Premium Essay

It Audit Guide

In:

Submitted By powermann
Words 6447
Pages 26
IT

[pic]

Australian Government
Department of Defence

Information System Audit Guide

VERSION 11.1
January 2012

Table of Contents

1. Introduction to Accreditation 4

2. The Information System Audit – Checklist 7

2.1. What is an Information System Audit? 7 2.2. Why is an Information System Certification needed? 7 2.3. Assessing an Information System’s Security Risks 7 2.4. Selecting an Information System’s Security Controls 7

3. Purpose of the Checklist 8

4. How to Use the Checklist 8

4.1. The Checklist Structure 8 4.2. Security Objectives 9 4.3. Guidance for IRAP Assessors 9 4.4. Information System Compliance 10

5. Guidance for IRAP Assessors 10

6. The Checklist 11

6.1. The Information Security Policy & Risk Management 11 6.2. Information Security Organisation 14 6.3. Information Security Documentation 17 6.4. Information Security Monitoring 20 6.5. Cyber Security Incidents 22 6.6. Physical & Environmental Security 24 6.7. Personnel Security for Information Systems 26 6.8. Product & Media Security 27 6.9. Software, Network & Cryptographic Security 30 6.10. Access Control & Working Off-site Security 33

Appendix A – Accreditation Governance 36

The ISM & Certification 36 Compliance Levels 37 Compliance Report 37 Compliance Comments 37 Audit Documentation Submissions 38

Appendix B – Standards 39

| |
|For Additional Information & Assistance |
|

Similar Documents

Premium Essay

Audit Study Guide

...ACT 803 FINAL STUDY GUDE Chapter 19: Audit of the Acquisition and Payment Cycle: * Be able to identify accounts that will likely be affected by weak internal I/C. ACCOUNTS PAYABLE flows into: -cash in bank / Raw material purchases -purchase R&A / PPE -purchase disc / Prepaid Expenses ….which then flows into Manufacturing/Selling/Admin Expense Control Accounts CLASSES OF TRANSACTIONS/ACCOUNTS Acquisitions: Cash Disbursements: * Inventory -Cash in bank (from cash disbursements) * Property, plant, and equipment -Accounts Payable * Prepaid expenses -Purchase Discounts * Leasehold improvements * Accounts payable * Manufacturing expenses * Selling and administrative expenses Processing Purchase Orders: -Purchase requisition -Purchase order Receiving Goods and Services -Receiving Report Recognizing Liability: -Vendor’s invoice -Debit memo -Voucher -Acquisitions transaction file -Acquisitions Journal/lisintg -AP master file -AP trial balance -Vendor’s statement Processing and recording Cash Disbursements: -Check -Cash disb. Transaction file -Cash disb. Journal/lisiting * For both the acquisition/expenditure and cash disbursement cycles, just refresh your understanding of the flow charts and be able to do the following: * Identify internal controls * Identify the objective/purpose of the I/C * Describe how the I/C is supposed to work * Describe how to perform...

Words: 584 - Pages: 3

Premium Essay

Advanced Audit Study Guide

...STUDY LIST & ESSAYS FOR THE FINAL Fall 2013 AICPA and PCAOB standards on computers can be used for the whole exam, keep time limits in mind Numbers in red are incomplete or need additional information. Some in red may not need additional information, but if additional information can be provided that will help with essays add it. 1. Code of Professional Conduct as it relates to the cases that we discussed -Rule 101 Independence-A member in public practice shall be independent in the performance of professional services. Fact and Appearance -Rule 102 Integrity and objectivity-In the performance of any professional service, a member shall maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others. -Rule 201 General Standards-A member must comply with the following standards in all engagements: Professional competence Due professional care Planning and supervision Sufficient relevant data used -Rule 202 Compliance with Standards- A member who performs auditing, review, compilation, management consulting, tax, or other professional services must comply with standards: Auditing standards board and PCAOB (Issue statements on auditing standards) -Rule 203 Accounting Principles- A member shall not express an opinion or state affirmatively or negatively that financial statements are presented in conformity with GAAP if there is any departure...

Words: 10499 - Pages: 42

Premium Essay

Student Org Audit Guide Outline

...Introduction a. Audit Environment Student organizations, just like any other organizations have basic financial needs necessary for them to operate and perform their functions. These financial needs are being provided by the members and the school (also referred to as the stakeholders), and it is the responsibility of each organization to make good use of available financial resources. As this financial responsibility of organizations to their stakeholders arises, they are required to establish a system of control that will ensure the integrity of all financial transactions. This financial integrity should then be completely and accurately captured in all financial records and reported periodically to the stakeholders. In essence, the system will be the organizations’ first line of defense against error, fraud, negligence, or dishonesty in arriving at the financial information. This system is aptly called the organizations’ internal control. However, it is not enough that organizations utilize their own internal control. There is a need to examine or review critically and systematically the organizations’ reports, documents, records, financial policies, and controls for the purpose of arriving at an objective conclusion regarding their accuracy, completeness, and reliability. This is called the external audit. Both the internal control and the external audit comprise the audit environment. There are five key players in an organization’s audit environment: the President...

Words: 2489 - Pages: 10

Premium Essay

It 255

...Security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes computers running Windows 7 or Windows Server 2008 R2. Organizations invest a large portion of their information technology budgets on security applications and services, such as antivirus software, firewalls, and encryption. But no matter how much security hardware or software you deploy, how tightly you control the rights of users, or carefully you configure security permissions on your data, you should not consider the job complete unless you have a well-defined, timely auditing strategy to track the effectiveness of your defenses and identify attempts to circumvent them. To be well defined and timely, an auditing strategy must provide useful tracking data on an organization's most important resources, critical behaviors, and potential risks. In a growing number of organizations, it must also provide absolute proof that IT operations comply with corporate and regulatory requirements. Unfortunately, no organization has unlimited resources to monitor every single resource and activity on a network. If you do not plan well enough, you will likely have gaps in your auditing strategy. However, if you try to audit every resource and activity, you may find yourself with far too much monitoring data, including thousands of benign audit entries that an analyst would need to sift through to identify the narrow set of entries that warrant closer...

Words: 1876 - Pages: 8

Premium Essay

Golden Bear Golf, Inc

...should be tested to determine the reason no billing has been posted for the work that was done. It also should be determined the reason income is being recognized for jobs that have not been identified as works in progress to determine the exact completion date of the project. By testing this assertion it would have been discovered that $4 million of work was fictitious. Valuation or allocation: Paragon overstated its revenue and profits by using the earned value method which caused a huge increase in unbilled revenue by the end of 1997. Approximately 30 percent of the 1997 income statement had not been billed to its customers. Paragon also overstated the revenue to be earned on its individual construction projects, and during the 1997 audit, Andersen personnel used thirteen of Paragon’s construction projects to corroborate the total revenue figures the company was...

Words: 1179 - Pages: 5

Premium Essay

Internal Control

...Guide to Internal Control Over Financial Reporting The Center for Audit Quality prepared this Guide to provide an overview for the general public of internal control over financial reporting (“ICFR”). The Guide explains what public company ICFR is and describes management’s responsibility for implementing effective ICFR. The Guide also discusses the responsibilities of the audit committee to oversee ICFR and of the independent auditor to audit the effectiveness of the company’s ICFR. A Guide to Internal Control Over Financial Reporting P reparing reliable financial information is a key responsibility of the management of every public company. The ability to effectively manage the company’s business requires access to timely and accurate information. Moreover, investors must be able to place confidence in a company’s financial reports if the company wants to raise capital in the public securities markets. Management’s ability to fulfill its financial reporting responsibilities depends in part on the design and effectiveness of the processes and safeguards it has put in place over accounting and financial reporting. Without such controls, it would be extremely difficult for most business organizations — especially those with numerous locations, operations, and processes — to prepare timely and reliable financial reports for management, investors, lenders, and other users. While no practical control system can absolutely assure that financial reports...

Words: 4333 - Pages: 18

Free Essay

Saks Fifth and Avenue

...Example of Audit Plan  ID  1  2  3  4  5  6  7  8  9  10  11  12  Task Name  Preliminary discussion  March Start  Wed 17/04/06  April  May  June  July  August  September  October  November  December  B  M  E  B  M  E  B  M  E  B  M  E  B  M  E  B  M  E  B  M  E  B  M  E  B  M  E  Audit planning meeting  Mon 29/04/06  Audit tool development  Audit analysis tool  development  Implement data collection  Mon 06/05/06  Wed 15/05/06  Thu 01/08/06  Data analysis  Mon 02/09/06  Result reporting  Mon 09/09/06  Action plan development  Mon 16/09/06  Dissemination of Results  Mon 30/09/06  Action plan implementation  Re­audit area marked for  improvement  Report on re­audit  Tue 01/10/06  Wed 11/12/06  Tue 17/12/06  Key:  AF = Audit Facilitator  AA = Audit Assistant  B = Beginning  M = Middle  NB.  The notes on the following pages give details of the various components of the plan. From NHS Lothian ‘Clinical Audit ­ Study Guide’ CD rom (West Lothian 2004)  E = End  Example of Audit Plan ­ notes  1.  Preliminary Discussion  Should establish · Why? · What? · Where? · When? · Who? · Does this audit fit in with Trust priorities? · Will it identify need for change (improve patient care) · Will it provide appropriate evidence ­ to satisfy regulatory requirements (i.e. CSBS)  .  2.  Audit Planning Meeting  This meeting should identify · Resources for audit · Establish who the audit team will be. · Timetable the audit process ...

Words: 521 - Pages: 3

Free Essay

Short Paper

...FINANCIAL MANAGEMENT GUIDE FOR NON-PROFIT ORGANIZATIONS NATIONAL ENDOWMENT FOR THE ARTS OFFICE OF INSPECTOR GENERAL SEPTEMBER 2008 Questions about this guide may be directed to the National Endowment for the Arts, Office of Inspector General, Room 601, 1100 Pennsylvania Avenue, NW, Washington, DC 20506, Telephone (202) 682-5402. Questions about the terms and conditions of grants and cooperative agreements may be directed to the Office of Grants and Contracts, Room 618, Telephone (202) 6825403. Table of Contents Page Use of the Guide .................................................................................................................................... 1 Accountability Requirements ................................................................................................................ 1 Financial Management Standards ............................................................................................. 1 Internal Control Standards ........................................................................................................ 2 Audit Standards ......................................................................................................................... 3 Reporting Standards .................................................................................................................. 4 Subgranting .............................................................................................................................

Words: 3186 - Pages: 13

Premium Essay

History of Auditing Standards

...Auditing standards history in the United States Auditing profession has relied on agreed upon procedures at the beginning of its emergence. The current formal audit practice has evolved relatively recently. The story of how auditing evolved started in the early 20th century with the growth of industrial revolution, when firms entered the stock market which was unregulated at the time a growing need evolved to detect fraud and make more reliable financial statements as investors began to depend on financial reports. Federal Trade Commission requested AICPA to provide guidance to accountants and auditors in 1917 as a response AICPA issued a series of recommendation to the accounting community on financial reporting and auditing. In 1929 the AICPA issued a specific guide for auditing (Verification of Financial Statements) and it stated that the extent of the work is a responsibility of the auditor which is one of the most important auditing concepts even now. In 1936 AICPA issued Examination of Financial Statements by Independent Public Accountants, a guide on performing audit procedures on small and mid-sized companies. The SEC which was created in 1934. A part of its duties was to oversight the auditing profession, and it required the companies to send periodic reports in accordance with GAAP and to provide assurances with their reports. Auditing standards issuance used to be triggered by financial fraud events or crimes. Statement on Auditing Procedure (SAP) No. 1 in October...

Words: 680 - Pages: 3

Free Essay

Audit

...the YELLOW box · Click on the down arrow next to departures expected · Checkout or extend any reservations. · Close out to the blue screen (main Opera page) 4. ___ Print Night Audit Reports · Miscellaneous (top) · Reports (left side) · Report Group – Drop down to Shift Reports · Highlight Downtime Reports · Click OK · Click Print · Separate the appropriate reports and staple: 5. ___ Check Phone Printer for any calls not posted and post them via the Cashiering Module's "Fast Posting" feature. Do a bucket check with the “Guest In House Rate Check” report you just printed out.(The Rate Check Report will also be used later in the morning to for Housekeeping Reports to mark the T&G Rate Rooms). 6.___ Start NIGHT AUDIT! · Click on End of Day (top) · Night Audit (left side) · Login User: YOUR USER NAME · Password: YOUR PASSWORD · Verify that the Business date is correct · Click Start! · If it asks you “Do you want to close cashier “YES”” · OK · OK · YES · OK Once the Night Audit starts it will pull up a screen of the programs that is currently running. Verify that it says Running / Completed in Green. NOTE: If any of these shows “FAILED” in red you must exit the night audit. Look for the room number or name shown at the bottom of the screen if the system...

Words: 746 - Pages: 3

Premium Essay

Sarbanes Act

...the public companies management after the scandals of WorldCom, Enron, and others. Sarbanes-Oxley has influenced the liabilities and responsibilities of Board of Directors, Corporate Executives, Auditors, Audit Committees, and Analysts (Advantages and Disadvantages, 2012). The strength of the act is companies have better internal control environment. This will lead to more accurate information being available to investors who are more confident in making investing decisions. All participants in financial reporting have increased responsibilities and consequences for not living up to those responsibilities. The weakness of the act is the legislation was passed without any specific guidance to companies as to how it should be implemented. As a result, each company had to create its own methodology for ensuring compliance, which was inefficient and expensive. Also Smaller companies that are audited will pay higher audit fees (Hazels & Thornton, 2007). After doing some research the Sarbanes Act is useful for large national, nonprofit organizations. Organizations have a checklist they have to abide by due to the Sarbanes Act. The first item on the checklist is information regarding Insider Transactions and Conflicts of Interest. The second item is Independent and Competent Audit Committee. The third item is Responsibilities of Auditors. The fourth item is Certified Financial Statements. The fifth item has information regarding Disclosure. The sixth item is Whistle-Blower Protection...

Words: 698 - Pages: 3

Premium Essay

Jjjj

...Study Guide Point Break-Down Multiple choice * 120 points possible * 40 questions * ~1.5 minutes per question Short answer * 30 points possible * 6 questions * ~3 minutes per question Exam is worth a total of 150 points Chapter Break-Down Chapter 1 * 1 MC question * 3 total points (2% of the exam) Chapter 2 * 3 MC questions * 9 total points (6% of the exam) Chapter 3 * 5 MC questions * 1 Short answer question * 20 total points (~13% of the exam) Chapter 4 * 5 MC questions * 1Short answer question * 20 total points (~13% of the exam) Chapter 5 * 6 MC questions * 18 total points (12% of the exam) Chapter 6 * 5 MC questions * 1 Short answer question * 20 total points (~13% of the exam) Chapter 7 * 5 MC questions * 1 Short answer question * 20 total points (~13% of the exam) Chapter 8 * 6 MC questions * 1 Short answer question * 23 total points (~15% of the exam) Chapter 9 * 4 MC questions * 12 total points (8% of the exam) Current Events * 1 Short answer question * 5 total points (~3% of the exam) Important Topics (This is intended to help guide the focus of your review for the exam, however, it is not intended to be sufficiently detailed to the exact exam questions. Note: many of the topics listed are broad and cover a variety of more specific points. Thus, not everything can or will be tested.) Chapter 1 * What is an audit ...

Words: 440 - Pages: 2

Premium Essay

Auditing - Research Paper

...economy especially after Congress passed the Sarbanes-Oxley Act its role in the economy was greatly solidified. Auditing is the accumulation and evaluation of evidence about information to determine and report on the degree of correspondence between the information and established criteria. Auditing should be done by a competent, independent person. “The auditing profession offers a wide range of employment opportunities for new accountants. Most accounting firms offer client services in three areas: auditing, tax, and consulting. A new accountant might be hired to work in any of these areas. In the audit area, the accountant may work for a variety of clients including private or public companies, clients in banking, insurance, manufacturing, technology, retail, health care, or government. Individuals working in the audit area may also spend most of their time providing internal audit services to clients rather than working as an external auditor. Working in any of the areas in an accounting firm may be one of the most demanding jobs, but it is also one of the most interesting, exciting experiences and a great way to prepare to work in the corporate business world.” “What is Auditing?” Web. 29 September 2013 Accounting is the recording, classifying, and summarizing of economic events in a logical manner for the purpose of providing financial information for decision making. To provide relevant information, accountants must have a thorough understanding of the...

Words: 2376 - Pages: 10

Premium Essay

Auditing

...and reports the results of an audit in accordance with generally accepted auditing standards (GAAS). Auditing standards provide a measure of audit quality and the objectives to be achieved in an audit. Auditing procedures differ from auditing standards. Auditing procedures are acts that the auditor performs during the course of an audit to comply with auditing standards. Auditing Standards 2. The general, field work, and reporting standards (the 10 standards) approved and adopted by the membership of the AICPA, as amended by the AICPA Auditing Standards Board (ASB), are as follows: General Standards 1. The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor. 2. In all matters relating to the assignment, an independence in mental attitude is to be maintained by the auditor or auditors. 3. Due professional care is to be exercised in the performance of the audit and the preparation of the report. Standards of Field Work 1. The work is to be adequately planned and assistants, if any, are to be properly supervised. 2. A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed. 3. Sufficient appropriate evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a reasonable basis for an opinion regarding the financial statements under audit. Standards of Reporting 1....

Words: 1115 - Pages: 5

Free Essay

Risk-Based Auditing, Strategic Prompts, and Auditor Sensitivity to the Strategic Risk of Fraud

...Risk-Based Auditing, Strategic Prompts, and Auditor Sensitivity to the Strategic Risk of Fraud ACC650M Auditing Principles January 30th, 2015 a. What is the issue being addressed in the paper? This paper are focus on the risk-based auditing. As the paper mentioned that Risk-based auditing is a way to guide auditor to devote more audit resources to account that may take more misstated. On the contrary, fewer resources to those are focused on the less misstated. Kendall Bowlin expect to guide effective and efficient audits. In the other words, the inaccurate assess misstatement risk may result in misallocated of audit resources and undetected misstatement. In additional, Kendall Bowlin seemingly consider that the low risk accounts may also caused high risk of fraud, because of managers and auditors (business operating and audit strategy) allocated audit resources to high risk accounts. That means if the audit resource concentrate on high risk accounts, it may create opportunities for intention people to manipulation low risk accounts. The study’s purpose is to demonstrate the potential threat with risk-based auditing that lead auditors allocate resources among accounting with different of non-strategic risk and account specific misstatement risk, and use prompting strategic for auditors to reduces this threat. There are two important ways of prompting auditors in the paper. The first one is auditors allocate limited pools of resources among client accounts that...

Words: 934 - Pages: 4