Information Technology Auditing. An Evolving Agenda

Size: px

Start display at page:

Download "Information Technology Auditing. An Evolving Agenda"

Leslie Watson
6 years ago
Views:

1 Information Technology Auditing An Evolving Agenda

2 Jagdish Pathak Information Technology Auditing An Evolving Agenda ^J Springer

3 Jagdish Pathak Odette School of Business University of Windsor Windsor, N9B3P4 Canada Library of Congress Control Number: ISBN Springer Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9,1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springeronline.com Springer-Verlag Berlin Heidelberg 2005 Printed in Germany The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Cover design: Erich Kirchner Production: Helmut Petri Printing: Strauss Offsetdruck SPIN Printed on acid-free paper - 43/

This Monograph is dedicated to all those who saw a potential in me and motivated me to strive hard in the education and career. They are many and difficult to isolate from the sea of well-wishers.

4 This Monograph is dedicated to all those who saw a potential in me and motivated me to strive hard in the education and career. They are many and difficult to isolate from the sea of well-wishers. I dedicate this volume to my parents (Shri Madan Lai Pathak and Mrs. Bhagwati Devi Pathak); brothers (Mr. Goverdhan Pathak and Mr. Giridhari Pathak) and sisters (Mrs. Vidya Mishra, Mrs. Lakshmi Mishra and Mrs. Binu lata Tiwari); parents of my wife (Mr. Kiriti Ranjan Das and Mrs. Minuprava Das); my late teachers (Dr. N.K.Sharma and Dr. S.M.Bijli); Dean of Odette School of Business, Dr. Roger Hussey; my students in India and Canada, Nupur, my wife; Joy, my son; and many unnamed others.

5 Preface Information Systems (IS) auditing is a component in the domain of Modern Auditing as well as accounting information systems. This component has acquired pre-dominance with the extensive use of computer technology in the business information processing area. Modern computer-based highly integrated information systems are fast replacing the traditional centralized and distributed information systems. The audit methodologies developed and used by the auditors in the earlier information systems have acquired adequate soundness and if at all any problem exists, it is more to do with the application of these methodologies rather than these methodologies themselves. Information needs of all the levels of management is not only fast evolving but getting diversified dramatically during the last two decade as a result of the growth and diversification of business interests. Economies of some of biggest countries of the world are fast opening up their markets to seek global participation and remove the obsolescence from the technological scenario. A New World trade order has emerged to seek the barrier less market mechanism. The concept of protectionism is almost given a good bye by many of these economies to open the channels for the global market forces to interact and decide optimally. And, of course, one should not forget the aftermath of ENRON and other big name's meltdown in the history of business and corporate world. Auditing had always been a key point of discussion and decisions made under various provisions of Sarbanes-Oxley Act New information processing and communication technologies are being applied to satisfy managements' information needs. In Response to this need, communication and digital electronic computer technologies have merged to provide the highspeed data communication capabilities (information super highways) used by many large business houses across the world. Multi-national business activities share the need for data communications capabilities, but also have other requirements that increase the complexities of management information needs. For instance, the need to accommodate currency conversion, regulatory reporting, and variations in accounting disclosure practices in developing information systems is felt more in case of multinational business entities. Expansion in target markets and product lines has involved acquisitions for much business. This has led to consolidation of activities in some situations and diversification in others. Increased transaction volumes and an expansion of existing information systems often accompany consolidation. Diversification through acquisition has, in contrast, often required an information exchange between previously unrelated management information systems. In some cases, diversification has resulted in a significant expansion of data processing/ information proc-

6 VIII Preface essing capabilities in order to provide required management information on a consolidated basis. The monograph in your hand is the outcome of my researches in the realm of information technology auditing during the span of more than twenty years in on different generations of hardware and software. The embedded objective of compiling these ten scholarly and applied essays in one book is to provide the developmental agenda at one place in this fast evolving field of specialty. The growth of EDP Auditing into a major force to reckon with in modern cyber environment is mostly due to the tireless efforts made by the Information Systems Audit & Controls Association (ISACA), many scholars of EDP Auditing, many professional certified information systems auditors and various prominent accounting bodies of professionals and big auditing firms of international stature. These ten essays have applied and scholarly flavor so as to make them useable by the professionals of all hue in this field of knowledge. The chapters carry many new developments and their potential impact on the auditors and their procedures. I have made my best efforts to provide synergy and integration of research and practice into this monograph. This monograph is basically designed to provide the basis for serious study and application of various recent developments in the segment of information and communication technology auditing. Any typical text on information technology auditing talks about many more complex concepts, techniques and software and refers them without often explaining the impact of those on the information technology auditing as many of these concepts, methods, applications are fast developing into industry standards, like enterprise resources planning or enterprise application integration etc. An auditor would be able to identify, understand and comprehend various new and fast evolving technologies to face them professionally. I have integrated many of my past papers with several modifications to extend the continuum to these chapters. I am indebted to many of my former and present colleagues who have contributed directly or indirectly to this monograph and its development which include my self development in acquiring the capability to write this monograph. I would extend my thanks to Professor Andrew Chambers, Former Dean & Professor, City University of London (UK); Professor (Dr.) Gerald Vinten, Head, European Business School, London (UK); Dr. Scott Summer, Brigham Young University, Utah (US); Professor (Dr.) Ram Sriram, Georgia State University, Atlanta, GA; Dr. Amelia Baldwin, University of Alabama, Tuscaloosa, AL; Professor (Dr.) Mary Lind, North Carolina A&T State University, Greensboro, NC; Professor (Dr.) Ramesh Chandra, Professor (Dr.) Jeffrey Kantor, Dr. Ben Chaouch, all of University of Windsor, ON, Canada; Professor (Dr.) S.N. Maheshwari, Director at Delhi Institute of Advanced Studies, New Delhi, India, Late Professor (Dr.) N.K. Sharma, Visiting Professor at Birla Institute of Technology & Science, Pilani, India & Late Professor (Dr.) Shah Mohammad Bijli, Former Dean, Faculty of Business at University of Goa. The list is not complete as there are still many who are not in this list but their contribution has been tremendous. My thanks go to them as well.

7 Preface IX I am also indebted to my wife Nupur and my son Joy who were always my source of joy and encouragement in this arduous task of putting my stray thoughts together in this monograph. Finally, I am as usual responsible for any error in this monograph and would make my best efforts to correct those errors in the second edition of this text (if it ever happens!). February 2005 Jagdish Pathak, PhD Odette School of Business University of Windsor Canada

8 Table of Contents 1 IT Auditing: An Overview and Approach Evolution in Managements' Perceptions Evolution in Information Processing Capabilities Exposure to Loss Objectives of IT Auditing Internal Controls and IT Audit Various Internal Controls Growth and Genesis of IT Auditing IT Audit Approach Nature of IT Controls Controls and Loss Internal Controls and Auditing Approach Steps in an IT Audit Audit Decisions 15 2 Auditing and Complex Business Information Systems Complex Integrated Accounting Systems Distributed Data and its Effects on Organisations Networks Portability and Systems Integration of Applications Productivity Aspect of the Technology Business Process Re-engineering Intelligent Systems Auditors and Changing Technology Strategic Use of Technology and Audit Implications Internal Controls and Auditing 40 3 Generation-X Technologies and IT Auditing Generation-X Enterprise Technologies Information Systems Integration: A Challenge Assured Information Emanates from Assured Systems Information Assurance: A Function of Strategic Importance Various Information Assurance and Control Measures Web-Level Assurance Measures Control Objectives and System Assurance 58

9 XII Table of Contents British Standards: BS7799 and BS : System Security Engineering Capability Maturity Model: SSE-CMM 60 4 Complex Information Systems, Auditing Standards and IT Auditors The Approach and Objectives The Scenario Impact of Technology Complexity on the Auditor Complex Information Technologies and Audit Risks SAS-94 and its Effect on the Audit Process 70 5 ERP and Information Integration Issues: Perspective for Auditors What is Enterprise Resource Planning? Implementation Cycle Conceptual Models Successes and Disasters Types of Implementation Social Integration Resistance in Social Integration Process Integration Communications in Process Integration Alignment of Culture in Process Integration Knowledge Integration Workflow Integration Best Practices in Functional Integration Virtual Integration Auditor and ERP ERP Internal Control Procedures 92 6 Technology, Auditing and Cyber-Commerce Technology and Auditing Risk Understanding in e-commerce for IT Auditor Information at Risk Controls and Audit Evidences IT Auditing and Security of Information Systems Information Security Computer Assets Security Controls Security Evaluation and Certification Criteria Networks Security OSI Architecture Security Mechanisms Integrity Security Mechanisms Location Future Trends 123

10 Table of Contents XIII 7.5 Exemplary Case Laws Related to Security Needs and Breaches in USA Case Laws Related to Data Preservation Case Laws Pertaining to the Scope of Discovery Case Laws Related to the Records Management Case Laws Pertaining to the Use of Experts Case Laws Related to the Costs and Allocation Case Laws Related to the Spoliation and Sanctions Case Laws Pertaining to Inadvertent Disclosure Case Laws Related to the Method of Litigation Case Laws Related to Criminal Issues of Security Case Laws Related to the Reliability E-Sign Statute and Case Laws Case Laws on Privacy Kind of Audits Called Security Audits Internet/Perimeter Audit Website Audit Penetration Audit (Ethical Hacking) Wireless Audit Network Audit Security Policies and Procedures Audit Facilities Audit (Physical) Business Continuity Plan (BCP) and Disaster Recovery (DR) Regulatory Compliance Audits How Can Security Audit Help the Enterprises? Protecting the Physical Safety of Your Employees, Vendors, and Visitors Information Technology Governance and COBIT Why Do we Need IT Governance? Introduction to COBIT COBIT and the Reality Database Management Systems and Auditing Concepts of Database Technology for Auditors Data Independence Database Management Systems and its Functions Relational Database Management Systems (RDMS) Database Security Distributed Database Systems Object Data Management Systems Relation and Object: A Comparison Data Warehouses Operational Systems Compared to Informational Systems 178

11 XIV Table of Contents 10 EAI: Auditors Should Know Potential Risks to Enterprise The Promise of EAI Improvement in Productivity Data Flow Streamlined EAI Reaches Beyond Your Borders Lowered Costs 186 Bibliography and Further References 189 Glossary of IT Auditing Terms 209

Anne König. Internet-Based Services and Processes. With 91 Figures and 4 Tables

Anne König. Internet-Based Services and Processes. With 91 Figures and 4 Tables Anne König E-Business @Print Internet-Based Services and Processes With 91 Figures and 4 Tables 123 Anne König Technische Fachhochschule Berlin University of Applied Sciences Luxemburger Str. 10 13353