版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
文档简介
Application-levelITRiskAssessment
ISACADenverChapterMeetingFebruary21,2008OutlineWhythistopic?SECinterpretiveguidanceABC’simplementationapproachDesignoftheITRAmodelModelwalk-through/Q&AWhyThisTopic?
GRCSpendingSkyrocketsGovernanceRiskComplianceBoardandEntityManagementEnterpriseRiskMgt
(COSO,COCO)PublicCompanies
(Sarbanes-Oxley,NYSE,Nasdaq,Turnbull,etc.)CorporatePolicyandProcedureManagementOperationalRiskMgtSOX-Like
(Japan,Canada,EU)ITGovernance
(CobiT,ISO17799&27001-ISM)ITRiskMgt
(CobiT,ITIL,etc.)SpecificAreas
(PCI-DSS,AML,etc.)InternalAuditDepartmentsFinancialInstitutionRiskMgt(BaselII,etc.)PersonalInformation
(FTC,HIPAA,GLBA,COPPA,EUD,etc.)WhyThisTopic?
USCongressRespondsPCAOBCreated
(07/30/02)PCAOBProposesAS2
(10/07/03)PCAOB&SECApproveAS2
(03/09/04&06/17/04)ICFROpinionsLargeAcceleratedFilers
(FYEs11/15/04+)RoundtableFeedback
(04/13/05)PCAOBPolicyStatement
(05/16/05)WhyThisTopic?
CorporateOutcryBegins “Thefirst-yearimplementationofnewrequirementsforpubliccompanies’internalcontroloverfinancialreporting(ICFR)provedmoreburdensomeandcostlythanexpected,resultinginanoutcryfromcorporateAmerica.”JournalofAccountancy,TwoYearsandCounting,June2007WhyThisTopic?
Fix:AuditFirmsPerthePCAOBPolicystatementissued5/16/05,theauditorsshould—IntegratetheirauditsTailorauditplanstotheirclient’srisksUseatop-downapproachUsetheworkofothersCommunicatedirectlyandtimelywithclientsWhyThisTopic?
SOXYearTwo-2005PCAOBSAGRe:InternalControl
(06/08/05)ICFROpinionsAcceleratedFilers
(FYEs07/15/05+)AS2ImplementationReport
(11/30/05)InternalControlAuditInspectionsReport
(05/01/06)RoundtableFeedback
(05/10/06)AndThen?WhyThisTopic?
CorporateOutcry(Cont)Theaveragecostofbeingapubliccompanywithrevenueunder$1billionrose$1.6million,or130%,sincetheSarbanes-Oxleyerabegan.
Source:“SecondAnniversary:TheImpactofSarbanes-Oxley,”InstitutionalShareholderServices,WhyThisTopic?
Fix:Issuer(&AuditFirms)PCAOBAnnouncesAS2Rewrite
(12/xx/06)PCAOBProposesGuidanceforIssuers
(12/20/06)SECApprovesInterpretiveGuidance
(05/23/07)PCAOBAdoptsAS5ReplacingAS2
(05/24/07)SECInterpretiveGuidanceEffective
(06/27/07)AS5Effective
(FYEs11/15/07+)Management’sReportRequired
(FYEs12/15/07+)SECAnnouncesSmallBizC&BStudy
(02/01/08)ICFROpinionsNon-AcceleratedFilers
(FYEs12/15/09+)SECInterpretiveGuidance
ForIssuerManagementGuidanceRegardingManagement’sReportonInternalControlOverFinancialReportingEffectiveDate:June27,2007ACTION:Interpretation.SECInterpretiveGuidance
UnderlyingPrinciplesManagementshould:Evaluatewhetherithasimplementedcontrolsthatadequatelyaddresstheriskthatamaterialmisstatementofthefinancialstatementswouldnotbepreventedordetectedinatimelymanner.Baseitsassessmentofriskontheevaluationofevidenceabouttheoperationofitscontrols.SECInterpretiveGuidance
BenefitsITRA
Overview-ApproachUseriskfactors(riskassessmentevaluationcriteria)toassessthelevelofinherentriskandcontrolriskforeachapplicationsystem.UsetheresultantriskratingstodeterminethelevelofoverallriskaccordingtotheCompany'smethodology.Usetheoverallriskassessmentratingtoguidetheappropriatelevelofinternalcontrolevaluationprocedurestobeapplied.ITRA
ModelWalk-ThroughITRA
RunSettingsAssignmentofpointvaluestoriskfactorsBreakpointswhichdefineLow,Medium,andHighriskapplicationsExcludingriskfactorcategoriesfromresultsExcludingmissing/unknowndataITRA
RiskFactorsInformationCategoriesAPPL(ApplicationSystems)ADOS(Application/DatabaseServerOperatingSystemsDBMS(DataBaseManagementSystems)PlusbasicAPPLinformationBiastowardsobjectivevssubjectiveevaluationcriteriaITRA
APPLBasicInformationNameSOX-Indicator-IC-DeptVendor-NameOriginal-Implementation-DateMajor-Release-Implementation-DateSoftware-VersionSupport-SourceInfrastructureManagement-SourceApp-Server-OS-Vendor,Product,Version,&SP-LevelDB-Server-OS-Vendor,Product,Version,&SP-LevelDB-DBMS-Vendor,Product,Version,&SP-LevelITRA
APPLRiskFactors(1of2)Vendor-ReputationMonths-Post-Original-Implementation-DateMonths-Post-Major-Release-DateVersion-SupportedUsers-CountCustomizationUser-ConfigurableSimple-or-Complex-LogicInterfaces-Total-CountInterfaces-Manual-CountChanges-Count-NormalChanges-Count-EmergencyFailures-CountRestores-CountITRA
APPLRiskFactors(2of2)Gaps-Security-CountGaps-Changes-CountGaps-QAAR-CountGaps-SOD-CountGaps-Other-CountOutages-Count-DaysOutages-HoursProcesses-Supported-CountBP-Risk-Average-InherentMateriality-I-CountMateriality-G-CountMateriality-S-CountITTierITRA
ADOSRiskFactorsOutsourcer-SAS70ReportOpinion,TestingExceptions-Moderate,&TestingExceptions-MajorAppServerOS-Vendor-ReputationDBServerOS-Vendor-ReputationAppServerOS-Version-SupportedDBServerOS-Version-SupportedChanges-CountFailures-CountGaps-Security-CountGaps-Changes-CountGaps-QOSR-CountGaps-Other-CountProduction-Server-CountITRA
DBMSRiskFactorsVendor-ReputationVersion-SupportedChanges-CountFailures-CountGaps-Security-CountGaps-Changes-CountGaps-QDBR-CountGaps-Other-CountITRA
ModelWalk-Through(cont)ITRA
MajorDataSourcesICDepartmentAPPLLi
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
最新文档
- 2024年企业聘用合同参考模板(二篇)
- 2024年借款合同格式范文(二篇)
- 2024年关于公司劳动合同参考模板(四篇)
- 2024年关于房屋租赁合同范例(二篇)
- 2024年个人购房合同协议标准样本(二篇)
- 2024年化妆品采购合同样本(二篇)
- 2024年汽车买卖合同样本
- 2024年产品委托加工合同标准模板(二篇)
- 2024年二手设备买卖合同参考样本(三篇)
- 耕地承包合同书
- 全过程工程咨询管理服务方案投标方案(技术方案)
- 统编版(2024新版)一年级上册道德与法治第二单元《过好校园生活》第8课《课余生活真丰富》教学设计
- 2024四川越盛油气田技术服务限公司招聘10人(高频重点提升专题训练)共500题附带答案详解
- 勤俭节约合理消费主题班会课件下学期
- 2024浙江省公众信息产业限公司无线运营分公司校园招聘30人(高频重点提升专题训练)共500题附带答案详解
- 新教科版(2017版)六年级上册科学全册课时练课件
- 第一单元群文阅读课件39张 统编版高中语文必修上册
- 2024年全国一级造价师之建设工程造价管理考试重点试题(详细参考解析)
- 2024年全国一级造价师之建设工程造价管理考试高频题(附答案)
- 2024年“正大杯”市场调查与分析竞赛考试题库及答案
- 卡通简约亲子阅读模板
评论
0/150
提交评论