1 RISK ASSESSMENT AND AUDIT Risk Assessment Risk Assessment (RA) • Control assessment performed on controls that are current concerns/interest to the organization from the applicable frameworks used by an organization. • The assessed controls usually validate the company's policy to confirm whether they are appropriate. • This involves determining the Risk level of identified control weaknesses from the product of likelihood and impact of such weaknesses. • RA primary aim is to eliminate & reduce the Risk by correcting the internal control weaknesses. Types of Risk assessment: • Qualitative assessment- Subjectivity & Risk impact are based assumption/probability (Medium, low or High) • Quantitative assessment- Objectivity & Measurable/predefined data (Time, cost & impact) ($10,000-$50,000 or $100,000-$200,000) Risk Assessment Basic steps for performing Risk assessment • Identify application for assessment • Prepare for Risk assessment- individuals such Risk Assessor, Devops, engineers, IT Managers ,Risk manager, Business unit, process owner etc • Conduct the Risk assessment- testing • Identify threat sources & events • Identify Vulnerabilities • Determine likelihood of occurrence • Determine magnitude of impact • Determine the Risk • Communicate Risk assessment result- reporting & metric • Evergreen- lessons learnt & continuous improvement etc RA Tool Archer: This is used in Creating, tracking; updating & monitoring inventory of all risk action required & allow you to make changes/set deadlines for those actions needed & monitor progress changes on each activity. 3 4 5 IRM Checklist Review 6 IRM Checklist Review 7 IT Government Audit • General Computer controls (GCC) & application Controls Table • COSO, COBIT & SOX • FISCAM, FISMA & A-123 Audit • GCC & application controls • FISMA Audit • Class quiz & Exercise 8 9 10 11 IT Government Audit COSO, COBIT & SOX COSO - Committee of Sponsoring Organizations of the Treadway Commission established in 1985 to provide integrated guidance or an Enterprise Risk Management (ERM) framework (or guide) against which companies and organizations may assess their internal controls. • Defined three internal control objectives : o effectiveness and efficiency of operation, reliability of financial reporting and compliance with applicable laws and regulations. Defined five internal control components o control environment, risk assessment, control activities, information and communication, and monitoring. 12 IT Government Audit COSO CUBE IT Government Audit 13 COBIT – Control Objectives for IT COBIT - was designed (by ISACA and IT Governance Institute) to be part of and enhance COSO with respect to IT as COBIT better targets the IT processes, providing more detailed guidance than COSO. COBIT 5 Framework released in April 2012 has 37 control objectives/processes and 5 domains (i.e control groups/buckets) of Evaluate, Direct and Monitor (EDM), Align, Plan and Organize (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA) COBIT 2019 is the latest updated framework (www.isaca.org/cobit). Information Technology Infrastructure Library (ITIL), and the International Organization for Standardization (ISO) are international internal control equivalents of COBIT. 14 IT Government Audit COBIT 2019 Framework – Core Model IT Government Audit SOX – Sarbanes - Oxley Act (2002) • SOX Named after its sponsors, U.S. Senator Paul Sarbanes (D-MD) and U.S. Representative Michael G. Oxley (R-OH). • The Act was in response to major corporate and accounting scandals such as at Enron and WorldCom. • SOX section 404 requires top management of commercial public companies (such as CEO and CFO) registered with the Stock Exchange Commission (SEC) evidenced with its shares trading on the Stock Exchange to certify the accuracy of their annual financial statements and include a report on the effectiveness of internal controls based on the annual SOX testing. • SEC is charged with ensuring compliance with this Act and in turn established the Public Company Accounting Oversight Board (PCAOB) as the regulator. • Compliance with SOX can be achieved with COSO and COBIT. 15 16 17 IT Government Audit SOX Control Objectives • IT Governance Institute (ITGI) identified the following 12 control objectives for SOX from COBIT and PCAOB auditing standards. • IT controls should only be part of the SOX 404 assessment to the extent that specific financial risks are addressed. These control objectives over financial reporting are contained in the “IT Control Objectives for Sarbanes-Oxley”. • The 12 controls are further reduced into 3 primary control objectives known as IT General controls (ITGCs) that all organizations are expected to have in place: • Access control (including system and physical security) • Change management (including system configuration and development) • IT Operations(including backup and job scheduling) 18 19 IT Government Audit SOX 12 Control Objectives • • • • • • • • • • Acquire and maintain application software; Acquire and maintain technology infrastructure; Enable operations; Install and accredit solutions and changes; Manage changes; Define and manage service levels; Manage third-party services; Ensure systems security; Manage the configuration; Manage problems and incidents; Manage data; and Manage the physical environment and operations. 20 IT Government Audit SOX Control Types • Preventive and, Corrective, Detective controls – prevent and detect likely risks • Key controls - primary, important or significant controls which the organization needs to have in place such as ITGCs. • Non-Key controls - secondary or additional controls that may have been addressed by a primary control. • Testing is focused on key controls in order to save time and focus on controls that address higher risks (i.e., risk-based audit). IT Government Audit 21 SOX Control Testing- SOX testing phases• Testing is focused on key controls in order to save time and focus on controls that address higher risks (i.e., risk-based audit). • Planning Phase - controls to test would be selected from the above controls relevant to the client to create a control matrix (containing the risk and associated controls), or from client’s established control matrix. • create the audit request/PBC List which is sent to the client, or the group being audited to obtain evidence needed for the audit • Fieldwork • Reporting • Follow Up 22 Summary Learning GCC- 40% Frameworks- 40% GCC Audit process- 20% 23
