IT稽核审计文档.pptVIP

Comparison of Control Concepts COBIT SAC COSO SASs 55/78 Primary Audience Management, users, information system auditors Internal Auditors Management External Auditors IC viewed as a Set of processes including policies, procedures, practices, and organizational structures Set of processes, subsystems, and people Process Process IC Objectives organizational Effective efficient operationsConfidentiality, Integrity and availability of informationReliable financial reportingCompliance with laws regs Effective efficient operationsReliable financial reportingCompliance with laws regs Effective efficient operationsReliable financial reportingCompliance with laws regs Reliable financial reportingEffective efficient operationsCompliance with laws regs Components or Domains Domains:Planning and organizationAcquisition and implementationDelivery and supportMonitoring Components:Control EnvironmentManual AutomatedSystems Control Procedures Components:Control EnvironmentRisk Management ControlActivities Information Communication Monitoring Components:Control Environment RiskAssessment ControlActivities Information Communication Monitoring Focus Information Technology Information Technology Overall Entity Financial Statement IC Effectiveness Evaluated For a period of time For a period of time At a point in time For a period of time Responsibility for IC System Management Management Management Management Size 187 pages in four documents 1193 pages in 12 modules 353 pages in four volumes 63 pages in two documents IT 保安要求 交通网络 电子商务的保安 Secure Remote Access 第三方的使用/电邮的保安 重要业务系统的保安 系统开发 讯息处理 保安管理 BS 7799 讯息保安政策 – 操作准则 IT 稽核程序 风险分析和审核 讯息保安调研工具 (样品) 业务流程 Walkthrough 采访 标准和作业 通过法规和/或者抽查 利用电脑进行资料分析 比较方法 标准和作业 稽核步骤样本 HSC/BOC/October 2001 银行的IT 内部稽核 典型的银行环境 信托/中介角色 涉及客户钱财 受高度的监管 信息系统的高使用度为和广大的客户群，交易方等进行业务收务操作处理 银行的产品与服务 为客户提供： 存款/提款 房屋贷款、汽车贷款等 信用卡 :使用的系统和分销渠道： 现金存款机，汇款系统，电话银行、互联网银行、信用卡付帐系统 银行的产业与服务 为企业客户提供： - 融资： 贷款－定期贷款、银团 信用