Day 1-Pres 1-Introduction to IT Supervision-TyrellPPT演示课件

ANINTRODUCTIONTOINFORMATIONTECHNOLOGY(IT)SUPERVISION,KirkTyrell,CISAAssistantDirectorFinancialInstitutionsSupervisoryDivisionBankofJ.jm,CARTAC&CaribbeanGroupofBankingSupervisorsITWorkshopforRegionalBankExaminersJune2325,2009Georgetown,Guyana,1,WhatisITSupervision?,ahighlevelexaminationthatencompassesreviewandevaluation(whollyorin-part)ofautomatedinformationprocessingsystems,relatednon-automatedprocessesandtheinterfacesbetweenthem,2,WhatisITSupervision?(contd),DOESIncreaseprobabilityofdetectingpotentiallyseriousissuesReducesprobabilityofoccurrenceoffraud,breaches,etc.,DOESNOTGuaranteefulldetectionPreventfraud,breaches,etc.fromoccurring,Whatis.“isanafter-the-fact,detailedreviewofasystemand,intheworldofinformationsecurityisconsideredalineofdefense.”(ISACA),3,Classifications,InformationSystemsauditCollectandevaluateevidence,assesses/effectiveness/adequacyofcontrolsofISresources,etc,detect,correctandpreventundesirableeventsSpecializedauditsExamines3rdpartyrelationship,forensicaudits,etc.ForensicauditsAuditspecializedindiscovering,disclosingandfollowinguponfraudsandcrimes,4,ITSupervisionvs.ISAuditing,ReportingrelationshipScopeandfrequencyofreviewsMandate,5,ITSupervisionvs.ISAuditing,Reportingrelationship:ITSupervisionreportsareroutedtotheChiefSupervisorofBanksand/orsupervisorycouncilISauditreportsaremadetotheboardofdirectors,auditcommitteeorthepublicScopeandfrequencyofreviewsMandate,6,ITSupervisionvs.ISAuditing,ReportingrelationshipScopeandfrequencyofreviews:ITSupervisionscopeislimitedtohighlevelexaminationofcontrolsthatgovernthedevelopment,operation,maintenance,andsecurityofITsystems.Reviewsarenormallyscheduledatleastonceayear,exceptifatargetreviewisrequiredISAuditingscopeincludesamoredetailedreviewofcontrolsthatevaluateITfunctionsandsystembasedonsecurity,quality,fiduciary,servicesandcapacity.Thesereviewsarenormallyongoing/continuousoveranagreedauditcycleMandate,7,ITSupervisionvs.ISAuditing,ReportingrelationshipScopeandfrequencyofreviewsMandate:ITSupervisionisprimarilyconcernedwithensuringthatfinancialinstitutionsoperateinasafeandsoundmannerinordertoprotectdepositorsinterestandtheintegrityofthefinancialsystemISauditingisdesignedtomeetthesafeguardingneedsofshareholdersandotherstakeholders.,8,WhyisITSupervisionNecessary?,GrowingimportanceofITtofinancialinstitutionGrowthofoperationalriskIncreasedfocusfromtheinternationalregulatorycommunity,9,WhyisITImportanttoFIs?,RegulatorypressurestoimproveriskmanagementandcomplianceStrategictechnologyinvestmentforsurvivalandgrowthRelentlessglobalizationShiftsincustomerdemographicsIncreasedcompetition,10,ITSpendingWithinBanks,Source:ITSpendinginFinancialServices:AGlobalPerspectiveReportPublishedbyCelentJanuary2009,11,GrowthinOperationalRisk,12,ITSupervisionvs.BankingSupervision,SupplementstheworkoffinancialorsafetyandsoundnessexaminationsProvidesforanoverallriskassessmentofthefinancialinstitutionCrossoverofITriskintothetraditionalrisksareas,Financials,13,ChallengesImpactingITSupervision,RapidtechnologyinnovationAuditfatigueSkill,competenceandavailabilityofITsupervisorsChangingscopeofexaminationsNeedtosatisfymultiplestakeholdersLackofstandardizedcertificationprocessforITsupervision,14,ChallengesImpactingITSupervision,SiloedviewofcomplianceExistenceofBarrierstocomplianceCollectingaccurate,timelydata/evidenceisaprotractedmanualprocessProprietaryinterfacespreventdataintegration,evenwhereautomationofITsupervisorytoolsexists,15,SpecializedskillsforITSupervisors,16,StandardsandStandards-SettingBodies,VendororJurisdictionSpecific,IFAC,17,ObjectivesofITSupervision,ToassessafinancialinstitutionsITmanagementandoperationToensureaccuracyandreliabilityofinformationsystemITalignmentwiththefinancialinstitutionsbusinessUltimateobjectivesensurethesafetyandsoundness,18,MainAreasofInterest,InternalControlEnvironmental,BusinessandTransactionalProcesses,ApplicationSystems,TechnologyInfrastructure,AreSupportedby,ArePoweredby,ProcessControls,ApplicationControls,ITGeneralControls,EffectivenessEfficiencyConfidentialityIntegrityAvailabilityComplianceReliability,EntryLevelControls,19,ARisk-BasedApproach,20,Risk-BasedApproach-GatherInformationandPlan,KnowledgeofthefinancialinstitutionandindustryPrioryearsexaminationresult(i.e.ITandnon-ITreports)Regulatorystatutes,standards,industryrequirements,etc.Inherentriskassessments,21,Risk-BasedApproach-GatherInformationandPlan,ScopingWhattoinclude:InformationanditsflowITarchitectureApplicationsanddatabases(e.g.OS,API,DBOracle,Sybase,etc.),22,ARisk-BasedApproachtoITSupervision,Starthere,23,Risk-BasedApproach-UnderstandingofInternalControl,ControlenvironmentControlproceduresDetectionriskassessmentControlriskassessmentEquatetotalrisk,24,ARisk-BasedApproachtoITSupervision,Starthere,25,Risk-BasedApproach-PerformComplianceTests,TestpoliciesandproceduresOthersubstantiveauditprocedures,26,ARisk-BasedApproachtoITSupervision,Starthere,27,Risk-BasedApproach-PerformSubstantiveTests,AnalyticalproceduresDetailedtestsofaccountbalanceOthersubstantiveexaminationprocedures,28,ARisk-BasedApproachtoITSupervision,Starthere,29,Risk-BasedApproach-ConcludeExamination,PresentfindingstoinstitutionsmanagementCreaterecommendationsandcourseofactionWriteauditreport,30,ARisk-BasedApproachtoITSupervision,S