Premium Essay

Audit Policy

In:

Submitted By TSmit
Words 416
Pages 2
[pic]

Server Audit Policy

Created by or for the SANS Institute. Feel free to modify or use for your organization. If you have a policy to contribute, please send e-mail to stephen@sans.edu

1.0 Purpose
The purpose of this policy is to ensure all servers deployed at are configured according to the security policies. Servers deployed at shall be audited at least annually and as prescribed by applicable regulatory compliance.

Audits may be conducted to: • Ensure integrity, confidentiality and availability of information and resources • Ensure conformance to security policies

2.0 Scope
This policy covers all servers owned or operated by . This policy also covers any server present on premises, but which may not be owned or operated by .

3.0 Policy hereby provides its consent to allow to access its servers to the extent necessary to allow to perform scheduled and ad hoc audits of all servers at .

3.1 Specific Concerns
Servers in use for support critical business functions and store company sensitive information. Improper configuration of servers could lead to the loss of confidentiality, availability or integrity of these systems.

3.2 Guidelines
Approved and standard configuration templates shall be used when deploying server systems to include: • All system logs shall be sent to a central log review system • All Sudo / Administrator actions must be logged • Use a central patch deployment system • Host security agent such as antivirus shall be installed and updated • Network scan to verify only required network ports and network shares are in use • Verify administrative group membership • Conduct baselines when systems are deployed and upon significant system changes • Changes to configuration template shall be coordinated with approval of change control board

3.2 Responsibility

Similar Documents

Premium Essay

Audit Policy Paper

...Mandatory Auditor Rotation Policy Through the course of an audit, auditors are constantly faced with pressure from the client regarding financial reporting and other issues that may arise. Clients can threaten to terminate the auditor, resulting in lost fees and tarnished reputations as the firm tries to pursue future clients. In these cases, partner evaluations can be negatively affected since they are judged based on hours billed and the number of clients they are able to secure. Mandatory auditor rotation is defined as the obligation to limit the number of years during which the accounting firm may be the auditor of record for a client. The Public Company Accounting Oversight Board (PCAOB) is a strong advocate in favor of mandatory auditor rotation, while a majority of accounting firms are opposed to the idea. Problems are more likely to develop in the initial years of the audit relationship (fraud and bankruptcy) when the auditor tries to gain as much knowledge as possible about the client. According to an American Institute of Certified Public Accountants (AICPA) study (Church and Zhang 2006, page 3), audit failures are three times more likely to occur in the first two years of the auditor-client engagement. Auditor rotations have never been mandated in the United States, and I believe this should continue in the future due to the high costs and decreased auditor effectiveness that would result from continual changes in the auditor-client relationships. There...

Words: 2151 - Pages: 9

Premium Essay

Human Resource Auditing

...An HR audit is like an annual health check, says EJ Sarma. It plays a vital role in instilling a sense of confidence in the management and the HR functions of an organisation A healthy HR function in an organisation is as important as the physical and mental well being of a human body. Typically the basic reason why organisations prefer to conduct an HR audit is to get a clear judgement about the overall status of the organisation and also to find out whether certain systems put in place are yielding any results. HR audit also helps companies to figure out any gaps or lapses and the reason for the same. Since every company plans certain systems and targets, an HR audit compares the plans to actual implementation. The concept of HR audit has emerged from the practice of yearly finance and accounting audit, which is mandatory for every company, to be done by external statutory auditors. This audit serves as an examination on a sample basis of practices and systems for identifying problems and ensuring that sound accounting principles are followed. Similarly, an HR audit serves as a means through which an organisation can measure the health of its human resource function. Organisations undertake HR audits for many reasons: 1 To ensure effective utilisation of human resources. 2 To review compliance with tons of laws and regulations. 3 To instill a sense of confidence in the human resource department that it is well-managed and prepared to meet potential challenges and opportunities...

Words: 1324 - Pages: 6

Premium Essay

Adms 4551

...explain how the conduct of an audit reduces each Information risk is the likelihood of improperly record information which end up being provided to decision makers. In this case I was able to identify two possible causes of information risk at Beaumont Limited: i. Not adopting proper internal control and formal accounting policies to prepare financial statements. An audit will reduce this risk by evaluating the management assessment of internal controls, make sure they are presented in accordance with applicable accounting standards and whether the error is material or not ii. Lack of task diversification, Kevin Bastian (BL’s shareholder) was in charge of 3 complex aspects of the business which are accounting, finance and administration which usually involve large amounts of data. An audit will detect any material error that might have occurred for handling too much information by one person B. Describe a management responsibility relating to the financial statements of BL that has not been properly completed. Explain why management responsibility is important Pierre Timmons, the new Chief Financial Officer, found out that appropriate internal control was not in place. In addition to this he found that BL have not adopted proper accounting policies in preparing their financial statements. Management is responsible for the proper preparation of financial statements using a proper reporting framework (GAAP) and corresponding accounting policies. Management is also responsible...

Words: 844 - Pages: 4

Premium Essay

Auditing

...Guidance for audit committees Reviewing auditor independence November 2003 The Combined Code on Corporate Governance – July 2003 C.3 Audit Committee and Auditors Main Principle: The board should establish formal and transparent arrangements for considering how they should apply the financial reporting and internal control principles and for maintaining an appropriate relationship with the company’s auditors. Code provisions C.3.1 The board should establish an audit committee of at least three, or in the case of smaller companies two, members, who should all be independent non-executive directors. The board should satisfy itself that at least one member of the audit committee has recent and relevant financial experience. C.3.2 The main role and responsibilities of the audit committee should be set out in written terms of reference and should include: • to monitor the integrity of the financial statements of the company, and any formal announcements relating to the company’s financial performance, reviewing significant financial reporting judgements contained in them; • to review the company’s internal financial controls and, unless expressly addressed by a separate board risk committee composed of independent directors, or by the board itself, to review the company’s internal control and risk management systems; • to monitor and review the effectiveness of the company’s internal audit function; • to make recommendations to the board, for it to put to the shareholders...

Words: 9845 - Pages: 40

Premium Essay

Syllabus

... |Auditing | Copyright © 2009, 2008, 2007 by University of Phoenix. All rights reserved. Course Description In this course, students focus on the auditing practice performed by public accountants. Topics include the CPA profession and the auditor’s role, planning the audit, audit reporting and required communications, evaluating internal controls, audit programs for current assets and liabilities, and audit programs for other business cycles. Policies Faculty and students/learners will be held responsible for understanding and adhering to all policies contained within the following two documents: • University policies: You must be logged into the student website to view this document. • Instructor policies: This document is posted in the Course Materials forum. University policies are subject to change. Be sure to read the policies at the beginning of each class. Policies may be slightly different depending on the modality in which you attend class. If you have recently changed modalities, read the policies governing your current class modality. Course Materials Arens, A. A., Elder, R. J., & Beasley, M. S. (2006). Auditing and assurance services: An integrated approach (11th ed.). New York, NY: Pearson. Hayes, R., Dassen, R., Schilder, A., & Wallage,...

Words: 2385 - Pages: 10

Premium Essay

Case Study for Dell Inc in Appendix a

...and integrity of Dell’s financial statements and notes. b. In which note does Dell report its significant accounting policies used to prepare financial statements? Note 1 is where Dell report its significant accounting policies used to prepare financial statements. c. What type of audit opinion is reported in its annual report and whose opinion is it? An integrated audit as been completed, of Dell Inc.’s January 28, 2005 consolidated financial statements and of its internal control over financial reporting as of January 28, 2005 and audits of its January 30, 2004 and January 31, 2003 consolidated financial statements in accordance with the standards of the Public Company Accounting Oversight Board (United States). It is the registrant’s auditors and the audit committee of the registrant’s board of director’s opinion. d. Is any of the information in its annual report based on estimates? If so, where does Dell discuss this? The preparation of GAAP financial statements requires certain estimates, assumptions, and judgments to be made that may affect Dell’s consolidated statement of financial position and results of operations. Management has discussed the development, selection, and disclosure of its critical accounting policies with the Audit Committee of Dell’s Board of Directors. These critical accounting policies and Dell’s other accounting policies are described in Note 1 of “Notes to Consolidated Financial Statements” included in “Item 8—Financial Statements and Supplementary...

Words: 266 - Pages: 2

Premium Essay

Strategic Managemnt

...Question 2 Referring to Section 550 Quality Assurance and Practice review of the MIA By-Laws (on professional ethics, conducts and practice) and ISA220 Quality Control for an Audit of Financial Statements, do you believe that the engagement leader of an audit (like David Duncan on the Enron audit) should have authority to overrule the opinions and recommendations of the accounting & auditing function? Why or why not? In our opinion, the engagement leader of an audit should not have the authority to overrule the opinions and recommendations of the accounting and auditing function. To support our judgment, we refer the case to Section 550 Quality Assurance and Practice Review of the MIA By-Laws and ISA 220 Quality Control for an Audit of Financial Statement. Section 550.1 The By-Laws states that every member in public practice has to ensure that the firm adopts and applies policies and procedures designed to maintained adherence to professional standard. Enron had been hiding its Special Purpose Entity (SPE) by not consolidating the entity into its financial statements. The SPE were used to embezzle funds and hide the firm’s debts and expenses. This caused the firm to have understated expenses and profitable financial statements. The action of creating SPE is totally against the fundamental principles of auditing in terms of integrity. The principle of integrity imposes an obligation on all professional accountants to be straightforward and honest in all professional and...

Words: 1833 - Pages: 8

Premium Essay

Hr Audit

...Project Title: HR Audit INDEX SR NO. | TOPIC | PAGE NO. | 1 | Acknowledgement | 3 | 2 | Executive Summary | 4 | 3 | Introduction to HR Audit | 6 | 4 | Qualitative & Quantitative Indicators for HR Audit | 8 | 5 | Types of Audit | 13 | 6 | HR Audit Process | 17 | 7 | Human Resource Management v/s Performance | 21 | 8 | Approaches to Human Resources Audit | 25 | 9 | HR Audit Tools | 30 | 10 | Checklist for HR Audit | 33 | 11 | Audit Report | 35 | 12 | Audit of HR Results | 36 | 13 | HR Audit in India | 37 | 14 | Conclusion | 40 | 15 | Bibliography | 49 | s ACKNOWLEDGEMENT “For any successful work, it owes its thanks to many” Presentation of this project gives us the feeling of fulfillment. It has taken an exhaustive effort in preparing this project. It took several hours, several days, and several meetings amongst us to make this project work up to its expectations. The faculty members of our college have provided us with great source of inspiration and have provided great help in pursuing this project. Many individuals have contributed in preparation of his project. We take this opportunity to thank few people without whom this project would not have been possible. We would like to thank our faculties for their kind support. Our sincere thanks go to our project guide Prof.Anjali Saida, who helped us through many aspects and whose friendly guidance on many issues helped us for the betterment of our project. Without her support...

Words: 9781 - Pages: 40

Premium Essay

Smackey Questions

...Discuss how the SEC has influence (if any) over the audit of Smackey Dog Foods, Inc. Solution: The SEC does not have direct influence over the audit of Smackey Company because, Smackey is not a public held organization, they do not have assets in excess of $10 million, and they do not have over 500 stockholders; which are the requirements for public and privately held companies. The SEC does have indirect influence over the audit because all companies, whether public or private are required to comply with General Accepted Accounting Principles (GAAP) and the SEC plays a significant role in influencing these standards. The auditors, while not bound by SEC rules they are required to obey specific audit rules and guidelines as outlined under the the American Institute of Certified Public Accountants (AICPA). The AICPA is responsible for establishing auditing and attestation standards for private companies in the United States and for enforcing a code of professional conduct for its members. The code is comprised of six principles that the auditors must adhere to. The principles are: responsibilities, the public interest, integrity, independence and objectivity, due care, and the scope and nature of services. Q2: Discuss the essential activities involved in the initial planning of an audit. How do these all specifically to the Smackey Dog Food client? Solution: During the initial planning of the audit of Smackey Dog Food, the auditors should discuss the...

Words: 2268 - Pages: 10

Premium Essay

Auditing

...1­14 (Objectives 1­1, 1­3, 1­5) the following questions deal with audits by CPA firms. 14. Choose the best response. A. Which of the following best describes why an independent auditor is asked to express an opinion on the fair presentation of financial statements? 1) It is difficult to prepare financial statements that fairly present a company’s financial position, operations, and cash flows without the expertise of an independent auditor. 2) It is management’s responsibility to seek available independent aid in the appraisal of the financial information shown in its financial statements. 3) The opinion of an independent party is needed because a company may not be objective with respect to its own financial statements. 4) Itisacustomarycourtesythatallstockholdersofacompanyreceiveanindependent report on management’s stewardship of the affairs of the business. B. Independent auditing can best be described as 5) A branch of accounting. 6) Adisciplinethatatteststotheresultsofaccountingandotherfunctionaloperations and data. 7) A professional activity that measures and communicates financial and business data. 8) A regulatory function that prevents the issuance of improper financial information. C. Which of the following professional services is an attestation engagement? 9) A consulting service engagement to provide computer ­ processing advice to a client. 10) An engagement to report on compliance...

Words: 2888 - Pages: 12

Premium Essay

Pcaob Research Assignment

...http://pcaobus.org/Standards/Auditing/Pages/default.aspx 1. After the report release date – can the auditor delete or discard or add information to the audit work papers? Information cannot be deleted or discarded from the audit work papers after the report release date, but information can be added to the work papers after the release date. 2. Certain audit matters may be documented in a central repository for the public accounting firm or in the particular office participating in the engagement. What matters may be documented in this manner and does the specific engagement’s audit documentation need to include a reference to such matters? Matters such as auditor independence, staff training and proficiency, and client acceptance and retention may be documented in a central repository. Also, yes, the specific engagement’s audit documentation needs to include a reference to the central repository if one is utilized. 3. May an auditor conduct an engagement to report on whether a previously reported material weakness continues to exist if and, if so, what are the related requirements that the auditor must comply with? An auditor may report on whether a previously reported material weakness continues to exist at a company only if all of the following conditions are met: • Management accepts responsibility for the effectiveness of internal control over financial reporting; • Management evaluates the...

Words: 950 - Pages: 4

Premium Essay

Android Under Attack

...1. CASE SUMMARY Androids is an audit firm which provides audit and consulting services to their clients. Androids & Co started in 1913 when Arthur and Clarence, both from the audit firm of Price, bought out a small audit firm in Illinois to form Arthur, Clarence & Co, which became Androids & Co in 1918. Arthur Androids, who is the founder, headed the firm of Androids & Co until his death in 1945. He was a passionate supporter of high standards in the accounting industry. In 1945, Leonardo Sparky, who handled Androids at the founder’s death, continued this emphasis on honesty. For all these years, Android’s motto was “Think Straight, Talk Straight”. David Lawrence joined Androids twenty years ago and earned a salary of USD 700,000 per annum. David is Androids’ partner and auditor who are responsible in auditing Enronaa’s account since 1987. Enronaa is a client of Androids for the past 16 years. David is one of the Androids’ partners who are responsible to check on Enronaa’s account and to ensure that they fairly representing the state of the business. The issues arise when there are evidences suggesting that Androids assisted Enronaa to sort of increase reported returns of off-balance sheet activities by units called raptors. In addition, the second issue that arises in Enronaa is many off-book partnerships were not properly accounted for. From this issue, David stated that millions in debts and losses had to be reflected in Enronaa’s books. David also confessed...

Words: 4487 - Pages: 18

Premium Essay

Audit Governance

...THE AUDIT FIRM GOVERNANCE CODE A PROJECT FOR THE FINANCIAL REPORTING COUNCIL Audit Firm Governance Working Group Chairman: Norman Murray January 2010 The ICAEW operates under a Royal Charter, working in the public interest. Its regulation of members, in particular in respect of auditors, is overseen by the Financial Reporting Council. As a world leading professional accountancy body, the ICAEW provides leadership and practical support to over 132,000 members in more than 165 countries, working with governments, regulators and industry in order to ensure that the highest standards are maintained. The ICAEW is a founding member of the Global Accounting Alliance with over 775,000 members worldwide. © ICAEW 2010 All rights reserved. Laws and regulations referred to in this document are stated as of December 2009. No responsibility for any persons acting or refraining to act as a result of any material in this document can be accepted by the ICAEW or the Audit Firm Governance Working Group. January 2010 ISBN 978-1-84152-863-2 THE AUDIT FIRM GOVERNANCE CODE A PROJECT FOR THE FINANCIAL REPORTING COUNCIL Audit Firm Governance Working Group Chairman: Norman Murray January 2010 Contents Page Introduction A B C D E F Leadership Values Independent non-executives Operations Reporting Dialogue 2 5 5 6 7 9 10 Appendix 1: Involvement of independent non-executives Appendix 2: Independence considerations Appendix 3: Working Group members and terms of reference 11...

Words: 5512 - Pages: 23

Premium Essay

Cast 1

...CAST 1 Audit procedures to be performed as part of the client acceptance process 1. Obtain management integrity on the audit. 2. Find out reasons why CA needs to be audited 3. Assess the business risks with respect to the environment of the client and the industry that the client is in 4. Make sure that our accounting firm is independent of CA (i.e. there’s no conflict of interest) 5. Communicate with the predecessor auditor These procedures are required by the GAAS. Audit Procedure #3 Non-financial: Stealing trade secrets: the integrity of Dupuis and CA employees is called into question. Will Mr. Dupuis and CA employees answer auditor’s question honestly and faithfully? Response from the predecessor auditors: Change of auditors causes some concerns. What does it mean that CA needs a “fresh perspective”? What are some services that we can provide that the predecessor can’t? New accounting information system: The transition to the new AIS can be disruptive, how will this affect the financial statements? Employee morale: Employee moral seems to be affect by the new AIS. Inadequate training of AIS may lead to unsatisfied workers. Aggressiveness of the CFO: Rob’s new aggressiveness on the A/R and A/P policies could negatively impact the CA’s relationships with customers and suppliers. Financial: Compare CA’s performance in terms of ratios to those of the industry Trend analysis between the years for ratios, balance sheet, income statement ...

Words: 942 - Pages: 4

Premium Essay

Auditing Work

...Cut Off: Cutoff relates to whether transactions and events have been recorded in the correct accounting period. Audit procedures must ensure that transactions occurring near year-end are recorded in the financial statements in the proper period. For example, the auditor may want to test proper cutoff of revenue transactions at December 31. This can be done by examining a sample of shipping documents and sales invoices for a few days before and after year-end. Audit evidence: Audit Evidence is evidence obtained during a financial audit and recorded in the audit working papers. In the audit engagement acceptance or reappointment stage, audit evidence is the information that the auditor is to consider for the appointment. For examples, change in the entity control environment, inherent risk and nature of the entity business, and scope of audit work. Subsequent Event: Subsequent event is the accounting term for a financial transaction that occurs after completion of the balance sheet for a specified period but before the company’s full set of financial statements is prepared. Subsequent events clarify information about a business’ financial picture as reflected by the balance sheet, a financial report that includes all transactions through the report date. The Financial Accounting Standards Board, the authority entrusted with establishing generally accepted accounting principles, publishes detailed requirements for defining and recording subsequent events in financial records...

Words: 826 - Pages: 4