A comprehensive guide to understanding and auditing modern
information systems
The increased dependence on information system resources for
performing key activities within organizations has made system
audits essential for ensuring the confidentiality, integrity, and
availability of information system resources. One of the biggest
challenges faced by auditors is the lack of a standardized approach
and relevant checklist. Understanding and Conducting Information
Systems Auditing brings together resources with audit tools and
techniques to solve this problem.
Featuring examples that are globally applicable and covering all
major standards, the book takes a non-technical approach to the
subject and presents information systems as a management tool with
practical applications. It explains in detail how to conduct
information systems audits and provides all the tools and
checklists needed to do so. In addition, it also introduces the
concept of information security grading, to help readers to
implement practical changes and solutions in their
organizations.
* Includes everything needed to perform information systems
audits
* Organized into two sections--the first designed to help
readers develop the understanding necessary for conducting
information systems audits and the second providing checklists for
audits
* Features examples designed to appeal to a global audience
Taking a non-technical approach that makes it accessible to
readers of all backgrounds, Understanding and Conducting
Information Systems Auditing is an essential resource for
anyone auditing information systems.
Autorentext
VEENA HINGARH is Joint Director of the South Asian Management Technologies Foundation, a center for research, training, and application in the areas of finance and risk management, which provides training in areas including IS auditing, enterprise risk management, and risk modeling. Winner of numerous merit-based awards during her career, Hingarh's major areas of focus are IFRS and IS. She speaks frequently at conferences and platforms throughout Asia and the Middle East. Hingarh is a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI), Certified Company Secretary of the Institute of Company Secretaries of India (ICSI), and Certified Information System Auditor (CISA) from ISACA (USA).
ARIF AHMED is a professor at and Director of the South Asian Management Technologies Foundation as well as a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI). He is an Information Security Management System Lead Auditor for the British Standards Institution. Ahmed's areas of focus are finance and risk management, and he has over two decades of postqualification experience in training and strategic consulting. He has been interviewed and quoted throughout the media and has spoken at various seminars and institutions, including the Institute of Chartered Accountants of India, XLRI, and the Institute of Company Secretaries of India.
Zusammenfassung
A comprehensive guide to understanding and auditing modern information systems
The increased dependence on information system resources for performing key activities within organizations has made system audits essential for ensuring the confidentiality, integrity, and availability of information system resources. One of the biggest challenges faced by auditors is the lack of a standardized approach and relevant checklist. Understanding and Conducting Information Systems Auditing brings together resources with audit tools and techniques to solve this problem.
Featuring examples that are globally applicable and covering all major standards, the book takes a non-technical approach to the subject and presents information systems as a management tool with practical applications. It explains in detail how to conduct information systems audits and provides all the tools and checklists needed to do so. In addition, it also introduces the concept of information security grading, to help readers to implement practical changes and solutions in their organizations.
- Includes everything needed to perform information systems audits
- Organized into two sectionsthe first designed to help readers develop the understanding necessary for conducting information systems audits and the second providing checklists for audits
- Features examples designed to appeal to a global audience
Taking a non-technical approach that makes it accessible to readers of all backgrounds, Understanding and Conducting Information Systems Auditing is an essential resource for anyone auditing information systems.
Inhalt
Preface xi
Acknowledgments xv
PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT 1
Chapter 1: Overview of Systems Audit 3
Information Systems Audit 3
Information Systems Auditor 4
Legal Requirements of an Information Systems Audit 4
Systems Environment and Information Systems Audit 7
Information System Assets 8
Classification of Controls 9
The Impact of Computers on Information 12
The Impact of Computers on Auditing 14
Information Systems Audit Coverage 15
Chapter 2: Hardware Security Issues 17
Hardware Security Objective 17
Peripheral Devices and Storage Media 22
Client-Server Architecture 23
Authentication Devices 24
Hardware Acquisition 24
Hardware Maintenance 26
Management of Obsolescence 27
Disposal of Equipment 28
Problem Management 29
Change Management 30
Network and Communication Issues 31
Chapter 3: Software Security Issues 41
Overview of Types of Software 41
Elements of Software Security 47
Control Issues during Installation and Maintenance 53
Licensing Issues 55
Problem and Change Management 56
Chapter 4: Information Systems Audit Requirements 59
Risk Analysis 59
Threats, Vulnerability, Exposure, Likelihood, and Attack 61
Information Systems Control Objectives 61
Information Systems Audit Objectives 62
System Effectiveness and Effi ciency 63
Information Systems Abuse 63
Asset Safeguarding Objective and Process 64
Evidence Collection and Evaluation 65
Logs and Audit Trails as Evidence 67
Chapter 5: Conducting an Information Systems Audit 71
Audit Program 71
Audit Plan 72
Audit Procedures and Approaches 75
System Understanding and Review 77
Compliance Reviews and Tests 77
Substantive Reviews and Tests 80
Audit Tools and Techniques 81
Sampling Techniques 84
Audit Questionnaire 85
Audit Documentation 86
Audit Report 87
Auditing Approaches 89
Sample Audit Work-Planning Memo 91
Sample Audit Work Process Flow 93
Chapter 6: Risk-Based Systems Audit 101
Conducting a Risk-Based Information Systems Audit 101
Risk Assessment 104
Risk Matrix 105
Risk and Audit Sample Determination 107
Audit Risk Assessment 109
Risk Management Strategy 112
Chapter 7: Business Continuity and Disaster Recovery Plan 115
Business Continuity and Disaster Recovery Process 115
Business Impact Analysis 116
Incident Response Plan 118
Disaster Recovery Plan 119
Types of Disaster Recovery Plans 120
Emergency Preparedness Audit Checklist 121
Business Continuity Strategies 122
Business Resumption Plan Audit Checklist 123
Recovery Procedures Testing Checklist 126
Plan Maintenance Checklist 126
Vital Records Re…