Understanding and Conducting Information Systems Auditing
Description
More details
Other editions
Additional editions
Persons
Content
Preface xi
Acknowledgments xv
PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT 1
Chapter 1: Overview of Systems Audit 3
Information Systems Audit 3
Information Systems Auditor 4
Legal Requirements of an Information Systems Audit 4
Systems Environment and Information Systems Audit 7
Information System Assets 8
Classification of Controls 9
The Impact of Computers on Information 12
The Impact of Computers on Auditing 14
Information Systems Audit Coverage 15
Chapter 2: Hardware Security Issues 17
Hardware Security Objective 17
Peripheral Devices and Storage Media 22
Client-Server Architecture 23
Authentication Devices 24
Hardware Acquisition 24
Hardware Maintenance 26
Management of Obsolescence 27
Disposal of Equipment 28
Problem Management 29
Change Management 30
Network and Communication Issues 31
Chapter 3: Software Security Issues 41
Overview of Types of Software 41
Elements of Software Security 47
Control Issues during Installation and Maintenance 53
Licensing Issues 55
Problem and Change Management 56
Chapter 4: Information Systems Audit Requirements 59
Risk Analysis 59
Threats, Vulnerability, Exposure, Likelihood, and Attack 61
Information Systems Control Objectives 61
Information Systems Audit Objectives 62
System Effectiveness and Effi ciency 63
Information Systems Abuse 63
Asset Safeguarding Objective and Process 64
Evidence Collection and Evaluation 65
Logs and Audit Trails as Evidence 67
Chapter 5: Conducting an Information Systems Audit 71
Audit Program 71
Audit Plan 72
Audit Procedures and Approaches 75
System Understanding and Review 77
Compliance Reviews and Tests 77
Substantive Reviews and Tests 80
Audit Tools and Techniques 81
Sampling Techniques 84
Audit Questionnaire 85
Audit Documentation 86
Audit Report 87
Auditing Approaches 89
Sample Audit Work-Planning Memo 91
Sample Audit Work Process Flow 93
Chapter 6: Risk-Based Systems Audit 101
Conducting a Risk-Based Information Systems Audit 101
Risk Assessment 104
Risk Matrix 105
Risk and Audit Sample Determination 107
Audit Risk Assessment 109
Risk Management Strategy 112
Chapter 7: Business Continuity and Disaster Recovery Plan 115
Business Continuity and Disaster Recovery Process 115
Business Impact Analysis 116
Incident Response Plan 118
Disaster Recovery Plan 119
Types of Disaster Recovery Plans 120
Emergency Preparedness Audit Checklist 121
Business Continuity Strategies 122
Business Resumption Plan Audit Checklist 123
Recovery Procedures Testing Checklist 126
Plan Maintenance Checklist 126
Vital Records Retention Checklist 127
Forms and Documents 128
Chapter 8: Auditing in the E-Commerce Environment 147
Introduction 147
Objectives of an Information Systems Audit in the E-Commerce Environment 148
General Overview 149
Auditing E-Commerce Functions 150
E-Commerce Policies and Procedures Review 155
Impact of E-Commerce on Internal Control 155
Chapter 9: Security Testing 159
Cybersecurity 159
Cybercrimes 160
What Is Vulnerable to Attack? 162
How Cyberattacks Occur 162
What Is Vulnerability Analysis? 165
Cyberforensics 168
Digital Evidence 170
Chapter 10: Case Study: Conducting an Information Systems Audit 173
Important Security Issues in Banks 174
Implementing an Information Systems Audit at a Bank Branch 180
Special Considerations in a Core Banking System 185
PART TWO: INFORMATION SYSTEMS AUDITING CHECKLISTS 197
Chapter 11: ISecGrade Auditing Framework 199
Introduction 199
Licensing and Limitations 200
Methodology 200
Domains 200
Grading Structure 202
Selection of Checklist 203
Format of Audit Report 206
Using the Audit Report Format 207
Chapter 12: ISecGrade Checklists 209
Checklist Structure 209
Information Systems Audit Checklists 210
Chapter 13: Session Quiz 281
Chapter 1: Overview of Systems Audit 281
Chapter 2: Hardware Security Issues 284
Chapter 3: Software Security Issues 286
Chapter 4: Information Systems Audit Requirements 288
Chapter 5: Conducting an Information Systems Audit 290
Chapter 6: Risk-Based Systems Audit 293
Chapter 7: Business Continuity and Disaster Recovery Plan 294
Chapter 8: Auditing in an E-Commerce Environment 296
Chapter 9: Security Testing 297
About the Authors 299
About the Website 301
Index 303
