Chapter Three
Chapter Three. IT Risks and Controls. Types of IT Risks. Business risk Audit risk inherent risk control risk detection risk Security risk Continuity risk. Assessing IT Risk. Threats and vulnerabilities The expected value of risk
Chapter Three
E N D
Presentation Transcript
Chapter Three IT Risks and Controls
Types of IT Risks • Business risk • Audit risk • inherent risk • control risk • detection risk • Security risk • Continuity risk
Assessing IT Risk • Threats and vulnerabilities • The expected value of risk • Risk indicators and risk measurement – risks relative to IT processes
COSO – 5 components of IC • Control environment • Risk assessment • Control activities • Information and communication • Monitoring
International IC Standards • Cadbury • CoCo • Other country standards
Quality Control Standards • ISO 9000 series – certifies that organizations comply with documented quality standards • Six Sigma – an approach to process and quality improvement
Statements on Auditing Standards • Issued by AICPA’s Accounting Standards Board • SAS 78 Consideration of IC in a Financial Statement Audit: An Amendment to SAS No. 55 • SAS 94 The Effect of IT on the Auditor’s Consideration of IC in a Financial Staetment Audit • New standards related to risk assessment
ISACA’s CobiT • Integrates IC with information and IT • Three dimensions: information criteria, IT processes, and IT resources • Requirements of quality, fiduciary, and security • Domains: planning and organization, acquisition and implementation, delivery and support, and monitoring • New management guidelines
Systems Reliability Assurance • SysTrust • WebTrust • New AICPA Trust Principles
Documenting It Controls • Internal control narratives • Flowcharts – internal control flowchart • IC questionnaires
Monitoring IT Risks and Controls • CobiT control objectives associated with monitoring • Need for independent assurance and audit of IT controls
