Conducting IT Audits in Public Institutions

Transcription

1 European Seminar for Internal and External Auditors 27 th 28 th May 2013, Berlin With Experts from: Performance Audit Department, National Audit Office, Sweden Brochure Central Audit Service, Ministry of Finance, the Netherlands Cass Business School, City University London, United Kingdom 1

2 European Seminar for Internal and External Auditors IT Audits play a crucial role in ensuring that IT systems are secure and effective Information Technology (IT) has become an integral component within public administration. Due to its importance in many administrative procedures nowadays, IT infrastructure and its application have to become part of audits as well. Audit activities must assess whether an organisation s governance of Information Technology supports its strategies and objectives. Therefore, it is essential that auditors have specific knowledge about key information technology risks and controls as well as available IT audit techniques to perform their assigned work. IT topics need to be integrated in the regular audit process or combined audits have to be conducted. However, as Information Technology auditing is not their primary responsibility, most auditors lack thorough expertise in this field. Many non-it auditors are not aware of the risks related to Information Technology and ignore IT elements in their audits. However, as a professional auditor, you need to acquire knowledge about IT risks to be able to integrate IT topics into your audit strategy. This task becomes especially challenging when an outsourced IT environment needs to be audited. Furthermore, both internal and external auditors are increasingly asked to act as constructive partner of top management raising constructive criticism and ensuring increased IT security and effectiveness. Who is this seminar for? This seminar will provide comprehensive training for all: internal auditors external auditors controllers evaluation officers audit methodologists audit statisticians financial managers quality managers and other professionals from public administrations on European, national and regional level as well as international organisations that already integrated or plan to integrate IT topics in their audits The seminar might be also interesting for private audit companies working with and for the public sector Find out at our European Seminar how you can help your public institution improve its use of IT systems by conducting solid IT audits. 2

3 What will you learn at this seminar? Why IT auditing is so important in public administrations nowadays How to identify IT topics for the auditing process What are typical sources of failure for IT projects What are the latest IT trends in public administration and how auditors can react to them How to develop and manage IT topics for your audit strategy How to audit security and business continuance management What kinds of IT risks exist and how to deal with them How to use IT as an instrument for (IT) audits What the connection between IT and fraud is How to audit an outsourced IT environment Your benefits Familiarise yourself with all IT aspects being especially relevant for your audit work Receive extensive and practical knowledge on how to assess IT procedures in your institution Learn how to integrate IT topics in your audit Learn how IT risks can be threats to your overall institution s processes, performance and functioning Boost your knowledge on IT audit risk analysis and improve your auditing strategy Benefit from various case studies and become acquainted with practical IT audit challenges Exchange experiences with excellent experts and attendees from all over Europe 3

4 PROGRAMME DAY Registration and Handout of Seminar Material Opening Remarks from the European Academy for Taxes, Economics & Law Welcome Note from the Chair and Introduction Round Jo Kremers, Senior Audit Manager, Central Audit Service, Ministry of Finance, the Netherlands Auditing the Use of IT in Public Administration How to Promote IT Efficiency Using Different Audit Perspectives The role of the audit organisation in promoting IT efficiency in public administration How can IT audits assist government and agency top management in managing IT better? Different IT Audit perspectives: - Value for Money of the use of IT (results and effectiveness) - Governance of the use if IT (goals, strategies, action programmes) - Performance of IT activities (IT systems, maintenance, IT projects, sourcing) - Support organisation to the use of IT (knowledge, methods) - Legislation dictating conditions for the use of IT Bengt E W Andersson, Audit Director, Performance Audit Department, National Audit Office, Sweden Coffee Break and Networking Opportunity Assessing IT Risks What are IT risks and how to increase awareness for them? Without IT audit: What areas and risks may not be covered? IT related risks in general IT control environment - IT infrastructure Hardware & software - IT Service Management - Cloud Computing IT related risks in application controls environment - Data processing cycle - Data reliability Andrew Robertson, FIIA - Faculty of Management, Cass Business School, City University London, United Kingdom BENGT E W ANDERSSON Audit Director, Performance Audit Department, National Audit Office, Sweden Bengt E W Andersson is Audit Director at the Swedish National Audit Office s Performance Audit Department. He has been working as a Performance IT Auditor at the Swedish National Audit Office since Since 1994, Bengt Andersson has been a member of the INTOSAI Working Group on IT Audit. His recent audit projects include The State Governance of the Telecom Market, IT Support in the Judicial Chain, Why IT Projects Fail, IT Based Information Exchange Projects with several agencies involved, and The Governance of Information and IT Security in Public Administration. Additionally, Bengt E W Andersson is a researcher in the area of IT-based information exchange between agencies in public administration. ANDREW ROBERTSON FIIA - Faculty of Management, Cass Business School, City University London, United Kingdom Andrew Robertson was until recently managing and delivering modules on audit and risk related topics to MSc students at Cass Business School. He has 35 years experience in auditing and risk management, covering manufacturing, retail, financial services and the not for profit sectors. He has been Head of Audit in several blue chip organisations, and Head of Risk in two organisations. During this time, he has been instrumental in both uncovering and resolving many organisational problems. Andrew Robertson delivers lectures and workshops in risk and audit related areas, particularly in fraud detection and prevention as well as the establishment of risk management systems. He has worked extensively in developing and transition, including China, Hungary, Poland, Romania, Slovakia and South Africa. His most recent assignments have been on behalf of the Commonwealth Secretariat to Trinidad, Barbados and Mauritius, and with the World Bank in Ghana. His work has taken him to 60 countries Lunch Break and Networking Opportunity 4

5 IT Trends in Public Administration Changes, risks and disadvantages for the public sector: Cases and examples How to explain these changes, risks and disadvantages to top management: Case studies Role of IT Auditor as partner of management in public institutions Added value of the internal (IT) auditor for IT risk management, IT control and IT governance Consequences for IT audit: Case studies Jo Kremers, Senior Audit Manager, Central Audit Service, Ministry of Finance, the Netherlands Coffee Break and Networking Opportunity With Case Studies JO KREMERS Senior Audit Manager, Central Audit Service, Ministry of Finance, the Netherlands Jo Kremers is Senior Audit Manager at the Central Audit Service of the Ministry of Finance in the Netherlands. He is a certified Public Auditor as well as certified IT Auditor. For the past 30 years, he has been working in the Dutch Tax and Customs Administration as Auditor, Fiscal Fraud Investigator and Internal Auditor. Furthermore, he has gained vast experience as project leader and expert in Information Security Audits and Integrity Audits. He is a lecturer, trainer and expert at The National Academy for Finance and Economics in The Hague. Working as an expert in international projects, he has gained notable experience in strengthening the internal control and audit function in the public sector in (candidate) EU Member States. Workshop Why IT Projects Fail Part 1: Presentation IT Project Failure is still a big problem too costly, too long time, too little results Most common sources of IT projects failure Approaches in auditing IT projects Auditing the management of IT projects risks The use of questionnaires, interviews and case studies Some conclusions on performing IT project audits Part 2: Group Work Identify sources of problems leading to IT project failures Part 3: Presentation of Group Results Bengt E W Andersson, Audit Director, Performance Audit Department, National Audit Office, Sweden End of Day One 5

6 PROGRAMME DAY Welcome Note from the Chair Jo Kremers, Senior Audit Manager, Central Audit Services, Ministry of Finance, the Netherlands With Case Studies IT as Instrument to Perform (IT) Audits IT as an audit tool for different kind of audits and as control instrument for management The use of IT for dual purpose tests The use of IT for CM and RTA The use of IT to detect trends and probable (new) fraud red flags Jo Kremers, Senior Audit Manager, Central Audit Service, Ministry of Finance, the Netherlands How to Audit Outsourced IT Environments? What are the challenges when auditing outsourced IT environments? How to include outsourced IT environments in your audit? Andrew Robertson, FIIA - Faculty of Management, Cass Business School, City University London, United Kingdom End of Seminar and Hand-out of Certificates Coffee Break and Networking Opportunity Information Systems and Fraud/Improper Use Importance of proper investment in information security in the public sector The role of the internal (IT) auditor Use of ISO standards for control frames and the IT audit Jo Kremers, Senior Audit Manager, Central Audit Service, Ministry of Finance, the Netherlands Auditing Security and Business Continuance Management Information security governance Administration of user access, passwords Access security controls Remote access and third parties User awareness How to deal with an IT system crash? What to do and how to continue? Andrew Robertson, FIIA - Faculty of Management, Cass Business School, City University London, United Kingdom Lunch Break and Networking Opportunity 6

7 ORGANISATIONAL MATTERS Date of Event 27 th - 28 th May 2013 Booking Number S-548 Event Language The event language will be English. Event Price 1.389,- Euro, excl. German VAT (19%) The above price covers the following: Admission to the seminar Hand-out documents in print and digital version Seminar certificate, if seminar fully attended Soft drinks and coffee/tea on both event days Lunch on both event days Booking Modalities It is recommended to book soon as seats are limited. For organisational matters, we kindly ask you to complete the booking form in capital letters. BOOKING Fax: +49 (0) booking@euroacad.eu Phone: +49 (0) For online booking please visit our website: Contact European Academy for Taxes, Economics & Law Hausvogteiplatz 13, Berlin, Germany Phone: +49 (0) Fax: +49 (0) info@euroacad.eu Internet: Your contact persons for the programme: Regina Lüning, M. Sc. econ. Head of Marketing and Sales Phone: +49 (0) Fax: +49 (0) regina.luening@euroacad.eu Peter Gassenmaier Conference Manager Phone: +49 (0) Fax: +49 (0) peter.gassenmaier@euroacad.eu (Programme is subject to alterations) Event Location Maritim Hotel Berlin Stauffenbergstraße Berlin, Germany Phone: +49 (0) Fax: +49 (0) info.ber@maritim.de Internet: Please contact the hotel directly and refer to the European Academy for Taxes, Economics & Law if you wish to benefit from a limited room availability-contingent. Of course you can always look for an alternative hotel accommodation. 7

8 NOTE Please note, you can register as many delegates as you wish (except, the seminar is fully booked). You only need to copy this formular for as many persons you wish. European Academy for Taxes, Economics & Law Brauner Klingenberg GmbH Hausvogteiplatz Berlin / Germany Phone.: +49 (0) Fax: +49 (0) info@euroacad.eu BOOKING BOOKING NUMBER: S-548 (PR) 27 th 28 th MAY 2013, BERLIN Herewith we register the following persons for the Seminar: Delegate 1 Ms. Mr. First name Last name Department Job position Your organisation Street Postcode / City Country Phone Fax Delegate 2 Ms. Mr. First name Last name Department Job position Your organisation Street Postcode / City Country Delegate 3 Ms. Mr. First name Last name Department Job position Your organisation Street Postcode / City Country Phone Fax Phone Fax Invoice organisation To the attention of Street Postcode / City Country Phone Fax In case of registration of more than one delegate - do you prefer: single invoice? collective invoice? With my signature I confirm my registration and accept the General Terms and Conditions as legally binding. I herewith agree to receive further information from the European Academy for Taxes, Economics & Law NOTE Only Valid with Signature and Stamp. 8 Place, Date Authorised Signature and Stamp

9 Terms & Conditions for Conferences, Seminars and other Training Courses 1. Area of Application The following terms and conditions settle the contractual relationship between conference participants and the European Academy for Taxes, Economics & Law Brauner Klingenberg GmbH [referred to as European Academy for Taxes, Economics & Law in the following]. Differing terms and conditions, as well as, other settlements and/or regulations have no validity. 2. Registration / Confirmation of Application A registration can be made via internet, mail, fax, or . The registration is considered granted and legally binding if not rejected by the European Academy for Taxes, Economics & Law in writing within seven (7) days after receipt of registration. The registration will be supplemented by a booking confirmation via . Partial bookings are only valid for seminars designed in modules. 3. Service The course fee covers the fee per participant and course in net, subject to current German VAT. It includes training course documents as per course description, a lunch meal/ snack and refreshments during breaks, as well as, a participation certificate. The European Academy for Taxes, Economics & Law has the right to change speakers/instructors and to modify the course program if and where necessary while maintaining the overall nature of the course. All registered participants will be notified in case of a course cancellation due to force majeure, due to speakers preventions, due to troubles at the chosen location or due to a low registration rate. Course cancellation notification due to a low registration rate is issued no later than two (2) weeks before the course date. Course fees are reimbursed in the cases listed above; however, reimbursement for travel expenses or work absenteeism is only granted in cases of intention or gross negligence by the European Academy for Taxes, Economics & Law. Any reimbursement of travel expenses are to be considered as an exceptional goodwill gesture and form no future general obligation. In case of disturbances and/or interruptions, the European Academy for Taxes, Economics & Law commits itself to solve or limit any problems that might occur in order to maintain and continue the course as planned. 4. Payment Date and Payment, Default of Payment Payment of the course fee is payable immediately upon receipt of invoice. Where payment is not received or lacking clear assignment to a participant prior to commencement of the course, the European Academy for Taxes, Economics & Law may refuse the relevant participant s participation in that course. The course fee, however, is still due immediately and can be claimed as part of a dunning procedure or legal action. In accordance with BGB 247 (1), in case of default of payment within the stipulated time period, default interest on arrears of at least 5% above the ECB base rate is due and payable. The European Academy for Taxes, Economics & Law can claim higher damage for delay if and where proven. Equally, the participant may prove that a damage has not occurred or has had less effect than estimated by the European Academy for Taxes, Economics & Law. Payment shall be made by cashless bank transfer; cash or cheques will not be accepted. The European Academy for Taxes, Economics & Law is not liable for any loss of means of payment. The participant may only offset such claims against the European Academy for Taxes, Economics & Law s as are undisputed, legally recognized or recognized in writing by the European Academy for Taxes, Economics & Law. The right of retention is only acceptable in accordance with a counterclaim based on the same contract. 5. Cancellation Cancellations need to be issued in writing. Cancellation by the participant will be subject to cancellation charges as follows: 30 days or more prior to commencement of the course: service charge of 80,00 net, subject to current German VAT, payable immediately, course fee will be reimbursed, two (2) weeks to 30 days prior to commencement of the course: 50% of course fee net, subject to current German VAT, payable immediately, non-attendance or cancellation less than two (2) weeks prior to commencement of the course: 100% of course fee net, subject to current Germany VAT, payable immediately The European Academy for Taxes, Economics & Law gladly accepts without additional costs a substitute participant nominated in case of a cancellation if the substitute participant is registered at least three (3) days prior to the commencement of the course. Neither cancellation of a specific module/part of the course or substitution per module/per day is possible. 6. Copyright Seminar/course documents are protected by property rights and may not be duplicated, processed, amended, circulated or published in any other way without the written consent of the European Academy for Taxes, Economics & Law. The European Academy for Taxes, Economics & Law reserves all rights. 7. Liability All seminars and courses are prepared and presented by qualified speakers and instructors. The European Academy for Taxes, Economics & Law accepts no liability for the upto-dateness, correctness and completeness of the seminar documentation, as well as, presentation of the seminar. 8. Applicable Law, Place of Jurisdiction, Place of Performance All cases shall be governed and construed in accordance with German law to the exclusion of the UN Sales Convention. As far as legally admissible, place of performance and place of exclusive jurisdiction shall be Berlin, Germany. 9. Data Protection The European Academy for Taxes, Economics & Law protects personal data by taking appropriate protection measures. For the purpose of optimization of the product and service portfolio and according to the regulations of the data privacy laws, it stores and processes person-specific data on the training participants. Hence, all European Academy for Taxes, Economics & Law website hits are registered. All personal data will, in accordance with the law, be used for documentation requests, placed orders or other enquiries in order to send information out by post. The European Academy for Taxes, Economics & Law will, in accordance with the law, inform participants by about special offers that resemble previously booked seminars. If and where personal data needs to be transferred to countries lacking appropriate data protection schemes, the European Academy for Taxes, Economics & Law shall grant alternative adequate protection. Furthermore, the European Academy for Taxes, Economics & Law will use personal data as far as participants have granted respective permission. When collecting personal data, the European Academy for Taxes, Economics & Law will always ask for permission regarding information about offers. The participant may, at any time, express their objection to data collection for the purpose of advertisement or address via or fax. Any data provided to the European Academy for Taxes, Economics & Law will be processed for reservations and bookings, as well as, for information about other seminars. Names and company names will be published in a participants list and forwarded to the mailing company. 9