Implementation and continuous review of effectiveness of Internal Controls has always been a challenge for enterprises. Internal Controls can be compared to the chassis of a vehicle - without the chassis, the engine is rendered useless. Internal Controls are most needed in a corporate environment to prevent fraud incidence and to manage risk of loss to assets and profits. In recent years, enterprises have become more enterprising and competitive and along with help of technology, they have succeeded in increasing their size of services, produces and presence. Enterprises are now having their locations all over the world. Thus the need of having correct Internal Controls is more than ever.
A CA provided the following services until the effect of technology struck business. As a professional, he used to provide services such as Audit, Tax, Company Matters, Legal Compliances, and Accounting etc. Specifically as an Audit Professional, he used to render services of conducting audit engagements such as Statutory Audit, Tax Audits (both Direct and Indirect Taxes), Special Audits (as prescribed under various Acts), Bank Audits, and Internal Audits etc. There is a paradigm shift in the expectations from Chartered Accountants in the new scenario.
A CA as an audit professional can provide more services that relate to technology such as IS Audits, Implementation of ERP and GRC (Governance, Risk Management and Compliance), Design of Access and Process Controls, Forensic Audits etc.
A CA is expected to know and review implementation of new regulations and standards like The Sarbanes – Oxley Act of 2002 – Section 302 and 404, The Companies Act 2013 – Section 134 and 143, Clause 49 of SEBI’s Listing Agreement, Privacy Acts of various Countries and Standards like ISO 27000 Family, ISO 22301, BSI (British Standards Institute) Standards, and PAS (Public Available Standards) Standards etc., not forgetting Frameworks like COBIT 5 (Control Objectives for Information and Related Technology) and COSO (Committee of Sponsoring Organizations) Framework for Internal Controls.
One such greenfield service is the engagement of conducting IS Audits or Information Systems Audit. An IS Audit is related to Internal Audit. Internal Controls that are present in the enterprise are completely relevant while conducting an IS Audit.
These are some keywords that would be repeating in this study and is important to understand them.
1. Control: It literally means Internal Controls that is present in a business environment. It can be IT Controls or non IT Controls.
2. Risk: It is the rate at which there is a threat to the business which has arisen from a specific happening/non happening.
3. Process: A set of tasks make a work flow. A set of work flows make a process. A process is controlled by a “Process owner” or “Function head”. E.g. HR Process, Procurement Process.
Internal Control simply means “Policies framed by the management in order to have stronger and adequate control of affairs within the enterprise, and which can be checked by the Internal or Statutory Auditor in order to ensure that the goals and objectives of the enterprise are duly met”. They are practices and processes enforced on the employees of an enterprise to prevent fraud and to maintain integrity of the data.
Internal Controls is said to be a sum of General Controls and IS Controls. IS controls is said to be a sum of IT Application Controls and IT General Controls. General Controls refers to Internal controls that are not enforced through the IT System unlike the IS Controls. IS Controls are controls that are present on the enterprise’s IT Infrastructure. IT Infrastructure includes hardware and software.
IT Application Controls: They vary depending on the applications that have been installed by the enterprise for its revenue generation. Application software is the software that processes business transactions. The Application software could be a retail banking system, an Inventory system or possibly an integrated ERP. Controls which relate to business applications leading to judicial use of the application and enforced through the application itself to the end user are called IT Application Controls. IT Application Controls can be broadly classified into five categories:
1. Input Controls: Controls that are enforced during the input of data by a user. E.g. Data Checks and validations.
2. Processing Controls: Controls that are enforced during the processing of data that have been input. E.g. duplicate checks, File Identifications and Validations etc.
3. Output Controls: Controls that are enforced during display of output of the processed data. E.g. Update Authorizations etc.
4. Integrity Controls: These controls are used to preserve the genuineness and accuracy of data. E.g. Data Encryption, Input Validations etc. These controls can be enforced during input and processing and storage of data.
5. Management Trails: These controls are for the management to find out the audit trail of a transaction. E.g. Time stamps and snapshots of application.
IT General Controls: They may also be referred as General Computer controls. These are controls other than IT Application Controls, which relate to the environment within which computer-based application systems are developed, maintained and operated and are therefore applicable to all applications These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems.
IT General Controls can be broadly classified into the following areas:
1. Physical Access Controls: These controls are enforced at protecting the physical locations of the IT Infrastructure. E.g. Security Personnel, Physical Locks, Bio Metric Locks, CCTV etc.
2. Data Center Controls: These controls are enforced specifically at the data centers of an enterprise. A data center is treated as an extremely sensitive area and thus a higher risk would be present. E.g. Biometric Locks, Presence of Server Racks, Presence of Air Conditioners, Fire Extinguishers, Weather Controls, Log Register of people etc.
3. IS Security: These controls are enforced at every level of IT Infrastructure. The objectives of these controls are protection of Information Assets. The CIA triad is enforced i.e. Confidentiality, Integrity and Availability of Data and information security is maintained. E.g. Firewall, Antivirus, Anti Spyware, Timely updating of software and antivirus updates and patches etc.
4. System Development Life Cycle and Change Management Controls: These controls are enforced to ensure that the correct process of software development/procurement and release management is followed. E.g. Documented Process for procuring software, Documented Process of incorporating changes to the acquired software etc.
5. Logical Controls: These are controls which provide access restrictions to the employees who use the IT Infrastructure. The motive of these controls is to protect the identities of the employees and to prevent misuse. E.g. User Account Passwords, Access Removal upon termination, screen locks etc.
6. Backup and Recovery: These controls are present to ensure proper backup and recovery processes of the data of the organization. E.g. Daily Backup of data and environment (OS), Restoration Practice trial etc.
7. End user computing: These controls are enforced directly on the employees. These controls are enforced with an objective of prevention of IT Infrastructure Abuse by the employees. E.g. Logging of user activity and Review, Disabling of USB Ports etc.
An IS Audit is performed to provide assurance that all of the above mentioned controls are adequate and satisfactory to the nature of the enterprise and effectively operational in the functions of the enterprise. An IS Audit is typically divided into two sections i.e. Review of IT Application Controls (ITAC) and Review of IT General Controls (ITGC). An IS Audit would have the following process:-
- An IS Auditor would begin his audit engagement by having conversation with the IT Administrator/CIO of an enterprise. The IS auditor would review all the documented policies and processes that are being enforced within the organization. Documented policies would include a IS Security Policy, Bring Your Own Device Policy (BYOD), Password Policy, BCP etc. The IS Auditor would be gaining an understanding of the overall level of the Internal Controls.
- An IS Auditor would then gain an understanding of the applications that have been implemented in the IT Infrastructure. It would be a base for him to decide the plan of action of the Audit.
- The next step would be to collect a list of all the types of logs that can be generated by the applications.
- After collecting the above information, the auditor the auditor identifies the risks that are applicable for the enterprise. The approach that would be followed is to create a matrix for each application and area (for ITAC and ITGC respectively) and would identify the controls that are enforced in the enterprise. All the identification and Review of controls would be performed by sampling, observations or any other method.
- Testing of Design Effectiveness and testing of operating effectiveness would be performed by the IS Auditor on every identified control. Testing of Design Effectiveness refers to the working design of the control as documented. It is a blue print of the control. Testing of Operating Effectiveness refers to actual performance of the Control in the IT Environment.
- It is important for the IS Auditor to collect sufficient evidence while identifying the controls. Evidences can be in the form of Screenshots, Email threads, Scanned documents, photographs, Minutes of Meetings etc.
- A Risk Rating exercise is then performed to the identified controls to see whether the identified control is sufficient to mitigate the identified risk.
- Based on the Risk Ratings and the evidences collected, suitable recommendations would be suggested and accordingly an IS Audit report would be drafted and shared to the enterprise.
Thus the ultimate test of IT Internal Controls can be performed in an IS Audit. Based on the findings and observations, an IS Auditor would be able to provide sufficient assurance whether the incorporated controls are adequate or not to the nature and size of the IT Infrastructure of the enterprise.
Bharath Rao B
SRO0350061
mailme@bharathraob.com
blog.bharathraob.com
/bharathraob
CAclubindia
