| Risk Assessment |
RiskAssessmentProgramDevelopmentChangeQuestionnaireImportance |
| Listing of Significant Risks (By Cycle)
| |
|
|
|
| Valid From: |
3/1/20=
05 |
|
|
|
|
| Valid To: |
12/31/=
2005 |
|
|
|
|
|
|
|
| Cycle |
Process |
Ref # |
Risk=
|
Impor=
tance |
|
| Program Development and Program Change |
Acquire
or Develop Application Systems |
PDPC
1.1 |
Lack
of a comprehensive SDLC methodology could lead to improperly controlled
financial systems. |
High |
|
| |
=
; |
PDPC
1.2 |
Failure
to apply SDLC to changes impacting financial information could lead to
insufficient controls. |
High |
|
| |
|
PDPC
1.3 |
Lack
of a comprehensive SDLC methodology could lead to improperly controlled
financial systems. |
High |
|
| |
|
PDPC
1.4 |
Systems
acquisitions that are not in line with strategic direction could lead to
inefficient use of corporate assets. |
Low |
|
| |
|
PDPC
1.5 |
Lack
of user involvement in system implementations could lead to improperly
controlled financial systems. |
High |
|
| |
|
PDPC
1.6 |
Failure
to assess financial systems after information could lead to errors going
undetected. |
Medium |
|
| |
|
PDPC
1.7 |
Improper
implementation of systems software could lead to control breakdowns. |
High |
|
|
<=
/td>
| |
=
|
|
| Program
Development and Program Change |
Defi=
ne the
Information Architecture |
PDPC 2.=
1 |
Impro=
per
implementation of infrastructure systems could lead to control breakdowns=
. |
High
| |
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Develop
and Maintain Policies and Procedures |
PDPC
3.1 |
Outdated
SDLC may not reflect changes in the business and/or in the technology are=
na. |
Low |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Develop
and Maintain Policies and Procedures |
PDPC
3.2 |
SDLC
methodology may not be applied to financial system implementations, leadi=
ng
to a breakdown in controls. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Intstall
and Test Application Software and Technology Infrastructure |
PDPC
4.1 |
Insufficient
testing could result in erroneous code being promoted into the production
environment. |
High |
|
| |
=
; |
PDPC 4.=
2 |
Lack of load and stres=
s testing
could lead to implementation of systems that do not perform properly under
true production conditions. |
High |
|
| |
|
PDPC 4.=
3 |
Insufficient testing of
interfaces could affect the completeness and accuracy of data transmitted=
in
the production environment. |
High |
|
| |
|
PDPC 4.=
4 |
Invalid, incomplete, a=
nd
inaccurate data could be loaded into the production environment. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program
Development and Program Change |
Manage Changes |
PDPC 5.=
1 |
Unapproved code could =
be placed
into production. |
High |
|
| |
=
; |
PDPC 5.=
2 |
Unapproved code could =
be placed
into production. |
High |
|
| |
|
PDPC 5.=
3 |
Unapproved
code could be placed into production. |
High |
|
| |
|
PDPC 5.=
4 |
Impro=
per
implementation of systems software could lead to security breaches for
financial information and systems. |
High
| |
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Define
and Manage Service Levels |
CO
1.1 |
Financial
systems may not meet the performance needs of management. |
Low |
|
|
|
CO
1.2 |
Financial
systems may not meet the performance needs of management. |
Low |
|
| |
|
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
Third-Party Services |
CO
2.1 |
Financial
systems may not meet the performance needs of management. |
Low |
|
| |
=
; |
CO
2.2 |
Control
reliance may be placed on third party providers without the appropriate d=
ue
diligence. |
High |
|
| |
|
CO
2.3 |
Control
reliance may be placed on third party providers without the appropriate d=
ue
diligence. |
High |
|
| |
|
CO
2.4 |
Third
party providers may not meet the organization's requirements for internal
controls. |
High |
|
| |
|
CO
2.5 |
Third
party providers may not meet the organization's requirements for internal
controls. |
High |
|
| |
|
CO
2.6 |
Third
party providers system of control may break down over time. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Ensure
Systems Security |
CO
3.1 |
Lack
of an information security policy could result in improper levels of secu=
rity
over financial systems and information. |
High |
|
| |
=
; |
CO
3.2 |
Lack
of an information security framework could result in inconsistent applica=
tion
of security policies, affecting security over financial systems and
information. |
High |
|
| |
|
CO
3.3 |
Lack
of a tie between the information security plan and overall IT strategic p=
lan
could lead to inefficient security implementation. |
Low |
|
| |
|
CO
3.4 |
Lack
of updates to the IT security plan could lead to degradation of system and
network security over time. |
High |
|
| |
|
CO
3.5 |
Improper
access could be provided to key financial transactions. |
High |
|
| |
|
CO
3.6 |
Lack
of mechanisms such as password changes could lead to weak security over t=
ime. |
High |
|
| |
|
CO
3.7 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.8 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.9 |
Transactions
may be improperly received or rejected between the company and outside
parties. |
High |
|
| |
|
CO
3.10 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.11 |
Management
may not be notified in a timely fashion when system resources are under
attack. |
Medium |
|
| |
|
CO
3.12 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.13 |
Improper
access could be provided to physical IT assets that support financial sys=
tems
and data. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
the Configuration |
CO
4.1 |
Unauthorized
software could introduce errors and/or lead to a breakdown in controls ov=
er
financial systems and data. |
High |
|
| |
=
; |
CO
4.2 |
Improper
access could be obtained from external sources. |
High |
|
|
|
CO
4.3 |
Improper
access could be granted to financial data and applications kept in data
storage systems. |
High |
|
|
|
CO
4.4 |
Computer
viruses could lead to the corruption of financial systems and data. |
High |
|
| |
|
CO
4.5 |
System
configurations may change over time, leading to possible breakdowns in
control. |
Medium |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
Problems and Incidents |
CO
5.1 |
Improper
follow-up and resolution of identified problems could lead to a breakdown=
in
controls over time. |
High |
|
| |
=
; |
CO
5. |