Scribd Logo
Upload

Welcome to Scribd!

  • 372 views

    IT General Controls

    Uploaded by

    AtulOsave
    The document discusses IT general controls, which are controls that help ensure the proper operation of information systems. It covers key areas of IT general controls like program change management, logical access controls, and computer operations. IT general controls are important for accountants and business professionals to understand because auditing standards and regulations like Sarbanes-Oxley require evaluating internal controls, including IT general controls, to assess financial reporting risks. Common issues found in IT general control reviews include weaknesses in administrative access controls, database monitoring, program change policies and access controls. The presentation also discusses encryption methods and takes questions.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    IT General Controls

    Uploaded by

    AtulOsave
    372 views18 pages
    The document discusses IT general controls, which are controls that help ensure the proper operation of information systems. It covers key areas of IT general controls like program change management, logical access controls, and computer operations. IT general controls are important for accountants and business professionals to understand because auditing standards and regulations like Sarbanes-Oxley require evaluating internal controls, including IT general controls, to assess financial reporting risks. Common issues found in IT general control reviews include weaknesses in administrative access controls, database monitoring, program change policies and access controls. The presentation also discusses encryption methods and takes questions.

    Original Description:

    IT General Controls

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses IT general controls, which are controls that help ensure the proper operation of information systems. It covers key areas of IT general controls like program change management, logical access controls, and computer operations. IT general controls are important for accountants and business professionals to understand because auditing standards and regulations like Sarbanes-Oxley require evaluating internal controls, including IT general controls, to assess financial reporting risks. Common issues found in IT general control reviews include weaknesses in administrative access controls, database monitoring, program change policies and access controls. The presentation also discusses encryption methods and takes questions.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    372 views18 pages

    IT General Controls

    Uploaded by

    AtulOsave
    The document discusses IT general controls, which are controls that help ensure the proper operation of information systems. It covers key areas of IT general controls like program change management, logical access controls, and computer operations. IT general controls are important for accountants and business professionals to understand because auditing standards and regulations like Sarbanes-Oxley require evaluating internal controls, including IT general controls, to assess financial reporting risks. Common issues found in IT general control reviews include weaknesses in administrative access controls, database monitoring, program change policies and access controls. The presentation also discusses encryption methods and takes questions.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 18

    IT General Controls

    Charles Broom
    IS Assurance Manager
    [email protected]

    ALASBO 12/11/2013
    Page 1

    Agenda
    What are IT General Controls?
    Why should an accountant/business professional care?
    Common issues found
    Encryption
    Questions

    ALASBO 12/11/2013
    Page 2

    What are IT General Controls?


    Areas of ITGC testing:
    Program Change Management
    Logical Access
    Layers

    Computer Operations

    ALASBO 12/11/2013
    Page 3

    Program Change Management


    Who
    Who
    Who
    How
    How

    authorizes the changes?


    tests the changes (or are the tested)?
    approves the change?
    do you know that all the changes went through the process?
    do you know a change did not undo a previous change?

    ALASBO 12/11/2013
    Page 4

    Logical Access Layers

    Operating System

    Application

    ALASBO 12/11/2013
    Page 5

    Database

    Logical Access Layers

    N
    e
    t
    w
    o
    r
    k

    ALASBO 12/11/2013
    Page 6

    Logical Access - Layers


    Controls exist at each layer
    Network
    - Firewall
    - Remote Access
    - Antivirus
    - Wireless

    OS
    - Password settings (why is this such a big deal?)
    - Administrative access

    ALASBO 12/11/2013
    Page 7

    Logical Access - Layers


    Controls exist at each layer (cont)
    Application
    - Password settings
    - Segregation of duties

    Database
    - Access to change outside the application
    - Monitoring

    ALASBO 12/11/2013
    Page 8

    Passwords a short deviation into math (aka how


    long would it take to guess your password)
    Length of
    password

    Just letters

    Letters &
    numbers

    Letters, numbers
    & symbols

    0.006 seconds

    0.01 seconds

    0.03 seconds

    0.292 seconds

    0.91 seconds

    3.26 seconds

    13.2 minutes

    1.20 hours

    8.17 hours

    24.7 days

    7.93 months

    8.41 years

    3.53 years

    44.9 years

    799 years

    10

    183 years

    3,100 years

    75,900 years

    11

    9,530 years

    214,000 years

    7,215,000 years

    12

    496,000 years

    14,772,000 years

    685,388,000 years

    Between 6,000 and 200,000 years

    ALASBO 12/11/2013
    Page 9

    Computer Operations
    What happens automatically?
    Batch processing
    Transfers between systems
    How is that controlled?
    Who can touch the servers? (Ignorance is not a control)

    ALASBO 12/11/2013
    Page 10

    Why should an accountant/business professional


    care?
    Risk Assessment Standards (AU 314)
    Sarbanes-Oxley Act of 2002

    ALASBO 12/11/2013
    Page 11

    AU 314
    The auditor must obtain a sufficient
    understanding of the entity and its
    environment, including its internal control, to
    assess the risk of material misstatement of the
    financial statements whether due to error or
    fraud, and to design the nature, timing, and
    extent of further audit procedures.

    ALASBO 12/11/2013
    Page 12

    SOX 404 (b)


    INTERNAL CONTROL EVALUATION AND REPORTING.
    With respect to the internal control assessment
    required by subsection(a), each registered public
    accounting firm that prepares or issues the audit
    report for the issuer shall attest to, and report on,
    the assessment made by the management of the
    issuer. An attestation made under this subsection
    shall be made in accordance with standards for
    attestation engagements issued or adopted by the
    Board. Any such attestation shall not be the
    subject of a separate engagement.

    ALASBO 12/11/2013
    Page 13

    Why should you care?


    So, just because the standards require that you care?

    NO
    ALASBO 12/11/2013
    Page 14

    Why should you care?


    Impact of different areas:
    Program Change Management
    Logical Access
    Layers

    Computer Operations

    ALASBO 12/11/2013
    Page 15

    Common issues
    Administrative Access
    Who is good?
    Who is bad?
    Databases
    Monitoring
    Program Change
    Policies
    Access
    Monitoring
    ALASBO 12/11/2013
    Page 16

    Encryption
    Hardware vs. Software based
    Symmetrical vs. Asymmetrical
    Good enough?

    ALASBO 12/11/2013
    Page 17

    Questions

    ALASBO 12/11/2013
    Page 18

    You might also like