Audit Objective

and Audit

Procedures-

General Controls

Example: Ping IP

Sumber: ITGI, COBIT 4.1, 2007

IT General Control v.s. IT Application Control

CPA Review, Wiley, 2013

IT Control and Audit, Sandra and Frederick, 2009

IT Audit, James A. Hall, 2011

IT Audit Process

•Effectiveness•Efficiency•Confidentiality•Integrity•Availability•Compliance•Reliability

•Applications•Information•Infrastructure•People

Scope of Information System AuditBUSINESS OBJECTIVES

GOVERNANCE OBJECTIVES

INFORMATION CRITERIA

PLAN AND ORGANIZE

ACQUIRE AND IMPLEMENT

DELIVERY AND SUPPORT

MONITOR AND EVALUATE

IT RESOURCES

.

Scope of IAS

Overview – Auditing Control

Auditing IT Control (General and Application)

Audit Objective

To Asses the Adequacy

To Asses the Effectiveness

Is there Desain/ / SOP

Is the Desain/ SOP adequate?

Is the Desain/SOP implemented?

Is the implement-ion effective?

- Understand IC Framework and Desain / SOP

-Obeserve, interview, test whether SOP is communicated and implemented

-Use attributes statistics

-Assess mgt’s monitoring and measurement

- Mitigate Risk,- Conform w/, standard

/best practice.- Flowchart n’ narative- Strength and weak.- Commit/communicate

When identifying risks, auditors may find it useful to employ a top-down RA to determine which applications to include as part of control review and what tests need to be performed.

Assess Risk

10-K

F/S

Financial Statements AssertionF/S Accounts mapped to processes;

Processes mapped BUs

Non Financial Disclosures mapped to processes

Revenue and

Receivables

Purchases and

Payables

Mgt and Financial

Reporting/Accounting

Payroll and

BenefitsTreasury Legal

Compliance

Manufacturing

Investor Relation

Environmental

BU 1BU 2BU 3

BU 1BU 2BU 3

Corporate

Corporate

Corporate

Risk Identification and AnalysisRisk Assessment Documents:•Risk analysis matrix by F/S Accounts and Disclosures•Accounts risk analysis mapped to Business and Critical Applications and Underlying Technology

Prepare Risk Control Matrix

(Manual and Automated)

Define Risk Assessment

for IT-GC dan

IT-AC

See Risk Assessment Approach in the Following Section

Example: Financial Statement Risk Analysis Approach

Example Application Control: Risk Assessment Approach

Risk Factor Weighting20 10 10 10 10 10 15 15 100

Process Logical Access Risk

Physical Risk

Financial Impact

Supports to Application

Risk ... Risk ... Risk ... Risk ... Composite scores

IT Govern-

ance

5 1 5 5 3 3 5 2 375

Data Center

1 1 2 1 1 1 4 2 170

BC & DRP

5 2 2 1 5 5 5 2 245

.... 5 3 5 1 5 5 5 2 395

... 5 1 1 1 1 1 3 2 225

Composite scores = ∑ (risk factor weight x risk scale) and adding the totals.

The composite score of 375 = [(20 x 5) + (10 x 1) + (10 x 5 ) +…].

For this example, the auditor may determine that the general control review will include all process with a score > 200.

NO. PROSEDUR √/Х KKAREF

PIC

Tujuan Audit (IT Governance= 7 kriteria informasi):To verify that the structure of the IT function is in accordance with the level of potential risk and in a manner that promotes a working environment. Audit Procedures

1 Review doc, including current org chart and job desc for key function, to determine if individual/group are performing incompatible func. Assess the adequacy of the structure of IT organization. Verify that maintenance programmers assigned to specific projects

are not also the original design programmers. Verify that computer operators do not have access to the

operational details of a system’s internal logic. Through observe, determine that segregation policy is followed.

2 Evaluasi hasil pengukuran Key Goal Indicator, terutama mengenai: Percent of critical IT objectives covered by risk assessment Percent of IT personnel certified according to job needs

3 Buat Simpulan Audit

Contoh Audit Program – General Control

NO. PROSEDUR √/Х KKAREF

PIC

Tujuan Audit (IT Services):Pengelolaan Layanan dan Kualitas Layanan telah sesuai dengan service level management (SLM) Framework dan Service Level Agreement (SLA).

1 Dapatkan dan pelajari daftar layanan (service catalogue) ICT, service level management (SLM) Framework, SLA, dan Operating Level Agreement (OLA), beserta service-level metrics masing-masing layanan. Layanan TI, antara lain: Sitem keamanan TI. Help Desk. Database administrator. System change.Lakukan wawancara dengan ICT Division untuk mendapatkan pemahaman mengenai Pengelolaan Layanan dan Kualitas Layanan.

2 a. Dapatkan dan pelajari SOP dan WI, serta job description proses Layanan TI, yang akan digunakan sebagai acuan/standar dalam penilaian kinerja ICT.

b. Evaluasi apakah SOP, dan WI, serta job description fungsi TI telah secara jelas diuraikan dan dikomunikasikan kepada seluruh staf TI.

Contoh Audit Program – General Control

3 SLA dan OLA (= untuk level operational)a. Periksa apakah SLA dan OLA telah didefinisikan secara jelas. Misal:

SLA waktu respon dihitung mulai keluhan terjadi atau saat laporan keluhan diterima oleh Help Desk.

b. Uji kecukupan transparansi / publikasi SLA dan OLA. Misal: SLA dan OLA telah dapat diakses oleh seluruh user.

4 SLA dan OLA Up-datea. Periksa apakah ICT Division telah melakukan reviu secara periodik atas

SLA dan OLA untuk menilai apakah SLA dan OLA up-to-date terhadap perubahan lingkungan internal dan eksternal.

b. Periksa apakah setiap keluhan/ request user telah direspon secara tepat dan cepat oleh ICT Division.

5 Lakukan pengujian terhadap performance Sistem TI:a. Load testing: Misal: semua user diminta melakukan operasi sistem TI

secara serentak).b. Throughput testing: Misal: untuk real-time sistem, cek apakah output

diproses segera setelah input.c. Security testing: Misal: Lakukan pengujian apakah sistem dapat

mendeteksi virus yang sengaja dimasukan. Atau, minta security tim untuk melakukan hack, perhatikan apakah sistem dapat menangkal hack tsb.

6 Lakukan observasi atas pelaksanaan layanan TI. Misal: saat keluhan user masuk ke bagian Help Desk, auditor mengamati respon terhadap keluhan tersebut lalu bandingkan dengan SOP.

NO. PROSEDU

R

√/Х KKAREFPIC

7 Monitor dan Reporting Service Level. a. Periksa apakah ICT Division memiliki mekanisme dan melakukan

memonitor SLA dan OLA secara kontinyu dan berkala.

8 Evaluasi apakah Key Goal Indicator telah mencakup seluruh process goal yang ditetapkan.Dapatkan dan pelajari hasil pengukuran Key Goal Indicator oleh Group TI terkait Pengelolaan Layanan dan Kualitas Layanan, termasuk ukuran: Jumlah layanan TIK yang tidak tercantum dalam katalog layanan. Jumlah layanan TIK yang tidak disertai dengan service levelnya. % service level yang diukur. % service level yang memenuhi batas service level minimum.

9 Evaluasi hasil pengukuran Key Goal Indicator, terutama mengenai: Kelayakan metode pengumpulan data. Validitas data. Deviasi antara target dan aktual. Kelayakan action plan dari management terkait deviasi yang

unfavorable.10 Lakukan wawancara dengan ICT Division. 11 Buat simpulan audit.

NO. PROSEDU

R

√/Х KKAREFPIC

Tujuan Audit: (Example: Data Center)Untuk menilai Pengelolaan Keamanan, Konfigurasi, Insiden dan Problem telah dilaksanakan secara cukup dan efektif, mencakup proses perencanaan, pengembangan, operasional, dan juga mencakup data dan informasi, aplikasi, maupun infrastruktur.

Logic controls, a. Periksa apakah terdapat SOP bahwa:

a) Untuk log-in ke dalam sistem memerlukan ID dan password.b) Karakter password harus minimal terdiri dari 6 karakter dan harus

merupakan kombinasi antar numerik dan alphabet. b. Uji apakah untuk log-in ke dalam sistem memerlukan ID dan password.c. Uji apakah karakter password harus minimal terdiri dari 6 karakter dan

harus merupakan kombinasi antar numerik dan alphabet. Physical controls:a) Observasi apakah ruangan penyimpanan fisik telah memiliki kunci

akses berupa kunci konvensional, electronic access lock, cipher lock, atau biometric lock.

b) Periksa apakah setiap personel yang masuk ke dalam ruangan Sistem TI telah dicatat ID, hari, jam.

c) Dapatkan Access Control List, dan bandingkan dengan catatan personil yang masuk ke dalam ruangan Sistem TI.

NO. PROSEDU

R

√/Х KKAREFPIC

Example: ITGC - Data Center Access Log

Tujuan Audit:Untuk menilai Pengelolaan Keamanan, Konfigurasi, Insiden dan Problem telah dilaksanakan secara cukup dan efektif, mencakup proses perencanaan, pengembangan, operasional, dan juga mencakup data dan informasi, aplikasi, maupun infrastruktur.

Physical controls:b) Observasi apakah ruangan telah dilengkapi dengan personil keamanan

dan video surveillance cameras (CCTV).c) Observasi apakah prosedur darurat telah ditempelkan di ruangan.d) Nilai kecukupan fasilitas sistem ventilasi, pendingin, dan anti

/penanganan kebakaran dalam ruangan fisik sistem TI.e) Uji apakah ruangan dapat dimasuki oleh pihak yang tidak terotorisasi,

dengan mencoba memasuki area fisik, dengan identitas orang lain atau melalui ventilasi udara.

f) Uji apakah sistem ventilasi, AC,dan pemadam kebakaran telah beroperasi seperti yang ditentukan.

g) Uji apakah ruangan telah dilengkapi dengan cadangan listrik dan UPS yang cukup.

NO. PROSEDU

R

√/Х KKAREFPIC

Example: Room Monitoring

Example: Fire Alarm System Test Report

Example: Fire Resistance

Certificate

NO. PROSEDUR √/Х KKAREF

PIC

Tujuan Audit:To verify the security and integrity of fin trans by determining that network controls (1) can prevent and detect illegal access, (2) will render useless any data that a perpetrator successfully captures, and (3) are sufficient to preserve the integrity and physical security of data connected to the network.Audit Procedures Relating to Subversive Threats

1 Review the adequacy of the firewall in achieving the proper balance between control and convenience based on the org’s business objectives and potential risks.Criteria for assessing the firewall effectiveness include:Flexibility. The firewall should be flexible enough to accommodate

new services as the security needs of the organization change.Proxy services: to provide explicit user authentication to sensitive

services, applications, and data.Filtering: to deny all services that are not explicitly permitted. Segregation of systems: Systems that do not require public access

should be segregated from the Internet.Audit tools.:The firewall should provide a thorough set of audit and

logging tools that identify and record suspicious activity.Probe for weaknesses. Auditor should periodically probe the

firewall for weaknesses just as a computer Internet hacker would do.

DDOS attack

Application Access Denid

Suspicious Behaviour

Date and Time

Severity Risk

Reporter

Example: Input Activity Log - Firewall

NO. PROSEDUR √/Х KKAREF

PIC

2 Verify that an intrusion prevention system (IPS) with deep packet inspection (DPI) is in place for organizations that are vulnerable to DDos attacks, such as financial institutions.

3 Review security procedures governing the administration of data encryption keys.

4 Verify the encryption process by transmitting a test message and examining the contents at various points along the channel between the sending and receiving locations.

5 Review the message transaction logs to verify that all messages were received in their proper sequence.

6 Test the operation of the call-back feature by placing an unauthorized call from outside the installation.

Informasi Lebih Lanjut,Hubungi: