Technology Systems Auditing (Part 1 of 2)

Explore the concept of corporate governance and how it promotes ethical decision-making practices within an organization. Define corporate governance as the system by which business corporations are directed and controlled.

Explore how corporate governance provides strategic direction, addresses risks through governance, and ensures proper use of organizational resources.

Align board, senior management, and stakeholders through team monitoring and assurance practices to guide IT governance decisions. Establish a controls framework and management system for the stewardship of IT resources.

Apply best practices in governance to ensure information supports business objectives and maximize benefits, use data mining to price correctly, and balance risk and return from information technology changes.

Auditors play a key role in IT governance by ensuring information and technology align with enterprise business objectives, applying best practices across the organization.

Explore the IT balanced scorecard as a management evaluation technique used in IT governance. It features a three-layered structure addressing mission, IT strategies, and measurement perspectives.

Examine information security governance through the CIA triad—confidentiality, integrity, and availability—highlighting encryption services and continuity of services. Understand how cloud computing and internet access shift security boundaries.

Align information security governance with top-down board-led policies to protect information resources and enforceable rules, ensuring CIA goals guide organizational protection.

Information protection now spans the entire lifecycle, securing data in motion and at rest through encryption and governance. Highlight real-world risks to stress full protection.

Good security governance reduces civil and legal liability by ensuring policy and standards compliance. It lowers risk, optimizes security resources, and provides accountability for partnerships and acquisitions.

Senior management leads security governance and defines penalties for non-compliance. A steering committee reaches consensus on priorities and tradeoffs with a chief information security officer.

Document IT assets in a structured enterprise architecture to clarify complex technology choices, provide a 10000-foot view, and show how components interact for IT investments and roadmaps.

Explore maturity and process improvement models, starting with the ideal model, to guide enterprises in planning and implementing an effective software process improvement program using the capability maturity model integration.

Explore maturity and process improvement models, including the team Soffer process and the personal Soffer process (psp), designed to guide teams, establish goals, assess risks, and improve estimating and planning.

Explore IT investment and allocation practices, weighing financial and non-financial benefits like customer satisfaction and mission performance against opportunity costs, and avoiding wasted investments.

Explore the value framework for IT, focusing on governance, portfolio management, and investment management to guide IT investment and allocation practices.

Explore governance of value to strengthen leadership and implement processes that establish an effective governance model, monitor performance, and continuously improve value management practices while aligning with enterprise financial planning.

Explore how policies function as high-level documents that express corporate philosophy, act as blueprints, and align lower-level policies with higher-level directives across divisions.

Structure information security policy with data classification, acceptable use, end user computing, and access control policies to prevent email leaks and malware risks.

Review the information security policy at planned intervals or after changes in the environment, such as new software or mergers, to ensure adequacy and identify improvement opportunities in security department.

Identify vulnerabilities and threats to information resources, apply risk management to analyze risk, and determine countermeasures that reduce risk to an acceptable level while monitoring IT process impacts.

Identify how threats exploit vulnerabilities to create risk, and how a risk management process evaluates impact and probability to form an overall risk view, prioritizing high-risk areas.

Explore risk analysis within risk management using qualitative, semi-quantitative, and quantitative methods to inform decisions.

Discover how quantitative risk analysis uses numeric values from historic records and industry data to assess likelihood and impact, enabling cost-benefit evaluation of safeguards and controls.

Explore information systems management practices aligned with implementation policies and procedures, covering personnel management, sourcing from internal and external sources, and IT change management.

Explore human resource management policies and procedures that govern hiring, training, evaluating employees, promoting staff, and disciplinary actions. Align these practices with organizational procedures to address personnel issues effectively.

Examine how human resource policies, from employee handbooks and fair promotions to training, scheduling, time reporting, vacations, and termination procedures, strengthen fraud detection and risk management.

Explore human resource management considerations for global or multi-state organizations, weighing outsourcing, regulatory and tax issues, continuity of operations, telecommunication and cross-border challenges, staffing, and customer satisfaction.

Ensure service level agreement requires a third-party audit and results are accessible to your auditor; assess the audit’s expertise and process, and allow periodic reviews by the user’s auditor.

Organizational change management uses defined and documented processes to identify and implement technology improvements, emphasizing proactive communication, training, and stakeholder understanding to prevent resistance.

Understand how sound financial management underpins IT services, using budgets and chargeback or user-pay schemes to monitor expenses and justify department value.

Quality management guides control, measurement, and continuous improvement of processes across software development, hardware acquisition, operations, services management, security management, administration, and human resources.

Explore performance optimization by modeling a system to align with business objectives, measure inputs and outputs, account for measurement errors and time lags, and prevent mismanagement.

Examine the I-S organizational structure and universally known responsibilities, including business owners, information security functions, and executive management, to prepare for CSA exam questions.

Identify key IS roles and responsibilities, from system's development manager and project managers to service desk and end users, including data management, QA manager, information security management, and the CISO.

Define roles for information systems, from database administrators as data custodians to security architects and network administrators. Identify responsibilities across system design, application and infrastructure staff, and network management.

Explain how separation of duties reduces fraud by splitting transaction authorization, asset custody, and data access, using banking examples, authorization forms, and authorization tables to enforce controls.

Implement compensating controls for limited segregation using audit trails and reconciliation. Use transaction logs and supervisor reviews to ensure accountability and detect irregularities.

Ensure the availability of key business processes to keep the organization viable during asset failures. Prioritize critical operations and resources in the VCP design under senior management.

Identify and align the business continuity planning with organizational strategy by prioritizing critical applications and premises to ensure uninterrupted i-s processing.

Understand how disasters and disruptive events threaten operations, and explore redundancy with multiple data centers across the country, power backups, and defenses against outages, hackers, and human error.

Define scope and priorities, assess risks and vulnerabilities, perform a business impact analysis, and develop a continuity strategy with countermeasures; train, test, monitor, and continuously update the plan as needed.

Define the scope of business continuity through policies approved by top management, and prepare internal and public portions of the plan that communicate restoration efforts to stakeholders before a disaster.

Compare a questionnaire approach and group interviews to gather and analyze data for identifying key business processes, then tabulate findings to shape the business impact analysis strategy.

Collaborate to identify critical systems and plan recovery through the VCP, detailing staff, facilities, equipment, and resources, including human resources and potential hot sites.

Assess risk transfer by detailing insurance coverage for equipment and facilities, reconstructing media, extra expenses from moving operations, business interruptions, errors and omissions insurance, fidelity coverage, and media transportation.

Explore how large-scale implementations like ERP projects become programs, coordinating multiple projects such as technology infrastructure, organizational realignments, and business process reengineering to meet business strategy.

Learn how program management coordinates program execution, treating a program as a collection of projects with scope, financials, costs, and schedules, while aligning communications, culture, and organization.

Feasibility studies define the problem scope, identify possible solutions, and recommend the best option; the business case guides the pre-implementation decision in the project lifecycle.

Define clear project results with smart objectives, specific, measurable, achievable, relevant, and time bound. Break them into main objectives linked to business success, plus additional objectives that clarify scope.

Explain how the work breakdown structure presents the basic elements as work packages, with dependencies, tasks, and phase-driven steps that drive the project.

Embed the audit function as an active participant in the ongoing lifecycle of business applications to ensure proper controls are designed and implemented, from business case to post review.

Clarify roles of the development project team, the user project team, and the security officer who ensures protection through controls and quality assurance of deliverables.

Apply project management practices by using knowledge, skills, tools, and techniques to manage deliverables, duration, and budget toward project objectives.

A project manager initiates projects by gathering information to gain approval, resulting in the project charter that states the project objectives.

Measure software size with lines of code, but acknowledge it often misses true complexity, while spreadsheets, diagrams, and graphical interfaces help communicate size and complexity.

Explore function points, or fops, and their use in function point analysis for estimating software size using inputs, outputs, inquiries, files, and external interfaces with rating factors.

Estimate task effort to build cost budgets by calculating personnel and machine hours, then apply hourly rates, including external costs like software licensing, consultants, and training.

Schedule tasks in sequence or parallel, using earliest start dates and latest finish estimates tied to budget and resources, and use a Gantt chart or the critical path message.

Identify the critical path methodology within a network of activities, where the longest sequence from start to end dictates project duration, even as some tasks run concurrently.

Define software deliverables within a fixed period using time box management, balancing quality with delivery needs and preventing cost overruns and delays.

Leverage automated techniques in general project management to handle proposals and cost estimations, build a performance monitor, and generate reports with recommended actions as decision support systems.

control project activities by managing scope and resource usage, including people and machines, assess inherent project risk, document new requirements, and ensure approved changes receive the appropriate resources.

Identify inherent project risks that may affect business benefits and project outcomes, and assign sponsors to mitigate business risk while the project manager handles changes and delays.

Explore how to perform risk assessments at milestone ends, quantify likelihood, mitigate inventory risks, and document findings in a risk management plan with methods to review effectiveness and cost.

Conduct a feasibility study to guide new or updated software and technology solutions, addressing opportunities, problems in current processes, and the drivers that push a function toward achieving business goals.

Utilize the SDLC and a smart approach to ensure a common understanding of objectives and how the parties involved contribute to the business, while noting potential objective gaps.

The lecture explains how development models reduce risk that the product won't meet company needs, using a waterfall lifecycle with verification and linking phase relationships to testing and unit tests.

Explore the SDLC phases, from feasibility and requirements to design, selection, development, and configuration, followed by implementation and post-implementation steps.

Organizations migrate to fully integrated ERP solutions, consolidating multiple applications into a single system. This shift changes management practices and requires assessment and approval of migration plans.

describes software acquisition as an option outside the SDLC that affects cost, availability, and deployment time. buying software enables quicker deployment through an RFP-driven vendor selection.

Advance from requirements to the design phase by forming a programming and analysts team to define the system architecture—the blueprint—while involving end users for feedback on screens and data flows.

Auditors assess design-phase controls by ensuring specifications and test plans include continuous online auditing, prototyping, and testing, and evaluate how the system was developed within contract scope.

During development, teams encode the system from detailed design toward the final product, creating system level documents, debugging code, converting old data, documenting modifications, and training end users.

Explore how testing approaches in IT adapt to system size and complexity, covering unit testing, integration testing, system testing, and final acceptance testing before release.

Execute final testing by combining quality assurance testing for technical aspects with user acceptance testing for functional readiness, ensuring production readiness and stakeholder sign-off in a secure staging environment.

Describe the certification and accreditation process within the implementation phase, including how a comprehensive assessment verifies operational controls, how accreditation authorizes operation, accepts risk, and informs post-implementation review.

Explore business application systems to help auditors build an effective audit program by understanding and reviewing the systems under examination.

Explore electronic commerce as a popular e-business model that lets customers find, purchase, and pay for orders without leaving. It reduces vendor costs by eliminating brick-and-mortar stores, delivering immediate savings.

Explore how trust underpins secure ecommerce, assess risk across confidentiality, integrity, and availability, and emphasize authentication and non repudiation to protect customers and sellers.

Explore electronic data interchange (EDI) as an early e-commerce method to transmit business documents in a machine readable format, reducing paperwork, errors, and delays while speeding invoicing and payments.

Identify the three core functions that move data through media—the communication handler, the interface, and the translator that adapts application data into the standard edi format via an api.

Ensure inbound transactions are accurate, completely received, and processed once by applying encryption, computerized correctness checks, and reasonableness tests, with transaction logs and control totals for partner reconciliation.

Explore how email works as a heavily used internet feature, detailing mail servers and clients, the traditional TSPP routing model, and crossing security perimeters with firewalls, plus encoding binary files.

Technology systems auditing defines standards for email security, covering mail server deployment, maintenance, and administration to avoid default deployments and ensure timely security patches, with encryption for outgoing mail.

Explore how point-of-sale systems capture data at checkout, including magnetic card readers and barcode scanners, and assess whether stored cardholder data uses strong encryption.

Examine risk management controls for e-banking, emphasizing board oversight, controls, due diligence of outsourced relationships, customer authentication, non repudiation, segregation of duties, authorization, transaction integrity, audit trails, and confidential storage.

Identify the key players in payment systems: issuers and users, and learn that issuers operate the payment service while users make or receive payments.

Explore how the electronic money model emulates physical cash by issuing digital certificates that users purchase to redeem with the issue or at a later date, similar to gift certificates.

Explore electronic funds transfer, a cost-saving method that exchanges money via telecommunications and the internet, transferring funds from one account to another, including automatic deposits like paychecks.

Auditors review the eft environment security and authorization using plastic cards and pins, and assess the security of unissued cards and pin generation procedures.

Audit an automated teller machine by examining customer identification controls, confidentiality, file retention, daily reconciliation, and exception reports. Ensure segregation of duties, retained cards procedures, and encryption key change management.

Develop controls to prevent alteration or loss of information image files and audit imaging workflows, plan for volume, and ensure device maintenance, software security, and staff training to ensure integrity.

Supply chain management links buyers and sellers across suppliers, manufacturers, wholesalers, distributors, and end users to manage the flow of goods, services, information, and logistics using SVM to optimize inventory.

Explore alternate forms of software project organization and describe different approaches to structuring a project, as an auditor, considering time delivery, system scale, clarity requirements, and technology maturity.

Rapid application development (rad) speeds building key systems at lower cost while maintaining quality, using an integrated platform and supporting analysis, design, development, and implementation.

Explore alternative development methods to manage complex systems and speed time to market, covering data oriented, object oriented, component based web based application development, software re-engineering, and reverse engineering.

Explore web-based application development as a cross-platform approach using XML and a common language to enable loosely coupled modules and easy enterprise integration via browsers.

Learn how software reengineering updates an existing system by extracting and reusing design and program components to create a new type of system.

Explore infrastructure development and acquisition practices, including physical architecture analysis and a roadmap to transition to new infrastructure, while considering training, installation issues, total cost of ownership, and economic-technological impacts.

Develop the functional requirements document from the draft requirements, marking the last checkpoint before sizing and a proof of concept. Confirm the chosen hardware and software meet security requirements.

Evaluate vendor proposals by assessing turnaround time for helpdesk response and system reaction time for login or connection. Compare throughput, compatibility, capacity for simultaneous requests, and utilization (uptime vs downtime).

Explore how a formal authorization process prioritizes and approves change requests from users or vendors, with management-level approval and permanent documentation in maintenance records.

Testing changed programs ensures updated functionality remains intact, and it conducts risk analysis after changes, evaluating service degradation and new security exposures for certification.

Audit the change control process, not the change itself, and evaluate security for program libraries, supervisory reviews, and approved change requests; assess impact and reference past requests for standardization.

Emergency changes demand immediate action during outages in service provider environments, using special credentials to deploy fixes while ensuring post-event documentation, uptime considerations, and change management.

Automate change control in configuration management to identify items affected by a change, record them, and implement changes per authorization, with baselines for rollback and error-free releases.

Explore computer aided software engineering as an automated tool that translates information and program logic to testing, modification, and implementation, with compilers converting text data into executable code.

Explore computer aided software engineering concepts by categorizing case products into upper case, middle case, and lower case, covering requirements documentation, detailed design, and code and database design.

Explore business process reengineering to improve product, service, or profitability by reengineering processes for customer value. Learn methods to organize people, outsourcing, joint development, and just in time inventory.

Assess how a new business process drives changes to culture, structure, and finances, and re-engineer key controls to match the redesigned workflow and software capabilities.

Follow the benchmarking process from planning to continuous improvement. Define critical processes, collect baseline data, observe and analyze results, and translate findings into principles, strategies, and action plans.

Explore ISO 15504, known as spice, as a baseline for software process improvement and benchmarking, reviewing models across software, system, and human-centered lifecycle, including component-based development and IT service management.

Examine input controls on the client side that validate forms and enforce correct data types for online transactions. Review how authorizations, access controls, and signatures safeguard source documents and workstations.

Use batch controls to group input transactions and generate control totals, including total monetary amount, item count, document count, and hash totals, then verify these against batch and system totals.

Verify that only the correct date is accepted and input errors are corrected, and choose whether to reject faulty transactions, reject the batch, hold for correction, or flag error transactions.

Implement processing controls to ensure the reliability and accuracy of application program processing. Create validation procedures to detect missing or inconsistent data and use client-side checks before submission.

Capture system development methodology documents, functional design specifications, program changes, user manuals, and technical reference documentation to verify that the application conforms to its documented design.

Continuous online auditing enables auditors to collect evidence of system reliability in real time as processing occurs, using logs and transaction items to track activity.

Review the requirements definition and detailed requirements document to verify accuracy, confirm initiation cost and management approval, identify team members, assess conceptual design and control specifications, and note vendor proposals.

Explore management control functions, including planning, authorizing, and monitoring IT resources to ensure adequacy, efficient use, policy alignment, and standards compliance.

Manage Ayas operations by authorizing shift schedule changes and monitoring performance to prevent outages. Track service level agreements, planning for equipment replacement, logs, and audit reviews to address disruptions promptly.

Align IT services with service level agreements to improve management, and outline the change control process, control of releases, and rollback options during deployments.

Practice infrastructure operations by executing and monitoring scheduled jobs, backups, and performance, capacity, and failure information of resources. Identify unauthorized access, follow procedures, align with disaster recovery plans for availability.

Analyze scheduling as a major function within the Ayas department, detailing job execution steps, sequence requirements, and the conditions that could affect program execution.

Explore detecting and documenting abnormal conditions across software and hardware, logging date, description, code, source of error, and assignee, then track status and resolution for audit reporting.

Execute a change management process to prevent outages by managing change control, moving changes from test to production after practice, and requiring approvals and risk assessments for hardware/software upgrades.

Explore how release management makes software available through authorized changes, distinguishing major releases, upgrades, minor releases, and emergency releases addressing quick fixes and vulnerabilities.

Agree on release contents and strategy, pilot or phase the rollout, and plan the high-level schedule, resources, roles, rollback, and quality for customer and support acceptance.

Explore the computer's hardware components, including the cpu with its alu and control unit, memory, ram and rom, storage, and input output devices such as keyboard, mouse, monitor, and printer.

Explore common enterprise back end devices, including print, file, application, email, web, proxy, and database servers, and learn how they handle authentication, authorization, and data storage.

Identify risks to enterprise networks from viruses, malware, and hackers, and assess impacts like data theft, data and media loss, and loss of confidentiality through stolen devices.

Identify RFID risks across business processes, including direct attacks on RFID components, competition-driven unauthorized access, privacy concerns with personal data, and interference with non-rfid networks and devices.

Establish management and technical controls to oversee RFID system security, detailing daily actions by system administrators and users, and technologies that monitor, restrict, or self-destruct tags and protect wireless communications.