RELATIONSHIP BETWEEN IT RISK AND THE IT AUDIT PLAN

Size: px
Start display at page:

Download "RELATIONSHIP BETWEEN IT RISK AND THE IT AUDIT PLAN"

Transcription

1 RELATIONSHIP BETWEEN IT RISK AND THE IT AUDIT PLAN Presenter: Mr Vincent M. Kgwale CISA, CISM Deputy Director: IT Audit, National Treasury 31 October 2012

2 Contents Pioneers Of Corporate Governance Acceptance of corporate governance in the public sector Corporate Governance Principles Auditor General 2010/11 results Elements of IT Governance Definition of IT Risk Definition of IT Risk Management ISACA Risk IT Framework IT Risk Management Approach IT Risk Management Approach Unpacking the IT Risks Unpacking the IT Risks IT Environment The Relationship Between IT Risk and IT Audit Crafting the IT Audit Plan IT Risk Standards and Framework 1

3 Pioneers Of Corporate Governance Sir Adrian Cadbury chaired the Committee on Financial Aspects of Corporate Governance set up in 1990 and published its report in

4 Pioneers Of Corporate Governance Cont. Mervyn King S.C chaired the King Committee on Corporate Governance which published King Report on Corporate Governance (King I) in 1994 aimed at promoting the highest standards of corporate governance in South Africa. 4

5 Acceptance of corporate governance in the public sector Limited adoption in government and the public services. Compliance with the Public Finance Management Act (PFMA) and the Municipal Finance Management Act (MFMA), as minimum requirements in the public sector. In contrast, the provisions of King III are specifically intended to be applied or explained within all economic sectors, including the public sector. 5

6 Acceptance of corporate governance in the public sector contint.. Parliament key stakeholder and it will determine the level of compliance that each public institution should strive to achieve in addition to its statutory compliance required in terms of the PFMA, MFMA and other applicable acts. National and provincial institutions will have similar compliance obligations and these will reside with the executive authority, who delegates these responsibilities to the accounting officer or equivalent. 6

7 Corporate Governance Principles Ethical leadership and corporate citizenship Boards and directors (Municipal councils) Audit committees The governance of risk

8 Corporate Governance Principles Cont. The governance of information technology Compliance with laws, rules, codes and standards Internal audit Governing stakeholder relationships Integrated reporting and disclosure

9 Auditor General 2010/11 results 79% of departments did not implement some IT governance aspects according to General Report on National Audit Outcomes 10/11 Financial Year 9

10 Elements of IT Governance Strategic Alignment Value Delivery Risk Management Resource Management Performance Measurement

11 Definition of IT Risk Every organization has a mission and in this digital age government also use automated information technology (IT) systems to process its information for better support of its objectives. Risk management plays a critical role in protecting an organization s information assets, and therefore its mission or objectives, from IT-related risk. IT risk can be defined as any threat to information technology, data, critical systems and business processes. IT risk provides an end-to-end, comprehensive view of all risks related to the use of IT and a similarly thorough treatment of risk management, from the tone and culture at the top, to operational issues. 11

12 Definition of IT Risk Management has a responsibility to identify areas of control weakness and respond in a timely fashion to these by improving processes, augmenting controls and even reducing the cycle time between control testing to ensure that the organization is properly identifying and responding to IT risks. 12

13 Definition of IT Risk Management IT risk is a business risk specifically associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise. It consists of IT-related events that could potentially impact the business. It can occur with both uncertain frequency and magnitude, and it creates challenges in meeting strategic goals and objectives; Aims to prioritize and manage IT risk; Senior executives need a frame of reference and a clear understanding of the IT function and IT risk associated with it; IT risk is not just a technical issue; and 13

14 Definition of IT Risk Management Cont. Organisation managers determine what IT needs to do to support their business; they set the targets for IT and are accountable for managing the associated risks. 14

15 ISACA Risk IT Framework Risk Governance: Risk appetite and tolerance, responsibilities and accountability for IT risk management, awareness and communication, and risk culture Risk Evaluation: Describing business impact and risk scenarios Risk Response: Key risk indicators (KRI) and risk response definition and prioritisation Source: ISACA Risk IT Framework 15

16 IT Risk Management Approach IT risk is a component of the overall risk universe of an organisation. Source: ISACA Risk IT Framework 16

17 IT Risk Management Approach Unpacking the IT Risks Source: ISACA Risk IT Framework 17

18 IT Risk Management Approach Unpacking the IT Risks Source: ISACA Risk IT Framework 18

19 Unpacking the IT Risks IT Environment IT ENVIRONMENT STRATEGIC IT STRATEGY IT STANDARDS, POLICIES, PROCEDURES & GUIDELINES SERVICE LEVEL AGREEMENTS APPLICATION INFRASTRUCTURE APPLICATION DATABASE NETWORK HOST PHYSICAL Source: National Treasury Internal Audit Information Systems Audit Methodology 19

20 The Relationship Between IT Risk and IT Audit IT ENVIRONMENT AUDIT TYPE STRATEGIC IT STRATEGY IT STANDARDS, POLICIES, PROCEDURES & GUIDELINES SERVICE LEVEL AGREEMENTS GENERAL CONTROL REVIEW IT Strategy IT Standards, Policies, Procedures and Guidelines Service Level Agreements APPLICATION APPLICATION SPECIFIC CONTROL REVIEW Application Control Review INFRASTRUCTURE DATABASE NETWORK HOST PHYSICAL SPECIFIC CONTROL REVIEW Database Management Review Data Integrity Review Network Review Operating System Review Physical and Environmental Review GENERAL CONTROL REVIEW (Controls Around the Computing Layers Supporting the Infrastructure) User Profile Management Change Management Logical Access Controls Physical Access Controls Environmental Controls Software Development Business Continuity and Disaster Recovery Source: National Treasury Internal Audit Information Systems Audit Methodology 20

21 Crafting the IT Audit Plan Risk Identified Inherent Priority Residual Priority IT AUDIT PLAN Audit Description Audit Objectives Interruptions to availability and access to business critical systems Priority 1 Priority 2 IT Strategy Framework and Operational Plan Review Assess the adequacy of the IT strategy framework and operational plan to assist business in the achievement of their objectives. Interruptions to availability and access to business critical systems Priority 1 Priority 2 IT Governance Review Assess the adequacy of the IT governance framework to ensure compliance with the King 3 requirements. Interruptions to availability and access to business critical systems Unauthorised malicious activity by internal users Unauthorised malicious activity by internal users Unauthorised malicious activity by external users Priority 1 Priority 2 Information Security Policy Review Priority 1 Priority 2 Internal Network Security Review Priority 1 Priority 2 Wireless Network Security Review Priority 1 Priority 2 External Network Security Review Review of information security management policies. Assess the level of internal network threats and vulnerabilities. Assess the configurations of the wireless network to prevent malicious activity. Assess the level of external network threats and vulnerabilities. Unauthorised malicious activity by external users Priority 1 Priority 2 Perimeter Firewall Review Assess the configurations of the firewall located on the external network perimeter to prevent malicious activity. Source: National Treasury Internal Audit IT Audit Plan 21

22 IT Risk Standards and Framework ISACA The Risk IT Framework; COSO Enterprise Risk Management: Integrated Framework; ISO Risk Management; and Public Sector Risk Management Framework. 22

23 ? QUESTIONS 23

24 THANK YOU 24

Facing Information Security Challenges

Facing Information Security Challenges AKTINA Event Information Security & Cloud Challenges March 17, 2016 Facing Information Security Challenges ISACA Cyprus Chapter Paschalis Pissarides CRISC, CISM, CISA Immediate Past President (2010-2014)

More information

Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks

Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks 2ο InfoCom Security Conference Anestis Demopoulos, Vice President ISACA Athens Chapter, & Senior Manager, Advisory Services, Ernst

More information

Risk IT A set of guiding principles and. the first framework to help enterprises identify, govern and effectively manage IT risk.

Risk IT A set of guiding principles and. the first framework to help enterprises identify, govern and effectively manage IT risk. Risk IT A set of guiding principles and the first framework to help enterprises identify, govern and effectively manage IT risk. In business today, risk plays a critical role. Almost every business decision

More information

COBIT 5 for Risk. CS 3-7: Monday, July 6 4:00-5:00. Presented by: Nelson Gibbs CIA, CRMA, CISA, CISM, CGEIT, CRISC, CISSP ngibbs@pacbell.

COBIT 5 for Risk. CS 3-7: Monday, July 6 4:00-5:00. Presented by: Nelson Gibbs CIA, CRMA, CISA, CISM, CGEIT, CRISC, CISSP ngibbs@pacbell. COBIT 5 for Risk CS 3-7: Monday, July 6 4:00-5:00 Presented by: Nelson Gibbs CIA, CRMA, CISA, CISM, CGEIT, CRISC, CISSP ngibbs@pacbell.net Disclaimer of Use and Association Note: It is understood that

More information

Domain 1 The Process of Auditing Information Systems

Domain 1 The Process of Auditing Information Systems Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge

More information

CRISC Glossary. Scope Note: Risk: Can also refer to the verification of the correctness of a piece of data

CRISC Glossary. Scope Note: Risk: Can also refer to the verification of the correctness of a piece of data CRISC Glossary Term Access control Access rights Application controls Asset Authentication The processes, rules and deployment mechanisms that control access to information systems, resources and physical

More information

ENTERPRISE RISK MANAGEMENT POLICY

ENTERPRISE RISK MANAGEMENT POLICY ENTERPRISE RISK MANAGEMENT POLICY TITLE OF POLICY POLICY OWNER POLICY CHAMPION DOCUMENT HISTORY: Policy Title Status Enterprise Risk Management Policy (current, revised, no change, redundant) Approving

More information

APPLICATION OF KING III CORPORATE GOVERNANCE PRINCIPLES 2014

APPLICATION OF KING III CORPORATE GOVERNANCE PRINCIPLES 2014 WOOLWORTHS HOLDINGS LIMITED CORPORATE GOVERNANCE PRINCIPLES 2014 CORPORATE GOVERNANCE PRINCIPLES 2014 CORPORATE GOVERNANCE PRINCIPLES 2014 This table is a useful reference to each of the King III principles

More information

APPLICATION OF THE KING III REPORT ON CORPORATE GOVERNANCE PRINCIPLES

APPLICATION OF THE KING III REPORT ON CORPORATE GOVERNANCE PRINCIPLES APPLICATION OF THE KING III REPORT ON CORPORATE GOVERNANCE PRINCIPLES Ethical Leadership and Corporate Citizenship The board should provide effective leadership based on ethical foundation. that the company

More information

Director, IT Security District Office Kern Community College District JOB DESCRIPTION

Director, IT Security District Office Kern Community College District JOB DESCRIPTION Director, IT Security District Office Kern Community College District JOB DESCRIPTION Definition Reporting to the Chief Information Officer, the Director of IT Security develops and implements procedures,

More information

Information Security and Risk Management

Information Security and Risk Management Information Security and Risk Management COSO and COBIT Standards and Requirements Page 1 Topics Information Security Industry Standards and COBIT Framework Relation to COSO Internal Control Risk Management

More information

Fraud Prevention and Deterrence

Fraud Prevention and Deterrence Fraud Prevention and Deterrence Fraud Risk Assessment 2016 Association of Certified Fraud Examiners, Inc. What Is Fraud Risk? The vulnerability that an organization faces from individuals capable of combining

More information

Saldanha Bay Municipality. Risk Management Strategy. Inclusive of, framework, procedures and methodology

Saldanha Bay Municipality. Risk Management Strategy. Inclusive of, framework, procedures and methodology Inclusive of, framework, procedures and methodology Contents 1 Introduction 1 1.1 Legislative Framework and best practice 1 1.2 Purpose of Enterprise Risk Management 2 1.3 Scope and Applicability 3 1.4

More information

CORPORATE GOVERNANCE ASSESSMENT TOOL

CORPORATE GOVERNANCE ASSESSMENT TOOL CORPORATE GOVERNANCE CODE PRINCIPLE 1: BOARD LEADERSHIP The Board must lead and control; take responsibility for the organisation s performance; insist on adequate information; inform management on its

More information

IS Audit and Assurance Guideline 2202 Risk Assessment in Planning

IS Audit and Assurance Guideline 2202 Risk Assessment in Planning IS Audit and Assurance Guideline 2202 Risk Assessment in Planning The specialised nature of information systems (IS) audit and assurance and the skills necessary to perform such engagements require standards

More information

THE SOUTH AFRICAN HERITAGE RESOURCES AGENCY ENTERPRISE RISK MANAGEMENT FRAMEWORK

THE SOUTH AFRICAN HERITAGE RESOURCES AGENCY ENTERPRISE RISK MANAGEMENT FRAMEWORK THE SOUTH AFRICAN HERITAGE RESOURCES AGENCY ENTERPRISE RISK MANAGEMENT FRAMEWORK ACCOUNTABLE SIGNATURE AUTHORISED for implementation SIGNATURE On behalf of Chief Executive Officer SAHRA Council Date Date

More information

Information Technology

Information Technology Information Technology Information Technology Session Structure Board of director actions Significant and emerging IT risks Practical questions Resources Compensating Controls at the Directorate Level

More information

COBIT 5 Introduction. 28 February 2012

COBIT 5 Introduction. 28 February 2012 COBIT 5 Introduction 28 February 2012 COBIT 5 Executive Summary 2012 ISACA. All rights reserved. 2 Information! Information is a key resource for all enterprises. Information is created, used, retained,

More information

NSW Government Digital Information Security Policy

NSW Government Digital Information Security Policy NSW Government Digital Information Security Policy Version: 1.0 Date: November 2012 CONTENTS PART 1 PRELIMINARY... 3 1.1 Scope... 3 1.2 Application... 3 1.3 Objectives... 3 PART 2 CORE REQUIREMENTS...

More information

NSW Government Digital Information Security Policy

NSW Government Digital Information Security Policy NSW Government Digital Information Security Policy Version: 2.0 Date: April 2015 CONTENTS PART 1 PRELIMINARY... 3 1.1 Scope... 3 1.2 Application... 3 1.3 Objectives... 3 PART 2 POLICY STATEMENT... 4 Core

More information

Supporting information technology risk management

Supporting information technology risk management IBM Global Technology Services Thought Leadership White Paper October 2011 Supporting information technology risk management It takes an entire organization 2 Supporting information technology risk management

More information

"Introduction to IT Governance with CobiT4.1 and CobiTQuickstart"

Introduction to IT Governance with CobiT4.1 and CobiTQuickstart "Introduction to Governance with CobiT4.1 and CobiTQuickstart" ISACA Joint Session San Francisco Chapter and Silicon Valley Chapter April 23, 2008 Debra Mallette CISA (Information Systems Audit and Control

More information

Information Security Management Systems

Information Security Management Systems Information Security Management Systems Øivind Høiem CISA, CRISC, ISO27001 Lead Implementer Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector

More information

Auditing in the New Millennium:

Auditing in the New Millennium: : Information Technology Controls and Network Vulnerability Assessments Ernie Barany, CPA, CPT, CEH Principal Auditor Dan Altobelli, CPA, CISA, CEH Principal Auditor 1 When you think of IT auditing, is

More information

MEMORANDUM. Date: October 28, 2013. Federally Regulated Financial Institutions. Subject: Cyber Security Self-Assessment Guidance

MEMORANDUM. Date: October 28, 2013. Federally Regulated Financial Institutions. Subject: Cyber Security Self-Assessment Guidance MEMORANDUM Date: October 28, 2013 To: Federally Regulated Financial Institutions Subject: Guidance The increasing frequency and sophistication of recent cyber-attacks has resulted in an elevated risk profile

More information

Basel Committee on Banking Supervision - Guidelines on the corporate governance principles for banks

Basel Committee on Banking Supervision - Guidelines on the corporate governance principles for banks Basel Committee on Banking Supervision - Guidelines on the corporate governance principles for banks Basel Committee on Banking Supervision Guidelines on the corporate governance principles for banks (

More information

Risk Management Policy

Risk Management Policy Risk Management Policy Effective from 4 July 2015 Version Number: 2.1 Author: Director of Planning Planning Directorate Document Control Information Status and reason for development Revised updating the

More information

ISO27001 Controls and Objectives

ISO27001 Controls and Objectives Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the

More information

Information Security Program CHARTER

Information Security Program CHARTER State of Louisiana Information Security Program CHARTER Date Published: 12, 09, 2015 Contents Executive Sponsors... 3 Program Owner... 3 Introduction... 4 Statewide Information Security Strategy... 4 Information

More information

Governance and Management of Information Security

Governance and Management of Information Security Governance and Management of Information Security Øivind Høiem, CISA CRISC Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector secretary for information

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

WHERE IS THE DEPARTMENT RIGHT NOW?

WHERE IS THE DEPARTMENT RIGHT NOW? STATEMENT OF PATRICIA A. DALTON DEPUTY INSPECTOR GENERAL U.S. DEPARTMENT OF LABOR BEFORE THE SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS EDUCATION AND THE WORKFORCE COMMITTEE U.S. HOUSE OF REPRESENTATIVES

More information

Information Technology Control Framework in the Federal Government Considerations for an Audit Strategy

Information Technology Control Framework in the Federal Government Considerations for an Audit Strategy Information Technology Control Framework in the Federal Government Considerations for an Audit Strategy Presentation to The Institute of Internal Auditors Breakfast Session February 6, 2014 Outline of

More information

Fraud Risk Management

Fraud Risk Management Fraud Risk Management Overview Discussion Questions 1) Does your organization follow a specific risk management model? If so, which one? Do you think this model adequately addresses the risks your organization

More information

KING III CORPORATE GOVERNANCE COMPLIANCE REGISTER

KING III CORPORATE GOVERNANCE COMPLIANCE REGISTER KING III CORPORATE GOVERNANCE REGISTER CHAPTER 1: ETHICAL LEADERSHIP AND CORPORATE CITIZENSHIP NON 1.1. The board should provide effective leadership based on an ethical foundation 1.2. The board should

More information

Operational Risk Publication Date: May 2015. 1. Operational Risk... 3

Operational Risk Publication Date: May 2015. 1. Operational Risk... 3 OPERATIONAL RISK Contents 1. Operational Risk... 3 1.1 Legislation... 3 1.2 Guidance... 3 1.3 Risk management process... 4 1.4 Risk register... 7 1.5 EBA Guidelines on the Security of Internet Payments...

More information

The PNC Financial Services Group, Inc. Business Continuity Program

The PNC Financial Services Group, Inc. Business Continuity Program The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page

More information

INFORMATION SECURITY STRATEGIC PLAN

INFORMATION SECURITY STRATEGIC PLAN INFORMATION SECURITY STRATEGIC PLAN UNIVERSITY OF CONNECTICUT INFORMATION SECURITY OFFICE 4/20/10 University of Connecticut / Jason Pufahl, CISSP, CISM 1 1 MISSION STATEMENT The mission of the Information

More information

AUD105-2nd Edition. Auditor s Guide to IT - 20 hours. Objectives

AUD105-2nd Edition. Auditor s Guide to IT - 20 hours. Objectives AUD105-2nd Edition Auditor s Guide to IT - 20 hours Objectives More and more, auditors are being called upon to assess the risks and evaluate the controls over computer information systems in all types

More information

Practical Overview on responsibilities of Data Protection Officers. Security measures

Practical Overview on responsibilities of Data Protection Officers. Security measures Practical Overview on responsibilities of Data Protection Officers Security measures Manuel Villaseca Spanish Data Protection Agency mvl@agpd.es Security measures Agenda: The rol of DPO on security measures

More information

An Overview of Information Security Frameworks. Presented to TIF September 25, 2013

An Overview of Information Security Frameworks. Presented to TIF September 25, 2013 An Overview of Information Security Frameworks Presented to TIF September 25, 2013 What is a framework? A framework helps define an approach to implementing, maintaining, monitoring, and improving information

More information

Issue 1.0. UoG/ILS/IS 001. Information Security and Assurance Policy. Information Security and Compliance Manager

Issue 1.0. UoG/ILS/IS 001. Information Security and Assurance Policy. Information Security and Compliance Manager Document Reference Number Date Title Author Owning Department Version Approval Date Review Date Approving Body UoG/ILS/IS 001 January 2016 Information Security and Assurance Policy Information Security

More information

Principles for the audit committee s role in performance management

Principles for the audit committee s role in performance management Principles for the audit committee s role in performance management The information contained in this guidance paper is provided for discussion purposes. As such, it is intended to provide the reader and

More information

Information Security Specialist Training on the Basis of ISO/IEC 27002

Information Security Specialist Training on the Basis of ISO/IEC 27002 Information Security Specialist Training on the Basis of ISO/IEC 27002 Natalia Miloslavskaya, Alexander Tolstoy Moscow Engineering Physics Institute (State University), Russia, {milmur, ait}@mephi.edu

More information

Risk and Information Security Committee Charter

Risk and Information Security Committee Charter Risk and Information Security Committee Charter Effective Date March 3, 2015 Document Summary Title: Risk and Information Security Committee Charter Policy Owner: Risk and Information Security Committee

More information

Integrated Risk Management. Balancing Risk and Budget

Integrated Risk Management. Balancing Risk and Budget Integrated Risk Management The Current Risk Landscape Organizations which depend upon information systems are challenged by serious threats that can exploit both known and unknown vulnerabilities in systems.

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

ow to use CobiT to assess the security & reliability of Digital Preservation

ow to use CobiT to assess the security & reliability of Digital Preservation ow to use CobiT to assess the security & reliability of Digital Preservation Erpa WORKSHOP Antwerp 14-16 April 2004 Greet Volders Managing Consultant - VOQUALS N.V. Vice President & in charge of Education

More information

HMG Security Policy Framework

HMG Security Policy Framework HMG Security Policy Framework Security Policy Framework 3 Foreword Sir Jeremy Heywood, Cabinet Secretary Chair of the Official Committee on Security (SO) As Cabinet Secretary, I have a good overview of

More information

R I S K M A N A G E M E N T S Y S T E M F R A M E W O R K

R I S K M A N A G E M E N T S Y S T E M F R A M E W O R K R I S K M A N A G E M E N T S Y S T E M F R A M E W O R K VERSION REV 4.0 OWNER VP OPS AND ENG EFFECTIVE DATE MARCH 2014 REVIEW DATE MARCH 2014 1. PURPOSE, APPLICATION AND SCOPE This Management System

More information

Terms of Reference - Board Risk Committee

Terms of Reference - Board Risk Committee Terms of Reference - Board Risk Committee The Board Risk Committee is authorised by the Board to oversee the Group s risk management arrangements. It ensures that the overarching risk appetite is appropriate

More information

JOE MOROLONG LOCAL MUNICIPALITY IT GOVERNANCE FRAMEWORK

JOE MOROLONG LOCAL MUNICIPALITY IT GOVERNANCE FRAMEWORK JOE MOROLONG LOCAL MUNICIPALITY IT GOVERNANCE FRAMEWORK INDEX 1 Introduction... 2 Contextual background... 2.1 The CobiT 5 framework (2012)... 2.2 The ISO 27000 series (2005, 2011)... 2.3 The Risk IT

More information

Explanation where the company has partially applied or not applied King III principles

Explanation where the company has partially applied or not applied King III principles King Code of Corporate Governance for South Africa, 2009 (King III) checklist The Board of Directors (the Board) of Famous Brands Limited (Famous Brands or the company) is fully committed to business integrity,

More information

Information Security Policy version 2.0

Information Security Policy version 2.0 http://kfu.edu.sa KING FAISAL UNIVERSITY Information Security Policy version 2.0 Prepared & Presented by: M. Shahul Hameed, MBA, M.Sc.IT, C\MA, CIA, PMP, CGEIT, CISA, CISM, ITSM(ITIL), ISO27001LA, Head

More information

Brink's Modern. Internal Auditing. Eighth Edition. A Common Body of Knowledge ROBERT R. MOELLER WILEY

Brink's Modern. Internal Auditing. Eighth Edition. A Common Body of Knowledge ROBERT R. MOELLER WILEY Brink's Modern Internal Auditing Eighth Edition A Common Body of Knowledge ROBERT R. MOELLER WILEY Contents Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING Chapter 1: Significance of Internal

More information

Policy 10.105: Enterprise Risk Management Policy

Policy 10.105: Enterprise Risk Management Policy Name: Responsibility: Complements: Enterprise Risk Management Framework Coordinator, Enterprise Risk Management Policy 10.105: Enterprise Risk Management Policy Date: November 2006 Revision Date(s): January

More information

Analyzing Risks in Healthcare. February 12, 2014

Analyzing Risks in Healthcare. February 12, 2014 Analyzing s in Healthcare February 12, 2014 1 Content What is Enterprise Management (ERM) ERM Benefits ERM Standards / ISO 31000:2009 ERM Process Register ERM Governance Model s Q&A 2 What is Enterprise

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

Terms of Reference for an IT Audit of

Terms of Reference for an IT Audit of National Maritime Safety Authority (NMSA) TASK DESCRIPTION PROJECT/TASK TITLE: EXECUTING AGENT: IMPLEMENTING AGENT: PROJECT SPONSOR: PROJECT LOCATION: To engage a professional and qualified IT Auditor

More information

PART 6: SECTOR SUPPLEMENTS SUPPLEMENT FOR RETIREMENT FUNDS

PART 6: SECTOR SUPPLEMENTS SUPPLEMENT FOR RETIREMENT FUNDS 1. Retirement funds the macro view and benefits of corporate governance Retirement funds are an important component of the institutional investor industry which consists of retirement funds, insurance

More information

RISK MANAGEMENT POLICY

RISK MANAGEMENT POLICY RISK MANAGEMENT POLICY 1. Purpose The purpose of the Risk Management Policy is to embed risk management as part of the culture of AFTRS where a shared understanding of risk leads to well-informed decision

More information

Chayuth Singtongthumrongkul

Chayuth Singtongthumrongkul IT is complicated. IT Governance doesn t have to be. Chayuth Singtongthumrongkul CISSP, CISA, ITIL Intermediate, PMP, IRCA ISMS (ISO/IEC 27001) Director of International Academic Alliance, ACIS Professional

More information

Firewall Administration and Management

Firewall Administration and Management Firewall Administration and Management Preventing unauthorised access and costly breaches G-Cloud 5 Service Definition CONTENTS Overview of Service... 2 Protects Systems and data... 2 Optimise firewall

More information

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results Acquire or develop application systems software Controls provide reasonable assurance that application and system software is acquired or developed that effectively supports financial reporting requirements.

More information

APPENDIX 50. Enterprise risk management - Risk management overview

APPENDIX 50. Enterprise risk management - Risk management overview APPENDIX 50 Enterprise risk management - Risk management overview Energex regulatory proposal October 2014 ENTERPRISE RISK MANAGEMENT Risk Management Overview (RMO) 06 11 2013 Table of Contents 1. INTRODUCTION...

More information

RISK MANAGEMENT FRAMEWORK 2013-2014 OKHAHLAMBA LOCAL MUNICIPALITYITY

RISK MANAGEMENT FRAMEWORK 2013-2014 OKHAHLAMBA LOCAL MUNICIPALITYITY RISK MANAGEMENT FRAMEWORK 2013-2014 OKHAHLAMBA LOCAL MUNICIPALITYITY Page 1 CONTENTS 1. Foreword by the Mayor... 3 2. Background... 4 2.1 Introduction... 4 2.2 Overall purpose of the Enterprise Risk Management

More information

LOBLAW COMPANIES LIMITED MANDATE OF THE BOARD OF DIRECTORS

LOBLAW COMPANIES LIMITED MANDATE OF THE BOARD OF DIRECTORS LOBLAW COMPANIES LIMITED MANDATE OF THE BOARD OF DIRECTORS LOBLAW COMPANIES LIMITED MANDATE OF THE BOARD OF DIRECTORS 1. ROLE The role of the Board is to provide governance and stewardship to the Corporation.

More information

ICT OPERATING SYSTEM SECURITY CONTROLS POLICY

ICT OPERATING SYSTEM SECURITY CONTROLS POLICY ICT OPERATING SYSTEM SECURITY CONTROLS POLICY TABLE OF CONTENTS 1. INTRODUCTION... 3 2. LEGISLATIVE FRAMEWORK... 3 3. OBJECTIVE OF THE POLICY... 4 4. AIM OF THE POLICY... 4 5. SCOPE... 4 6. BREACH OF POLICY...

More information

Guidelines 1 on Information Technology Security

Guidelines 1 on Information Technology Security Guidelines 1 on Information Technology Security Introduction The State Bank of Pakistan recognizes that financial industry is built around the sanctity of the financial transactions. Owing to the critical

More information

Introduction to Enterprise Risk Management at UVM DRAFT

Introduction to Enterprise Risk Management at UVM DRAFT Introduction to Enterprise Management at UVM 1 Enterprise What is Enterprise Management? Enterprise risk management is a structured, consistent, and continuous process across the whole organization for

More information

Technology Risk Management

Technology Risk Management 1 Monetary Authority of Singapore Technology Risk Guidelines & Notices New Requirements for Financial Services Industry Mark Ames Director, Seminar Program ISACA Singapore 2 MAS Supervisory Framework Impact

More information

Mapping COBIT 5 with IT Governance, Risk and Compliance at Ecopetrol S.A. By Alberto León Lozano, CISA, CGEIT, CIA, CRMA

Mapping COBIT 5 with IT Governance, Risk and Compliance at Ecopetrol S.A. By Alberto León Lozano, CISA, CGEIT, CIA, CRMA Volume 3, July 2014 Come join the discussion! Alberto León Lozano will respond to questions in the discussion area of the COBIT 5 Use It Effectively topic beginning 21 July 2014. Mapping COBIT 5 with IT

More information

Implementing an Integrated City-wide Risk Management Framework

Implementing an Integrated City-wide Risk Management Framework AUDITOR GENERAL S REPORT ACTION REQUIRED Implementing an Integrated City-wide Risk Management Framework Date: June 11, 2015 To: From: Wards: Audit Committee Auditor General All Reference Number: SUMMARY

More information

WEST COAST DISTRICT MUNICIPALITY IT GOVERNANCE FRAMEWORK IT CHARTER

WEST COAST DISTRICT MUNICIPALITY IT GOVERNANCE FRAMEWORK IT CHARTER WEST COAST DISTRICT MUNICIPALITY IT GOVERNANCE FRAMEWORK IT CHARTER MAY 2012 INDEX 1 Introduction... 1 2 Contextual background... 3 2.1 The CobiT 5 framework (2012)... 4 2.2 The ISO 27000 series (2005,

More information

CORPORATE GOVERNANCE FRAMEWORK

CORPORATE GOVERNANCE FRAMEWORK CORPORATE GOVERNANCE FRAMEWORK TABLE OF CONTENTS 1 INTRODUCTION 3 2 PURPOSE 3 3 SCOPE 3 4 GOVERNANCE PRINCIPLES 3 4.1 THREE LINES OF DEFENCE 4 4.2 COMBINED ASSURANCE 4 4.3 FIT AND PROPER REQUIREMENTS FOR

More information

Val-EdTM. Valiant Technologies Education & Training Services. 2-day Workshop on Business Continuity & Disaster Recovery Planning

Val-EdTM. Valiant Technologies Education & Training Services. 2-day Workshop on Business Continuity & Disaster Recovery Planning Val-EdTM Valiant Technologies Education & Training Services 2-day Workshop on Business Continuity & Disaster Recovery Planning All Trademarks and Copyrights recognized Page 1 of 8 Welcome to Valiant Technologies.

More information

External Supplier Control Requirements

External Supplier Control Requirements External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must

More information

CISM Certified Information Security Manager

CISM Certified Information Security Manager CISM Certified Information Security Manager Firebrand Custom Designed Courseware Chapter 4 Information Security Incident Management Exam Relevance Ensure that the CISM candidate Establish an effective

More information

Corporate Governance Attestation Statement Health Support Services 2011-12

Corporate Governance Attestation Statement Health Support Services 2011-12 Corporate Governance Attestation Statement 2011-12 ESTABLISH ROBUST GOVERNANCE AND OVERSIGHT FRAMEWORKS Role and function of the Chief Executive The Chief Executive carries out that Offices functions,

More information

Overview TECHIS60851. Manage information security business resilience activities

Overview TECHIS60851. Manage information security business resilience activities Overview Information security business resilience encompasses business continuity and disaster recovery from information security threats. As well as addressing the consequences of a major security incident,

More information

Internal Controls over Financial Reporting. Integrating in Business Processes & Key Lessons learned

Internal Controls over Financial Reporting. Integrating in Business Processes & Key Lessons learned Internal Controls over Financial Reporting Integrating in Business Processes & Key Lessons learned Introduction Stephen McIntyre, CA, CPA (Illinois) Senior Manager at Ernst & Young in the Risk Advisory

More information

FINAL. Internal Audit Report. Data Centre Operations and Security

FINAL. Internal Audit Report. Data Centre Operations and Security FINAL Internal Audit Report Data Centre Operations and Security Document Details: Reference: Report nos from monitoring spreadsheet/2013.14 Senior Manager, Internal Audit & Assurance: ext. 6567 Engagement

More information

HSBC FINANCE CORPORATION CHARTER OF THE RISK COMMITTEE

HSBC FINANCE CORPORATION CHARTER OF THE RISK COMMITTEE HSBC FINANCE CORPORATION CHARTER OF THE RISK COMMITTEE I. Committee Purpose The Risk Committee is appointed by the Board of Directors of HSBC Finance Corporation (the Corporation ) and is responsible,

More information

CONFIGURATION COMMITTEE. Terms of Reference

CONFIGURATION COMMITTEE. Terms of Reference SWBTB (8/13) 166 (g) CONFIGURATION COMMITTEE Terms of Reference 1. CONSTITUTION 1.1 The Board hereby resolves to establish a Committee of the Board to be known as the Configuration Committee (The Committee).

More information

IS Audit and Assurance Guideline 2402 Follow-up Activities

IS Audit and Assurance Guideline 2402 Follow-up Activities IS Audit and Assurance Guideline 2402 Activities The specialised nature of information systems (IS) audit and assurance and the skills necessary to perform such engagements require standards that apply

More information

Business Continuity Planning

Business Continuity Planning Business Continuity Planning Public Entities Risk Management Forum 5 th July 2012 Presented by Mark Penberthy FBCI Overcoming Practical Challenges Business Continuity Management (BCM) AGENDA 1. What is

More information

IT Audit in the Cloud

IT Audit in the Cloud IT Audit in the Cloud Pavlina Ivanova, CISM ISACA-Sofia Chapter Content: o 1. Introduction o 2. Cloud Computing o 3. IT Audit in the Cloud o 4. Residual Risks o Used Resources o Questions 1. ISACA Trust

More information

The New International Standard on the Practice of Risk Management A Comparison of ISO 31000:2009 and the COSO ERM Framework

The New International Standard on the Practice of Risk Management A Comparison of ISO 31000:2009 and the COSO ERM Framework The New International Standard on the Practice of Risk Management A Comparison of ISO 31000:2009 and the COSO ERM Framework Dorothy Gjerdrum, ARM-P, Chair of the ISO 31000 US TAG and Executive Director,

More information

Introduction Auditing Internal Controls in an IT Environment SOx and the COSO Internal Controls Framework Roles and Responsibilities of IT Auditors

Introduction Auditing Internal Controls in an IT Environment SOx and the COSO Internal Controls Framework Roles and Responsibilities of IT Auditors Introduction Auditing Internal Controls in an IT Environment SOx and the COSO Internal Controls Framework Roles and Responsibilities of IT Auditors Importance of Effective Internal Controls and COSO COSO

More information

Effective Internal Audit in the Financial Services Sector

Effective Internal Audit in the Financial Services Sector Effective Internal Audit in the Financial Services Sector Recommendations from the Committee on Internal Audit Guidance for Financial Services: How They Relate to the Global Institute of Internal Auditors

More information

Risk Management Policy Adopted by:

Risk Management Policy Adopted by: Risk Management Policy Adopted by: Infigen Energy Limited Infigen Energy (Bermuda) Limited Infigen Energy RE Limited in its capacity as Responsible Entity of Infigen Energy Trust Adopted: 17 December 2009

More information

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA 1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

Web Version. Information Technology (IT) Security Management Practices

Web Version. Information Technology (IT) Security Management Practices Department of Innovation, Energy and Mines Treasury Board Secretariat Department of Finance Civil Service Commission 3 Information Technology (IT) Security Management Practices January 2013 55 55 Executive

More information

State of Oregon. State of Oregon 1

State of Oregon. State of Oregon 1 State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information

More information

Strategy, COBIT and Vision: HOW DO THEY RELATE? Ken Vander Wal, CISA, CPA, Past President, ISACA vandeke@gmail.com 11.16.2013

Strategy, COBIT and Vision: HOW DO THEY RELATE? Ken Vander Wal, CISA, CPA, Past President, ISACA vandeke@gmail.com 11.16.2013 Strategy, COBIT and Vision: HOW DO THEY RELATE? Ken Vander Wal, CISA, CPA, Past President, ISACA vandeke@gmail.com 11.16.2013 AGENDA IT s Changing Landscape ISACA s Response Vision and Mission COBIT 5

More information

Cybersecurity The role of Internal Audit

Cybersecurity The role of Internal Audit Cybersecurity The role of Internal Audit Cyber risk High on the agenda Audit committees and board members are seeing cybersecurity as a top risk, underscored by recent headlines and increased government

More information

Business Continuity Management

Business Continuity Management GENERALLY ACCESSIBLE Business Continuity Management Field Report from an Audit Point of View ISACA Swiss Chapter - After Hour Seminar 28 August 2006 - Urs Voigt - Group Internal Audit Disasters Happen

More information

CIO, CISO and Practitioner Guidance IT Security Governance

CIO, CISO and Practitioner Guidance IT Security Governance CIO, CISO and Practitioner Guidance IT Security Governance June 2006 (Revision 1, August 2007) 1 CIO, CISO and Practitioner Guidance Whatever your business, security and privacy are key matters that affect

More information

The Information Systems Audit

The Information Systems Audit November 25, 2009 e q 1 Institute of of Pakistan ICAP Auditorium, Karachi Sajid H. Khan Executive Director Technology and Security Risk Services e q 2 IS Environment Back Office Batch Apps MIS Online Integrated

More information

Business Continuity Planning and Disaster Recovery Planning

Business Continuity Planning and Disaster Recovery Planning 4 Business Continuity Planning and Disaster Recovery Planning Basic Concepts 1. Business Continuity Management: Business Continuity means maintaining the uninterrupted availability of all key business

More information