资讯科技的一般和应用控制ITGeneralandApplication-ISACA.PDFVIP

  資訊科技的一般和應用控制：內部化模型 IT General and Application Controls : The Model of Internalization 作者 : Emanuele Palmas, CISA, has been part of the internal 各產業公司有時會發現自己面臨著 事實上，主要風險是很清楚的：辨 audit team at Guess Europe Group, based in Lugano, 是否將電腦審計服務及資訊科技一般 識風險的過程中，很有可能是被局限於 Switzerland, since 2008. He 控制（IT general controls -ITGC ）和 除了資訊科技以外的作業面、財務面或 has gained experience in external auditing for medium 應用控制（ IT application controls - 合規面的角度，致未能正確地識別所有 and large companies within the industrial sector at ITAC ）外包的選擇。外包的決定很可 的風險。此外，也代表所有辨識評估的 PricewaterhouseCoopers, with mandates including the 能是由於被審計的企業之財務規劃、 模式已被固定化，這也意味著錯過了成 US Sarbanes-Oxley Act and 時間因素、資源不足或是公司本身技 熟的稽核部門擬建置“整合性審計模式 ” support to IT audit. At Guess Europe Group, Palmas has 術層面上無法勝任，特別是資訊科技 基礎的機會。 had the opportunity to improve his IT audit skills and has 一般和應用控制在技術和實務上的知 followed the implementation of 能需求，並不像如 COBIT4.1或資訊科 內部稽核業務外包時會錯過的機會 IT general controls (ITGC) and IT application controls (ITAC) MISSED OPPORTUNITIES WHEN 技基礎設施庫（ the IT Infrastructure （ at the enterprise, supporting the external auditors when Library -ITIL ）等資訊管理模型那般盡 INTERNAL AUDIT IS OUTSOURCED ） required. An important task 如人意，而是遠超出如沙賓法案中相 during his practice has been the ITGC performance in 關資訊科技控制目標理論範本中（ IT 內部稽核業務外包使得內部稽核沒 Hong Kong for Guess Asia. Palmas holds the COBIT 4.1 Control Objectives for Sarbanes-Oxley: 有機會去了解他們單位的全部業務流程 。 Foundation Certificate and ITIL The Role of IT in the Design and 所有的數據資料都是代表公司業務運作 v3 Foundation Certificate. He can be contacted at emanuele. Implementation of Internal Contr