Understanding and Conducting Information Systems Auditing

Informationen zum Autor VEENA HINGARH is Joint Director of the South Asian Management Technologies Foundation, a center for research, training, and application in the areas of finance and risk management, which provides training in areas including IS auditing, enterprise risk management, and risk modeling. Winner of numerous merit-based awards during her career, Hingarh's major areas of focus are IFRS and IS. She speaks frequently at conferences and platforms throughout Asia and the Middle East. Hingarh is a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI), Certified Company Secretary of the Institute of Company Secretaries of India (ICSI), and Certified Information System Auditor (CISA) from ISACA (USA). ARIF AHMED is a professor at and Director of the South Asian Management Technologies Foundation as well as a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI). He is an Information Security Management System Lead Auditor for the British Standards Institution. Ahmed's areas of focus are finance and risk management, and he has over two decades of postqualification experience in training and strategic consulting. He has been interviewed and quoted throughout the media and has spoken at various seminars and institutions, including the Institute of Chartered Accountants of India, XLRI, and the Institute of Company Secretaries of India. Klappentext A comprehensive guide to understanding and auditing modern information systemsThe increased dependence on information system resources for performing key activities within organizations has made system audits essential for ensuring the confidentiality, integrity, and availability of information system resources. One of the biggest challenges faced by auditors is the lack of a standardized approach and relevant checklist. Understanding and Conducting Information Systems Auditing brings together resources with audit tools and techniques to solve this problem.Featuring examples that are globally applicable and covering all major standards, the book takes a non-technical approach to the subject and presents information systems as a management tool with practical applications. It explains in detail how to conduct information systems audits and provides all the tools and checklists needed to do so. In addition, it also introduces the concept of information security grading, to help readers to implement practical changes and solutions in their organizations.* Includes everything needed to perform information systems audits* Organized into two sections--the first designed to help readers develop the understanding necessary for conducting information systems audits and the second providing checklists for audits* Features examples designed to appeal to a global audienceTaking a non-technical approach that makes it accessible to readers of all backgrounds, Understanding and Conducting Information Systems Auditing is an essential resource for anyone auditing information systems. Zusammenfassung A comprehensive guide to understanding and auditing modern information systems The increased dependence on information system resources for performing key activities within organizations has made system audits essential for ensuring the confidentiality, integrity, and availability of information system resources. Inhaltsverzeichnis Preface xi Acknowledgments xv PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT 1 Chapter 1: Overview of Systems Audit 3 Information Systems Audit 3 Information Systems Auditor 4 Legal Requirements of an Information Systems Audit 4 Systems Environment and Information Systems Audit 7 Information System Assets 8 Classification of Controls 9 The Impact of Computers on Information 12 The Impact of Computers on Auditing 14 Information Systems Audit Cov...

List of contents

Preface xi
 
Acknowledgments xv
 
PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT 1
 
Chapter 1: Overview of Systems Audit 3
 
Information Systems Audit 3
 
Information Systems Auditor 4
 
Legal Requirements of an Information Systems Audit 4
 
Systems Environment and Information Systems Audit 7
 
Information System Assets 8
 
Classification of Controls 9
 
The Impact of Computers on Information 12
 
The Impact of Computers on Auditing 14
 
Information Systems Audit Coverage 15
 
Chapter 2: Hardware Security Issues 17
 
Hardware Security Objective 17
 
Peripheral Devices and Storage Media 22
 
Client-Server Architecture 23
 
Authentication Devices 24
 
Hardware Acquisition 24
 
Hardware Maintenance 26
 
Management of Obsolescence 27
 
Disposal of Equipment 28
 
Problem Management 29
 
Change Management 30
 
Network and Communication Issues 31
 
Chapter 3: Software Security Issues 41
 
Overview of Types of Software 41
 
Elements of Software Security 47
 
Control Issues during Installation and Maintenance 53
 
Licensing Issues 55
 
Problem and Change Management 56
 
Chapter 4: Information Systems Audit Requirements 59
 
Risk Analysis 59
 
Threats, Vulnerability, Exposure, Likelihood, and Attack 61
 
Information Systems Control Objectives 61
 
Information Systems Audit Objectives 62
 
System Effectiveness and Effi ciency 63
 
Information Systems Abuse 63
 
Asset Safeguarding Objective and Process 64
 
Evidence Collection and Evaluation 65
 
Logs and Audit Trails as Evidence 67
 
Chapter 5: Conducting an Information Systems Audit 71
 
Audit Program 71
 
Audit Plan 72
 
Audit Procedures and Approaches 75
 
System Understanding and Review 77
 
Compliance Reviews and Tests 77
 
Substantive Reviews and Tests 80
 
Audit Tools and Techniques 81
 
Sampling Techniques 84
 
Audit Questionnaire 85
 
Audit Documentation 86
 
Audit Report 87
 
Auditing Approaches 89
 
Sample Audit Work-Planning Memo 91
 
Sample Audit Work Process Flow 93
 
Chapter 6: Risk-Based Systems Audit 101
 
Conducting a Risk-Based Information Systems Audit 101
 
Risk Assessment 104
 
Risk Matrix 105
 
Risk and Audit Sample Determination 107
 
Audit Risk Assessment 109
 
Risk Management Strategy 112
 
Chapter 7: Business Continuity and Disaster Recovery Plan 115
 
Business Continuity and Disaster Recovery Process 115
 
Business Impact Analysis 116
 
Incident Response Plan 118
 
Disaster Recovery Plan 119
 
Types of Disaster Recovery Plans 120
 
Emergency Preparedness Audit Checklist 121
 
Business Continuity Strategies 122
 
Business Resumption Plan Audit Checklist 123
 
Recovery Procedures Testing Checklist 126
 
Plan Maintenance Checklist 126
 
Vital Records Retention Checklist 127
 
Forms and Documents 128
 
Chapter 8: Auditing in the E-Commerce Environment 147
 
Introduction 147
 
Objectives of an Information Systems Audit in the E-Commerce Environment 148
 
General Overview 149
 
Auditing E-Commerce Functions 150
 
E-Commerce Policies and Procedures Review 155
 
Impact of E-Commerce on Internal Control 155
 
Chapter 9: Security Testing 159
 
Cybersecurity 15

Product details

• Authors: Arif Ahmed, Arif Hingarh Ahmed, V Hingarh, Veen Hingarh, Veena Hingarh, Veena Ahmed Hingarh, Hingarh Veena, HINGARH VEENA AHMED ARIF
• Publisher: Wiley, John and Sons Ltd
• Languages: English
• Product format: Hardback
• Released: 15.03.2013
• EAN: 9781118343746
• ISBN: 978-1-118-34374-6
• No. of pages: 304
• Series: Wiley Corporate F&A; Wiley Corporate F&A (Unnumbere; Wiley Corporate F&A
• Subjects: Social sciences, law, business > Business > Business administration; Rechnungswesen, Revision, Accounting, Auditing, Revision (Wirtsch.), Management and management techniques