Chapter 5 : IS Audit - আৰবিআই - Reserve Bank of India
Chapter 5 : IS Audit
Introduction: In the past decade, with the increased technology adoption by Banks, the complexities within the IT environment have given rise to considerable technology related risks requiring effective management. This led the Banks to implement an Internal Control framework, based on various standards and its own control requirements and the current RBI guidelines. As a result, Bank’s management and RBI, need an assurance on the effectiveness of internal controls implemented and expect the IS Audit to provide an independent and objective view of the extent to which the risks are managed. As a consequence, the nature of the Internal Audit department has undergone a major transformation and IS audits are gaining importance as key processes are automated, or enabled by technology. Hence, there is a need for banks to re-assess the IS Audit processes and ensure that IS Audit objectives are effectively met. The scope of IS Audit includes:
Following areas have been covered under this chapter:
Board of Directors and Senior Management Board of Directors and senior management are responsible for ensuring that an institution’s system of internal controls operates effectively. One important element of an effective internal control system is an internal audit function that includes adequate IT coverage. To meet its responsibility of providing an independent audit function with sufficient resources to ensure adequate IT coverage, the Board, or its Audit Committee, should enable an internal audit function, capable of evaluating IT controls adequately. Audit Committee of the Board An institution’s board of directors establishes an “Audit Committee” to oversee audit functions and to report on audit matters periodically to the Board of Directors. Banks should enable adequately skilled Audit Committee composition to manage the complexity of the IS Audit oversight. A designated member of an Audit Committee needs to possess the knowledge of Information Systems, related controls and audit issues. Designated member should also have competencies to understand the ultimate impact of deficiencies identified in IT internal control framework by the IS Audit. The committee should devote appropriate time to IS audit findings identified during IS Audits and members of the Audit Committee need to review critical issues highlighted and provide appropriate guidance to a bank’s management. As a part of its overall responsibilities, the committee should also be ultimately responsible for the following IS Audit areas:
Internal Audit/Information System Audit function Internal Audit is a part of the Board’s assurance process with regard to the integrity and effectiveness of systems and controls. It is an independent group that reports directly to the Audit Committee or the Board of Directors. IS Audit, being an integral part of Internal Audit, requires an organisation structure with well-defined roles which needs to function in alignment with the Internal Audit, and provide technical audit support on key focus areas of audit or its universe, identified by an Internal Audit department. A well-defined IS Audit organisation structure ensures that the tasks performed fulfill a bank’s overall audit objective, while preserving its independence, objectivity and competence. In this regard, banks require a separate IS Audit function within an Internal Audit department led by an IS Audit Head reporting to the Head of Internal Audit or Chief Audit Executive (CAE). The personnel needs to assume overall responsibility and accountability of IS Audit functions. Where the bank leverages external resources for conducting IS Audit on areas where skills are lacking, the responsibility and accountability for such external IS Audits still remain with the IS Audit Head and CAE. Critical Components and Processes (i) Because the IS Audit is an integral part of the Internal Auditors, auditors will also be required to be independent, competent and exercise due professional care. Independence: IS Auditors should act independently of the bank's management. In matters related to the audit, the IS Audit should be independent of the auditee, both in attitude and appearance. The Audit Charter or Policy, or engagement letter (in case of external professional service provider), should address independence and accountability of the audit function. In case independence is impaired (in fact or appearance), details of the impairment should be disclosed to the Audit Committee or Board. Independence should be regularly assessed by the Audit Committee. In case of rotation of audit staff members from IT department to the IS Audit, care should be taken to ensure that the past role of such individuals do not impact their independence and objectivity as an IS Auditor. Additionally, to ensure independence for the IS Auditors, Banks should make sure that:
Competence: IS Auditors should be professionally competent, having skills, knowledge, training and relevant experience. They should be appropriately qualified, have professional certifications and maintain professional competence through professional education and training. As IT encompasses a wide range of technologies, IS Auditors should possess skills that are commensurate with the technology used by a bank. They should be competent audit professionals with sufficient and relevant experience. Qualifications such as CISA (offered by ISACA), DISA (offered by ICAI), or CISSP (offered by ISC2), along with two or more years of IS Audit experience, are desirable. Similar qualification criteria should also be insisted upon, in case of outsourced professional service providers. Due Professional Care: IS Auditors should exercise due professional care, which includes following the professional auditing standards in conducting the audit. The IS Audit Head should deal with any concerns in applying them during the audit. IS Auditors should maintain the highest degree of integrity and conduct. They should not adopt methods that could be seen as unlawful, unethical or unprofessional to obtain or execute an audit. (ii) Outsourcing relating to IS Audit Banks may decide to outsource execution of segments of audit plan to external professional service providers, as per the overall audit strategy decided in co-ordination with the CAE and the Audit Committee. This may be due to inadequate staff available internally within the bank to conduct audits, or insufficient levels of skilled staff. The work outsourced shall be restricted to execution of audits identified in the plan. Banks need to ensure that the overall ownership and responsibility of the IS Audit, including the audit planning process, risk assessment and follow-up of compliance remains within the bank. External assistance may be obtained initially to put in place necessary processes in this regard. Both the CAE and Audit Committee should ensure that the external professional service providers appointed should be competent in the area of work that is outsourced and should have relevant prior experience in that area. 2). Audit Charter, Audit Policy to include IS Audit Audit Charter or Policy is a document, which guides and directs activities of an internal audit function. IS Audit, being integral part of an Internal Audit department, should also be governed by the same charter or policy. The charter should be documented to contain a clear description of its mandate, purpose, responsibility, authority and accountability of relevant members or officials in respect of the IS Audit (namely the IS Auditors, management and Audit Committee) apart from the operating principles. The IS Auditor will have to determine how to achieve the implementation of the applicable IS Audit standards, use professional judgement in their application, and be prepared to justify any departure therefrom. (a) Contents of the Audit Policy The Policy should clearly address the aspects of responsibility, authority and accountability of the IS auditor. Aspects to be considered: Responsibility: Some of the aspects include : Authority: Includes the following: Accountability: Some of the aspects in this regard include the following: 1. Reporting Lines to Senior Management, Board of Directors or Designated Authority The policy should also cover Audit Rating Methodology and Quality Assurance Reviews. There should also be annual review of IS Audit Policy or Charter to ensure continued relevance. (b) Communication with the Auditees Effective communication with the auditees involves considering the following:
The Audit Charter forms a basis for communication with an auditee. It should include relevant references to service-level agreements for aspects like the following, as applicable:
(c) Quality Assurance Process The IS Auditor should consider establishing a quality assurance process (e.g., interviews, customer satisfaction surveys, or assignment performance surveys) to understand his expectations relevant to the function. These needs should be evaluated against the Charter, to improve the service or change the service delivery or Audit Charter, if necessary. (d) Engagement Letter Engagement letters are often used for individual assignments. They set out the scope and objectives of a relationship between an external IS audit agency and an organisation. The letter should address the three aspects of responsibility, authority and accountability. Following aspects needs to be considered: Responsibility: The aspects addressed includes scope, objectives, independence, risk assessment, specific auditee requirements and deliverables Authority: The aspects to be addressed include right of access to information, personnel, locations and systems relevant to the performance of the assignment, scope or any limitations of scope and documentary evidence or information of agreement to the terms and conditions of the engagement Accountability: Areas addressed include designated or intended recipients of reports, auditees’ rights, quality reviews, agreed completion dates and agreed budgets or fees if available 3) Planning an IS Audit (a) Introduction An effective IS Audit programme addresses IT risk exposures throughout a bank, including areas of IT management and strategic planning, data centre operations, client or server architecture, local and wide-area networks, telecommunications, physical and information security, electronic banking, applications used in banking operations, systems development, and business continuity planning. A well-planned, properly structured audit programme is essential to evaluate risk management practices, internal control systems and compliance with policies concerning IT-related risks of every size and complexity. Effective programmes are risk-focused, promote sound IT controls, ensure timely resolution of audit deficiencies, and inform the Audit Committee of the effectiveness of Risk Management practices and internal control systems. In the past, the Internal Audit concentrated on transaction testing, testing of accuracy and reliability of accounting records and financial reports, integrity, reliability and timeliness of control reports, and adherence to legal and regulatory requirements. However, in the changing scenario, there is an increased need for widening, as well as redirecting, the scope of Internal Audit to evaluate the adequacy of IT Risk Management procedures and internal control systems. To achieve these, banks are moving towards risk-based internal audit, which include, in addition to selective transaction testing, an evaluation of the Risk Management systems and control procedures prevailing in a bank’s operations. Risk-based Internal Audit (RBIA) approach helps in planning the IS Audit. It includes the following components:
Steps involved are:
As a part of RBIA, planning the IS Audit involves the following:
The above components are clarified in the sub-sections below: (b) Risk Based IS Audit This internal audit approach is aimed at developing a risk-based audit plan keeping in mind th inherent risks of a business or location and effectiveness of control systems managing inherent risks. In this approach, every bank business or location, including risk management function, undergoes a risk assessment by the internal audit function. RBI issued the “Guidance Note on Risk-based Internal Audit” in 2002 to all scheduled commercial banks, introducing the system of “risk-based internal audit”. The guidance note at a broad-level provided the following aspects:
The overall plan, arrived at, using the risk assessment approach enables the Internal Audit to identify and examine key business areas that have highest exposure and enables effective allocation of Audit resources. As stated earlier, IS Audit, being an integral part of the Internal Audit, there is a need for IS Auditors to focus on the IT risks, related to the high-risk business areas identified by the Internal Audit for review during a year. This enables the IS Audit to provide an assurance to the management on the effectiveness of risk management and internal controls underlying the high-risk business processes, which when read in conjunction with the Internal Audit reports, provides a holistic view of the effectiveness. Risk-based IS Audit needs to consider the following:
Further, while identifying IT risks, an IS Auditor must consider the impact of non-alignment with any information security-related guidelines issued by RBI based on recommendations in Chapter 2 of this report. It should also be ensured that all systems, domains and processes, irrespective of their risk-levels, are covered within a period of three years. (c) Adopting a Suitable Risk Assessment Methodology The IS Auditor must define, adopt and follow a suitable risk assessment methodology. This should be in consonance with the focus on risks, to be addressed as a part of the overall Internal Audit Strategy. A successful risk-based IS Audit Programme can be based on an effective scoring system arrived at by considering all relevant risk factors. Major risk factors used in scoring systems include: Adequacy of internal controls, business criticality, regulatory requirements, amount or value of transactions processed, if a key customer information is held, customer facing systems, financial loss potential, number of transactions processed, availability requirements, experience of management and staff, turnover, technical competence, degree of delegation, technical and process complexity, stability of application, age of system, training of users, number of interfaces, availability of documentation, extent of dependence on the IT system, confidentiality requirements, major changes carried out, previous audit observations and senior management oversight. On the basis of risk matrix of business criticality and system or residual risk, applications or systems can be graded, based on where they fall on the “risk map” and accordingly their audit frequency can be decided. Banks should develop written guidelines on the use of risk assessment tools and risk factors and review these with the Audit Committee or the Board. Risk assessment guidelines will vary for banks depending on size, complexity, scope of activities, geographic diversity and technology systems used. Auditors should use the guidelines to grade major risk areas and define range of scores or assessments (e.g., groupings such as low, medium, or high risk or a numerical sequence such as 1 to 5). The written risk assessment guidelines should specify the following elements:
Notwithstanding the above, IT governance, information security governance-related aspects, critical IT general controls such as data centre controls and processes and critical business applications/systems having financial/compliance implications, including regulatory reporting, risk management, customer access (delivery channels) and MIS systems, needs to be subjected to IS Audit at least once a year (or more frequently, if warranted by the risk assessment). IS Auditors should periodically review results of internal control processes and analyse financial or operational data for any impact on a risk assessment or scoring. Accordingly, auditee units should be required to keep auditors up-to-date on major changes, such as introduction of a new product, implementation of a new system, application conversions, significant changes in organisation or staff, regulatory and legal requirements, security incidents. (d) Defining the IS Audit Universe An Audit Universe is an outcome of the risk assessment process. It defines the audit areas to be covered by the IS Auditor. It is usually a high-level structure that identifies processes, resources, risks and controls related to IT, allowing for a risk-based selection of the audit areas. The IT risks faced by banks due to emerging technologies, prioritisation of IS Audit Universe, selection of types of audits that need to be performed, optimisation of available resources, and ensuring quality of findings, are challenges faced by IS Audit. The IS Audit Universe can be built around the four types of IT resources and processes: Such as application systems, information or data, infrastructure (technology and facilities such as hardware, operating systems, database management systems, networking, multimedia, and the environment that houses and supports them and enable processing of applications) and people (internal or outsourced personnel required to plan, organise, acquire, implement, deliver, support, monitor and evaluate the information systems and services). The challenge is to provide the “right level of granularity” in the definition of the universe, so as to make it effective and efficient.
An inadequate number of audit hours are spread over too many audits, which results in consistently poor quality audits, because there is not enough time. Audits that should be performed are not performed because the budget does not allow it. (e) Scoping for IS Audit Information gathered by the IS Auditors during IT risk assessment about the IT system processing and operational environment, threats, vulnerabilities, impact and controls, enables identification of the control objectives and activities to be tested for design and implementation effectiveness and its operating effectiveness. Scoping plays a crucial role in overall effectiveness. This is exacerbated by the need for the IS Auditors to integrate with the process, operational or financial auditors, and the procedures they are performing, particularly in environments with large integrated CBS applications, where a high number of key process controls are contained within the systems. IS Audits should also cover branches, with focus on large and medium branches, in areas such as control of passwords, user ids, operating system security, anti-malware, maker-checker, segregation of duties, physical security, review of exception reports or audit trails, BCP policy and or testing. Reports and circulars issued by RBI for specific areas which also need to be covered in the IS Audit Scope: Report of the Committee on Computer Audit (dated: April 2, 2002) Circular on Information System Audit–A Review of Policies and Practices (dated: April 30, 2004 (RBI/2004/191 DBS.CO.OSMOS.BC/ 11 /33.01.029/2003-04) (i) Defining Control Objectives and Activities IT control objectives, based on well known frameworks can be included in the scope. (ii) Materiality When conducting financial statement audits, Internal Auditors measure materiality in monetary terms, since areas that are audited are also measured and reported in monetary terms. However, since IS Auditors conduct audit on non-financial items, alternative measures are required to assess materiality. Such assessments are a matter of professional judgment. They include consideration of its effect on a bank as a whole, of errors, omissions, irregularities and illegal acts, which may have happened as a result of “internal control weaknesses” in an area being audited. ISACA IS Auditing Guideline G6: specifies that if the IS Audit focus relates to systems or operations that process financial transactions, the value of assets controlled by the system(s), or the value of transactions processed per day/week/month/year, should be considered in assessing materiality. In case, the focus is on systems that do not process financial transactions, then following measures should be considered:
IS Auditors should review the following additional areas that are critical and high risk such as:
(iii) Building Fraud Risk Perspective In planning and performing an audit to reduce risks to a low level, the auditor should consider the risk of irregularities and illegal acts. He should maintain professional skepticism during an audit, recognising the possibility that “material mis-statements due to irregularities and illegal acts” could exist, irrespective of their evaluation of risk of irregularities and illegal acts. IS Auditors are also required to consider and assess the risk of fraud, while performing an audit. They should design appropriate plans, procedures and tests, to detect irregularities, which can have a material effect on either a specific area under an audit, or the bank as a whole. IS Auditors should consider whether internal control weaknesses could result in material irregularities, not being prevented or detected. The auditor should design and perform procedures to test the appropriateness of internal control and risk of override of controls. They should be reasonably conversant with fraud risk factors and indicators, and assess the risk of irregularities connected with the area under audit. In pursuance to the understanding gathered during threat identification step of the IT Risk Assessment process, the suditors should identify control objectives and activities. These are required to be tested to address fraud risk. He should consider “fraud vulnerability assessments” undertaken by the “Fraud Risk Management Group”, while identifying fraud risk factors in the IT risk assessment process. He should be aware that certain situations may increase a bank’s vulnerability to fraud risk (e.g. introduction of a new line of business, new products, new delivery channels and new applications or systems.) In preparing an audit scope, auditors should consider fraud risk factors including these: 1. Irregularities and illegal acts that are common to banking industry Instances of fraud should be reported to appropriate bank stakeholders: 1. Frauds involving amounts of Rs 1 crore (and above) should be reported to Special Committee formed to monitor and follow up large fraud cases (f) Planning the Execution The IS Audit Head is responsible for the annual IS Audit Plan, prepared after considering the risk assessment and scoping document. The plan covers overall audit strategy, scoped areas, details of control objectives identified in the scoping stage, sample sizes, frequency or timing of an audit based on risk assessment, nature and extent of audit and IT resource skills availability, deployment and need for any external expertise. A report on the status of planned versus actual audits, and any changes to the annual audit plan, needs to be periodically presented to Audit Committee and Senior Management on a periodic basis. There are well-known guidance on IS Audit. The Institute of Chartered Accountants of India (ICAI), in March 2009, published the “Standard on Internal Audit (SIA) 14: Internal Audit in an Information Technology Environment” covering requirements of the planning stage, which an auditor should follow. IIA has provided guidance on defining the IS Audit Universe, through the guide issued on “Management of IS Auditing” under the “Global Technology Audit Guide” series. ITGI has provided guidance on audit planning in its “IT Assurance Guide using COBIT”. Suggested guidelines for implementation by banks are as follows: i. Documenting the Audit Plan The plan (either separately or as part of overall internal audit plan) should be a formal document, approved by the Audit Committee initially and during any subsequent major changes. The plan should be prepared so that it is in compliance with any appropriate external requirements in addition to well-known IS Auditing Standards. Audit Plan Components include:
Types of testing that can be performed are as below:
On case-to-case basis, the auditor should exercise professional judgment and decide the nature and extent of procedures that need to be adopted for conclusions. ISA 330 gives guidance on the nature, timing and extent of procedures. iii. Sampling techniques During an audit, auditors should obtain sufficient, reliable and relevant evidence to achieve their objectives. Findings and conclusions should be supported by appropriate analysis and interpretation. Auditors should consider sample selection techniques, which result in a statistically-based representative sample for performing compliance or substantive testing. Statistical sampling involves the use of techniques from which mathematically-constructed conclusions regarding the population can be drawn. Non-statistical sampling is not statistically-based. Its results should not be extrapolated over the population as a sample is unlikely to be representative of the population. Examples of compliance testing of controls where sampling could be considered, include user-access rights, programme change control procedures, procedures documentation, programme documentation, follow-up of exceptions, review of logs and software licences audits. Examples of substantive tests where sampling could be considered, include re-performance of a complex calculation (e.g., interest applied), on a sample of accounts, sample of transactions to vouch to supporting documentation, etc. Design of A Sample While designing the size and structure of an audit sample, auditors may consider the following guidelines:
Selection of A Sample – Random Sampling: It ensures that all combinations of units in the population have an equal chance of selection – Systematic Sampling: It involves selecting units using a fixed interval between selections, the first interval having a random start. Examples include “Monetary Unit Sampling” or “Value Weighted Selection”, where each individual monetary value (e.g., Rs 100) in the population, is given an equal chance of selection. As an individual monetary unit cannot ordinarily be examined separately, the item which includes that monetary unit is selected for examination. This method systematically weighs the selection in favour of the larger amounts, but gives every monetary value an equal opportunity for selection. Another example includes selecting every ‘nth sampling unit”. iv. Standards and Frameworks One challenge that the IS Auditors face is knowing what to audit against as a fully-developed IT control baselines for applications and technologies that may not have been developed. Rapid evolution of technology is likely to render baselines useless, after a period of time. However, this does not detract from the concept of control objectives. Control objectives, by definition, should remain more or less constant (from environment to environment). Consider the objective that critical business data and programmes should be backed up and recoverable. Now, each environment may do that differently; backups could be manual, or automated, or a tool may be used. They could be incremental only, or there may be complete backups of everything. Backups could be done daily, weekly, or monthly. Storage of backups could be onsite in a fireproof safe, off-site at another company facility, or outsourced to a third party. Method used by the organisation to manage backups would certainly impact the audit procedures and budget, but the control objective will not change. IS Auditor should be able to start with a set of IT control objectives, and though not specific to particular environments, select an appropriate framework. v. Resource Management A bank’s auditors play a critical role in efficiency and effectiveness of audits. IT encompasses a wide range of technology and sophistication—the skill set needed to audit a Firewall configuration is vastly different from the skill set needed to audit application controls. It is critical to match the skills needed to perform a particular IS Audit, with the appropriate auditor. IS Auditors should also have the appropriate analytical skills to determine and report the root cause of deficiencies. Bank’s hiring and training practices should ensure that it has qualified IS Auditors where education and experience should be consistent with job responsibilities. Audit management should also provide an effective programme of continuing education and development. The main issue is having staff with the requisite range of IS Audit skills, needed to audit an IS Audit universe, effectively. If internal expertise is inadequate, the Board should consider using qualified external sources, such as management consultants, independent auditors, or professionals, to supplement internal resources and support bank's objectives. 4. Executing IS Audit As mentioned earlier, auditors must understand the business and IT environment, risks and internal control framework. During audit, auditors should obtain evidences, perform test procedures, appropriately document findings, and conclude a report. This section provides guidance on matters that IS Auditor should consider while executing the Plan. ICAI, in March 2009, had published a “Standard on Internal Audit (SIA) 14: Internal Audit in an Information Technology Environment” covering the requirements of executing a plan that an IS Auditor should follow. Additionally, IIA has also provided guidance in their “Management of IS Auditing” under their “Global Technology Audit Guide” series. The ITGI has also provided guidance on execution of assurance initiative in its “IT Assurance Guide Using COBIT”. Guidance on executing the IS Audit entails the following steps:
The above are covered in the following sections: (a) Refine understanding of the business process and IT environment: The first step of the execution stage is refining the understanding of an IT environment, in which a review is being planned. This implies understanding of a bank’s business processes to confirm the correct scope and control objectives. The scope of the IS Audit need to be communicated to and agreed upon by stakeholders. Output from this step consists of documented evidence regarding:
The IS Auditor can structure this step along the following lines:
While understanding and evaluating internal controls of a bank, areas mentioned under “Scope of IS Audit” needs to be covered. However, the nature and extent of control risks may vary, depending on nature and characteristics of a bank’s information system:
This section lists the different techniques that will be used in detailed audit steps. Testing of controls is performed covering the main test objectives:
In the testing phase, different types of testing can be applied. Five generic testing methods include: 1. Enquire and confirm:
2. Inspect:
3. Compare actual with expected findings
4. Re-perform or re-calculate:
5. Review automated evidenced collection:
To assess the adequacy of the design of controls the following steps should be performed:
IS Auditor must determine whether:
Additionally, specifically in internal audit assignments, cost-effectiveness of a control design may also be verified, with the following audit steps:
(d) Test the Outcome of Control Objectives Audit steps performed ensure that control measures established are working as prescribed and conclude on the appropriateness of the control environment. To test the effectiveness of a control, the auditor needs to look for direct and indirect evidence of the control’s impact on the process outputs. This implies the direct and indirect substantiation of measurable contribution of the control to the IT, process and activity goals, thereby recording direct and indirect evidence of actually achieving the outcomes or various control objectives (based on those documented in standards like COBIT, as relevant). The auditor should obtain direct or indirect evidence for selected items or periods to ensure that the control under review is working effectively by applying a selection of testing techniques as presented in step on test of control design. The IS Auditor should also perform a limited review of the adequacy of the process deliverables, determine the level of substantive testing and additional work needed to provide assurance that the IT process is adequate. Substantive testing would involve performing analytical procedures and tests of details, to gain assurance on areas where control weaknesses are observed. Substantive testing is performed to ascertain the actual impact of control weaknesses. (e) Audit Evidence IS Auditors should obtain sufficient and reliable audit evidence to draw reasonable conclusions on which to base the audit results. Sufficient Evidence: Evidence can be considered sufficient if it supports all material questions in the audit objective and scope. Evidence should be objective and sufficient to enable a qualified independent party to re-perform tests and obtain the same results. The evidence should be commensurate with the materiality of an item and risks involved. In instances where IS Auditor believes sufficient audit evidence cannot be obtained, they should disclose this in a manner consistent with the communication of the audit results. Appropriate Evidence: Appropriate evidence shall include the following indicative criteria:
When obtaining evidence from a test of control design, auditors should consider the completeness of an audit evidence to support the assessed level of control risk. Reliable Evidence: IS Auditors should take note of following examples of evidence that is more reliable when it is:
Procedures used to gather evidence can be applied through the use of manual audit procedures, computer-assisted techniques, or a combination of both. For example: a system, which uses manual control totals to balance data entry operations might provide audit evidence that the control procedure is in place by way of an appropriately reconciled and annotated report. IS Auditors should obtain audit evidence by reviewing and testing this report. Detailed transaction records may only be available in machine-readable format, requiring IS Auditors to obtain evidence using computer-assisted techniques. When information produced by a bank is used by auditors, they should obtain evidence about the completeness and accuracy by the following means:
Auditors should consider the following controls over production and maintenance of information produced by a bank:
(f) Documentation Audit evidence gathered should be documented and organised to support findings and conclusions. IS Audit documentation is a record of the work performed and evidence supporting findings and conclusions. The potential uses of documentation:
Documentation should include, at a minimum, a record of:
Extent of an IS Auditor’s documentation may depend on needs for a particular audit and should include such things as:
Documentation should include audit information, required by law, government regulations, or by applicable professional standards. Documentation should be clear, complete and understandable, by a reviewer. IS Audit owns evidences documented by them, in order to substantiate conclusions on tests performed and specific observations reported to management and Audit Committee. (g) Conclusion on Tests Performed IS Auditors should evaluate conclusions drawn as a basis for forming an opinion on the audit. Conclusions should be substantiated by evidences, collected and documented. The IS Audit Team may be required to provide and maintain evidences in respect of observations reported by them. IS Auditors may perform following activities required to conclude on tests performed based on nature and amount of identified control failures and likelihood of undetected errors:
If audit evidence or information indicate that irregularities could have occurred, IS auditors should recommend the bank management on matters that require detailed investigation to enable the management to initiate appropriate investigative actions. The auditors should also consider consulting the Audit Committee and legal counsel about the advisability and risks of reporting the findings outside the Bank. RBI (vide its circular DBS.CO.FrMC.BC.No.7/23.04.001/ 2009-10, dated: September 16, 2009) requires that fraud cases should be reported to law enforcement agencies and to the RBI. Banks should appropriately include requirements for reporting to RBI, of such instances, in engagement letters issued to external IS Auditors. (h) Audit Accelerators Since IS Audit budgets can be difficult to estimate and manage, CAEs should consider using testing accelerators—tools or techniques that help support procedures that the IS Auditors will be performing —to increase efficiency and effectiveness. CAEs can use an accelerator to do the same audit in less time, or do more detailed audit procedures in the same amount of time. Audit accelerators require an investment, so the CAE should carefully consider the cost or benefits of any solution, prior to investing. Audit accelerators can be divided into two categories:
Audit Facilitators Electronic Workpapers: These provide centralised management and retention of workpapers, audit workflow, version tracking, electronic sign-off, etc. It’s important to consider the functionality of the tool. For example, can it support multiple simultaneous audits? Prior to implementing any tool, the audit functional requirements should be defined. More important, however, is the content that is provided with the tool. Does it contain suggested audit procedures, or control activities? Internal audit function will need to customise whatever knowledge base is included with the tool, but it can provide a significant headstart. Project Management Software: This schedules workplans, assigns responsibility for tasks, tracks project milestones and deliverables, and can be used by auditors to provide additional consistency and reporting in IS Audits. Flowcharting Software: Can graphically document transaction flows, control points and key process steps. It is useful when documenting process walkthroughs, particularly for detailed application control reviews. Storing graphical process documentation electronically supports the ease of updating flowcharts, as processes change, and provides for easy storage and sharing. Open Issue Tracking Software: This software allows to track outstanding audit issues, or deficiencies, and may also be integrated with document management software. Typically, it includes the ability to assign responsibility for remediation procedures, assign due dates and deliverables, and track and report on progress. Audit Department Website: A number of Internal Audit Departments have established departmental websites that enable central information sharing and communication. Testing Accelerators Testing accelerators can automate time-consuming audit tasks, such as reviewing large populations of data. Also, using a tool to perform audit procedures helps establish consistency. For example, if a tool is used to assess server security configuration, servers tested with that tool will be assessed along the same baselines. Performing these procedures manually allows for a degree of interpretation on the part of the IS Auditor. Lastly, the use of tools enables IS Auditors to test an entire population of data, rather than just a sample of transactions. This provides for a much higher degree of audit assurance. Data Analysis Software: These allow an auditor to perform robust statistical analysis of large data sets. They can also be used to support process or operational audits like KYC reviews. They can support types of testing. One consideration when using a data analysis tool is that it may be difficult to extract the data from the original source. It is critical that audit procedures be performed to ensure the completeness and accuracy of the source data. Security Analysis Tools: These are a broad set of tools that can review a large population of devices or users and identify security exposures. There are different types of security analysis tools. Generally they can be categorised as follows:
Verifying the accuracy of network diagrams by mapping corporate network Identifying key network devices that may warrant additional audit attention Gathering information about what traffic is permitted across a network (which would directly support the IT risk assessment process).
The CAE should be aware that most of these come with a set of pre-configured rules, or vendor-touted “best practices”. Implementation of one will need to be accompanied by a substantive project to create a rule set that is relevant for that particular organisation. Failure to do so, will result in audit reports that contain a number of either false-positives or false-negatives. CAEs should be aware of the following considerations, with respect to IS Audit Accelerators:
Sometimes, IT management or third-party service providers are not allowed tools to access the production environment directly. They are instead asked to do so from a copy of data from an alternative site, or standby server. Any use of tools or scripts should be thoroughly discussed with and approved by IT management and be tested fully before deploying. (i) Computer-Assisted Audit Techniques (CAATS) IS Auditors can use an appropriate combination of manual techniques and CAATs. IS Audit function needs to enhance the use of CAATs, particularly for critical functions or processes carrying financial or regulatory or legal implications. The extent to which CAATs can be used will depend on factors such as efficiency and effectiveness of CAATs over manual techniques, time constraints, integrity of the Information System and IT environment and level of audit risk. CAATs may be used in critical areas (like detection of revenue leakage, treasury functions, assessing impact of control weaknesses, monitoring customer transactions under AML requirements and generally in areas where a large volume of transactions are reported). Process involved in using CAATs involve the following steps:
CAATs may be used to perform the following audit procedures among others:
In instances, where CAATs may be used to extract sensitive programmes, system information or production data, IS Auditors should safeguard the programme, system information or production data, with an appropriate level of confidentiality and security. In doing so, IS Auditors should consider the level of confidentiality and security required by the bank, owning the data and any relevant legislation. IS Auditors should be provided with “view access” to systems and data. In case audit procedures cannot be performed in the live environment, appropriate test environment should be made available to IS Auditors. Systems and data under test environment should be synchronised to the live environment. IS Auditors should use and document results of appropriate procedures to provide for ongoing integrity, reliability, usefulness and security of the CAATs. Example: this should include a review of programme maintenance and change controls over embedded audit software to determine that only authorised changes were made to the CAATs. In instances where CAATs reside in an environment not under the control of the IS Auditor, an appropriate level of control should, in effect, be placed to identify changes. When the CAATs are changed, IS Auditors should obtain assurance of their integrity, reliability, usefulness and security, through appropriate planning, design, testing, processing and review of documentation, before placing their reliance. (j) Continuous Auditing Traditionally, testing of controls performed by an internal audit team was on a retrospective and cyclical basis, often many months after business activities have occurred. The testing procedures have often been based on a sampling approach. They included activities such as reviews of policies, procedures, approvals and reconciliations. Today, however, it is recognised that this approach only affords internal auditors a narrow scope, and is often too late to be of “real value” to business performance or regulatory compliance. Continuous auditing is a method used to perform control and risk assessments automatically on a more frequent basis using technology which is key to enabling such an approach. Continuous auditing changes the audit paradigm from periodic reviews of a sample of transactions to ongoing audit testing of 100 percent of transactions. It becomes an integral part of modern auditing at many levels. It also should be closely tied to management activities such as performance monitoring, scorecard or dashboard and enterprise risk management. A continuous audit approach allows internal auditors to fully understand critical control points, rules, and exceptions. With automated, frequent analyses of data, they are able to perform control and risk assessments in real time or near real time. They can analyse key business systems for both anomalies at the transaction level and for data-driven indicators of control deficiencies and emerging risk. Finally, with continuous auditing, the analysis results are integrated into all aspects of the audit process, from the development and maintenance of the enterprise audit plan to the conduct and follow-up of specific audits. As they implement and sustain the risk-based IS Audit approach, banks may explore implementation of continuous auditing in critical areas in a phased manner. (k) Application Control Audit: Detailed pre-implementation application control audits and data migration audits in respect of critical systems needs to be subjected to independent external audit. Banks also need to conduct a post-implementation detailed application control audit. Furthermore, banks should also include application control audits in a risk based manner as part of the regular Internal Audit/IS Audit plans with focus on data integrity (among other factors). General internal auditors with requisite functional knowledge need to be involved along with the IS Auditors in the exercise to provide the requisite domain expertise. Some of the considerations in application control audit (based on ISACA guidelines) include:
(I) Using the Work of Others Purpose of an IS Audit standard is to establish and provide a guidance to auditors who can use the work of experts on an audit. The following are standards, to test the reliability of the work of an expert:
(m) Third Party Review of Service Providers A bank may use a third-party service provider (service organisation) to obtain services of packaged software applications and technology environment, which enables customers to process financial and operational transactions (ATM management, networking and infrastructure development and maintenance, document imaging and indexing, software development and maintenance). RBI has issued “Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services by Banks” (circular no: DBOD.NO.BP.40/21.04.158/ 2006-07 dated November 3, 2006), asking banks to adhere to guidelines before outsourcing activities related to financial services. Services provided by a third party are relevant to the scope of IS Audit. Especially, when those services and controls within them, are a part of the bank’s information systems. Though controls at the service organisation are likely to relate to financial reporting, there may be other controls that may also be relevant to the IS Audit (controls over safeguarding of assets or document images). A service organisation’s services are a part of a bank’s information system, including related business processes, relevant to IS Audit if these services affect any of the following:
IS Auditors will have to obtain an understanding of how a bank uses services of a service organisation in the bank’s IS operations, including:
In situations, services provided by the organisation may not appear to be “material” to the bank’s IS operations. But, the service nature may be. IS Auditors should determine that an understanding of those controls is necessary in the circumstances. Information on the nature of services, provided by an organisation, may be available from a variety of sources:
IS Auditors may use a service auditor to perform procedures such as tests of controls at service organisation, or substantive procedures on the bank’s IS operations, served by a service organisation. Understanding Controls Relating to Services Provided by a Service Organisation Banks may establish control over the services offered by an organisation, which may be tested by IS Auditors. This may enable IS Auditors to conclude that the bank’s controls are operating effectively for some (or all) of the related assertions, regardless of the controls put in place at the organisation. If a bank, for example, uses an organisation to manage payroll transactions, it may establish controls over authentication of submission or receipt of information, which could prevent, or detect, material misstatements. Controls include:
Further Procedures When a Sufficient Understanding Cannot Be Obtained from the Bank An IS Auditor’s decision taken on the procedure (individually or in combination) to obtain the necessary information, to provide a basis for identification and assessment of risks of IS operations in relation to a bank’s use of a service organisation, may be influenced by several matters. They are:
A service organisation may engage a service auditor to report on the description and design of its controls, and their operating effectiveness, through “Third Party Assurance Reports”, such as “Statement of Auditing Standards” (SAS70) based on guidelines provided by the American Institute of Certified Public Accountants (AICPA); or “Standard on Auditing (SA) 402” issued by ICAI. International Auditing and Assurance Standards Board (IAASB) has also issued a new standard “ISAE 3402”. AICPA has issued the “Statement on Standards for Attestation Engagements (SSAE) 16”, which would replace the current “SAS 70”. These provide a mechanism to the bank’s management and statutory auditors to gain assurance on performance of internal control at a service organisation, as they relate to internal control of the user organisation (bank that outsources the work). Service organisations: are entities that provide outsourcing services that impact the control environment of their customers i.e. user organisation. The standards referred above, provide a guidance to service auditors, when assessing the internal control at a service organisation and when issuing a service auditors report: that contain the description, design and operating effectiveness of controls at a service organisation–referred to as a “Type 2 Report”. It comprises: i) A description (prepared by management of the service organisation) of its system; control objectives; related controls; design and implementation at a specified date, or throughout a specified period; and, in some cases, their operating effectiveness throughout a specified period ii) A report by the service auditor with an objective of conveying reasonable assurance that includes: the service auditor’s opinion on the description of the service organisation’s system; control objectives and related controls; suitability of control designs to achieve the control objectives; operating effectiveness of controls; and a description of the service auditor’s tests of controls and results In the event of coverage or scope of the service auditor is not per the requirements of the bank, the bank may carry out the audit, or arrange to get the audit done, as per its requirements. A bank may use a service organisation, that in turn, uses a “sub-service organisation” to provide some services that are part of the bank’s information system relevant to financial reporting. The “sub-service organisation” may be a separate entity from the “service organisation”. Or, it may be related to a service organisation. IS Auditors may need to consider controls at the sub-service organisation. In situations where one or more sub-service organisations are used, interaction between the activities of a bank and those of the service organisation, is expanded, to include the interaction between the bank, the service organisation and the sub-service organisations. The degree of this interaction, as well as the nature of services provided by the service organisation and the sub-service organisations, are important factors for the user auditor to consider, in determining the significance of the service organisation’s and sub-service organisation’s controls to the Bank’s controls. 5) Reporting and Follow-up This phase involves reporting audit findings to the CAE and Audit Committee. Before reporting the findings, it is imperative that IS Auditors prepare an audit summary memorandum providing overview of the entire audit processing from planning to audit findings, discuss the findings with auditee and obtain responses. Additionally, reviewing the actions taken by management to mitigate the risks observed in audit findings and appropriately updating the audit summary memorandum is also important. Reporting entails deciding the nature, timing and extent of follow-up activities and planning future audits. Professional bodies like ISACA, IIA, ICAI have issued guidance in this regard. Reporting and follow-up entails following activities or steps:
These are covered in the following sections:
Senior Management may decide to accept the risk of not correcting the reported condition because of cost or other considerations. The Board (or the Audit Committee, if one exists) should be informed of Senior Management’s decision on significant observations and recommendations. When Auditors IS believes that an organisation has accepted a level of residual risk that is inappropriate for the organisation, they should discuss the matter with Internal Audit and Senior Management. If the IS Auditors are not in agreement with the decision, regarding residual risk, IS Auditors and Senior Management should report the matter to the Board, or Audit Committee, for resolution. Events sometimes occur, subsequent to the point in time or period of time of the subject matter being tested, but prior to the date of the IS Auditor’s report, that have a material effect on the subject matter and therefore require adjustment or disclosure in the presentation of the subject matter or assertion. (c) Finalise and Submit Reports IS Auditors should review and assess the conclusions drawn from the evidence obtained as the basis for forming an opinion on the effectiveness of the control procedures based on the identified criteria. Major findings identified during an audit should have a definite time line indicated for remedial actions, these should be followed up intensively and compliance should be confirmed. An IS Auditor’s report about the effectiveness of control procedures should cover aspects like:
After reporting of findings and recommendations, IS Auditors should request and evaluate relevant information to conclude whether appropriate action has been taken by management in a timely manner.If management’s proposed actions to implement reported recommendations have been discussed with, or provided to, the IS Auditor, these actions should be recorded as a management response in the final report. The nature, timing and extent of the follow-up activities should take into account the significance of the reported finding and the impact if corrective action is not taken. The timing of IS Audit follow-up activities in relation to the original reporting should be a matter of professional judgment dependent on a number of considerations, such as the nature or magnitude of associated risks and costs to the entity. (e) Follow-up Procedures Procedures for follow-up activities should be established which includes:
(f) Update Audit Summary Memorandum An audit summary memorandum should be prepared and addresses the following:
(g) Archival of Documents Banks are recommended to have an archiving/ retention policy to archive the audit results. Banks to have an archiving policy that:
6) Quality Review This section is aimed at emphasising quality of work of IS Auditors, while performing duties as an auditor. Appropriate levels in IS Audit function are recommended to assess audit quality by reviewing documentation, ensuring appropriate supervision of IS Audit members and assessing whether IS Audit members have taken due care while performing their duties. This will bring efficiency, control and improve quality of the IS Audit. (a) Evidences and Documentation IS Auditors may perform the following progressive reviews of the evidences and documentation:
IS Audit staff should be supervised to provide reasonable assurance that audit objectives are accomplished and applicable professional auditing standards are met. (c) Due Care The standard of “due care” is that level of diligence which a prudent and competent person would exercise under a given set of circumstances. “Due professional care” applies to an individual who professes to exercise a special skill such as IS auditing. Due professional care requires the individual to exercise that skill to a level commonly possessed by auditors with the specialty. Due professional care applies to the exercise of professional judgment in the conduct of work performed. It implies that the professional approaches matters requiring professional judgment with proper diligence. Despite the exercise of due professional care and professional judgment, situations may arise where an incorrect conclusion may be drawn from a diligent review of the available facts and circumstances. Therefore, the subsequent discovery of incorrect conclusions does not, in and of itself, indicate inadequate professional judgment or lack of diligence on the part of the IS Auditor. Due professional care should extend to every aspect of the audit, including the evaluation of audit risk, the formulation of audit objectives, the establishment of the audit scope, the selection of audit tests, and the evaluation of test results. In doing this, IS Auditors should determine or evaluate:
Intended recipients of audit reports have an appropriate expectation that IS Auditors have exercised due professional care throughout the course of the audit. IS Auditors should not accept an assignment unless adequate skills, knowledge, and other resources are available to complete the work in a manner expected of a professional. IS Auditors should conduct the audit with diligence while adhering to professional standards. IS Auditors should disclose the circumstances of any non-compliance with professional standards in a manner consistent with the communication of the audit results. (d) Independent Assurance of the Audit function With a view to provide assurance to bank’s management and regulators, banks are required to conduct a quality assurance, at least once in three years, on the bank's Internal Audit, including IS Audit function, to validate approach and practices adopted by them in the discharge of its responsibilities as laid out in the Audit Policy. Objectives of performing a quality assessment are:
INDUSTRY WIDE RECOMMENDATION Accreditation and empanelment of IS audit qualifications or certifications, and IS audit vendors or firms can be considered by Government of India. ANNEXURE: KEY RECOMMENDATIONS 1. To meet the responsibility of providing an independent audit function with sufficient resources to ensure adequate IT coverage, the Board or Audit Committee should provide an internal audit function, capable of evaluating IT controls adequately. 2. Banks should enable adequately-skilled Audit Committee composition to manage the complexity of the IS Audit oversight. A designated member of the Audit Committee needs to possess relevant knowledge of Information Systems, IS Controls and audit issues. Designated member should also have competencies to understand the impact of deficiencies, identified in IT Internal Control framework, by IS Audit. The Board or its Audit Committee should seek training to fill any gaps in the knowledge, related to IT risks and controls. 3. Audit Committee should devote appropriate and sufficient time to IS Audit findings identified and members of Audit Committee need to review critical issues highlighted and provide appropriate guidance to the bank’s management. 4. Internal Audit is part of the Board’s assurance process with regard to the integrity and effectiveness of systems and controls. It is an independent group, with reporting lines directly to the Audit Committee or Board. IS Audit function, being an integral part of Internal Audit function, requires an organisation structure with well-defined roles and responsibilities to function in alignment with the Internal Audit and provide technical audit support. 5. Banks require a separate IS Audit function within the Internal Audit department, led by an IS Audit Head reporting to the Head of Internal Audit or Chief Audit Executive (CAE), assuming overall responsibility and accountability of IS audit function. Where the bank leverages external resources for conducting IS audit on areas, where skills are lacking within the bank, the responsibility and accountability for such external IS audits still remain with the IS Audit Head and CAE. 6. IS Auditors should act independently of the bank's management. In all matters related to the audit, the IS Audit should be independent of the auditee in both attitude and appearance. IS Auditors should be professionally competent, having skills, knowledge, training and relevant experience to conduct an audit. IS Auditors should exercise due professional care, that includes following professional auditing standards in conducting the audit. 7. Banks may decide to outsource execution of segments of audit plan to external professional service providers, as per the overall audit strategy decided in co-ordination with the CAE and the Audit Committee. This may be due to inadequate staff available internally within the Bank to conduct IS audits, or insufficient levels of skills/ training of Bank staff. The work outsourced shall be restricted to execution of audits identified in the audit plan. Banks need to ensure that the overall ownership and responsibility of the IS Audit including the audit planning process, risk assessment and follow up of compliance remains within the Bank. External assistance may be obtained initially to put in place necessary processes in this regard. 8. Audit Charter or Policy is a document, which guides and directs activities of an Internal Audit function. IS Audit, being integral part of Internal Audit department, should also be governed by the same Audit Charter or Policy. The mission statement or audit charter should be documented to contain a clear description of mandate, purpose, responsibility, authority and accountability of relevant members or officials in respect of IS Audit, namely the IS Auditors, audit management, and Audit Committee and operating principles. The document should be approved by the board of directors. 9. There should also be annual review of IS Audit Policy or Charter to ensure its continued relevance and effectiveness. 10. The IS Auditor should consider establishing a quality assurance process (e.g., interviews, customer satisfaction surveys, assignment performance surveys, etc.) to understand the auditee’s needs and expectations relevant to the IS audit function. These needs should be evaluated against the policy with a view to improving the service or changing service delivery or Audit Charter or Policy, as considered necessary. 11. A well-planned, properly-structured audit programme is essential to evaluate risk management practices, internal control systems and compliance with policies concerning IT-related risks of every size and complexity. Effective audit programmes are risk-focused, promote sound IT controls, ensure timely resolution of audit deficiencies, and inform the Audit Committee of the effectiveness of risk management practices. 12. Banks need to carry out IS Audit planning using the Risk Based Audit Approach. It involves an understanding of IT risk assessment concepts and methodology, defining the IS Audit Universe, scoping, and planning the audit, execution and follow up activities. Details in this have been elucidated in the chapter. 13. Executing IS Audit involving activities such as understanding the business process and IT environment, refining the scope and identifying internal controls, testing for control design and control objectives, appropriate audit evidence, documentation of workpapers and concluding on tests performed. The detailed requirements have been provided in the chapter. 14. The IS Audit Universe can be built around the four types of IT resources and various IT processes like application systems, information or data, infrastructure(technology and facilities like hardware, operating systems, database management systems, networking, multimedia, etc., and the environment that houses and supports them that enable the processing of the applications) and people (internal or outsourced personnel required to plan, organise, acquire, implement, deliver, support, monitor and evaluate the information systems and services). 15. The IS Auditor must define, adopt and follow a suitable risk assessment methodology. A successful risk-based IS audit program can be based on an effective scoring system arrived at by considering all relevant risk factors. Banks should develop written guidelines on the use of risk assessment tools and risk factors and review these guidelines with the audit committee or the board of directors. Risk assessment related guidelines will vary for individual banks depending on their size, complexity, scope of activities, geographic diversity, and various technologies/systems used. 16. The IS Audit Head is responsible for the annual IS Audit Plan which is prepared based on the scoping document and risk assessment. The Audit plan typically covers the overall audit strategy, scoped audit areas, details of control objectives identified in the scoping stage, sample sizes, frequency/ timing of audit based on risk assessment, nature and extent of audit, IT Resource skills identification and budget allocation. A report on the status of planned versus actual audits, and any changes to the annual audit plan, needs to be periodically presented to Audit Committee and Senior management. 17. The IS Audit Plan(either separately or as part of overall internal audit plan) should be a formal document, duly approved by the Audit Committee initially and during any subsequent major changes. Audit plan should be prepared so that it is in compliance with any appropriate external requirements in addition to well known IS Auditing Standards. 18. IT governance, information security governance related aspects , critical IT general controls like data centre controls and processes and critical business applications having financial/ compliance/ customer access(like delivery channels) including MIS and regulatory reporting systems need to be audited atleast once a year (or more frequently, if warranted by the risk assessment). 19. IS Auditors should also review critical areas like IT Governance and Information Security Governance structures and practices implemented by the bank, detailed testing of controls on newly development systems before implementing them in live environment (pre-implementation review), performing a post implementation review of application controls (along with underlying IT environment) to confirm that controls as designed are implemented and are operating effectively, reviewing the process followed by implementation team to ensure data integrity upon data migration from older to new system, detailed audit of SDLC process to confirm that security features are incorporated into a new system implemented by the Bank, or while modifying an existing system and validating the IT risks identified by the business teams before launching a new product or service and which may enable the business to incorporate additional controls, if required, in the system before the launch. 20. IS Audits should also cover branches, with focus on large and medium branches, in areas like password controls, control of user ids, operating system security, anti-malware controls, maker-checker controls, segregation of duties, physical security, review of exception reports/audit trails, BCP policy and testing etc 21. Detailed pre-implementation application control audits and data migration audits in respect of critical systems needs to be subjected to independent external audit. 22. Banks also need to conduct a post-implementation detailed application control audit. Furthermore, banks should also include application control audits in a risk based manner as part of the regular Internal Audit/IS Audit plans with focus on data integrity (among other factors). General internal auditors with requisite functional knowledge need to be involved along with the IS Auditors in the exercise to provide the requisite domain expertise. 22. IS Auditors should periodically review the results of internal control processes and analyse financial or operational data for any impact on a risk assessment or scoring. Accordingly, various auditee units should be required to keep auditors up to date on all major changes in departments or functions, such as the introduction of a new product, implementation of a new system, application conversions, significant changes in organisation or staff , new regulatory and legal requirements, security incidents etc. 23. As regards application control audits, application controls to address the application-level risks may be in the form of computerised controls built into the system, manually performed controls, or a combination of both. Risks of manual controls in critical controls need to be considered. Where the option to place reliance on programmed controls is taken, relevant general IT controls should be considered, as well as controls specifically relevant to the audit objective. Objectives should be developed to address various criteria like integrity, availability, compliance, reliability and confidentiality. Effectiveness and efficiency can also be additional criteria. 24. IS Auditors should be reasonably conversant with various fraud risk factors and should assess the risk of occurrence of irregularities, connected with the area under audit. In pursuance to the understanding gathered during threat identification step of the IT Risk assessment process, the IS Auditors should identify the control objectives and activities that are required to be tested to address fraud risk. The IS Auditor should consider Fraud Vulnerability assessments undertaken by the Fraud Risk Management group, while identifying fraud risk factors in the IT risk assessment process. 25. Banks should consider using testing accelerators — tools and/or techniques that help support the procedures IS Auditors will be performing — to increase the efficiency and effectiveness of the audit. CAEs can use an accelerator to do the same audit in less time or do more detailed audit procedures in the same amount of time taking into consideration the cost/ benefits of any solution. The audit accelerators can be divided into two general categories – audit facilitators that help support the overall management of the audit (e.g. an electronic workpaper management tool) and testing accelerators that automate the performance of audit tests (e.g. data analysis tools) 26. Auditors need to enhance utilisation of CAATs in various areas such as detection of revenue leakage, assessing impact of control weaknesses, KYC/AML requirements and generally in areas where a large volume and value of transactions are involved. Suitable “read-only” access rights should be provided to auditors for enabling use of CAATs. 27. Banks can consider, wherever possible, for critical systems, continuous auditing approach which is a method used to perform control and risk assessments automatically on a more frequent basis using technology, which is key to enabling such an approach. Continuous auditing changes the audit paradigm from periodic reviews of a sample of transactions to ongoing audit testing of 100 percent of transactions. It can become an integral part of modern auditing. 28. A continuous audit approach allows internal auditors to fully understand critical control points, rules, and exceptions. With automated, frequent analyses of data, they are able to perform control and risk assessments in real time or near real time. They can analyse key business systems for both anomalies at the transaction level and for data-driven indicators of control deficiencies and emerging risk. 29. Reporting and follow up aspect of IS Audit involves preparing audit summary and memorandum, requirements for discussing findings with management, finalising and submitting reports, carrying out follow-up procedures, archiving documents and ensuring continuous auditing 30. Senior Management may decide to accept the risk of not correcting the reported condition because of cost or other considerations. The Board (or the Audit Committee) should be informed of Senior Management’s decision on significant observations and recommendations. When IS Auditors believes that the bank has accepted a level of residual risk that is inappropriate for the organisation, they should discuss the matter with appropriate level of management. If the IS Auditors are not in agreement with the decision, regarding residual risk, IS Auditors and Senior Management should report the matter to the Board (or Audit Committee) for resolution. 31. Services provided by a third party are relevant to the IS Audit of a bank when those services, and the controls over them, are part of the bank’s information system, including related business processes, relevant to scope of IS Audit. These need to be adequately assessed as part of IS Audit process. 32. With a view to provide assurance to bank’s management and regulators, banks are required to conduct a quality assurance, atleast once every three years, on the banks Internal Audit including IS Audit to validate the approach and practices adopted by them in the discharge of its responsibilities as laid out in the Audit Charter / Audit Policy. 33. Accreditation and empanelment of IS audit qualifications/certifications and IS audit vendors/firms can be considered by Government of India. |
ভাৰতীয় ৰিজাৰ্ভ বেংক মোবাইল এপ্পলিকেষ্যন ইনষ্টল কৰক আৰু নৱীনতম বাতৰিৰ প্ৰৱেশাধিকাৰ পাওক!
