| GC_Risk<= /font> | Question= aire | GC_Cobit= _Guidelines | ITAC_RCM= | ITGC_RCM= | Gen Ctrl= s Test Template | GC Test = Status |
| Risk Assessment | RiskAssessmentProgramDevelopmentChangeQuestionnaireImportance | ||||
| Listing of Significant Risks (By Cycle) | |||||
| Valid From: | 3/1/20= 05 | ||||
| Valid To: | 12/31/= 2005 | ||||
| Cycle | Process | Ref # | Risk= | Impor= tance | |
| Program Development and Program Change | Acquire or Develop Application Systems | PDPC 1.1 | Lack of a comprehensive SDLC methodology could lead to improperly controlled financial systems. | High | |
| = ; | PDPC 1.2 | Failure to apply SDLC to changes impacting financial information could lead to insufficient controls. | High | ||
| PDPC 1.3 | Lack of a comprehensive SDLC methodology could lead to improperly controlled financial systems. | High | |||
| PDPC 1.4 | Systems acquisitions that are not in line with strategic direction could lead to inefficient use of corporate assets. | Low | |||
| PDPC 1.5 | Lack of user involvement in system implementations could lead to improperly controlled financial systems. | High | |||
| PDPC 1.6 | Failure to assess financial systems after information could lead to errors going undetected. | Medium | |||
| PDPC 1.7 | Improper implementation of systems software could lead to control breakdowns. | High | |||
| <= /td> | = | ||||
| Program Development and Program Change | Defi= ne the Information Architecture | PDPC 2.= 1 | Impro= per implementation of infrastructure systems could lead to control breakdowns= . | High | |
| = ; | <= /td> | = ; | = | ||
| Program Development and Program Change | Develop and Maintain Policies and Procedures | PDPC 3.1 | Outdated SDLC may not reflect changes in the business and/or in the technology are= na. | Low | |
| = ; | <= /td> | = ; | = | ||
| Program Development and Program Change | Develop and Maintain Policies and Procedures | PDPC 3.2 | SDLC methodology may not be applied to financial system implementations, leadi= ng to a breakdown in controls. | High | |
| = ; | <= /td> | = ; | = | ||
| Program Development and Program Change | Intstall and Test Application Software and Technology Infrastructure | PDPC 4.1 | Insufficient testing could result in erroneous code being promoted into the production environment. | High | |
| = ; | PDPC 4.= 2 | Lack of load and stres= s testing could lead to implementation of systems that do not perform properly under true production conditions. | High | ||
| PDPC 4.= 3 | Insufficient testing of interfaces could affect the completeness and accuracy of data transmitted= in the production environment. | High | |||
| PDPC 4.= 4 | Invalid, incomplete, a= nd inaccurate data could be loaded into the production environment. | High | |||
| = ; | <= /td> | = ; | = | ||
| Program Development and Program Change | Manage Changes | PDPC 5.= 1 | Unapproved code could = be placed into production. | High | |
| = ; | PDPC 5.= 2 | Unapproved code could = be placed into production. | High | ||
| PDPC 5.= 3 | Unapproved code could be placed into production. | High | |||
| PDPC 5.= 4 | Impro= per implementation of systems software could lead to security breaches for financial information and systems. | High | |||
| = ; | <= /td> | = ; | = | ||
| Computer Ops and Access to Programs & Data | Define and Manage Service Levels | CO 1.1 | Financial systems may not meet the performance needs of management. | Low | |
| CO 1.2 | Financial systems may not meet the performance needs of management. | Low | |||
| <= /td> | = ; | = | |||
| Computer Ops and Access to Programs & Data | Manage Third-Party Services | CO 2.1 | Financial systems may not meet the performance needs of management. | Low | |
| = ; | CO 2.2 | Control reliance may be placed on third party providers without the appropriate d= ue diligence. | High | ||
| CO 2.3 | Control reliance may be placed on third party providers without the appropriate d= ue diligence. | High | |||
| CO 2.4 | Third party providers may not meet the organization's requirements for internal controls. | High | |||
| CO 2.5 | Third party providers may not meet the organization's requirements for internal controls. | High | |||
| CO 2.6 | Third party providers system of control may break down over time. | High | |||
| = ; | <= /td> | = ; | = | ||
| Computer Ops and Access to Programs & Data | Ensure Systems Security | CO 3.1 | Lack of an information security policy could result in improper levels of secu= rity over financial systems and information. | High | |
| = ; | CO 3.2 | Lack of an information security framework could result in inconsistent applica= tion of security policies, affecting security over financial systems and information. | High | ||
| CO 3.3 | Lack of a tie between the information security plan and overall IT strategic p= lan could lead to inefficient security implementation. | Low | |||
| CO 3.4 | Lack of updates to the IT security plan could lead to degradation of system and network security over time. | High | |||
| CO 3.5 | Improper access could be provided to key financial transactions. | High | |||
| CO 3.6 | Lack of mechanisms such as password changes could lead to weak security over t= ime. | High | |||
| CO 3.7 | Improper access could be provided for financial systems and data. | High | |||
| CO 3.8 | Improper access could be provided for financial systems and data. | High | |||
| CO 3.9 | Transactions may be improperly received or rejected between the company and outside parties. | High | |||
| CO 3.10 | Improper access could be provided for financial systems and data. | High | |||
| CO 3.11 | Management may not be notified in a timely fashion when system resources are under attack. | Medium | |||
| CO 3.12 | Improper access could be provided for financial systems and data. | High | |||
| CO 3.13 | Improper access could be provided to physical IT assets that support financial sys= tems and data. | High | |||
| = ; | <= /td> | = ; | = | ||
| Computer Ops and Access to Programs & Data | Manage the Configuration | CO 4.1 | Unauthorized software could introduce errors and/or lead to a breakdown in controls ov= er financial systems and data. | High | |
| = ; | CO 4.2 | Improper access could be obtained from external sources. | High | ||
| CO 4.3 | Improper access could be granted to financial data and applications kept in data storage systems. | High | |||
| CO 4.4 | Computer viruses could lead to the corruption of financial systems and data. | High | |||
| CO 4.5 | System configurations may change over time, leading to possible breakdowns in control. | Medium | |||
| = ; | <= /td> | = ; | = | ||
| Computer Ops and Access to Programs & Data | Manage Problems and Incidents | CO 5.1 | Improper follow-up and resolution of identified problems could lead to a breakdown= in controls over time. | High | |
| = ; | CO 5.2 | Improper follow-up and resolution of identified problems could lead to a breakdown= in controls over time. | High | ||
| CO 5.3 | Improper follow-up and resolution of security incident could lead to unauthorized access to financial systems and data. | High | |||
| Computer Ops and Access to Programs & Data | Manage Data | CO 6.1 | Financial information may be improperly disclosed or destroyed. | High | |
| = ; | CO 6.2 | Financial information may be improperly disclosed or destroyed. | High | ||
| CO 6.3 | Financial information may not be available when needed by business unit management.= | High | |||
| CO 6.4 | Financial information may not be available when needed by business unit management.= | High | |||
| CO 6.5 | Financial information may not be available when needed by business unit management.= | High | |||
| CO 6.6 | Improper changes to data structures could lead to errors in financial systems or d= ata. | High | |||
| Computer Ops and Access to Programs & Data | Manage Operations | CO 7.1 | Lack of procedures for problem management could lead to control breakdowns bei= ng undetected. | High | |
| CO 7.2 | Lack of sufficient system event history could make it difficult to reconstruct financial system and data processing. | Low | |||
| CO 7.3 | Lack of sufficient system event data could cause incomplete or untimely proces= sing to go undetected. | Low | |||
| CO 7.4 | Insufficient end user computing policies and procedures could lead to a control breakd= own for end user tools such as spreadsheets. | High | |||
| CO 7.5 | End user computing tools may have control breakdowns over time that go undetected. | High | |||
| CO 7.6 | End user computing tools may not be recoverable. | High | |||
| CO 7.7 | End user computing tools may be exposed to improper access. | High | |||
| CO 7.8 | End user computing tools may be exposed to improper access. | High | |||
| CO 7.9 | End user computing tools may have control breakdowns over time that go undetected. | High | |||
| <= /td> |
| Compan= y-level Questionnaire | N | |||||||||
| Information and Communication |
||||||||||
| COSO stat= es that information is needed at all levels of an organization to run the business and achieve the company’s control objectives. However, the identification, management and communication of relevant information represents an ever-increasing challenge to the IT department. The determination of which information is required to achieve control objecti= ves and the communication of this information in a form and time frame that a= llow people to carry out their duties support the other four components of the COSO framework. | ||||||||||
| Points= to Consider | Response (Y/N) | Comments | ||||||||
| Inform= ation Architecture | ||||||||||
| 24 | = ; Has IT management defined information capture, processing and reporting controls—including completeness, accuracy, validity and authorization—to support the quality and integrity of information u= sed for financial and disclosure purposes? | <= /td> | = ; | |||||||
| Has IT management defined information classification standards in accordance with corporate security and privacy policies? | <= /td> | = ; | ||||||||
| 26 | = ; Has IT management defined, implemented and maintained security levels for each of the data classifications? Do these security levels represent the appropri= ate (minimum) set of security and control measures for each of the classifications? Are they reevaluated periodically and modified according= ly? | <= /td> | = ; | |||||||
| Communication of Management Aims and Direct= ions | ||||||||||
| 27 | = ; Has IT management formulated, developed and documented policies and procedures governing the IT organization’s activities? | <= /td> | = ; | |||||||
| Has IT management communicated policies and procedures governing the IT organization’s activities? | <= /td> | = ; | ||||||||
| 29 | = ; Does IT management periodically review its policies, procedures and standards to reflect changing business conditions? | <= /td> | = ; | |||||||
| Does IT management have processes in place to investi= gate compliance deviations and introduce remedial action? | <= /td> | = ; | ||||||||
| 31 | = ; Does IT management have a process in place to assess compliance with its policies, procedures and standards? | <= /td> | = ; | |||||||
| Does IT management understand its roles and responsibilities related to the Sarbanes-Oxley Act? | <= /td> | = ; | ||||||||
| = | ||||||||||
| Risk Assessment | ||||||||||
| Risk assessment involves the identification and analysis by management of rele= vant risks to achieve predetermined objectives, which form the basis for determining control activities. It is likely that internal control risks could be more pervasive in the IT organization than in other areas of the company. Risk assessment may occur at the company level (for the overall organization) or at the activity level (for a specific process or business unit). | ||||||||||
| Points= to Consider | Response (Y/N) | Comments | ||||||||
| Assess= ment of Risks | ||||||||||
| 33 | = ; Does the IT organization have an entity- and activity-level risk assessment framew= ork that is used periodically to assess information risk to achieving business objectives? Does it consider the probability and likelihood of threats? | <= /td> | = ; | |||||||
| Does the IT organization’s risk assessment framework measure the impact of risks according to qualitative and quantitative criteria, using inputs from different areas including, but n= ot limited to, management brainstorming, strategic planning, past audits and other assessments? | <= /td> | = ; | ||||||||
| 35 | = ; Is the IT organization’s risk assessment framework designed to support cost-effective controls to mitigate exposure to risks on a continuing bas= is, including risk avoidance, mitigation or acceptance? | <= /td> | = ; | |||||||
| Is a comprehensive security assessment performed for critical systems and locations based on their relative priority and importance to the organization? | <= /td> | = ; | ||||||||
| 37 | = ; Where risks are considered acceptable, is there formal documentation and accept= ance of residual risk with related offsets, including adequate insurance cover= age, contractually negotiated liabilities and self-insurance? | <= /td> | = ; | |||||||
| Is the IT organization committed to active and contin= uous risk assessment processes as an important tool in providing information on the design and implementation of internal controls, in the definition of = the IT strategic plan, and in the monitoring and evaluation mechanisms? | <= /td> | = ; | ||||||||
| 39 | = ; Is access to the data center restricted to authorized personnel, requiring appropriate identification and authentication? | <= /td> | = ; | |||||||
| Has a business impact assessment been performed that considers the impact of systems failure on the financial reporting proces= s? | <= /td> | = ; | ||||||||
| Manage Facilities | ||||||||||
| Are data center facilities equipped with adequate environmental controls to maintain systems and data, including fire suppression, uninterrupted power service (UPS), air conditioning and elev= ated floors? | <= /td> | = ; | ||||||||
| = | ||||||||||
| Monitoring | ||||||||||
| Monitorin= g, which covers the oversight of internal control by management through continuous= and point-in-time assessment processes, is becoming increasingly important to= IT management. There are two types of monitoring activities: continuous monitoring and separate evaluations. | ||||||||||
| Points= to Consider | Response (Y/N) | Comments | ||||||||
| Compli= ance With External Requirements | ||||||||||
| 42 | = ; Does the organization monitor changes in external requirements for legal, regulato= ry or other external requirements related to IT practices and controls? | <= /td> | = ; | |||||||
| Are control activities in place and followed to ensure compliance with external requirements, such as regulatory and legal rules= ? | = ; | |||||||||
| 44 | = ; Are internal events considered in a timely manner to support continuous compliance with legal and regulatory requirements? | = ; | ||||||||
| Management of Quality | ||||||||||
| 45 | = ; Is documentation created and maintained for all significant IT processes, controls and activities? | <= /td> | = ; | |||||||
| Does a plan exist to maintain the overall quality assurance of IT activities based on the organizational and IT plans? | = ; | |||||||||
| 47 | = ; Are documentation standards in place, have they been communicated to all IT staff, and are they supported with training? | = ; | ||||||||
| Does a quality plan exist for significant IT functions (e.g., system development and deployment) and does it provide a consistent approach to address both general and project-specific quality assurance activities? | = ; | |||||||||
| 49 | = ; Does the quality plan prescribe the type(s) of quality assurance activities (such = as reviews, audits, inspections) to be performed to achieve the objectives of the quality plan? | = ; | ||||||||
| Does the quality assurance process include a review of adherence to IT policies, procedures and standards? | = ; | |||||||||
| 51 | Have = data integrity ownership and responsibilities been communicated to the appropr= iate data owners and have they accepted these responsibilities? | = ; | ||||||||
| Manage Performance and Capacity | ||||||||||
| 52 | Does = IT management monitor the performance and capacity levels of the systems and network? | <= /td> | = ; | |||||||
| Does IT management have a process in place to respond to suboptimal performance and capacity measures in a timely manner? | = ; | |||||||||
| 54 | Is pe= rformance and capacity planning included in system design and implementation activities? | = ; | ||||||||
| Monito= ring | ||||||||||
| 55 | Have performance indicators (e.g., benchmarks) from both internal and external sources been defined, and are data being collected and reported regarding achievement of these benchmarks? | <= /td> | = ; | |||||||
| Has IT management established appropriate metrics to effecti= vely manage the day-to-day activities of the IT department? | = ; | |||||||||
| 57 | Does = IT management monitor IT’s delivery of services to identify shortfalls= and does IT respond with actionable plans to improve? | = ; | ||||||||
| Adequa= cy of Internal Control | ||||||||||
| 58 | Does = IT management monitor the effectiveness of internal controls in the normal course of operations through management and supervisory activities, comparisons and benchmarks? | <= /td> | = ; | |||||||
| Are serious deviations in the operation of internal control, including major security, availability and processing integrity events, reported to senior management? | = ; | |||||||||
| 60 | Are i= nternal control assessments performed periodically, using self-assessments or independent audits, to examine whether or not internal controls are opera= ting satisfactorily? | = ; | ||||||||
| Indepe= ndent Assurance | ||||||||||
| 61 | Does = IT management obtain independent reviews prior to implementing significant IT systems that are directly linked to the organization’s financial reporting environment? | <= /td> | = ; | |||||||
| Does IT management obtain independent internal control revie= ws of third-party service providers (e.g., by obtaining and reviewing copies= of SAS 70, SysTrust or other independent audit reports)? | = ; | |||||||||
| 63 | Is documentation retained in a manner that can be used by the independent auditor or examiner as a basis for reliance? | = ; | ||||||||
| Internal Audit | ||||||||||
| 64 | Does = the organization have an IT internal audit department that is responsible for reviewing IT activities and controls? | <= /td> | = ; | |||||||
| Is the audit plan based upon a risk assessment that includes= IT? Does it cover the full range of IT audits, e.g., general and application controls, systems development life cycle? | = ; | |||||||||
| 66 | Are p= rocedures in place to follow up on IT control issues in a timely manner? | = ; |
| Cobit Guidelines | |
| Field Name | Field Description |
| Control Ref. | Refer= ence codes that tie into the IT Governance Institute's guidelines (e.g., PDPC 1.1 is= the first control under Program Development and Program Change, Objective 1)<= /td> |
| Cyc= le / Process | Indicates which cycle/process the control falls into, per the IT Governance Institu= te's structure. The two main cycles/processes are "Program Development and Program Change", = and "Computer Operations and Access to Programs and Data". |
| Ill= ustrative Controls | These are typical controls that exist to satisfy the control objectives laid ou= t by IT Governance Institute's document. These controls serve as an example only - other controls may be acceptable, and in some cases they may not apply to a given organization's actual situation. |
| Con= trol Importance | This is an evaluation by management of the importance of this control to achie= ving the overall control objective. |
| Ris= k | This describes the actual risk of a financial statement error if the control w= as not in place or not functioning as intended. |
| Cont= rol | This
is the actual control management has put in place to address the risk. |
| Cont= rol Type (PDC) | This optional field indicates the type of control management has put in place. "P", or preventive controls, stop an error from occurring (e.g., field edits, acc= ess controls). "D", or detective controls, notify appropriate personnel of a possible error (e.g= ., notification of a possible hacker attack). "C", or corrective con= trols, fix an error after it occurs (e.g., automatic retransmission upon a failed file transfer). |
| Vali= dation Approach | This field explains the steps to be taken by the organization's management to ensure controls are functioning as intended over time. |
| Vali= dation Results | Documents the actual findings upon completion of the validation steps. If errors were identified in the validation process, remediation and retesting may be required. |
| Area= for Improvement | This field shows either insufficient control design, or controls that have been put in place but are not functioning as intended. |
| Act= ion Items | This is an optional field that can be used to as a project management tool, allowing the user to input open items. |
| Test= of Controls Time Estimate | This is an optional field that allows the user to input the estimated number of hours needed to validate the control.&nb= sp; This information is important for project planning and resource management. |
| Cont= rol Maturity Assessment | Allows the organization's management to assess whether the control is strong eno= ugh to provide reasonable assurance that a material misstatement of the finan= cial statements will not occur. = One possible guideline is the IT Governance Institute, which recommends evaluating controls on a scale from 1 - 5. Controls rated less than 3 may r= equire remediation. |
| Cont= rol Effective Date | Field that indicates the date the control went into effect. This is used primarily in situat= ions where new controls have been added recently. |
| Rea= dy to Test? | This is an evaluation based on the control maturity assessment and the control effective date that indicates whether validation testing can occur. For controls to be properly asse= ssed, they need to have been in operation long enough for sufficient evidence of performance to be accumulated. |
| IT Application Controls Matrix: | ||||||||||||||||||||
| Client: | Comsys | |||||||||||||||||||
| Valid From: | 3/1/200= 5 | |||||||||||||||||||
| Valid To: | 12/31/2= 005 | |||||||||||||||||||
| Control Ref. | Cycle / Process | Control Objectives | Financial Statement Assertions | Illustrative Controls | Control Importance | Risk | Control (Peoplesoft) |
Control (Application 1) |
Control (Application 2) |
Control Type | Validation Approach | Validation Results | Area for Improvement | Action Items | Validation Estimate | Control Maturity Assessment | Control Effective Date | Ready to Test? | Illustrative Test of Controls | |
| IT1 | Sales | Orders are processed only within approved customer credit limits. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT2 | Sales | Orders are approved by management as to prices and terms of sale. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT3 | Sales | Orders and cancellations of orders are input accurately. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT4 | Sales | Order entry data are transferred completely and accurately to the shipping and invoicing activities. | Valuation, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT5 | Sales | All orders received from customers are input and processed. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT6 | Sales | Only valid orders are input and processed. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT7 | Sales | Invoices are generated using authorized terms and prices. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT8 | Sales | Invoices are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT9 | Sales | Credit notes and adjustments to accounts receivable are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT10 | Sales | All goods shipped are invoiced. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT11 | Sales | Credit notes for all goods returned and adjustments to accounts receivable are issued in accordance with organization policy. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT12 | Sales | Invoices relate to valid shipments. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT13 | Sales | All credit notes relate to a return of goods or other valid adjustments. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT14 | Sales | All invoices issued are recorded. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT15 | Sales | All credit notes issued are recorded. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT16 | Sales | Invoices are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT17 | Sales | Credit notes issued are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT18 | Sales | Cash receipts are recorded in the period in which they are received. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT19 | Sales | Cash receipts data are entered for processing accurately. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT20 | Sales | All cash receipts data are entered for processing. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT21 | Sales | Cash receipts data are valid and are entered for processing only once. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT22 | Sales | Cash discounts are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT23 | Sales | Timely collection of accounts receivable is monitored. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT24 | Sales | The customer master file is maintained. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT25 | Sales | Only valid changes are made to the customer master file. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT26 | Sales | All valid changes to the customer master file are input and processed. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT27 | Sales | Changes to the customer master file are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT28 | Sales | Changes to the customer master file are processed in a timely manner. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT29 | Sales | Customer master file data remain up-to-date. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT30 | Purchasing | Purchase orders are placed only for approved requisitions. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT31 | Purchasing | Purchase orders are accurately entered. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT32 | Purchasing | All purchase orders issued are input and processed. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT33 | Purchasing | Amounts posted to accounts payable represent goods or services received. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT34 | Purchasing | Accounts payable amounts are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT35 | Purchasing | All amounts for goods or services received are input and processed to accounts payable. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT36 | Purchasing | Amounts for goods or services received are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT37 | Purchasing | Accounts payable are adjusted only for valid reasons. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT38 | Purchasing | Credit notes and other adjustments are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT39 | Purchasing | All valid credit notes and other adjustments related to accounts payable are input and processed. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT40 | Purchasing | Credit notes and other adjustments are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT41 | Purchasing | Disbursements are made only for goods and services received. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT42 | Purchasing | Disbursements are distributed to the appropriate suppliers. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT43 | Purchasing | Disbursements are accurately calculated and recorded. | Valuation, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT44 | Purchasing | Disbursements are recorded in the period in which they are issued. | Valuation, Occurance | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT45 | Purchasing | Only valid changes are made to the supplier master file. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT46 | Purchasing | All valid changes to the supplier master file are input and processed. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT47 | Purchasing | Changes to the supplier master file are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT48 | Purchasing | Changes to the supplier master file are processed in a timely manner. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT49 | Purchasing | Supplier master file data remain up-to-date. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT50 | Monetary Cycle | Borrowings are accurately recorded as to amounts and terms. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT51 | Monetary Cycle | All borrowings are recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT52 | Monetary Cycle | Borrowings are recorded in the appropriate period. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT53 | Monetary Cycle | All interest is accurately calculated and recorded in the appropriate period.= | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT54 | Monetary Cycle | Recorded loan repayments are valid. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT55 | Monetary Cycle | Loan repayments are accurately recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT56 | Monetary Cycle | All loan repayments are recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT57 | Monetary Cycle | Loan repayments are recorded in the appropriate period. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT58 | Monetary Cycle | Investment purchases, sales and maturities are accurately recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT59 | Monetary Cycle | All investment transactions are recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT60 | Monetary Cycle | Investment transactions are recorded in the appropriate period. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT61 | Monetary Cycle | All investment income is accurately calculated and recorded in the appropriate period. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT62 | Monetary Cycle | Derivative transactions are accurately recorded. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT63 | Monetary Cycle | Derivative transactions are recorded in the appropriate period. | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | ||
| IT64 | Inventory | Adjustments to inventory prices or quantities are recorded promptly and in the appropriate period. | Validity, Completeness, Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT65 | Inventory | Adjustments to inventory prices or quantities are recorded accurately. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT66 | Inventory | Raw materials are received and accepted only if they have valid purchase orde= rs. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT67 | Inventory | Raw materials received are recorded accurately. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT68 | Inventory | All raw materials received are recorded. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT69 | Inventory | Receipts of raw materials are recorded promptly and in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT70 | Inventory | Defective raw materials are returned promptly to suppliers. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT71 | Inventory | All transfers of raw materials to production are recorded accurately and in t= he appropriate period. | Valuation, Occurrence, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT72 | Inventory | All direct and indirect expenses associated with production are recorded accurately and in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT73 | Inventory | All transfers of completed units of production to finished goods inventory are recorded completely and accurately in the appropriate period. | Valuation, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT74 | Inventory | Finished goods returned by customers are recorded completely and accurately in the appropriate period. | Valuation, Completeness, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT75 | Inventory | Finished goods received from production are recorded completely and accurately in = the appropriate period. | Completeness, Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT76 | Inventory | All shipments are recorded. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT77 | Inventory | Shipments are recorded accurately. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT78 | Inventory | Shipments are recorded promptly and in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT79 | Inventory | Inventory is reduced only when goods are shipped with approved customer orders. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT80 | Inventory | Costs of shipped inventory are transferred from inventory to cost of sales. | Validity, Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT81 | Inventory | Costs of shipped inventory are accurately recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT82 | Inventory | Amounts posted to cost of sales represent those associated with shipped inventory= . | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT83 | Inventory | Costs of shipped inventory are transferred from inventory to cost of sales prom= ptly and in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT84 | Inventory | Only valid changes are made to the inventory management master file. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT85 | Inventory | All valid changes to the inventory management master file are input and processed. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT86 | Inventory | Changes to the inventory management master file are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT87 | Inventory | Changes to the inventory management master file are promptly processed. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT88 | Inventory | Inventory management master file data remain up-to-date. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT89 | Asset | Fixed asset acquisitions are accurately recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT90 | Asset | Fixed asset acquisitions are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT91 | Asset | All fixed asset acquisitions are recorded. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT92 | Asset | Depreciation charges are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT93 | Asset | All depreciation charges are recorded in the appropriate period. | Validity, Valuation, Occurrence, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT94 | Asset | All fixed asset disposals are recorded. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT95 | Asset | Fixed asset disposals are accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT96 | Asset | Fixed asset disposals are recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT97 | Asset | Records of fixed asset maintenance activity are accurately maintained. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT98 | Asset | Fixed asset maintenance activities records are updated in a timely manner. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT99 | Asset | Only valid changes are made to the fixed asset register and/or master file. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT100 | Asset | All valid changes to the fixed asset register and/or master file are input and processed. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT101 | Asset | Changes to the fixed asset register and/or master file are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT102 | Asset | Changes to the fixed asset register and/or master file are promptly processed. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT103 | Asset | Fixed asset register and/or master file data remain up-to-date. | Completeness, Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT104 | Human Resourc= es | Additions to the payroll master files represent valid employees. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT105 | Human Resourc= es | All new employees are added to the payroll master files. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT106 | Human Resourc= es | Terminated employees are removed from the payroll master files. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT107 | Human Resourc= es | Employees are terminated only within statutory and union requirements. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT108 | Human Resourc= es | Deletions from the payroll master files represent valid terminations. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT109 | Human Resourc= es | All time worked is input. | Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT110 | Human Resourc= es | Time worked is accurately input and processed. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT111 | Human Resourc= es | Payroll is recorded in the appropriate period. | Valuation, Occurrence | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT112 | Human Resourc= es | Payroll (including compensation and withholdings) is accurately calculated and recorded. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT113 | Human Resourc= es | Payroll is disbursed to appropriate employees. | Validity | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT114 | Human Resourc= es | Only valid changes are made to the payroll master files. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT115 | Human Resourc= es | All valid changes to the payroll master files are input and processed. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT116 | Human Resourc= es | Changes to the payroll master files are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT117 | Human Resourc= es | Changes to the payroll master files are processed in a timely manner. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT118 | Human Resourc= es | Payroll master file data remain up-to-date. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT119 | Human Resourc= es | Only valid changes are made to the payroll withholding tables. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT120 | Human Resourc= es | All valid changes to the payroll withholding tables are input and processed.<= /td> | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT121 | Human Resourc= es | Changes to the payroll withholding tables are accurate. | Valuation | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT122 | Human Resourc= es | Changes to the payroll withholding tables are promptly processed. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| IT123 | Human Resourc= es | Payroll withholding table data remain up-to-date. | Validity, Completeness | TBD | TBD | TBD | TBD | N/A | N/A | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | |
| Master COBIT-SOX List | |||||||||||||||||||
| Client: | |||||||||||||||||||
| Valid From: | 3/1/2005= | ||||||||||||||||||
| Valid To: | 12/31/20= 05 | ||||||||||||||||||
| Note: This document provides a framewo= rk of common general computer controls that support a Sarbanes-Oxley compliant environment. The framework = is taken directly from the "IT Control Objectives for Sarbanes-Oxley&qu= ot; issued by the IT Governance Institute. | |||||||||||||||||||
| <= /td> | 0 | 0 | 0 | 0 | |||||||||||||||
| Control Ref.[1] | Cycle | Process | Control Objectives | Illustrative Controls | Control Importance | Risk | Control | Control Type | Validation Approach | Validation Results | Area for Improvement | Action Items | Validation Estimate | Control Maturity Assessment | Control Effective Date | Ready to Test? | Illustrative Test of Controls | ||
| PDPC 1.1 | Program Development and Program Change | Acquire or Develop Application Systems | The organization's system development life cycle methodology (SDLC) should include security, availability and processing integrity requirements of t= he organization. | The organization's system development life cycle methodology (SDLC) includes security, availability and processing integrity requirements of the organization. | High | Lack of a comprehensive SDLC methodology could lead to improperly controlled financial systems. | Obtain a copy of the organization's SDLC methodology. Review the methodology to determ= ine that it addresses security, availability and processing integrity requirements. Consider whet= her there are appropriate steps to ensure that these requirements are conside= red throughout the development or acquisition life cycle, e.g. security and availability and processing integrity should be considered during the requirements phase. | ||||||||||||
| PDPC 1.2 | Program Development and Program Change | Acquire or Develop Application Systems | The organization's SDLC policies and procedures should consider the developme= nt and acquisition of new systems and major changes to existing systems. | The organization's SDLC policies and procedures consider the development and acquisition of new systems and major changes to existing systems. | High | Failure to apply SDLC to changes impacting financial information could lead to insufficient controls. | Review the organization's SDLC methodology to determine if it considers both the development and acquisition of new systems and major changes to existing systems | ||||||||||||
| PDPC 1.3 | Program Development and Program Change | Acquire or Develop Application Systems | The SDLC methodology ensures that information systems are designed to include application controls that support complete, accurate, authorized and valid transaction processing. | The SDLC methodology ensures that information systems are designed to include application controls that support complete, accurate, authorized and valid transaction processing. | High | Lack of a comprehensive SDLC methodology could lead to improperly controlled financial systems. | Review the methodology to determine if it addresses application controls are considered throughout the development or acquisition life cycle, e.g. application controls should be included in the conceptual design and deta= il design phases. | ||||||||||||
| PDPC 1.4 | Program Development and Program Change | Acquire or Develop Application Systems | The organization has an acquisition and planning process that aligns with its overall strategic direction. | The organization has an acquisition and planning process that aligns with its overall strategic direction. | Low | Systems acquisitions that are not in line with strategic direction could lead to inefficient use of corporate assets. | Review the SDLC methodology to ensure that the organization's overall strategic direction is considered, e.g., an IT steering committee must review and approve projects to ensure that a proposed project aligns with strategic business requirements and that it will utilize approved technologies. | ||||||||||||
| PDPC 1.5 | Program Development and Program Change | Acquire or Develop Application Systems | IT management ensures that users are appropriately involved in the design of applications, selection of packaged software and the testing thereof, to ensure a reliable environment. | IT management ensures that users are appropriately involved in the design of applications, selection of packaged software and the testing thereof, to ensure a reliable environment. | High | Lack of user involvement in system implementations could lead to improperly controlled financial systems. | Review the SDLC to determine if users are appropriately involved in the design of applications, selection of packaged software and testing. | ||||||||||||
| PDPC 1.6 | Program Development and Program Change | Acquire or Develop Application Systems | Post-implementation reviews are performed to verify controls are operating effectively. | Post-implementation reviews are performed to verify controls are operating effectively. | Medium | Failure to assess financial systems after information could lead to errors going undetected. | Determine if post-implementation reviews are performed on new systems and significa= nt changes reported. | ||||||||||||
| PDPC 1.7 | Program Development and Program Change | Acquire or Develop Application Systems | The organization acquires/develops systems software in accordance with its acquisition, development and planning process. | The organization acquires/develops systems software in accordance with its acquisition, development and planning process. | High | Improper implementation of systems software could lead to control breakdowns. | Select a sample of projects that resulted in new financial systems being implemented. Review the documentation and deliverables from these projects to determine if they h= ave been completed in accordance with the acquisition, development and planni= ng process. | ||||||||||||
| PDPC 2.1 | Program Development and Program Change | Define the Information Architecture | Documented procedures exist and are followed to ensure that infrastructure systems, including network devices and software, are acquired based on the requirements of the financial applications they are intended to support.<= /td> | Documented procedures exist and are followed to ensure that infrastructure systems, including network devices and software, are acquired based on the requirements of the financial applications they are intended to support.<= /td> | High | Improper implementation of infrastructure systems could lead to control breakdowns= . | Select a sample of technology infrastructure implementations. Review the documentation and deliverables from these projects to determine if infrastructure requireme= nts were considered at the appropriate time during the acquisition process | ||||||||||||
| PDPC 3.1 | Program Development and Program Change | Develop and Maintain Policies and Procedures | The organization's SDLC methodology and associated policies and procedures are regularly reviewed, updated and approved by management. | The organization's SDLC methodology and associated policies and procedures are regularly reviewed, updated and approved by management. | Low | Outdated SDLC may not reflect changes in the business and/or in the technology are= na. | Confirm that the organ=
ization's
policies and procedures are regularly reviewed and updated as changes in =
the
environment dictate. When
policies and procedures are changed, determine if management approves suc=
h changes. Select a sample of projects and determine that user reference and suppo= rt manuals and systems documentation and operations documentation were prepared. Consider whether = drafts of these manuals were incorporated in user acceptance testing. Determine whether any changes to proposed controls resulted in documentation updates. |
||||||||||||
| PDPC 3.2 | Program Development and = Program Change | Develop and Maintain Policies and Procedures | The organization ensur= es that its systems and applications are developed in accordance with its support= ed, documented policies and procedures. | The organization ensur= es that its systems and applications are developed in accordance with its support= ed, documented policies and procedures. | High | SDLC methodology may n= ot be applied to financial system implementations, leading to a breakdown in controls. | Review a sample of app= lication documentation (including user manuals to determine if they comply with the policies and procedures that have been documented by the organization. | ||||||||||||
| PDPC 4.1 | Program Development and = Program Change | Intstall and Test Appl= ication Software and Technology Infrastructure | A testing strategy is = developed and followed for all significant changes in applications and infrastructu= re technology, which addresses unit, system, integration, and user acceptance-level testing to help ensure that deployed systems operate as intended. | A testing strategy is = developed and followed for all significant changes in applications and infrastructu= re technology, which addresses unit, system, integration, and user acceptance-level testing to help ensure that deployed systems operate as intended. | High | Insufficient testing c= ould result in erroneous code being promoted into the production environment.<= /td> | Select a sample of sys= tem development projects and significant system upgrades (including technology upgrades). Determine if a f= ormat testing strategy was prepared and followed. Consider whether this strategy considered potential development and implementation risks and addressed a= ll the necessary components to address these risks, e.g. if the completeness= and accuracy of system interfaces were essential to the production of complete and accurate reporting, these interfaces were included in the testing strategy. | ||||||||||||
| PDPC 4.2 | Program Development and = Program Change | Intstall and Test Appl= ication Software and Technology Infrastructure | Load and stress testin= g is performed according to a test plan and established testing standards. | Load and stress testin= g is performed according to a test plan and established testing standards. | High | Lack of load and stres= s testing could lead to implementation of systems that do not perform properly under true production conditions. | Select a sample of sys= tem development projects and significant system upgrades that are significant= for financial reporting. Where = it was considered that capacity and performance were of potential concern, review the approach to load and stress testing.= Consider whether a structured approach was taken to load and stress testing and that the approach taken adequately modeled the anticipated volumes, including types of transactions being processed and impact on performance of other services that would be running concurrently. | ||||||||||||
| PDPC 4.3 | Program Development and = Program Change | Intstall and Test Appl= ication Software and Technology Infrastructure | Interfaces with other = systems are tested to confirm that data transmissions are complete, accurate and valid. | Interfaces with other = systems are tested to confirm that data transmissions are complete, accurate and valid. | High | Insufficient testing of interfaces could affect the completeness and accuracy of data transmitted= in the production environment. | Select a sample of sys= tem development projects and significant system upgrades that are significant= for financial reporting. Determ= ine if interfaces with other systems were tested to confirm that data transmissi= ons are complete, e.g., record totals are accurate and valid. Consider whether the extent of t= esting was sufficient and included recovery in the event of incomplete data transmissions. | ||||||||||||
| PDPC 4.4 | Program Development and = Program Change | Intstall and Test Appl= ication Software and Technology Infrastructure | The conversion of data= is tested between its origin and its destination to confirm that it is complete, accurate, and valid. | The conversion of data= is tested between its origin and its destination to confirm that it is complete, accurate, and valid. | High | Invalid, incomplete, a= nd inaccurate data could be loaded into the production environment. | Obtain a sample of sys= tem development projects and significant for financial reporting. Determine if a conversion strate= gy was documented. Consider whethe= r it included strategies to "scrub" the data in the old system before conversion or to "run down" data in the old system before conversion. Review the conv= ersion testing plan. Consider whet= her the following were considered: data transformations, input of data not available in the old system, edits, completeness controls and timings of conversions. Determine if the conversion was included in acceptance testi= ng and was approved by user management. | ||||||||||||
| PDPC 5.1 | Program Development and = Program Change | Manage Changes | Requests for program c= hanges, system changes and maintenance (including changes to system software) are standardized, documented and subject to formal change management procedur= es. | Requests for program c= hanges, system changes and maintenance (including changes to system software) are standardized, documented and subject to formal change management procedur= es. | High | Unapproved code could = be placed into production. | Determine
that a documented change management process exists and is maintained to
reflect the current process. Consider if = change management procedures exist for all changes to the production environment, including program changes, system maintenance and infrastructure changes. Evaluate the= process used to control and monitor change requests Consider whe= ther change requests are properly initiated, approved and tracked. Determine wh= ether program change is performed in a segregated, controlled environment. Select a sam= ple of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if t= he following are included in the approval process: Operations, security, IT infrastructure management and IT management. Evaluate pro= cedures designed to ensure only authorized./ approve changes are moved into production. |
||||||||||||
| PDPC 5.2 | Program Development and = Program Change | Manage Changes | Emergency change reque= sts are documented and subject to formal change management procedures. | Emergency change reque= sts are documented and subject to formal change management procedures. | High | Unapproved code could = be placed into production. | Trace the
sample of changes back to the change&nbs=
p;
request log and supporting documentation. Confirm that= these procedures address the timely implementation of patches to system software. Select a sample to determine compliance with the documented procedures. |
||||||||||||
| PDPC 5.3 | Program Development and Program Change | Manage Changes | Controls are in place to restrict migration of programs to production only by authorized individuals. | Controls are in place to restrict migration of programs to production only by authorized individuals. | High | Unapproved code could be placed into production. | Determine if
a process exists to control and supervise emergency changes. Determine if= an audit trail exists of all emergency activity and that it is independently reviewed. Determine th= at procedures require that emergency changes be supported by appropriate documentation. Establish th= at backout procedures are developed for emergency changes. Evaluate pro= cedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made. Review a sample of changes that are recorded as "emergency: changes, and determine if they cont= ain the needed approval and the needed access was terminated after a set peri= od of time. Establish that the sample of changes was well documented.= |
||||||||||||
| PDPC 5.4 | Program Development and Program Change | Manage Changes | IT ma= nagement ensures that the setup and implementation of system software do not jeopardize the security of the data and programs being stored on the syst= em. | IT ma= nagement ensures that the setup and implementation of system software do not jeopardize the security of the data and programs being stored on the syst= em. | High | Impro= per implementation of systems software could lead to security breaches for financial information and systems. | = ; | <= /td> | = ; | = ; | = ; | = ; | <= /td> | = | = | = | Evaluate the approvals=
required
before a program is moved to production.=
Consider approvals from system owners, development staff and compu=
ter
operations. Confirm that there is appropriate segregation of duties between the sta= ff responsible for moving a pr= ogram into production and development staff.&n= bsp; Obtain and test evidence to support this assertion. |
||
| CO 1.1 | Computer Ops and Access to Programs & Data | Define and Manage Service Levels | Service levels are defined and managed to support financial reporting system requirements. | Service levels are defined and managed to support financial reporting system requirements. | Low | Financial systems may not meet the performance needs of management. | Determine that a risk = assessment of the potential impact of changes to system software is performed. Review procedures to test change= s to system software in a development environment before they are applied to p= roduction. Verify that backout procedures e= xist. | ||||||||||||
| CO 1.2 | Computer Ops and Access to Programs & Data | Define and Manage Service Levels | A framework is defined to establish key performance indicators to manage service level agreements, both internally and externally. | A framework is defined to establish key performance indicators to manage service level agreements, both internally and externally. | Low | Financial systems may not meet the performance needs of management. | Obtain service level p=
erformance
reports and confirm that they include key performance indicators. Review the performance results, identify performance issues and assess = how service level managers are addressing these issues. |
||||||||||||
| CO 2.1 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | A designated individual is responsible for regular monitoring and reporting= on the achievement of the third-party service level performance criteria. | A designated individual is responsible for regular monitoring and reporting= on the achievement of the third-party service level performance criteria. | Low | Financial systems may not meet the performance needs of management. | Determine if the manag= ement of third-party services has been assigned to appropriate individuals. | ||||||||||||
| CO 2.2 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | Selection of vendors for outsourced services is performed in accordance with the organization's vendor management policy. | Selection of vendors for outsourced services is performed in accordance with the organization's vendor management policy. | High | Control reliance may be placed on third party providers without the appropriate d= ue diligence. | Obtain the organizatio=
n's vendor
management policy and discuss with those responsible for third-party serv=
ice
management if they follow such standards. Obtain and test evidence that the selection of vendors for outsourced services is performed in accordance with the organization's vendor manage= ment policy. |
||||||||||||
| CO 2.3 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | IT management determines that, before selection, potential third parties are properly qualified through an assessment of their capability to deliver t= he required service and a review of their financial viability. | IT management determines that, before selection, potential third parties are properly qualified through an assessment of their capability to deliver t= he required service and a review of their financial viability. | High | Control reliance may be placed on third party providers without the appropriate d= ue diligence. | Obtain the criteria an=
d business
case used for selection of third-party service providers. Assess whether these criteria include a consideration of the third part= y's financial stability, skill and knowledge of the systems under management = and controls over security, availability and processing integrity. |
||||||||||||
| CO 2.4 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | Third-party service contracts address the risks, security controls and procedures for information systems and networks in the contract between the parties. | Third-party service contracts address the risks, security controls and procedures for information systems and networks in the contract between the parties. | High | Third party providers may not meet the organization's requirements for internal controls. | Select a sample of thi= rd-party service contracts and determine if they include controls support security, availability and processing integrity in accordance with the company's policies and procedures. | ||||||||||||
| CO 2.5 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | Procedures exist and are followed to ensure that a formal contract is defined and ag= reed for all third-party services before work is initiated, including definiti= on of internal control requirements and acceptance of the organization's policies and procedures. | Procedures exist and are followed to ensure that a formal contract is defined and ag= reed for all third-party services before work is initiated, including definiti= on of internal control requirements and acceptance of the organization's policies and procedures. | High | Third party providers may not meet the organization's requirements for internal controls. | Review a sample of con=
tracts and
determine whether: There is a definiti= on of services to be performed The responsi= bilities for the controls over financial reporting systems have been adequately defined. The third pa= rty has accepted compliance with the organization's policies and procedures, E.G., security policies and procedures. The contract= s were reviewed and signed by appropriate parties before work commenced. The controls= over financial reporting systems and subsystems described in the contract agree with those required by the organization. Review gaps, if any, and consider further analysis to determine the imp= act on financial reporting. |
||||||||||||
| CO 2.6 | Computer Ops and Access to Programs & Data | Manage Third-Party Services | A regular review of security, availability and processing integrity is performed for service level agreements and related contracts with third-p= arty service providers. | A regular review of security, availability and processing integrity is performed for service level agreements and related contracts with third-p= arty service providers. | High | Third party providers system of control may break down over time. | Inquire whether third-= party service providers perform independent reviews of security, availability a= nd processing integrity, e.g., service auditor report. Obtain a sample of the most rece= nt review and determine if there are any control deficiencies that would imp= act financial reporting. | ||||||||||||
| CO 3.1 | Computer Ops and Access to Programs & Data | Ensure Systems Security | An information security policy exists and has been approved by an appropriate level of executive management. | An information security policy exists and has been approved by an appropriate level of executive management. | High | Lack of an information security policy could result in improper levels of secu= rity over financial systems and information. | IT security policies need to be signed off by management. | Obtain a copy of the
organization's security policy and evaluate the effectiveness. Points to be taken into consider=
ation
include: Is there an overall statement of the importance of security to the organization? Have specifi= c policy objectives been defined? Have employe= e and contractor security responsibilities been addressed? Has the poli= cy been approved by an appropriate level of senior management to demonstrate management's commitment to security? Is there a p= rocess to communicate the policy to all levels of management and employees? |
|||||||||||
| CO 3.2 | Computer Ops and Access to Programs & Data | Ensure Systems Security | A framework of security standards has been developed that supports the objectives of the security policy. | A framework of security standards has been developed that supports the objectives of the security policy. | High | Lack of an information security framework could result in inconsistent applica= tion of security policies, affecting security over financial systems and information. | Security framework should also indicate high level server controls such as password length and expiration, maximum logon attempts, etc. This will likely appear in IT-15= 0. | Obtain a copy of the s=
ecurity
standards. Determine whethe=
r the
standards framework effectively meets the objectives of the security poli=
cy.
Consider whether the following topics, which are often addressed by secur=
ity
standards, have been appropriately covered: Security organizati= on Asset classi= fication and control Personnel security Software sec= urity policy Physical and environmental security Workstation security Computing en= vironment management Network environment management Business con= tinuity planning Compliance Determine if their are processes in place to communicate and maintain t= hese standards. |
|||||||||||
| CO 3.3 | Computer Ops and Access to Programs & Data | Ensure Systems Security | An IT security plan exists that is aligned with overall IT strategic plans.<= /td> | An IT security plan exists that is aligned with overall IT strategic plans.<= /td> | Low | Lack of a tie between the information security plan and overall IT strategic p= lan could lead to inefficient security implementation. | Obtain a copy of secur= ity plans or strategies for financial reporting systems and subsystems and assess t= heir adequacy in relation to the overall company plan | ||||||||||||
| CO 3.4 | Computer Ops and Access to Programs & Data | Ensure Systems Security | The IT security plan is updated to reflect changes in the IT environment as w= ell as security requirements of specific systems. | The IT security plan is updated to reflect changes in the IT environment as w= ell as security requirements of specific systems. | High | Lack of updates to the IT security plan could lead to degradation of system and network security over time. | Confirm that the secur= ity plan reflects the unique security requirements of financial reporting systems = and subsystems. | ||||||||||||
| CO 3.5 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Procedures exist and are followed to authenticate all users to the system to support= the validity of transactions and subsystems. | Procedures exist and are followed to authenticate all users to the system to support= the validity of transactions and subsystems. | High | Improper access could be provided to key financial transactions. | Assess the authenticat= ion mechanisms used to validate user credentials for financial reporting syst= ems and validate that user sessions time-out after a predetermined period of time. | ||||||||||||
| CO 3.6 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Procedures exist and are followed to maintain the effectiveness of authentication and access mechanisms (e.g., regular password changes). | Procedures exist and are followed to maintain the effectiveness of authentication and access mechanisms (e.g., regular password changes). | High | Lack of mechanisms such as password changes could lead to weak security over t= ime. | Review security practi= ces to confirm that authentication controls (passwords, IDs, Two-Factor, etc.) a= re used appropriately and are subject to common confidentiality requirements (IDs and password not shared, alphanumeric passwords used, etc.). | ||||||||||||
| CO 3.7 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Procedures exist and are followed to ensure timely action relating to requesting, establishing, issuing, suspending and closing user accounts. | Procedures exist and are followed to ensure timely action relating to requesting, establishing, issuing, suspending and closing user accounts. | High | Improper access could be provided for financial systems and data. | Confirm that procedure=
s exist
for the registration, change and deletion of users from financial reporti=
ng
systems and subsystems on a timely basis and the procedures are
followed. Validate that attempts to gain unauthorized access to financial reporti= ng systems and subsystems are logged and are followed up on a timely basis. Select a sample of new users and determine if management approved their access and the access granted agrees with eh access privileges that were approved. Select a sample of terminated employees and determine if their access h= ave been removed, and was done in a timely manner. Select a sample of current users and review their access for appropriateness based upon their job functions. |
||||||||||||
| CO 3.8 | Computer Ops and Access to Programs & Data | Ensure Systems Security | A control process exists and is followed to periodically review and confirm access rights. | A control process exists and is followed to periodically review and confirm access rights. | High | Improper access could be provided for financial systems and data. | Inquire whether access=
controls
are reviewed for financial reporting systems and subsystems on a periodic
basis by management. Assess the adequacy of how exceptions are reexamined, and if the follow= -up occurs in a timely manner. |
||||||||||||
| CO 3.9 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Where appropriate, controls exist to ensure that neither party can deny transactions and controls are implemented to provide nonrepudiation of or= igin or receipt, proof of submission and receipt of transactions. | Where appropriate, controls exist to ensure that neither party can deny transactions and controls are implemented to provide nonrepudiation of or= igin or receipt, proof of submission and receipt of transactions. | High | Transactions may be improperly received or rejected between the company and outside parties. | Determine how the orga=
nization
establishes accountability for transaction initiation and approval. Test the use of accountability controls by observing a user attempting = to enter an unauthorized transaction. Obtain a sample of transactions, and identify evidence of the accountability or origination of each. |
||||||||||||
| CO 3.10 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Where network connectivity is used, appropriate controls, including firewalls, intrusion detection and vulnerability assessment, exist and are used to prevent unauthorized access. | Where network connectivity is used, appropriate controls, including firewalls, intrusion detection and vulnerability assessment, exist and are used to prevent unauthorized access. | High | Improper access could be provided for financial systems and data. | Determine the sufficie=
ncy and
appropriateness of perimeter security controls including firewalls and
intrusion detection systems. Inquire whether management has performed an independent assessment of controls within the past year (e.g., ethical hacking, social engineering). Obtain a copy of this assessment and review the results, including the appropriateness of follow-upon identified weaknesses. Determine if antivirus systems are used to protect the integrity and security of financial reporting systems and subsystems. When appropriate, determine if encryption techniques are used to support the confidentiality of financial information sent from one system to anot= her. |
||||||||||||
| CO 3.11 | Computer Ops and Access to Programs & Data | Ensure Systems Security | IT security administration monitors and logs security activity, and identifi= ed security violations are reported to senior management. | IT security administration monitors and logs security activity, and identifi= ed security violations are reported to senior management. | Medium | Management may not be notified in a timely fashion when system resources are under attack. | Inquire whether a secu=
rity
office exists to monitor for security vulnerabilities and related threat
events. Assess the nature and extent of such events over the past year and disc= uss with management how they have responded with controls to prevent unauthor= ized access or manipulation of financial systems and subsystems. |
||||||||||||
| CO 3.12 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Controls relating to appropriate segregation of duties over requesting and granting access to systems and data exist and are followed. | Controls relating to appropriate segregation of duties over requesting and granting access to systems and data exist and are followed. | High | Improper access could be provided for financial systems and data. | Review the process to = request and grant access to systems and data and confirm that the same person does not perform these functions. | ||||||||||||
| CO 3.13 | Computer Ops and Access to Programs & Data | Ensure Systems Security | Access to facilities is restricted to authorized personnel and requires appropri= ate identification and authentication. | Access to facilities is restricted to authorized personnel and requires appropri= ate identification and authentication. | High | Improper access could be provided to physical IT assets that support financial sys= tems and data. | Obtain policies and pr=
ocedures
as they relate to facility security, key and card reader access- and
determine if those procedures account for proper identification and
authentication. Observe the in and out traffic to the organization's facilities to establish that proper access is controlled. Select a sample of users and determine if their access is appropriate b= ased upon their job responsibilities. |
||||||||||||
| CO 4.1 | Computer Ops and Access to Programs & Data | Manage the Configuration | Only authorized software is permitted for use by employees using company IT assets. | Only authorized software is permitted for use by employees using company IT assets. | High | Unauthorized software could introduce errors and/or lead to a breakdown in controls ov= er financial systems and data. | Determine if procedure=
s are in
place to detect and prevent the use of unauthorized software. Obtain and review the company po=
licy
as it relates to software use to see that this is clearly articulated. Consider reviewing a sample of applications and computers to determine = if they are in conformance with organization policy. |
||||||||||||
| CO 4.2 | Computer Ops and Access to Programs & Data | Manage the Configuration | System infrastructure, including firewalls, routers, switches, network operating systems, servers and other related devices, is properly configured to pre= vent unauthorized access. | System infrastructure, including firewalls, routers, switches, network operating systems, servers and other related devices, is properly configured to pre= vent unauthorized access. | High | Improper access could be obtained from external sources. | Determine if the organ=
ization's
policies require the documentation of the current configuration, as well =
as
the security configuration settings to be implemented. Review a sample of servers, firewalls, routers, etc., to consider if th= ey have been configured in accordance with the organization's policy. |
||||||||||||
| CO 4.3 | Computer Ops and Access to Programs & Data | Manage the Configuration | Application software and data storage systems are properly configured to provision ac= cess based on the individual's demonstrated need to view, add, change, or dele= te data. | Application software and data storage systems are properly configured to provision ac= cess based on the individual's demonstrated need to view, add, change, or dele= te data. | High | Improper access could be granted to financial data and applications kept in data storage systems. | Conduct an evaluation =
of the
frequency and timeliness of management's review of configuration
records. Assess whether management has documented the configuration management procedures. Review a sample of configuration changes, additions or deletions, to consider if they have been properly approved based on demonstrated need.<= /td> | ||||||||||||
| CO 4.4 | Computer Ops and Access to Programs & Data | Manage the Configuration | IT management has established procedures across the organization to protect information systems and technology from computer viruses. | IT management has established procedures across the organization to protect information systems and technology from computer viruses. | High | Computer viruses could lead to the corruption of financial systems and data. | Review the organizatio=
n's
procedures to detect computer viruses. Verify that the organization has installed and is using virus software = on its networks and personal computers. |
||||||||||||
| CO 4.5 | Computer Ops and Access to Programs & Data | Manage the Configuration | Periodic testing and assessment is performed to confirm that the software and netw= ork infrastructure is appropriately configured. | Periodic testing and assessment is performed to confirm that the software and netw= ork infrastructure is appropriately configured. | Medium | System configurations may change over time, leading to possible breakdowns in control. | Review the software an= d network infrastructure to establish that it has been appropriately configured and maintained, according to the organization's documented process. | ||||||||||||
| CO 5.1 | Computer Ops and Access to Programs & Data | Manage Problems and Incidents | IT management has defined and implemented a problem management system to ens= ure that operational events that are not part of standard operation (incident= s, problems, and errors) are recorded, analyzed and resolved in a timely man= ner. | IT management has defined and implemented a problem management system to ens= ure that operational events that are not part of standard operation (incident= s, problems, and errors) are recorded, analyzed and resolved in a timely man= ner. | High | Improper follow-up and resolution of identified problems could lead to a breakdown= in controls over time. | Determine if a problem
management system exists, and how it is being used. Review how management has docume=
nted
how the system is to be used, Review a sample of problem or incident reports, to consider if the issu= es were addressed (recorded, analyzed and resolved) in a timely manner. |
||||||||||||
| CO 5.2 | Computer Ops and Access to Programs & Data | Manage Problems and Incidents | The problem management system provides for adequate audit trail facilities, w= hich allow tracing from incident to underlying cause. | The problem management system provides for adequate audit trail facilities, w= hich allow tracing from incident to underlying cause. | High | Improper follow-up and resolution of identified problems could lead to a breakdown= in controls over time. | Determine if the organ=
ization's
procedures include audit trail facilities-tracking of the incidents. Review a sample of problems recorded on the problem management system to consider if a proper audit trail exists and is used. |
||||||||||||
| CO 5.3 | Computer Ops and Access to Programs & Data | Manage Problems and Incidents | A security incident response process exists to support timely response and investigation of unauthorized activities. | A security incident response process exists to support timely response and investigation of unauthorized activities. | High | Improper follow-up and resolution of security incident could lead to unauthorized access to financial systems and data. | Verify that all unauth= orized activities are responded to in a timely fashion, and there is a process to support proper disposition. | ||||||||||||
| CO 6.1 | Computer Ops and Access to Programs & Data | Manage Data | Policies and procedures exist for the handling, distribution and retention of data= and reporting output. | Policies and procedures exist for the handling, distribution and retention of data= and reporting output. | High | Financial information may be improperly disclosed or destroyed. | Review the policies and
procedures for the handling, distribution and retention of data and repor=
ting
output. Determine whether t=
he
policies and procedures are adequate for the protection of data and the
timely distribution of all the correct financial reports (including
electronic reports) to appropriate personnel. Obtain and test evidence that the controls over the protection of data = and the timely distribution of financial reports (including electronic report= s) to appropriate personnel are operating effectively. |
||||||||||||
| CO 6.2 | Computer Ops and Access to Programs & Data | Manage Data | Management protects sensitive information, logically and physically, in storage and during transmission against unauthorized access or modification. | Management protects sensitive information, logically and physically, in storage and during transmission against unauthorized access or modification. | High | Financial information may be improperly disclosed or destroyed. | Review the results of = security testing. Determine if there= are adequate controls to protect sensitive information, both logically and physically, in storage and during transmission against unauthorized acces= s or modification. | ||||||||||||
| CO 6.3 | Computer Ops and Access to Programs & Data | Manage Data | Retention periods and storage terms are defined for documents, data, programs, repo= rts and messages (incoming and outgoing), as well as the data (keys, certificates) used for their encryption and authentication. | Retention periods and storage terms are defined for documents, data, programs, repo= rts and messages (incoming and outgoing), as well as the data (keys, certificates) used for their encryption and authentication. | High | Financial information may not be available when needed by business unit management.= | Obtain the procedures =
dealing
with distribution and retention of data. Confirm that the procedures define the retention periods and storage te= rms for documents, data, programs, reports and messages (incoming and outgoin= g), as well as the data (keys, certificates) used for their encryption and authentication. Confirm that the retention periods are in conformity with the Sarbanes-Oxley Act. Confirm that the retention periods of previously archived material are = in conformity with the Sarbanes-Oxley Act.&= nbsp; Select a sample of archived material and test evidence that archiv= ed material is being archived in conformance with the requirements of the Sarbanes-Oxley Act. |
||||||||||||
| CO 6.4 | Computer Ops and Access to Programs & Data | Manage Data | Management has implemented a strategy for cyclical backup of data and programs. | Management has implemented a strategy for cyclical backup of data and programs. | High | Financial information may not be available when needed by business unit management.= | Determine if the organ= ization has procedures in place to backup data and programs based on IT and user requirements. Select a samp= le of data files and programs and determine if they are being backed up as requ= ired. | ||||||||||||
| CO 6.5 | Computer Ops and Access to Programs & Data | Manage Data | Procedures exist and are followed to periodically test the effectiveness of the restoration process and the quality of backup media. | Procedures exist and are followed to periodically test the effectiveness of the restoration process and the quality of backup media. | High | Financial information may not be available when needed by business unit management.= | Inquire whether the re=
tention
and storage of messages, documents, programs, etc., have been tested duri=
ng
the past year. Obtain and review the results of testing activities. Establish whether any deficiencies were noted and whether they have been reexamined. Obtain the organization's access security policy and discuss with those responsible whether they follow such standards and guidelines dealing with sensitive backup data. |
||||||||||||
| CO 6.6 | Computer Ops and Access to Programs & Data | Manage Data | Changes to data structure are authorized, made in accordance with design specifications and implemented in a timely manner. | Changes to data structure are authorized, made in accordance with design specifications and implemented in a timely manner. | High | Improper changes to data structures could lead to errors in financial systems or d= ata. | Obtain a sample of data structure changes and determine whether they adhere to the design specifications and were implemented in the time frame required. | ||||||||||||
| CO 7.1 | Computer Ops and Access to Programs & Data | Manage Operations | Management has established and documented standard procedures for IT operations, including scheduling, managing, monitoring and responding to security, availability and processing integrity events. | Management has established and documented standard procedures for IT operations, including scheduling, managing, monitoring and responding to security, availability and processing integrity events. | High | Lack of procedures for problem management could lead to control breakdowns bei= ng undetected. | Determine if managemen=
t has
documented its procedures for IT operations, and operations are reviewed
periodically to ensure compliance. Review a sample of events to confirm that response procedures are opera= ting effectively. When used, rev= iew the job scheduling process and the procedures in place to monitor job completeness. |
||||||||||||
| CO 7.2 | Computer Ops and Access to Programs & Data | Manage Operations | System event data are sufficiently retained to provide chronological information= and logs to enable the review, examination and reconstruction of system and d= ata processing. | System event data are sufficiently retained to provide chronological information= and logs to enable the review, examination and reconstruction of system and d= ata processing. | Low | Lack of sufficient system event history could make it difficult to reconstruct financial system and data processing. | Determine if sufficient chronological information is being recorded and stored in logs, and it is useable for reconstruction, if necessary. Obtain a sample of the log entri= es, to determine if they sufficiently allow for reconstruction. | ||||||||||||
| CO 7.3 | Computer Ops and Access to Programs & Data | Manage Operations | System event data are designed to provide reasonable assurance as to the completeness and timeliness of system and data processing. | System event data are designed to provide reasonable assurance as to the completeness and timeliness of system and data processing. | Low | Lack of sufficient system event data could cause incomplete or untimely proces= sing to go undetected. | Inquire as to the type=
of
information that is used by management to verify the completeness and
timeliness of system and data processing. Review a sample of system processing event data to confirm the complete= ness and timeliness of processing. |
||||||||||||
| CO 7.4 | Computer Ops and Access to Programs & Data | Manage Operations | End-user computing policies and procedures concerning security, availability and processing integrity exist and are followed. | End-user computing policies and procedures concerning security, availability and processing integrity exist and are followed. | High | Insufficient end user computing policies and procedures could lead to a control breakd= own for end user tools such as spreadsheets. | Obtain a copy of the e=
nd-user
computing policies and procedures and confirm that they address security
availability and processing integrity controls. Select a sample of users and inquire whether they are aware of this pol= icy and if they are in compliance with it. |
||||||||||||
| CO 7.5 | Computer Ops and Access to Programs & Data | Manage Operations | End-user computing, including spreadsheets and other user-developed programs, are documented and regularly reviewed for processing integrity, including the= ir ability to sort, summarize and report accurately. | End-user computing, including spreadsheets and other user-developed programs, are documented and regularly reviewed for processing integrity, including the= ir ability to sort, summarize and report accurately. | High | End user computing tools may have control breakdowns over time that go undetected. | Inquire as to manageme=
nt's
knowledge of end-user programs in use across the company. Inquire as to the frequently and approaches followed to review end-user programs for processing integrity, and review a sample of these to confirm effectiveness. Review user-developed systems and test their ability to sort, summarize= and report in accordance with management intentions. |
||||||||||||
| CO 7.6 | Computer Ops and Access to Programs & Data | Manage Operations | User-developed systems and data are regularly backed up and stored in a secure area. | User-developed systems and data are regularly backed up and stored in a secure area. | High | End user computing tools may not be recoverable. | Inquire how end-user s= ystems are backed up and where they are stored. | ||||||||||||
| CO 7.7 | Computer Ops and Access to Programs & Data | Manage Operations | User-developed systems, such as spreadsheets and other end-user programs, are secured fr= om unauthorized use. | User-developed systems, such as spreadsheets and other end-user programs, are secured fr= om unauthorized use. | High | End user computing tools may be exposed to improper access. | Review the security us=
ed to
protect unauthorized access to user-developed systems. Consider observing a user attempting to gain unauthorized access to user-developed systems. Inquire how management is able to detect unauthorized access and what follow-up procedures are performed to assess the impact of such access. | ||||||||||||
| CO 7.8 | Computer Ops and Access to Programs & Data | Manage Operations | Access to user-developed systems is restricted to a limited number of users. | Access to user-developed systems is restricted to a limited number of users. | High | End user computing tools may be exposed to improper access. | Select a sample of user-developed systems and determined who has access if the access is appropriate. | ||||||||||||
| CO 7.9 | Computer Ops and Access to Programs & Data | Manage Operations | Inputs, processing and outputs from user-developed systems are independently veri= fied for completeness and accuracy. | Inputs, processing and outputs from user-developed systems are independently veri= fied for completeness and accuracy. | High | End user computing tools may have control breakdowns over time that go undetected. | Inquire how management=
verifies
the accuracy and completeness of information processed and reported from
user-developed systems. Inquire who reviews and approves outputs from user-developed systems pr= ior to their submission for further processing or final reporting. Consider re-performing or reviewing the logic used in user-developed systems and conclude on its ability to process completely and accurately.= |
||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> | |||||||||||||||||||
| <= /td> |
| SOX General | Test Date: | = | |||||||||||||||
| Overall Cobit Score: | = | Key = Control Reference #: PDPC 1.1= | Did the Control Pass or Fail in its entirety? | P= rocess Owners: | Tester: <= /span> | = | |||||||||||
| Control Objective : | Appropriate computer related controls must be incorporated into any computer system.<= span style=3D'mso-spacerun:yes'> | IT Support Personnel: | = | ||||||||||||||
| Risk: = ; | <= /td> | Una= uthorized access may be gained to computer systems, resulting in data being intentionally or unintentionally altered or destroyed. | = | IT Support Personnel: | = | ||||||||||||
| Control: | Access controlled through system security | = | Platform: | = | |||||||||||||
| Information Criteria Category | Item | Test Criteria/Objective | Test= Procedure | Actu=
al Results |
Ref. | Disc= ussion | Pass /= Fail | Doma= in/Process | |||||||||
| Substantiate Effectiveness: | 1 | TBD | Obtain a copy of the organization's SDLC methodology. Review the methodology to determ= ine that it addresses security, availability and processing integrity requirements. Consider whet= her there are appropriate steps to ensure that these requirements are conside= red throughout the development or acquisition life cycle, e.g. security and availability and processing integrity should be considered during the requirements phase. | General controls risk= s.xls | Program Development and Program Change | Pass | Interface | Lewis Adams | MAS | ||||||||
| Substantiate Efficiency: | 5 | ||||||||||||||||
| Substantiate Confidentiality: | 6 | ||||||||||||||||
| Substantiate Integrity: | 7 | ||||||||||||||||
| Substantiate Availability: | 8 | ||||||||||||||||
| Substantiate Compliance: | 9 | ||||||||||||||||
| Substantiate Reliability: | 10 | ||||||||||||||||
| (Date) | =3D estimated completion date | Pass | Fail | N/A | = | ||||||||||||||||||||
| TESTING | RETESTING | ||||||||||||||||||||||||
| Domain | Key Ctrl | Notes | Resp | First Cut Compl | Started= | Compl | Pass/ F= ail | Resp | Can be = Started | Compl | Pass/ F= ail | Comments | |||||||||||||
| Delivery & Support | PDPC 1.1 | Momin, Karim | &n= bsp; | Fail | <= /td> | Pass | Pass | &nbs= p; | |||||||||||||||||
| PDPC 1.2 | Momin, Karim | Fail | <= /td> | Pass | Pass | = ; | |||||||||||||||||||
| PDPC 1.3 | Momin, Karim | Pass | <= /td> | <= /td> | <= /td> | <= /td> | = ; | ||||||||||||||||||
| PDPC 1.4 | Momin, Karim | &n= bsp; | Pass | <= /td> | <= /td> | <= /td> | |||||||||||||||||||
| <= /td> | <= /td> | <= /td> | = ; | ||||||||||||||||||||||
| <= /td> | <= /td> | <= /td> | |||||||||||||||||||||||
| Acquire & Implement | = | = | |||||||||||||||||||||||
| = ; | = | = | <= /td> | <= /td> | <= /td> | ||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | = ; | ||||||||||||||||||||||
| Plan & Organize | = | = | = | ||||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| &n= bsp; | <= /td> | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| = | = | <= /td> | <= /td> | = ; | |||||||||||||||||||||
| Monitor & Evaluate | = | = | = | ||||||||||||||||||||||
| = ; | |||||||||||||||||||||||||
| = ; | |||||||||||||||||||||||||
| = | = ; | = | = | Pass | = | = | = | Pass | = | &nbs= p; | = | = | = | = | = | = | = | = | = | = | = | = | = | ||
| &n= bsp; | Fail | Test by 12/31 | |||||||||||||||||||||||
| &n= bsp; | Total | = | Fail | ||||||||||||||||||||||
| Not Remediated | |||||||||||||||||||||||||
| = | Total | &nbs= p; | |||||||||||||||||||||||