国外简约大气的ppt课件

1、1The Importance of IT Controls to Sarbanes-Oxley Compliance. 2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 2 Provide a high-level overview of Sarbanes-Oxley and the internal control certification requirements Discuss the importance of information technology in internal contro

2、l over financial reporting Describe how the Sarbanes-Oxley section 404 rules impact information technology Provide an overview of the Cobit IT control framework Provide an example of a readiness program roadmap Summarize the importance and impact of IT controls to Sarbanes-Oxley complianceTodays Obj

3、ectives 2003 Firm Name/Legal EntityImportance of IT Controls to Sarbanes-Oxley 3Setting the Stage2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 4Setting the Stage What is internal control?Internal control is broadly defined as a process, effected by an entitys board of directo

4、rs, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reportingCompliance with applicable laws and regulations Internal control is now the L

5、awThe Sarbanes-Oxley Act of 2002 was created to restore investor confidence in the public marketsSection 404 of the Act requires management to establish and maintain internal control and requires the independent auditors to evaluateCompliance deadline: Year-ends on or after November 15, 2004 Prepari

6、ng for Sarbanes-Oxley compliance is a significant and challenging taskThere are many requirements, including the identification of significant financial statement accounts, processes and systems that support them and then documenting and testing them 2004 Deloitte & Touche LLPImportance of IT Contro

7、ls to Sarbanes-Oxley 5Overview of Internal Control Certification RequirementsSection 302 Certification OverviewCEO and CFO to make specific certifications as of the end of each quarterly and annual reporting period, including:Report contains no untrue statements Report is fairly presented in all mat

8、erial respectsResponsibility for design and maintenance of disclosure controls and procedures as well as internal controls over financial reporting Became effective in 2002 (amended in June 2003)Section 404 Certification OverviewCEO and CFO to certify as of the end of every annual reporting period:T

9、heir responsibility for establishing and maintaining effective internal controls over financial reportingTheir assessment of internal controls, accompanied by the independent auditors attestation report Effective for annual periods ending after November 15, 2004 (small business and foreign filers Ju

10、ly15, 2005).2003 Firm Name/Legal EntityImportance of IT Controls to Sarbanes-Oxley 6Understanding the Rules Impact to IT2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 7Understanding the Rules Impact to IT Management is required to assess the design and effectiveness of its int

11、ernal control over financial reporting and provide an assertion to that effect in the published financial statements. The companys external auditors are required to express an opinion on managements assessment as well their own opinion on the companys internal controls. Auditor must perform a walkth

12、rough of major classes of transactions for significant processes to understand process flows, and assess the design and effectiveness of controls including application and IT general controls. Evaluate the design effectiveness of IT controls to determine whether they are properly designed to achieve

13、 relevant assertions. Perform tests of the operating effectiveness of IT controls that are necessary to achieve relevant assertions.Key Compliance RequirementsImpact to IT Controls2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 8(paragraph 47)“The auditor should obtain an under

14、standing of the design of specific controls by applying procedures that include tracing transactions through the information system relevant to financial reporting”(paragraph 73)“Most processes involve a series of tasks such as capturing input data, sorting and merging data, making calculations, upd

15、ating transactions and master files, generating transactions, and summarizing and displaying or reporting data. The processing procedures relevant for the auditor to understand the flow of transactions generally are those activities required to initiate, authorize, record, process and report transac

16、tions.” The PCAOB rules are clear - auditors must understand how transactions flow through the system not around itUnderstanding the Rules Impact to IT contd2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 9(paragraph 69)“The auditor should identify each significant process over

17、 each major class of transactions affecting significant accounts or groups of accounts and Understand the flow of transactions, including how transactions are initiated, authorized, recorded, processed, and reported. Identify the points within the process at which a misstatement including a misstate

18、ment due to fraud related to each relevant financial statement assertion could arise. Identify the controls that management has implemented to address these potential misstatements. Identify the controls that management has implemented over the prevention or timely detection of unauthorized acquisit

19、ion, use, or disposition of the companys assets. PCAOB statements applicable to Application Controls:Understanding the Rules Impact to IT contd2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 10(paragraph 40)“Determining which controls should be tested Generally, such controls i

20、nclude information technology general controls, on which other controls are dependent”(paragraph 50)“Some controls have a pervasive effect on the achievement of many objectives for example, information technology general controls over program development, program changes, computer operations, and ac

21、cess to programs and data” PCAOB statements applicable to IT General Controls:Understanding the Rules Impact to IT contd2003 Firm Name/Legal EntityImportance of IT Controls to Sarbanes-Oxley 11The Importance of Information Technology in Internal Control over Financial Reporting 2004 Deloitte & Touch

22、e LLPImportance of IT Controls to Sarbanes-Oxley 12 For most organizations, IT is pervasive and critical to the financial reporting process Financial and routine business applications are commonly used to initiate, authorize, record, process and report transactions Relevant IT controls includeapplic

23、ation controls - those that are embedded in financial and business applicationsgeneral computer controls underlying infrastructure components that support the applications Statements made by the Public Company Accounting and Oversight Board (PCAOB) on the impact of IT (paragraph 75):“The nature and

24、characteristics of a companys use of information technology in its information system affect the companys internal control over financial reporting”The Importance of Information Technology (IT) in Internal Control over Financial Reporting2004 Deloitte & Touche LLPImportance of IT Controls to Sarbane

25、s-Oxley 13Application Controls SoDData integrityCompletenessValidationGeneral Computing ControlsInformation SecurityOperationsDatabase Impl. & SupportNetwork SupportBusiness ProcessClasses of Transactions SalesReturnsWrite offsSignificant Account Balance Balance Sheet (AR)IncomeStatementG/LInventory

26、OtherAR Mgt ProcessFCRPSales ProcessProcess StagesInitiateRecordProcessReport Application Impl. & Maint.System Software SupportThe Role of Information Technology in Internal Control over Financial Reporting contd2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 14 Account balance

27、: Trade AR, Sales Classes of Transactions:Invoices, Sales orders Business Process:AR, Sales Order processes Process Stages:Initiate, record, process Application Controls:Access controlsBuilt in limits for credit approvalRestricted access to pricing table GCC Controls:Program change Operations Networ

28、k & system securityLink Accounts and Assertions to IT: An Example Customerorder entry Accounts Receivable Invoice controls SAP, Oracle, Other ApplicationsGeneral computing controls cover security access, change management, operations, systems and network support, data retention, etc.Order Processing

29、Order & supplier controlsSalesSub-processCustomer controlsIT InfrastructureNetworksSystem SoftwareDatabases and InformationSecurityApplication controls cover authorized changes, segregation of duties, validity, completeness and timeliness of reporting of financial information.2003 Firm Name/Legal En

30、tityImportance of IT Controls to Sarbanes-Oxley 15Cobit IT Control Framework Overview2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 16COBIT A Model for General Computer Controls The IT Governance Institute () has recently published “revised” guidance for IT professionals on ho

31、w to address Sarbanes-Oxley from an IT perspective April 2004 “Sarbanes-Oxley; The importance of information technology in the design, implementation and sustainability of internal control” The publication is the result of a joint effort of industry and auditors, with leadership from Deloitte and ot

32、hers The ITGI is a recognized global leader in IT governance, control and assurance with members in more than 100 countries2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 17 PCAOB designates COSO as the prescribed standard control framework and has become the control framework

33、of choice for SOX complianceAll 5 layers must be considered when evaluating internal control However, COSO does not provide specific guidance around IT control. CobiT is a widely accepted IT control framework (ITGI)CobiT provides 4 domains of IT controlCobiT controls address the 5 layers of COSO Wit

34、h the development of this approach, organizations can be confident that they are taking an approach that reflects COSO requirementsControl EnvironmentRisk AssessmentControl ActivitiesInformation and CommunicationMonitoringCOSO ComponentsCobiT ObjectivesPlanning and OrganizationPlanning and Organizat

35、ionSection 302Section 302Delivery and SupportDelivery and SupportMonitoringMonitoringAcquisition and ImplementationAcquisition and ImplementationSection 404Section 404Information Technology controls should consider the overall governance framework to support the quality and integrity of informationC

36、ompetency in all 5 layers of COSOs framework are necessary to achieve an integrated control programControls in Information Technology are relevant to both Financial Reporting and Disclosure requirements of Sarbanes-OxleyCOBIT A Model for General Computer Controls contd2004 Deloitte & Touche LLPImpor

37、tance of IT Controls to Sarbanes-Oxley 18 The ITGI publication provides guidance to IT professionals on how to meet the Sarbanes-Oxley challenge Detailed control objectives are provided for each CobiT domain and mapped to their respective COSO component Other control guidelines were reviewed and rec

38、onciled to this approach during the development process, including ISO17799, Common Criteria, ITIL, and SysTrust Organizations should assess their requirements on an individual basis and tailor their approach accordingly COSO Component CobiT Control Objectives Control Environment Risk Assessment Con

39、trol Activities Information & Communication Monitoring Planning & Organization Define a strategic IT plan Define the information architecture Determine technological direction Define the IT organization and relationships Manage the IT investment Communicate management aims and direction Manage human

40、 resources Ensure compliance with external requirements Assess risks Manage projects Manage quality Acquisition & Implementation Identify automated solutions Acquire and maintain application software Acquire and maintain technology infrastructure Develop and maintain procedures Install and accredit

41、systems Manage changes Delivery & Support Define and manage service levels Manage third-party services Manage performance and capacity Ensure continuous service Ensure systems security Identify and allocate costs Educate and train users Assist and advise customers Manage the configuration Manage pro

42、blems and incidents Manage data Manage facilities Manage operations Monitoring Monitor the processes Assess internal control adequacy Obtain independent assurance Provide for independent audit COSO ComponentsCobiT ObjectivesCOBIT A Model for General Computer Controls contd2004 Deloitte & Touche LLPI

43、mportance of IT Controls to Sarbanes-Oxley 19 The CobiT SOA framework identified a sub-set of these areas for the purpose of focusing on SOA requirementsCompany level: Planning & Organizing / Monitoring COBIT A Model for General Computer Controls contdPlanning & OrganizationIT Strategic PlanningIT o

44、rganization and relationshipsManagement of human resourcesEducate and train usersInformation architectureCommunication of mgmt aims and directionAssessment of risksManage the IT investmentManage projectsMonitoringCompliance with external requirementsManagement of qualityEnsure continuous servicePerf

45、ormance and capacityMonitoringAdequacy of internal controlsIndependent assuranceInternal auditActivity level: Acquisition and Implementation / Delivery and SupportProgram Development (SDLC)Program ChangesComputer Operations (scheduling, backup, problem management)Access to programs and data (applica

46、tions, database, operating system, network)2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 20Top 5 List 404 IT Controls Requirements SecurityApplication and platform basedFocused on applications that may impact financials and supporting infrastructure Requires secure operating

47、systems, database, network, firewalls and infrastructureAuditors will look for excessive access; lack of segregation of duties; inadequate approval of access; they will be testing key processes to determine that they are effective Change ControlNeed to ensure that procedures are in place to control

48、and ensure proper approval of changes to productionTechnical controls must tightly limit and control developer access to production Disaster RecoveryFocus will be on basic backup and recoverability of financial data IT GovernanceFocus will be on determining of there are clear policies, procedures, a

49、nd communications within ITAre there clear segregation of duties? Is there the appropriate “tone at the top” of the IT organization? Development And Implementation ActivitiesProper controls need to be built in before a new system or system changes go in the production environmentAuditors may evaluat

50、e new financial systems; data conversion and testing are critical2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 21Most Common IT Control Gaps To Remediate Change control processes not fully in place (especially in distributed or web based environments) Security procedures, str

51、ategies, and pro not documented for critical applications. Organizational security policies, procedures, and roles and responsibility gaps. Security administration procedures lack appropriate controls or consistencyInadequate controls to delete or change access when individual leaves of changes job

52、responsibilities (especially contractors) Inadequate approval of access changesAccess levels not regularly reviewed and approved by management Excessive access to systemsPrivileged access to operating system, database, and application environmentInadequate segregation of dutiesApplication developers

53、 and DBAs have access to production Infrastructure supporting applications is not secure (network, operating system, database) IT controls not integrated into key business processes (e.g. SDLC, change control, compliance, testing and data conversion procedures) Lack of a regular process to verify th

54、at controls continue to be adequate and effective (at least quarterly) No long term strategy to evaluate and address risksThe areas that will get hit hardest are security and change control2003 Firm Name/Legal EntityImportance of IT Controls to Sarbanes-Oxley 22IT Control Readiness Roadmap2004 Deloi

55、tte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 23SOA Readiness Roadmap Preparing for SOX 404 requires a structured and measured approach, otherwise you will find yourself doing “too much” or “too little” The current PCAOB rules require auditors to attest on “management assessment proces

56、s” As such, the readiness roadmap that many organizations are following demonstrates the assessment process through a series of steps and activities that align to the PCAOB rules2004 Deloitte & Touche LLPImportance of IT Controls to Sarbanes-Oxley 24SOA Readiness RoadmapBusiness ValueSarbanes-Oxley

57、IT Compliance1. Plan & ScopeFinancial reporting processSupporting systems3. Identify Significant ControlsApplication controls - over initiating, recording, processing & reportingIT General Controls5. Evaluate Control DesignMitigates control risk to an acceptable levelUnderstood by users8. Document P

58、rocess & ResultsCoordination with AuditorsInternal sign-off (302, 404)Independent sign-off (404) 7. Identify & Remediate DeficienciesSignificant deficienciesMaterial weaknessRemediation6. Evaluate Operational EffectivenessInternal auditTechnical testingSelf assessmentInquiry +All locations and contr

59、ols (annual)4. Document Controls Policy manualsProceduresNarrativesFlowchartsConfigurationsAssessment questionnaires2. Perform Risk AssessmentProbability & Impact to businessSize / complexity9. Build SustainabilityInternal evaluationExternal evaluation2004 Deloitte & Touche LLPImportance of IT Contr

60、ols to Sarbanes-Oxley 25A Readiness RoadmapPlan & ScopeKey Considerations In-scope vs out-of-scope systems Opportunities for improvement Prevention, identification and detection of fraudKey Components Financial reporting processes Initiating Recording Processing Reporting Classes of transactions Non