INFORMATION SYSTEMS AUDITING (GREEK)

INFORMATION SYSTEMS AUDITING (GREEK)

AUTHOR: John Kyriazoglou

Published by ANUBIS Publications (www.anubis.gr),

Athens, Greece, 2001.

SUMMARY

This book provides a set of techniques for conducting audits in ITC Systems, and a system (a methodology, the conceptual organizational tools, etc.) to be followed in audits, to document and describe the IT audit areas and associated control measures, assessed during the audit process by IT Auditors. The book is made up of 3 parts, as outlined next:

Part A: Development & Operation of Information Systems.

Chapter 1: Definition and description of the “Life-cycle development” process of information systems and of the 4 stages of development and operation of computerized systems.

Chapter 2: Description of the steps making up stage 1 (needs analysis), of the “life-cycle development” process.

Chapter 3: Analysis of the steps included in stage 2 (system development), of the “life-cycle development” process.

Chapter 4: Explanatory description of the steps making up the stage 3 (system operation), of the “life-cycle development” process.

Chapter 5: Descriptive analysis of the technological and administrative infrastructural aspects, these being termed as the stage 4 of the “life-cycle development” process.

Chapter 6: Definition of the major responsibilities, duties and activities of an IT department, the work environment within which IT operates and the various EDP operating modes.

Part B: Operation of an IT Audit Department

Chapter 7:  Analysis of an IT Audit Methodology (audit risk analysis, audit objectives, sampling, audit products, audit report, audit software, etc.) and a summary description of the IT Audit Areas.

Chapter 8: Description of the job roles and responsibilities of the IT Audit Manager and staff, the audit committee, the audit manual, the audit charter, etc.

Chapter 9: Description of an IT Audit Risk Analysis Methodology.

Part C: EDP/IT Audit Areas

Chapter 10: Description of the “IT Organization and administration” audit area and its components, as well as the major control concepts necessary an operating IT department and assessed during IT audits and reviews.

Chapter 11: Definition of the constituent elements of the audit area pertaining to “IT Strategy” (balanced scorecard methodology, activities plans, etc.) and the most critical control points that should be reviewed in the process of IT audits (as per international standards).

Chapter 12: Analysis of the most critical concepts and minimum control measures of the audit area “IT Security” (vulnerability analysis, security policy, security procedures).

Chapter 13: Description of the major elements and most critical control concepts of the audit area “Contingency Planning & Disaster Recovery” for IT Systems.

Chapter 14: Analysis and description of the major parts included in the audit area “System Development & Maintenance” and the necessary control points to be examined during the IT audit review process.

Chapter 15: Description of the elements and control points of the audit area “Computer Centre Operations & Services”, which are examined during the IT audit process.

Chapter 16: Analysis and description of the most critical controls to be assessed in the audit area of “Computerized System Operation”, during the audit review process.

                                                                           
Appendices

         

COMPLIANCE, ETHICS AND RISK MANAGEMENT

COMPLIANCE, ETHICS AND RISK MANAGEMENT

A question was recently put in a discussion group, whether COMPLIANCE is distinct from ETHICS and how they interact in a corporate environment.

I think COMPLIANCE has to do with meeting fully to all standards, rules and regulations, whether external or internal to the ORGANIZATION. The term comes from Latin (COM=TOGETHER), and Ancient Greek (PLERE=TO FULLFILL).

ETHICS provides the background in terms of moral character (good, evil, just, etc.), nature, disposition, habit and custom of a person to obey willingly or face the moral and other consequences if he or she does not. The term comes from Ancient Greek (ETHOS=Moral Character).

The question ‘If the person complies should he/she be also ethical?’ is irrelevant.

The question ‘If the person is ethical should he/she also comply?’ is also irrelevant.

The major philosophical question for managing organizations, to be resolved, however, is this: How to handle the case and to minimize if not avoid all-together, the possibility that the person (staff member, manager, executive, etc.) might easily damage and potentially destroy the organization, its stakeholders, customers and employees, etc., when that specific corporate person (staff member, manager, executive, etc.) who is complying fully with all rules and regulations and is or is not ethical, but WITH COMPLETE DISREGARD for the RISKS involved, makes the right decision on a strategic or operational transaction, issue or activity.

In other words we should see both COMPLIANCE and ETHICS co-existing within the GOVERNANCE FRAMEWORK which should also include RISK ASSESSMENT and RISK MANAGEMENT. 

Also we should ensure that all these mechanisms resolve to a satisfactory and beneficial level, to society, economy, community, organization and individuals concerned, the classical principal-agent problem.

ARTICLE: IT RISK EVALUATION

ARTICLE: IT RISK EVALUATION

This article describes a methodology to be used in offering concluding remarks to the management of an audited entity as to whether, for each objective assessed during an audit assignment, the situation is satisfactory, requires improvement or unsatisfactory. The aim is to provide a conceptual and practical framework to define and implement an evaluation method for Internal Audit assignments. The main uncertainties are identified and the objectives of Internal Audit are described, then we present an evaluation methodology for risk assessment. 

FOR MORE INFORMATION SEE: “IT Risk Evaluation”, Intelligent Risk Journal, Oct. 2011, Vol. 1: Issue 3, pp. 14-19, www.prmia.org/irisk

IT PERFORMANCE MEASUREMENT

IT PERFORMANCE MEASUREMENT

John Kyriazoglou*, CICA, M.S, B.A(Honours), (jkyriazoglou@hotmail.com)
IT Consultant and Author of the book ‘IT STRATEGIC & OPERATIONAL CONTROLS’ (www.itgovernance.co.uk)

Very complex IT projects frequently fail either due to budget overruns, or due to implementation delays, or even due to mismatches of functional specifications and business expectations. If the designers and managers of IT projects succeed in overcoming these obstacles, then the IT project is put into productive use with the optimism to satisfy the multiple targets of its users and the strategic objectives of its leadership and the organization.
Also IT projects, frequently, during their productive operation, in their attempts to be aligned with corporate objectives, are faced with new challenges which many times change due to competitive forces, and due to a large set of threats that could both lead to undesirable developments.

This is why the most care possible and the prior organizational preparedness and implementation of well-thought out control plans and actions (broadly termed ‘corporate controls’) are required in advance, so that on the one hand the risks that will cause damages to the reputation, effectiveness, and profitability are minimized and, on the other hand the benefits accrued due to the IT project are maximized.

In almost all types of organizations, both private and public, corporate controls denote the set of policies, procedures, techniques, methods, and practices to manage and control their business operations. Within this corporate controls framework, Information Technology controls (or IT controls) are specific actions, usually specified by policies, procedures, practices, etc., performed by persons, hardware or software with the main objective to ensure that specific business objectives are met. The overall guiding aim of IT controls relate to the secure processing, confidentiality, integrity, and availability of data and the overall management of the IT function of the organizations.

IT General Controls are those controls that are applicable to all IT activities (systems, services, issues, processes, operations, etc.) and data for a given organization or IT systems environment. They include controls over such areas as the strategy for IT, systems development, data center operations, data base and data communications infrastructure, systems software support and maintenance, IT security, and ready-made application systems acquisition, development and maintenance.
IT Application controls are those controls that are appropriate for transaction processing by individual computerized subsystems, such as financial accounting, personnel administration, customer sales, inventory control, payroll or accounts payable, etc.
Both corporate and IT controls are most efficient and effective when they are monitored, reviewed and improved to deliver the expected results. This is the main objective of performance measurement and reporting system.
A performance measurement and reporting system is an integral part of the corporate performance management process and it provides feedback, relative to the specific objectives of an organization that increases the possibility of the organization in achieving the predefined strategic and operational goals efficiently and effectively. Performance measurement gains real value when it is used as the basis for timely decisions by management. In terms of the particular function the purpose of performance measures is to provide the basis for performance management, review and improvements of the area being examined. The purpose of performance measuring is not to know how the organization is performing but to enable it to perform better. The ultimate aim of implementing a performance measurement system is to improve the performance of the given organization. If management can get the performance measurement of the organization right, the performance data generated will tell management and stakeholders where the organization is and where it is heading.

Establishing the corporate performance management process includes:

Step1: formulating and setting up the performance measurement system (e.g., BSC at the corporate level, and IT BSC at the IT level, etc.),

Step 2: entering the performance data into the performance system,

Step 3: carrying out the required performance reports and analyses, and

Step 4: setting up a corporate awards system and linking it to performance.

A good performance system must communicate strategy, must measure performance in real time, must offer an integrated performance project management capability, and must acknowledge and enable emotional contracting with all staff, which is so vital for linking individual commitment and activity to the attainment of organizational plans and goals. Emotional contracting (also referred to as 'the psychological contract') is the crucial and powerful link between the organizational performance intent, and the motivations, values and aspirations of the people. This emotional contracting element is sometimes overlooked by organizations, and that is the reason that may explain why the people have failed to do what the organization expected and asked them to do.

Ensuring that the objectives of IT systems are achieved may be done by establishing, monitoring and reviewing the IT Performance and IT Compliance Measures. These measures ensure that the formulated IT plan has the required and expected performance, and to take the necessary improvement actions, as needed.

In the IT domain and its areas of IT organization, IT strategy, systems development, application operation, etc., the typical IT performance measures are indicated next.

These performance measures could be based on a mixed system with two components: Component 1 would be IT Strategic and Operational Performance Measures, possibly maintained by an IT-BSC (Information Technology-Balanced Scorecard) Measurement System, and Component 2 would be a Compliance Monitoring System for monitoring compliance to policies, procedures and related matters (e.g., budget issues).

Examples of these performance measures follow:

IT Strategic and Operational Performance Measures

IT Finance: Expenditures on maintenance vs. new development, Expenditures on preventative maintenance, Return on IT Investments,  IT Human Resource Management Turn-over ratios, Training per employee (amounts, hours),  etc. 

IT System Development: Functions developed worth to users, No. of lines coded / tested / changed, Number of Applications supporting critical business functions,  etc.

IT Operations: Timely delivery of reports to users, Average response time, Average availability time, Volume of data stored, Mean time between failures, etc.

IT Compliance Performance Measures 

IT Corporate procedures not documented and kept current, IT Corporate committee not established, IT Corporate committee not functioning, IT Personnel management controls not followed, IT procedures not followed, IT Budget not followed, IT Visitors not recorded, IT Problem solutions not recorded, Security incidents not recorded, etc.

The IT management of the company, may, depending on various aspects of the organization, analyze all this performance and compliance monitoring information to review, assess and improve the elements of the IT function and the given IT activities of the specific organization.

---------------------------------------------------------------------------------------------------------------
* For more detail information on IT Performance and related Controls, see the book:

'IT STRATEGIC AND OPERATIONAL CONTROLS'
PRINTED VERSION:                www.itgovernance.co.uk/products/3066

E-BOOK FORMAT VERSION:    www.itgovernance.co.uk/products/3067

CUSTOMISABLE IT AUDIT PROGRAMMES AND CHECKLISTS (WORD FORMAT): www.itgovernance.co.uk/products/3143

Author: John Kyriazoglou

Publisher: IT Governance Publishing

ISBN: 9781849280617

Pages: 686

Format: Softcover

Published date: 2 September 2010

IT SYSTEMS AUDITING (ΕΛΕΓΧΟΣ ΣΥΣΤΗΜΑΤΩΝ ΠΛΗΡΟΦΟΡΙΚΗΣ)

IT SYSTEMS AUDITING (ΕΛΕΓΧΟΣ ΣΥΣΤΗΜΑΤΩΝ ΠΛΗΡΟΦΟΡΙΚΗΣ)

Του Ιωάννη Κυριαζόγλου*, CICA, M.S, B.A(Honours), Συμβούλου Πληροφορικής και Συγγραφέα (jkyriazoglou@hotmail.com)

  Τα πιο κρίσιμα περιουσιακά στοιχεία κατά τον 21^ο αιώνα, για τις ιδιωτικές επιχειρήσεις και δημόσιους οργανισμούς και φορείς, και γενικά για την παγκόσμια κοινωνία και οικονομία (τοπική, εθνική, διεθνή, κ.λπ.), δεν είναι τα κτίρια, οι εγκαταστάσεις, οι μηχανές, τα εργοστάσια, τα χρήματα, οι πιστώσεις, οι μετοχές, οι επιχορηγήσεις, τα δάνεια, το λογισμικό υπολογιστών (computer software), οι υπολογιστές (computers), κ.λπ., δηλ. η φυσική περιουσία, η οικονομική περιουσία, ή η πληροφοριακή περιουσία.
Τα πιο κρίσιμα περιουσιακά στοιχεία είναι η γνώση, οι έννοιες και οι ιδέες που είναι αποθηκευμένες στους εγκεφάλους των ανθρώπων, και σε πολλές περιπτώσεις, τουλάχιστον σε σύγχρονες επιχειρήσεις και οργανισμούς, είναι καταχωρημένες σε βάσεις δεδομένων που συντηρούνται από αυτοματοποιημένα πληροφοριακά συστήματα, είτε σε προσωπικούς υπολογιστές είτε και σε κεντρικά υπολογιστικά συστήματα.

Η υπολογιστική τεχνολογία και οι συγγενείς υποδομές, τα αυτοματοποιημένα πληροφοριακά συστήματα, η εθνική, διεθνής ή και επιχειρησιακή υποδομή δικτύωσης (το λεγόμενο ‘network backbone’) και οι συμπληρωματικές τεχνολογίες αποθήκευσης μαζικών πληροφοριών παρέχουν σε όλους, και στα πλαίσια λειτουργίας εταιρειών και οργανισμών, όλες τις απαραίτητες πληροφορίες και λεπτομερειακά στοιχεία για την λειτουργία της συγκεκριμένης οργάνωσης (επιχείρησης, οργανισμού, κ.λπ.), άμεσα, έγκυρα και με σχετική ασφάλεια (συνήθως).

Όλα αυτά τα τεχνολογικά στοιχεία, που γενικά απαρτίζουν την τεχνολογία πληροφορικής (IT: Information Technology), και τα συναφή πληροφοριακά συστήματα (IS: Information Systems) που λειτουργούν με βάση και εντός αυτού του τεχνολογικού πλαισίου, παρέχουν τα εξής οφέλη στις σύγχρονες επιχειρήσεις και οργανισμούς (ενδεικτικά): Πιο γρήγορη και πιο αποτελεσματική πληροφόρηση για την λήψη αποφάσεων σε όλα τα επίπεδα της οργάνωσης,  Αυξημένη ανταγωνιστικότητα σε όλες τις υπηρεσίες που προσφέρονται από την συγκεκριμένη οργανωτική μονάδα, Βελτιωμένες παραγωγικές επεξεργασίες και διαχειριστικές διαδικασίες, και Καλύτερη ποιότητα σε προϊόντα και υπηρεσίες στους πελάτες (για ιδιωτικές επιχειρήσεις), πολίτες (για δημόσιους οργανισμούς), και για την κοινωνία και οικονομία (γενικότερα).

Με δεδομένο τον γρήγορο ρυθμό ανάπτυξης της πληροφοριακής και υπολογιστικής τεχνολογίας, ένα ρυθμό χωρίς προηγούμενο στην ιστορία της ανθρωπότητας, είναι τώρα ακόμη πιο εύκολο για τις επιχειρήσεις και οργανισμούς να μεταβιβάσουν (σχεδόν) όλες τις επιχειρηματικές τους συναλλαγές και λειτουργίες να εκτελούνται από ολοκληρωμένα πληροφοριακά συστήματα.
Αυτά τα συστήματα είναι σαν φάρμακα. Ενδυναμώνουν τον συγκεκριμένο οργανισμό (ή επιχείρηση) και τον διευκολύνουν να θεραπεύσει ή επιλύσει ένα συγκεκριμένο πρόβλημα ή λειτουργική αστοχία.

Με βάση το παράδειγμα αυτό (δηλ. των φαρμάκων), εάν αυτά τα συστήματα  δεν χρησιμοποιηθούν με πειθαρχεία, μπορεί να δημιουργήσουν χαώδεις καταστάσεις και πολλές φορές όχι τα αναμενόμενα αποτελέσματα. Ακόμη και την μερική ή ολική καταστροφή.

Αυτά τα ολοκληρωμένα πληροφοριακά συστήματα πρέπει, λοιπόν, να λειτουργήσουν εντός ενός επιχειρησιακού περιβάλλοντος που διέπεται από κανόνες, πολιτικές και  διαδικασίες και ένα σύστημα διαχείρισης κινδύνων. Αυτά συνολικά απαρτίζουν το πλαίσιο εταιρικής διακυβέρνησης το οποίο, στην περίπτωση των πληροφοριακών συστημάτων, συμπληρώνεται και από ένα πλαίσιο τεχνολογικής διακυβέρνησης. Όπως έχει αναφέρει ο διάσημος καθηγητής πληροφορικής του ΜΙΤ (Η.Π.Α.) N. Negreponte (βλέπε: ‘Being Digital’, Alfred A. Knopf, New York, U.S.A., 1995): ‘Η επόμενη δεκαετία θα αναδείξει περιπτώσεις ζημιών και βλαβών σε προϊόντα πνευματικής φύσης (π.χ., παραβίαση πνευματικής ιδιοκτησίας), και παράνομης πρόσβασης της ιδιωτικής ζωής μας. Θα έχουμε εμπειρίες ψηφιακού βανδαλισμού, πειρατείας λογισμικού και κλοπής δεδομένων’.

Αυτά έχουν αποδειχθεί στην πράξη. Επεισόδια ασφάλειας και άλλα συμβάντα ηλεκτρονικών εγκλημάτων και παράνομων πράξεων με την βοήθεια ή με βάση την τεχνολογία των ηλεκτρονικών υπολογιστών και επικοινωνιών έχουν ολοένα και μεγαλύτερη αυξητική τάση (Βλέπε:www.fbi.gov, www.parliament.uk, www.infosyssec.net).

Και όπως ο ‘διαβόητος’ Kevin D. Mitnick, συγγραφέας, σύμβουλος ασφαλείας πληροφορικής και φυλακισμένος για εγκλήματα μέσω ηλεκτρονικών υπολογιστών (1995, Η.Π.Α.) έχει γράψει: ‘Πληροφορίες που έχουν αξία πρέπει α προστατευθούν ανεξάρτητα από τον τρόπο ή πού είναι αυτές αρχειοθετημένες. Ένας κατάλογος πελατών έχει την ίδια αξία ανεξάρτητα από την μορφή του (εκτυπωμένος η αποθηκευμένος σε ηλεκτρονικό αρχείο) και τον χώρο φύλαξής του (γραφείο ή ψηφιακή αρχειοθήκη). Οι εισβολείς που χρησιμοποιούν τρόπους κοινωνικής επαφής, οι λεγόμενοι ‘social engineers’, πάντα προτιμούν τον ευκολότερο τρόπο να εισβάλουν σε ένα αδύνατο και αφύλακτο σημείο του πληροφοριακού συστήματος’.

Επίσης ο έλεγχος συστημάτων πληροφορικής (IT auditing) θα βελτιώσει την ποιότητα των πληροφοριών, δηλ., αποτελεσματικότητα, αποδοτικότητα, εμπιστευτικότητα, διαθεσιμότητα, συμμόρφωση, εγκυρότητα και αντοχή,  σύμφωνα με το Διεθνές Ινστιτούτο Ελεγκτών Πληροφορικής (ISACA: www.isaca.org).
Η απάντηση για τους διευθυντές και ηγέτες οργανισμών είναι να σχεδιάσουν για αυτό το νέο επιχειρησιακό περιβάλλον λειτουργίας με τα σωστά εργαλεία, μεθοδολογίες και πόρους.

Σε όλους τους τύπους των επιχειρήσεων και δημόσιων οργανισμών, τα επιχειρησιακά μέτρα ελέγχου (corporate controls) απαρτίζονται από ένα σύνολο πολιτικών, διαδικασιών, τεχνικών, μεθόδων και πρακτικών εφαρμογής για την διοίκηση και έλεγχο των επιχειρησιακών λειτουργιών.
Εντός αυτού του επιχειρησιακού πλαισίου ελέγχου τα μέτρα ελέγχου πληροφορικής (IT Controls) καθορίζονται ως συγκεκριμένες ενέργειες, συνήθως αποτυπωμένες σε πολιτικές, διαδικασίες, πρακτικές εφαρμογής, κ.λπ., που εκτελούνται από ανθρώπους, εξοπλισμό ηλεκτρονικών υπολογιστών και επικοινωνιών, ή και λογισμικό (software) με μόνο στόχο την διαβεβαίωση επίτευξης των συγκεκριμένων επιχειρησιακών στόχων.
Η γενική κατεύθυνση και αναγκαιότητα των μέτρων ελέγχου πληροφορικής σχετίζονται με την ασφαλή επεξεργασία, εμπιστευτικότητα και διαθεσιμότητα των δεδομένων και την γενικότερη διοίκηση της διεύθυνσης πληροφορικής της επιχείρησης ή οργανισμού.

Τα μέτρα ελέγχου πληροφορικής διαχωρίζονται σε γενικά μέτρα ελέγχου πληροφορικής (IT General Controls) και σε μέτρα ελέγχου πληροφοριακών εφαρμογών (IT Application Controls), σύμφωνα με διάφορες πηγές (www.isaca.org, www.theiia.org, www.itpi.org).

Γενικά μέτρα ελέγχου πληροφορικής είναι τα μέτρα που εφαρμόζονται σε όλες τις δραστηριότητες της πληροφορικής (συστήματα, υπηρεσίες, θέματα, επεξεργασίες, συναλλαγές, κ.λπ.) και στα δεδομένα της επιχείρησης ή οργανισμού σε ένα συγκεκριμένο περιβάλλον πληροφορικής. Αφορούν περιοχές όπως: στρατηγική, ανάπτυξη και συντήρηση συστημάτων, λειτουργία κέντρου δεδομένων, τράπεζες δεδομένων, λειτουργικό σύστημα, κλπ.

Τα μέτρα ελέγχου πληροφοριακών εφαρμογών είναι τα μέτρα που αρμόζουν στην επεξεργασία συναλλαγών από συγκεκριμένα πληροφοριακά συστήματα, όπως: γενική λογιστική, διαχείριση προσωπικού, πωλήσεις, έλεγχος αποθηκών, μισθοδοσία, κ.λπ.
Σχετίζονται δε, με την επεξεργασία και αποθήκευση δεδομένων σε ψηφιακά αρχεία και βάσεις δεδομένων, βασισμένα και οργανωμένα από συστήματα ηλεκτρονικών υπολογιστών και συγκεκριμένων εφαρμογών και προγραμμάτων εφαρμογών, και που έχουν στόχο την διαβεβαίωση ότι όλες οι επιχειρησιακές συναλλαγές είναι εγκεκριμένες, και επεξεργάζονται και αποθηκεύουν και αναφέρουν τα αποτελέσματά των με ακρίβεια, ασφάλεια και εγκυρότητα.

Τα οφέλη των μέτρων ελέγχου πληροφορικής, είναι συνήθως:

(1) Κατανόηση των κινδύνων ανάπτυξης και λειτουργίας συστημάτων πληροφορικής.

(2) Βελτίωση των εργασιών σχεδιασμού, ανάπτυξης, εφαρμογής και ελέγχου νέων και υπαρχόντων συστημάτων πληροφορικής,

(3) Αύξηση της ικανότητας της διοίκησης στην επίτευξη στρατηγικών στόχων.

(4) Διαβεβαίωση υψηλών προτύπων των συστημάτων και υποδομών πληροφορικής σε όλες τις επιχειρήσεις και οργανισμούς.

---------------------------------------------------------------------------------------------------------------

* Για περισσότερα στο θέμα ‘Μέτρα Ελέγχου Πληροφορικής’ βλέπε το βιβλίο:

'IT STRATEGIC AND OPERATIONAL CONTROLS'

PRINTED VERSION:                www.itgovernance.co.uk/products/3066

E-BOOK FORMAT VERSION:    www.itgovernance.co.uk/products/3067

CUSTOMISABLE IT AUDIT PROGRAMMES AND CHECKLISTS (WORD FORMAT): www.itgovernance.co.uk/products/3143

Author: John Kyriazoglou

Publisher: IT Governance Publishing

ISBN: 9781849280617
Pages: 686

Format: Softcover

Published date: 2 September 2010

IT CONTROLS IN BUSINESS OPERATIONS

IT CONTROLS IN BUSINESS OPERATIONS

John Kyriazoglou, CICA, M.S, B.A (Honours), IT & Management Consultant and Author of the book 'IT STRATEGIC AND OPERATIONAL CONTROLS'

(www.itgovernance.co.uk, and www.itgovernanceusa.com)

 “It is possible to fail in many ways, while to succeed is possible only in one way”

                                                                        Aristotle (384 B.C. – 322 B.C.)

 “The global information society is increasingly dependent on electronic networking and exchanging ‘electronic goods’ with high economic value, both in private life and in business.”

                        Prof. Heinz Thielmann, Fraunhofer Institute, Germany (2006)

The most critical assets, in the 21st century, for the private and public enterprises, for organizations in general, for the global society, and for the economy (local, national, international) are not of physical nature (equipment, machines, installations, plants), or of financial nature (money, credit or other financing instruments), or of computer software nature.

The most critical assets are the knowledge and ideas (concepts) that exist in the brains of people, which are stored in computerized systems (personal and corporate), in the modern business environment.

The computer technology and related infrastructure, the information systems, the network backbone (intranet, extranet, metropolitan, Internet, etc.) and related media technologies give everyone, within a given organizational environment, direct access to what is going on: within the given organization, in the industrial sector to which it belongs, and in the general economy and market in which it operates.

All these technological components, broadly termed Information Technology (IT) and the related Information Systems (IS) which operate within its realm enable the modern private and public corporation and/or organization to accrue the following benefits (indicative only):

(1) Quicker and more effective information for decision-making at all levels,

(2) Increased competition in all services of the firm,

(3) Improved production processes and procedures, and

(4) Higher quality in products and services offered by information systems to customers (and citizens) and society in general.

Given the rate of development of the information processing and computer manufacturing technologies and processes, a rate without a precedent in the history of man-kind, it is possible now for organizations to transfer almost all of their daily business operations to be carried out by integrated information systems.

These systems are like medical drugs, either strengthening the organization, or enabling it to cure or resolve a particular problem or operating malfunction.

But, using the drug analogy, if these systems are not used in a disciplined manner, they can create havoc and many times bring about not the expected results and even catastrophe.

These integrated information systems must therefore operate within a business environment which is ruled by the rules, policies, regulations and instructions of a corporate governance framework and a related information technology governance framework.

As Negroponte has said (see Nicholas Negroponte: “Being Digital”, Alfred A. Knopf, N. York, U.S.A., 1995): “The next decade will see cases intellectual property abuse and invasion of our privacy. We will experience digital vandalism, software piracy and data thievery”.

This has definitely been proven correct. Security incidents and other acts of electronic and computer-based crimes are on the rise (as per www.cert.org and other security-related sites).

And as the notorious Mitnick has said (see book by Kevin. D. Mitnick and William L. Simor: “The art of deception”, Wiley, 2002): “Valuable information must be protected no matter what forum it takes or where it is located. An organization’s customer list has the same value whether in hard-copy form or an electronic file at your office or in a storage box. Social engineers always prefer the easiest to circumvent, least defended point of attack. A company’s offsite backup storage facility is seen as having less risk of detection or getting caught. Every organization that stores any valuable, sensitive, or critical data with third parties should encrypt their data to protect its confidentiality”.

Also IT auditing will enhance the qualities of information (effectiveness, efficiency, confidentiality, integrity, availability, compliance, reliability) according to ISACA (www.isaca.org).

The answer for managers and leaders of organizations is to plan for this new operating environment with the proper tools, methodologies and resources.

Never forget that because organizations differ, their control needs also will differ. For example, all groups need change management, but how it's implemented will depend on the enterprise. Delving into the work instruction level, access controls are needed, but how they are handled on a mainframe vs. a Windows network will vary. The point is that you will need to tune your policies, procedures and work instructions not only to meet the spirit of the controls but also to be feasible in the context of your organization.

In almost all types of organizations, both private and public, corporate controls denote the set of policies, procedures, techniques, methods, and practices to manage and control their business operations.

Within this corporate controls governance framework Information Technology controls (or IT controls) are specific actions, usually specified by policies, procedures, practices, etc., performed by persons, hardware or software with the main objective to ensure that specific business objectives are met.

The overall guiding aim of IT controls relate to the secure processing, confidentiality, integrity, and availability of data and the overall management of the IT function of the organizations.

IT controls are commonly described in two categories according to various sources (www.isaca.org", www.isaca.org, www.theiia.org, www.theiia.org, www.itpi.org): IT General Controls and IT Application Controls.

IT General Controls are those controls that are applicable to all IT activities (systems, services, issues, processes, operations, etc.) and data for a given organization or IT systems environment. They include controls over such areas as the strategy for IT, systems development, data center operations, data base and data communications infrastructure, systems software support and maintenance, IT security, and ready-made application systems acquisition, development and maintenance.

IT Application controls are those controls that are appropriate for transaction processing by individual computerized subsystems, such as financial accounting, personnel administration, customer sales, inventory control, payroll or accounts payable, etc.

They relate to the processing and storing of data in computer-based files by individual IT applications and help ensure that business transactions occurred, are authorized, and are completely and accurately recorded, stored, processed, and reported. 

Benefits of the existence of IT Controls to business include:

(1) Understand and control the associated risks of IT systems.

(2) Improve the process of designing, implementing and auditing new and existing IT systems.

(3) Increase management’s aptitude to achieve operational goals. With well-controlled, integrated and robust IT systems, you can gain a comparative advantage in a competitive environment, whilst ensuring that information is relevant, accurate and timely.

(4) Ensure high standards within your IT systems.

BENEFITS OF IT CONTROLS

BENEFITS OF IT CONTROLS

John Kyriazoglou*, CICA, M.S, B.A(Honours), IT Consultant and Author (jkyriazoglou@hotmail.com)    

“It is possible to fail in many ways, while to succeed is possible only in one way”

                                                                        Aristotle (384 B.C. – 322 B.C.)

“Computers are useless. They only give you answers”

                                                            Pablo Picasso (1881 – 1973)

“The global information society is increasingly dependent on electronic networking and exchanging ‘electronic goods’ with high economic value, both in private life and in business.”
                        Prof. Heinz Thielmann, Fraunhofer Institute, Germany (2006)

The most critical assets, in the 21st century, for the private and public enterprises, for organizations in general, for the global society, and for the economy (local, national, international) are not of physical nature (equipment, machines, installations, plants), or of financial nature (money, credit or other financing instruments), or of computer software nature.

The most critical assets are the knowledge and ideas (concepts) that exist in the brains of people, which are stored in computerized systems (personal and corporate), in the modern business environment.

The computer technology and related infrastructure, the information systems, the network backbone (intranet, extranet, metropolitan, Internet, etc.) and related media technologies give everyone, within a given organizational environment, direct access to what is going on: within the given organization, in the industrial sector to which it belongs, and in the general economy and market in which it operates.

All these technological components, broadly termed Information Technology (IT) and the related Information Systems (IS) which operate within its realm enable the modern private and public corporation and/or organization to accrue the following benefits (indicative only):

(1) Quicker and more effective information for decision-making at all levels,

(2) Increased competition in all services of the firm,

(3) Improved production processes and procedures, and

(4) Higher quality in products and services offered by information systems to customers (and citizens) and society in general.

Given the rate of development of the information processing and computer manufacturing technologies and processes, a rate without a precedent in the history of man-kind, it is possible now for organizations to transfer almost all of their daily business operations to be carried out by integrated information systems.

These systems are like medical drugs, either strengthening the organization, or enabling it to cure or resolve a particular problem or operating malfunction.

But, using the drug analogy, if these systems are not used in a disciplined manner, they can create havoc and many times bring about not the expected results and even catastrophe.

These integrated information systems must therefore operate within a business environment which is ruled by the rules, policies, regulations and instructions of a corporate governance framework and a related information technology governance framework.

As Negroponte has said (see Nicholas Negroponte: “Being Digital”, Alfred A. Knopf, N. York, U.S.A., 1995): “The next decade will see cases intellectual property abuse and invasion of our privacy. We will experience digital vandalism, software piracy and data thievery”.

This has definitely been proven correct. Security incidents and other acts of electronic and computer-based crimes are on the rise (as per www.cert.org and other security-related sites).

And as the notorious Mitnick has said (see book by Kevin. D. Mitnick and William L. Simor: “The art of deception”, Wiley, 2002): “Valuable information must be protected no matter what forum it takes or where it is located. An organization’s customer list has the same value whether in hard-copy form or an electronic file at your office or in a storage box. Social engineers always prefer the easiest to circumvent, least defended point of attack. A company’s offsite backup storage facility is seen as having less risk of detection or getting caught. Every organization that stores any valuable, sensitive, or critical data with third parties should encrypt their data to protect its confidentiality”.

Also IT auditing will enhance the qualities of information (effectiveness, efficiency, confidentiality, integrity, availability, compliance, reliability) according to ISACA (www.isaca.org).

The answer for managers and leaders of organizations is to plan for this new operating environment with the proper tools, methodologies and resources.

Never forget that because organizations differ, their control needs also will differ. For example, all groups need change management, but how it's implemented will depend on the enterprise. Delving into the work instruction level, access controls are needed, but how they are handled on a mainframe vs. a Windows network will vary. The point is that you will need to tune your policies, procedures and work instructions not only to meet the spirit of the controls but also to be feasible in the context of your organization.

In almost all types of organizations, both private and public, corporate controls denote the set of policies, procedures, techniques, methods, and practices to manage and control their business operations.

Within this corporate controls governance framework Information Technology controls (or IT controls) are specific actions, usually specified by policies, procedures, practices, etc., performed by persons, hardware or software with the main objective to ensure that specific business objectives are met.

The overall guiding aim of IT controls relate to the secure processing, confidentiality, integrity, and availability of data and the overall management of the IT function of the organizations.

IT controls are commonly described in two categories according to various sources (www.isaca.org", www.isaca.org, www.theiia.org, www.theiia.org, www.itpi.org): IT General Controls and IT Application Controls.
IT General Controls are those controls that are applicable to all IT activities (systems, services, issues, processes, operations, etc.) and data for a given organization or IT systems environment. They include controls over such areas as the strategy for IT, systems development, data center operations, data base and data communications infrastructure, systems software support and maintenance, IT security, and ready-made application systems acquisition, development and maintenance.

IT Application controls are those controls that are appropriate for transaction processing by individual computerized subsystems, such as financial accounting, personnel administration, customer sales, inventory control, payroll or accounts payable, etc.

They relate to the processing and storing of data in computer-based files by individual IT applications and help ensure that business transactions occurred, are authorized, and are completely and accurately recorded, stored, processed, and reported. 

Benefits of the existence of IT Controls to business include:

(1) Understand and control the associated risks of IT systems.

(2) Improve the process of designing, implementing and auditing new and existing IT systems.

(3) Increase management’s aptitude to achieve operational goals. With well-controlled, integrated and robust IT systems, you can gain a comparative advantage in a competitive environment, whilst ensuring that information is relevant, accurate and timely.

(4) Ensure high standards within your IT systems.

---------------------------------------------------------------------------------------------------------------

* For more information on IT Controls, see the book:

'IT STRATEGIC AND OPERATIONAL CONTROLS'

PRINTED VERSION:                www.itgovernance.co.uk/products/3066

E-BOOK FORMAT VERSION:    www.itgovernance.co.uk/products/3067

CUSTOMISABLE IT AUDIT PROGRAMMES AND CHECKLISTS (WORD FORMAT): www.itgovernance.co.uk/products/3143

Author: John Kyriazoglou

Publisher: IT Governance Publishing

ISBN: 9781849280617

Pages: 686

Format: Softcover

Published date: 2 September 2010