Scribd Logo
Upload

Welcome to Scribd!

  • 186 views

    Risks and Controls

    Uploaded by

    Jela Oasin
    This document discusses information technology risks and controls. It defines key risk-related terms like risk, threat, vulnerability, business risk, audit risk, and security risk. It then covers the risk management process of identifying, assessing, and monitoring risks and controls. Various frameworks for internal controls are discussed, including COSO, COBIT, ITIL, and ISO 27000. The five components of internal control - control environment, risk assessment, control activities, information and communication, and monitoring - are explained. Finally, ways to document IT controls such as narratives, flowcharts, and questionnaires are presented.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Risks and Controls

    Uploaded by

    Jela Oasin
    186 views43 pages
    This document discusses information technology risks and controls. It defines key risk-related terms like risk, threat, vulnerability, business risk, audit risk, and security risk. It then covers the risk management process of identifying, assessing, and monitoring risks and controls. Various frameworks for internal controls are discussed, including COSO, COBIT, ITIL, and ISO 27000. The five components of internal control - control environment, risk assessment, control activities, information and communication, and monitoring - are explained. Finally, ways to document IT controls such as narratives, flowcharts, and questionnaires are presented.

    Original Description:

    sdfsadfsd

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses information technology risks and controls. It defines key risk-related terms like risk, threat, vulnerability, business risk, audit risk, and security risk. It then covers the risk management process of identifying, assessing, and monitoring risks and controls. Various frameworks for internal controls are discussed, including COSO, COBIT, ITIL, and ISO 27000. The five components of internal control - control environment, risk assessment, control activities, information and communication, and monitoring - are explained. Finally, ways to document IT controls such as narratives, flowcharts, and questionnaires are presented.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    186 views43 pages

    Risks and Controls

    Uploaded by

    Jela Oasin
    This document discusses information technology risks and controls. It defines key risk-related terms like risk, threat, vulnerability, business risk, audit risk, and security risk. It then covers the risk management process of identifying, assessing, and monitoring risks and controls. Various frameworks for internal controls are discussed, including COSO, COBIT, ITIL, and ISO 27000. The five components of internal control - control environment, risk assessment, control activities, information and communication, and monitoring - are explained. Finally, ways to document IT controls such as narratives, flowcharts, and questionnaires are presented.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 43

    Information

    Technology
    Risks and
    Controls

    Risk, Threat, Vulnerability

    What is Risk?
    Chances of negative outcomes
    A possibility that a threat is
    capable of exploiting a known
    weakness or vulnerability

    Business Risk
    The likelihood that an organization will not
    achieve its business goals and objectives
    Chances of occurrence can be attributed to
    internal and external factors
    Auditors must first become familiar with
    the enterprises Strategic Plan

    Audit Risk
    The likelihood that an organizations
    external auditor makes a mistake when
    issuing an opinion attesting to the fairness
    of its financial statements or that an IT
    auditor fails to uncover a material error or
    fraud.

    Audit Risk

    Audit
    Risk =
    (AR)

    Inherent
    Risk (IR)

    Control
    Risk (CR)

    Detection
    Risk (DR)

    Test of Controls
    Objective is to determine whether
    adequate internal controls are in place and
    functioning properly

    Substantive Tests
    Involves a detailed investigation of specific
    account balances

    Zero Audit Risk?


    Audit Risk cannot be reduced to zero.
    Risks should be controlled at an acceptable
    level and in a cost-effective manner

    Residual Risk
    Any risk remaining after implementation
    of effective internal controls

    Security Risk
    Includes risks associated with:
    i) data access
    ii) integrity
    Physical or logical unauthorized
    access to data
    Risks in collecting and
    processing of data

    Continuity Risk
    Includes risks associated with an
    information systems availability and
    backup and recovery

    Availability
    Backup &
    Recovery

    Ensures that information


    system is always accessible to
    users
    Ensures that in case of
    interruption in continuity,
    procedures are available to
    restore data & operations

    Risk Management
    Attempts to balance risk
    against the needs of the organization

    The Risk Management


    Process
    Identify IT
    Risks
    Assess IT
    Risks
    Identify IT
    Controls

    Document IT
    Controls

    Monitor IT
    Risks &
    Controls

    Risk Assessment
    Operational process by which risks
    are identified and characterized.

    Risk and Control SelfAssessment (RCSA)


    is the process of identifying, recording and
    assessing potential risks and related
    controls

    IT Risk Assessment
    1) Identify Threats/ Exposures

    Data confidentiality, availability, integrity, timeliness,


    accuracy and IT infrastructure

    2) Assess Vulnerabilities to Threats/


    Exposures

    Remote access/ on-site access by unauthorized users

    3) Determine Acceptable Risk Levels

    Chance is .05 %

    4) Assess the Probability of Vulnerabilities

    Guesstimation

    Expected
    Value of =
    Risk

    Estimated
    %
    Loss from X Likelihood
    Specific
    of Loss
    Risk

    Internal Control
    Objectives
    1) To safeguard assets of the firm
    2) To ensure the accuracy and reliability
    of accounting records and information
    3) To promote efficiency of the firms
    operations
    4) To measure compliance with laws
    and regulations

    Internal Control
    Limitations
    1) Possibility of Error

    2) Circumvention
    3) Management Override
    4) Changing Conditions

    Preventive Control
    Passive techniques designed to
    reduce the frequency of occurrence
    of undesirable events

    Detective Control
    Devices, techniques and procedures
    designed to identify and expose
    undesirable events that elude
    preventive controls

    Corrective Control
    Actions that must be taken to
    reverse the effects of detected
    errors.

    COSO and Other


    Control Models
    Committee of Sponsoring
    Organizations (COSO) Framework
    Internal control is broadly defined as a process,
    effected by an entitys Board of Directors,
    management and other personnel, designed to
    provide reasonable assurance regarding the
    achievement of objectives in the following
    categories : effectiveness and efficiency of
    operations, reliability of financial reporting and
    compliance with laws and regulations.

    COSO and Other


    Control Models
    United Kingdoms Cadbury
    Commission
    provided a broad definition of
    internal control and stressed that it
    encompasses both financial and
    operational controls and that
    auditors should report both

    COSO and Other


    Control Models
    Canadian Criteria of Control
    Committee (CoCo)
    similar model in definition and
    elements but less complex than the
    first two.

    SAS 109
    Based on the COSO
    framework
    Describes the complex
    relationship between the
    firms internal controls,
    auditors assessment of risk
    and the planning of audit
    procedures

    COBIT
    Control Objectives for Information and
    Related Technologies
    defines a set of generic processes for the
    management of IT, with each process
    defined together with process inputs and
    outputs, key process-activities, process
    objectives, performance measures and an
    elementary maturity model

    COBIT 5
    [Process Reference Model]

    ITIL
    Information Technology Infrastructure
    Library
    set of practices for IT Service
    Management (ITSM) that focuses on
    aligning IT services with the needs of
    business

    ITIL

    ISO/IEC 27000
    explains the purpose of an Information
    Security Management System (ISMS)
    used to manage information security risks
    and controls within an organization.

    ISO/IEC 27000

    Components of
    Internal Control
    1) Control Environment

    2) Risk Assessment
    3) Control Activities
    4) Information and Communication
    5) Monitoring

    Control Environment
    Sets the tone for the organization
    Influences the control awareness of its
    management and employees
    i. Integrity & ethical values
    ii. Organization structure
    iii. BODs and Audit Committee participation
    iv. Managements philosophy and operating style
    v. Procedures for delegating responsibility & authority
    vi. Performance assessment method of management
    vii. External influence (ex. Regulatory agencies)
    viii. Policies and procedures for managing human resources

    Risk Assessment
    Identify, analyze and manage risks
    relevant to financial reporting

    Auditors should understand how


    management identifies, prioritizes
    and manages the risks related to
    financial reporting

    Information &
    Communication
    The Accounting Information
    System consists of records and
    methods used to initiate, identify,
    analyze, classify and record the
    organizations transactions and to
    account for the related assets and
    liabilities.

    Monitoring
    Process by which the quality of
    internal control design and
    operation can be assessed.
    2 categories:
    i. Physical Controls
    ii. Information Technology (IT)
    Controls

    Control Activities
    Policies and procedures used to
    ensure that appropriate actions are
    taken to deal with the organizations
    identified risks
    2 categories
    i. Physical Controls
    ii. IT Controls

    Physical Controls
    Transaction Authorization
    Segregation of duties

    Supervision
    Accounting Records
    Access Control
    Independent Verification

    IT Controls
    Application Controls
    - ensures validity, completeness &
    accuracy of financial transactions

    General Controls
    - applies to all systems

    Documenting
    IT Controls
    I. Internal Control Narratives
    Text describing controls over a
    particular risk
    Should describe the origin and
    disposition of each document (paper
    or electronic), list processing steps
    and describe internal controls (ex.
    approvals and authorizations).

    Documenting
    IT Controls
    II. Flowcharts
    Systems flowcharts that highlights
    control points
    Uses symbols and connectors to
    show documents, data flows and
    process steps

    Documenting
    IT Controls
    Common Flowchart Symbols
    Computer
    Process
    Start/
    Stop

    Document

    Manual
    Process

    Data Flow

    Decis
    ion

    Disk
    Storage

    Keyboard
    Input

    Online
    Storage

    Documenting
    IT Controls
    III. Internal Control
    Questionnaires
    Lists questions about internal
    control over various applications,
    processes or risks.
    Answerable with yes or no

    You might also like