IT审计与控制模型COBITppt课件

1、Advanced Information Technology and ManagementIT Audit and Control Model of Information and Related Technology -COBITHu kejin W.IT AuditISACA (Information Systems Audit and Control Association)CISA (Certified Information System Auditor).COBIT-Control Objectives For Information and Related Technology

2、Information Systems Audit and ControlFoundationIT Governance Institute.1. IT Audit Overview2. COBIT Overview3. COBIT Architecture4. Control Objectives5. Management Guidelines6. Audit Guidelines.1. IT Audit OverviewAuditingObjectivesSecurity Reliability Effectiveness.Scope of the audit1) Information

3、Systems2) to cover life cycle of IS.Audit Plan$ Definition of Scope and Objectives.$ Analysis and understanding of standard procedures.$ Evaluation of system and internal controls.$ Audit Procedures and documentation of evidence.$ Analysis of facts encountered.$ Formation of opinion over the control

4、s.$ Presentation of report and recommendations.Audit Techniques$ Compliance tests.$ Substantive tests.$ Auditing program.$ Integrated Test Facility.$ Parallel Simulation.$ Snapshot$ Tracing $ Program Code Comparison$ Computer Assisted Audit Techniques and Tools.Audit Work Team$ Manager: Responsible

5、for the audit and quality control.$ Senior/team leader: Responsible for the work papers.$ Staff: Responsible for the performance of the audit. .Audit ReportProgress Reports.Work Papers.Other Work Papers.Preliminary Reports.Final Audit Report.1What is our mission?2What are our goals and how will we a

6、chieve them?3 How can we measure our performance? 4How will we use that information to make improvements?.1Accounting Audit2System Audit3Performance Audit .Business Reference Model (BRM) Lines of Business Agencies, Customers, PartnersService Component Reference Model (SRM)Service Domains, Service Ty

7、pesBusiness & Service ComponentsTechnical Reference Model (TRM)Service Component Interfaces, Interoperability Technologies, RecommendationsData & Information Reference Model (DRM) Business-focused Data Standardization Cross-Agency Information ExchangesPerformance and Business-DrivenPerformance Refer

8、ence Model (PRM)Inputs, Outputs, and OutcomesUniquely Tailored IT Performance IndicatorsComponent-Based Architectures Performance Reference Model (PRM)Inputs, Outputs, and OutcomesUniquely Tailored IT Performance IndicatorsBusiness Reference Model (BRM) Lines of Business Agencies, Customers, Partner

9、sService Component Reference Model (SRM)Service Domains, Service TypesBusiness & Service ComponentsTechnical Reference Model (TRM)Service Component Interfaces, Interoperability Technologies, RecommendationsData & Information Reference Model (DRM) Business-focused Data Standardization Cross-Agency In

10、formation ExchangesPerformance and Business-DrivenComponent-Based ArchitecturesTHE FEA REFERENCE MODEL FRAMEWORK.HUMAN CAPITAL MISSION AND BUSINESS RESULTS CUSTOMERRESULTDVALUE VALUE STRATEGIC OUTCOMSINPUTTECHONLOGY OTHER FIXED ASSETSPROCESS AND ACTIVITY Mission and business-critical resultsaligned

11、with the Business ReferenceModel. Results measured from a customerperspectiveThe direct effects of day-to-day activitiesand broader processes measured as drivenby desired outcomes. Used to furtherdefine and measure the Mode of Delivery in The business reference model.Key enablers measured through th

12、eir contribution to outputs and by extension outcomes.Data and Information Reference Model (DRM) Data and Information Reference Model (DRM) is currently under development.COBIT is the model for IT governance!2. COBIT Overview.BusinessRequirementsIT ManagementIT Resources.1). Executive Summary2). Fra

13、mework3).Control Objectives4).Management Guidelines5).Audit Guidelines6).Implementation Tool set.The control ofwhich satisfyis enabled byconsideringIT ProcessesBusinessRequirementsControlStatementsControlPractices. DataApplication SystemsTechnologyFacilitiesPeopleEventsBusiness ObjectivesBusiness Op

14、portunitiesExternal RequirementsRegulationsRisksInformationEffectivenessConfidentialityIntegrityAvailabilityComplianceReliabilityMessageinputServiceoutput.BusinessProcessesInformationIT ResourcesIT ResourcesPeopleApplication SystemsTechnologyFacilitiesDataInformation Criteria effectiveness confident

15、iality integrity availability compliance reliability?Do they matchWhat you getWhat you need.Information criteria ITdomains ITresourcesPlanning & organizationAcquisition &implementationDelivery &supportMonitoring.DomainsProcessesActivitiesInformation CriteriaIT ProcessesIT ResourcesQualityFiduciarySe

16、curitypeopleApplication SystemsTechnologyFacilitiesData.DomainsProcessesActivities/Tasks.3. COBIT ArchitectureManagement frameworkManagementguidelinesControlobjectivesAuditguidelinesTool set.ManagementguidelinesMaturitymodelsCritical success factorsKey goalindicatorsKey performance indicators.IT dom

17、ainsPlanning &OrganizationAcquisition &ImplementationDelivery &SupportMonitoringCOBIT IT Processes Defined Within the Four Domains.COBITBusiness ObjectivesInformationIT ResourcesPlanning &OrganizationAcquisition &ImplementationDelivery &SupportMonitoring.IT ResourcesIT ResourcesApplication SystemsDa

18、taApplication SystemsTechnologyFacilitiesPeople.DomainsProcesses.ProcessesActivities/Tasks.Information CriteriaQualityFiduciarySecurityQualityCostDeliveryEffectivenessEfficiencyReliabilityComplianceConfidentialityIntegrityAvailability.4.Control Objectives High-Level Control Objectives 34(Control Ove

19、r the IT Process)Control Objectives 318(Control Over the Activities/Tasks) .Planning & OrganizationPO1 define a strategic IT planPO2 define the information architecturePO3 determine the technological directionPO4 define the IT organization and relationshipsPO5 manage the IT investmentPO6 communicate

20、 management aims and directionPO7 manage human resourcesPO8 ensure compliance with external requirementsPO9 assess risksPO10 manage projectsPO11 manage quality .Acquisition &ImplementationAI1 identify solutionsAI2 acquire and maintain application softwareAI3 acquire and maintain technology architect

21、ureAI4 develop and maintain IT proceduresAI5 install and accredit systemsAI6 manage changes.Delivery &SupportDS1 define service levelsDS2 manage third-party servicesDS3 manage performance and capacityDS4 ensure continuous serviceDS5 ensure systems securityDS6 identify and attribute costsDS7 educate

22、and train usersDS8 assist and advise IT customersDS9 manage the configurationDS10 manage problems and incidentsDS11 manage dataDS12 manage facilitiesDS13 manage operations.MonitoringM1 monitor the processesM2 assess internal control adequacyM3 obtain independent assuranceM4 provide for independent a

23、udit.DOMAINProcessInformation CriteriaIT ResourcesPlanning & OrganizationPO1 PO2 PO3 PO4 PO5 PO6 PO7 PO8 PO9 PO10 PO11EffectivenessEfficiencyConfidentialityIntegrityAvailabilityComplianceReliabilityPeopleApplication SystemsTechnologyFacilitiesData.DOMAINProcessInformation CriteriaIT ResourcesPeopleA

24、pplication SystemsTechnologyFacilitiesDataEffectivenessEfficiencyConfidentialityIntegrityAvailabilityComplianceReliabilityPO1 define a strategic IT planPlanning & OrganizationPO2 define the informationarchitectureP S S SP S.Managements Question1. How do responsible managers “keep the ship on course?

25、2. How to achieve results that are satisfactory for the largest possiblesegment of our stakeholders?3. How to timely adapt the organizationto trends and developments in the enterprises environment?DashboardsScorecardsBenchmarkingBenchmarking.5. Management GuidelinesMaturity ModelsCSFKGIKPI .Generic

26、Maturity Model0 Non-Existent1 Initial2 Repeatable3 Defined4 Managed5 Optimized .012345Non-ExistentInitialRepeatableDefinedManagedOptimizedEnterprise Current StatusInternational Standard GuidelinesIndustry Best PracticeEnterprise Strategy.GoalsEnablersBalanced Business ScorecardInformationTechnologyM

27、easure(Outcome) Measure(Performance).Critical Success Factors (CSF)Define the most important issues or actionsfor management to achieve control over and within its IT processes.Key Goal Indicators (KGI)Define measures that tell management-after the fact-whether an IT process has achieved itsbusiness requirements.Key PerformanceInd