Auditing IT Governance

Controls
 IT Governance
Structure of the IT Function
The Computer Center
Disaster Recovery Planning
Outsourcing the IT Function
IT Governance

is a relatively new subset of corporate governance

that focuses on the management and assessment of

strategic IT resources.

Key objectives:

to reduce risk and

to ensure that investments in IT resources add value to the

corporation.
3 IT Governance Issues

1. Organizational structure of the IT function

2. Computer center operations

3. Disaster recovery planning

Process

1. Explanation of nature of risk and description of

the controls needed to mitigate the risk.

2. Present audit objectives

3. Sample test of controls

Structure of the IT Function
Centralized data processing

-all data processing is performed by one or more large

computers housed at a central site that serves users throughout the
organization

Primary Service Areas

-Data Administration

-Data Processing

-Systems Development and Maintenance

Data Administration
Data Processing

manages the computer resources used to perform day-to-

day processing of transaction

It consists of the following organizational functions:

-data conversion

-computer operations

-data library
Systems Development and Maintenance

responsible for analyzing user needs and for designing

new systems to satisfy those needs

Participants:

-system professionals

-end users

-stakeholders
Segregation of Incompatible IT Functions

Separate systems development from computer

operations

Separate database administration from other functions

Separate new systems development from maintenance

-inadequate documentation

-program fraud
The Computer Center
Physical Location

Construction

Access

Air Conditioning

Fire Suppression

Fault Tolerance
Audit Objectives
to evaluate the controls governing computer center
security

Auditor must verify that:

-physical security controls are adequate to

reasonably protect the organization from physical exposures

-insurance coverage on equipment is adequate to

compensate the organization for the destruction or damage
of its computer
Audit Procedures

Test of:

Physical construction

Fire Detection Program

Access Control

Raid

Uninterruptible Power Supply

Insurance Coverage
Disaster Recovery Planning

a comprehensive statement of all actions to be taken

before, during, and after any type of disaster
Steps:

1. Identify critical applications

2. Create a disaster recovery team

3. Provide site backup

- Mutual aid pact

- Empty Shell

- Recovery operations center

- Internally provided backup

4. Specify backup and off-site storage procedures

- Operating system backup

- Application backup

- Backup data files

- Backup documentation

- Backup supplies and source documents

- Testing the DRY

Audit Objective
The auditor should verify that management's disaster
recovery plan is adequate and feasible for dealing with a
catastrophe that could deprive the organization of its
computing resources.
Audit Procedures
Site Backup

Critical Application List

Software Backup

Data Backup

Backup Supplies, Documents, and Documentation

Disaster Recovery Team

Outsourcing the IT Function

Core Competency Theory

- an organization should focus exclusively on its core

business competencies, while allowing outsourcing vendors
to efficiently manage the none-core areas such as IT
functions. This however ignores an important distinction
between Commodity IT Assets & Specific IT Assets.
 Transaction Cost Economics (TCE) Theory

- firms should retain certain specific non-core IT

assets in-house
Risks
Failure to perform

Vendor exploitation

Cost exceeds benefits

Reduced security

Loss of strategic advantage

 SAS 70
a definitive standard by which client organization's
auditors can gain knowledge that controls at the third-
party vendor are adequate to prevent or detect material
errors that could impact the client's financial statements