS Audit Report