GIAS - Month 201X

GIAS XXX Department PBC List

Client XXX Department Period-end 31 December 2010
Prepared By Paul Mburu Date 20 April 2011 W/P Reference

We would like to request and receive the following documentation prior to performing assessment procedures on-site. Either electronic or hard copy format is acceptable.
For each document, please provide a contact name to facilitate discussion and completion of our procedures.

Please note, we will also request to interview appropriate personnel in order to gain additional information in each of the areas below.

Whereas this PBC contains a list of information we deem vital for the IT audit, we may request for additional information as required.

Tracking Statistics

GIAS
Client Client
Item GIAS Original Requested
Process Description of Requested Item Responsible Comments / Date Delivered to GIAS
# Request Date Delivery
Personnel Questions
Date

Entity Level Controls Program

1 Entity Level The business strategy and the IT strategy showing how the XXX 20-Apr-11 27-Apr-11
Controls Program alignment of the two

2 Entity Level Previous year (2009) and current year IT budgets (2010) XXX 20-Apr-11 27-Apr-11
Controls Program

3 Entity Level ICT department organizational structure XXX 20-Apr-11 27-Apr-11

Controls Program

4 Entity Level Job descriptions of all Top IT personnel XXX 20-Apr-11 27-Apr-11
Controls Program

5 Entity Level The data classification policy XXX 20-Apr-11 27-Apr-11

Controls Program

6 Entity Level Service Level Agreement between the IT department and the XXX 20-Apr-11 27-Apr-11
Controls Program business units

7 Entity Level ICT equipment inventory XXX 20-Apr-11 27-Apr-11

Controls Program

8 Entity Level Training calendar / Program for IT personnel XXX 20-Apr-11 27-Apr-11
Controls Program

Access to Programs and Data

9 Access to Information Technology security Policies and procedures XXX 20-Apr-11 27-Apr-11
Programs and
Data
10 Access to Internet and Email policies and procedures XXX 20-Apr-11 27-Apr-11
Programs and
Data

Group Internal Audit Services

 GIAS - Month 201X Tracking Statistics

GIAS
Client Client
Item GIAS Original Requested
Process Description of Requested Item Responsible Comments / Date Delivered to GIAS
# Request Date Delivery
Personnel Questions
Date

11 Access to End user policies XXX 20-Apr-11 27-Apr-11

Programs and
Data

12 Access to Copies of management meeting minutes that ratified the above XXX 20-Apr-11 27-Apr-11
Programs and policies i.e. items 9, 10 and 11
Data

13 Access to Documented procedures on communication of security policies to XXX 20-Apr-11 27-Apr-11

Programs and all users within the firm
Data

14 Access to User awareness training calendar XXX 20-Apr-11 27-Apr-11

Programs and
Data

15 Access to Evidence of security awareness training done to users during the XXX 20-Apr-11 27-Apr-11
Programs and year
Data

16 Access to System generated reports of the password policies implemented XXX 20-Apr-11 27-Apr-11
Programs and for ISCALA, HIAFFINITY, ECLIPSE and the Windows domain.
Data

17 Access to System generated reports of all users of ISCALA, HIAFFINITY, XXX 20-Apr-11 27-Apr-11
Programs and ECLIPSE and all the domain users. This report should include:
Data User Name, Status (enabled/disabled), last password change
date and last log on date
18 Access to Example user access form for new system access (ISCALA, XXX 20-Apr-11 27-Apr-11
Programs and HIAFFINITY, ECLIPSE and the Windows domain) and evidence of
Data approval by the IT department and the business unit.

19 Access to Example access change request form requesting for user profile XXX 20-Apr-11 27-Apr-11
Programs and changes (both ISCALA, HIAFFINITY, ECLIPSE and the windows
Data domain) and evidence of approval by the IT department and the
business unit.
20 Access to Documented procedures for revoking system access in ISCALA, XXX 20-Apr-11 27-Apr-11
Programs and HIAFFINITY, ECLIPSE and the Windows domain
Data

21 Access to A copy of the server room access logs for the current year (Soft XXX 20-Apr-11 27-Apr-11
Programs and copy / Hard Copy)
Data

22 Access to The network diagram XXX 20-Apr-11 27-Apr-11

Programs and
Data

23 Access to Router and firewall configuration reports XXX 20-Apr-11 27-Apr-11

Programs and
Data

Group Internal Audit Services

 GIAS - Month 201X Tracking Statistics

GIAS
Client Client
Item GIAS Original Requested
Process Description of Requested Item Responsible Comments / Date Delivered to GIAS
# Request Date Delivery
Personnel Questions
Date

24 Access to Evidence of vulnerability assessments / penetration tests XXX 20-Apr-11 27-Apr-11

Programs and performed by independent parties to help identify loop holes in
Data the LAN and WAN

25 Access to The name and version of ISCALA, HIAFFINITY, ECLIPSE XXX 20-Apr-11 27-Apr-11
Programs and underlying database
Data

26 Access to A formal approval granting the ISCALA, HIAFFINITY, ECLIPSE XXX 20-Apr-11 27-Apr-11
Programs and DBA access to the production database
Data

27 Access to Audit logs of activities performed by the ISCALA, HIAFFINITY, XXX 20-Apr-11 27-Apr-11
Programs and ECLIPSE DBA and evidence of their periodic review
Data

28 Access to Segregation of duty matrix illustrating access considerations that XXX 20-Apr-11 27-Apr-11
Programs and are considered when creating profiles within ISCALA,
Data HIAFFINITY, ECLIPSE and the Windows domain

29 Access to System generated report of group profiles within ISCALA, XXX 20-Apr-11 27-Apr-11
Programs and HIAFFINITY, ECLIPSE and the Windows domain. This report
Data should also include all the rights assigned to each profile

30 Access to System generated report of all users showing which profiles they XXX 20-Apr-11 27-Apr-11
Programs and belong to in both ISCALA, HIAFFINITY, ECLIPSE and the
Data Windows domain

31 Access to Evidence of segregation of duty review performed by XXX 20-Apr-11 27-Apr-11

Programs and management including supporting documentation and criteria
Data included for evaluation of appropriate segregation of duties has
been considered for all users in ISCALA, HIAFFINITY, ECLIPSE
and the Windows domain

Program Changes
32 Program Changes Policies and procedures relating to change management and XXX 20-Apr-11 27-Apr-11
exception management during implementation. Specifically,
policies and procedures documenting the process of requesting,
end-user, IT testing, authorizing/approving, migrating into
production, resolving application issues, emergency change
control process, configuration change control process,
implementation plans, process for updating production libraries.

33 Program Changes System-generated listing of changes carried out on the ISCALA, XXX 20-Apr-11 27-Apr-11
HIAFFINITY, ECLIPSE application.

34 Program Changes Copies of user testing results for changes XXX 20-Apr-11 27-Apr-11

Program Development
35 Program System development methodology/System acquisition XXX 20-Apr-11 27-Apr-11
Development methodology
Group Internal Audit Services
 GIAS - Month 201X Tracking Statistics

GIAS
Client Client
Item GIAS Original Requested
Process Description of Requested Item Responsible Comments / Date Delivered to GIAS
# Request Date Delivery
Personnel Questions
Date

36 Program List of ongoing IT projects XXX 20-Apr-11 27-Apr-11

Development

37 Program List of significant software amendments /upgrades /changes XXX 20-Apr-11 27-Apr-11
Development during the year

38 Program Project management documentation that has been prepared to XXX 20-Apr-11 27-Apr-11
Development define project scope, requirements, and budgetary requirements
for all system development projects implemented in the current
year.

Computer Operations
39 Computer Disaster Recovery Plan / Business Continuity Plan (BCP). XXX 20-Apr-11 27-Apr-11
Operations
40 Computer Backup policies & procedures XXX 20-Apr-11 27-Apr-11
Operations
41 Computer Back-ups sign off documents XXX 20-Apr-11 27-Apr-11
Operations
42 Computer Testing plans and support documentation of tests over XXX 20-Apr-11 27-Apr-11
Operations application recovery, backups, and record retention
requirements tested prior to implementation.
43 Computer XXX 20-Apr-11 27-Apr-11
Evidence that backup tapes are rotated to an offsite storage
Operations
facility.

44 Computer Problem/Incident management procedures XXX 20-Apr-11 27-Apr-11

Operations

45 Computer Problem logs for the current year XXX 20-Apr-11 27-Apr-11
Operations

46 Computer Antivirus software name and version XXX 20-Apr-11 27-Apr-11

Operations

47 Computer Antivirus software configuration screenshots i.e. when to run XXX 20-Apr-11 27-Apr-11
Operations updates, scans etc

48 Computer Listing of all batch jobs within ISCALA, HIAFFINITY, ECLIPSE XXX 20-Apr-11 27-Apr-11
Operations

49 Computer Documented procedures for execution of batch jobs XXX 20-Apr-11 27-Apr-11
Operations

Group Internal Audit Services