17 System Audit Checklist
17 System Audit Checklist
17 System Audit Checklist
**
**
Audit Procedures
Review the company organisation chart, and the data processing department organisation chart. Yes/No 1 2 Is there a separate EDP department within the Company? Is there a steering committee and their duties and responsibilities for managing MIS are clearly defined? Has the Company developed an IT strategy linked with the long and medium term plans? Is the EDP Department independent of the user department and in particular the accounting department? Comments
5 Are there written job descriptions for all jobs Within EDP department and these job descriptions are communicated to designated employees? 6 Are EDP personnel prohibited from having incompatible responsibilities or duties in user departments and vice versa? Are there written specifications for all jobs in the EDP Department? Are the following functions within the EDP Department performed by separate sections:
7 8
Comments 9 Are the data processing personnel prohibited from duties relating to:
10 11
Are all processing prescheduled and authorised by appropriate personnel? Are there procedures to evaluate and establish who has access to the data in the database? Are the EDP personnel adequately trained? Are systems analysts programmers denied access to the computer room and limited in their operation of the computer? Do any of the computer operators have programming knowledge? Are operators barred from making changes to programs and from creating or amending data before, during, or after processing? Is the custody of assets restricted to personnel outside the EDP department? Is strategic data processing plan developed by the company for the achievement of long-term business plan? Are there any key personnel within IT department whose absence can leave the company within limited expertise?
12 13
14
15
16
17
18
19 20
Are there any key personnel who are being over - relied? Is EDP audit being carried by internal audit or an external consultant to ensure compliance of policies and controls established by management?
Audit Objective
Development and changes to programs are authorised, tested, and approved, prior to being placed in production.
(ii)
(iii) Obtain an understanding of any program library management software used. Yes/No 1 2 3 4 Are there written standards for program maintenance? Are these standards adhered to and enforced? Are these standards reviewed regularly and approved? Are ther e procedures to ensure that all programs required for maintenance are kept in a separate program test library? Are programmers denied access to all libraries other than the test library? Are changes to programs initiated by written request from user department and approved? Are changes initiated by Data Processing Department communicated to users and approved by them? Are there adequate controls over the transfer of programs from production into the programmer's test library? Are all systems developed or changes to existing system tested according to user approved test plans and standards? Comments
5 6
Yes/No 10 11 Are tests performed for system acceptance and test data documented? Are transfers from the development library to the production library carried out by persons independent of the programmers? Do procedures ensure that no such transfer can take place without the change having been properly tested and approved? Is a report of program transfers into production reviewed on a daily basis by a senior official to ensure only authorised transfers have been made? Are all program changes properly documented? Are all changed programs immediately backed up? Is a copy of the previous version of the program retained (for use in the event of problems arising with the amended version)? Are there standards for emergency changes to be made to application programs? Are there adequate controls over program recompilation? Are all major amendments notified to Internal audit for comment? Are there adequate controls over authorisation, implementation, approval and documentation of changes to operating systems?
Comments
12
13
14 15 16
17
18 19 20
System Development
1 Are there formalised standards for system development life cycle procedure? Do they require authorisation at the various stages of development feasibility study, system specification, testing, parallel running, post
Yes/No 3 Do the standards provide a framework for the development of controlled applications? 4 5 Are standards regularly reviewed and updated? Do the adequate system documentation exist for:
Comments
Programmers to maintain and modify programs? Users to satisfactorily operate the system? Operators to run the system?
Have the internal audit department been involved in the design stage to ensure adequate controls exist? Testing of programs - see Program Maintenance. Procedures for authorising new applications to production - see Program Maintenance. Are user and data processing personnel adequately trained to use the new applications? Is system implementation properly planned and implemented by either parallel run or pilot run? Are any differences and deficiencies during the implementation phase noted and properly resolved? Are there adequate controls over the setting up of the standing data and opening balances? Is a post implementation review carried out? Are user manuals prepared for all new systems developed and revised for subsequent changes? Is there a Quality Assurance Function to verify the integrity and acceptance of applications developed?
7 8
10
11
12
13 14
15
Yes/No Comments
3 4 5
Are vendor warranties (if any) still in force? Is the software purchased, held in escrow? Are backup copies of user/operation s manual kept off-site?
Access to Data
1 Is there any formal written data security policy? Consider whether the policy addresses data ownership, confidentiality of information, and use of password.
Is the security policy communicated to individuals in the organisation? Is physical access to off line data files controlled in:
Does the company employ a fulltime librarian who is independent of the operators and programmers? Are libraries locked during the absence of the librarian? Are requests for on-line access to off line files approved?
Yes/No 7 Are requests checked with the actual files issued and initialled by the librarian? Are sensitive applications e.g. payroll, maintained on machines in physically restricted areas? Are encryption techniques used to protect against unauthorised disclosure or undetected modification of sensitive data? Are returns followed up and non returns investigated and adequately documented?
Comments
10
Computer Processing
11 12 13 14 Does a scheduled system exist for execution of programs? Is there a comparison between actual and scheduled processing? Are non-scheduled jobs approved prior to being run? Is the use of utility programs controlled (in particular those that can change executable code or data)? Are program tests restricted to copies of live files? Is access to computer room restricted to only authorised personnel? Are internal and external labels used on files? Are overrides of system checks by operators controlled? Are exception reports for such overrides pointed and reviewed by appropriate personnel? Are sufficient operating instructions exist covering procedures to be followed at operation?
15 16
17 18 19
20
D a t a b a s e
Yes/No Comments
21 Does the position of database administrator (DBA) exist? If not note who is responsible for:
Defining user and program access Mediating between users who share data Maintaining the integrity of the database Setting standards of backup and recovery
22
23
Are logs maintained of the use of utilities, changes to access methods, etc.? If so, are these independently reviewed? Does the DBMS have the facility to abort jobs when two users, with the same priority, are locked out from the same chain of data? Is integrity checking programs run
24 25
26
periodically for checking the accuracy and correctness of linkages between records?
issuing, amending, and deleting passwords. (ii) Obtain an understanding of any access control software used. 1 Do formal procedure s exist for the issue and subseque nt control of passwords ?
Yes/No 2 Is there any proper password syntax inmin. 5 and max. 8 characters and include alphanumeric characters. Are there satisfactory procedures for reissuing passwords to users who have forgotten theirs? Are procedures in place to ensure the removal of terminated employee passwords? Are system access compatibilities properly changed with regard to personnel status change? Are individual job responsibilities considered when granting users access privileges? Is each user allocated a unique password and user account? Are there procedures in place to ensure change of password after every 30 days? Is application level security violations Do standards and procedures exist for follow up of security violations? Do formal and documented procedures exist for use and monitoring of dial up access facility? Is use made of passwords to restrict specific file access to s? Do terminals automatically log off after a set period of time? Is there a limit of the number of invalid passwords before the terminal closes down? Are there any administrative regulations limiting physical access to terminals? Are invalid password attempts reported to department managers? user Are restrictions placed on which applications terminals can access?
Comments
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Yes/No 18 Are keys, locks, cards or other physical devises used to restrict access to only authorised user?
Comments
2 3
4 5
8 9
10
Yes/No 11 12 Is an error log maintained and reviewed to identify recurring errors? Are persons responsible for data preparation and data entry independent of the output checking and balancing process? Are persons responsible for data entry prevented from amending master file data?
Comments
13
Headed Pages numbered Dated Identified by report/program number Adequately totalled/control totalled Designed to give an End of Report message, if not obvious?
Are significant reports distributed to only authorised personnel in line with an approved distribution list? Are there formal procedures for checking, filing and retention of reports? Where output from one system is input to another, are run to run totals, or similar checks, used to ensure no data
is lost or corrupted?
Yes/No 6 7 Are there adequate controls over forms that have monetary value? Is maximum use made of programmed checks on limits, ranges reasonableness, etc. and items that are detected reported for investigation? Where calculations can be 'forced' i.e. bypass a programmed check, are such items reported for investigation? Where errors in processing are detected is there a formal procedure for reporting and investigation? Is reconciliation between input, output and brought forward figures carried out and differences investigated? Are suspense accounts checked and cleared on a timely basis? Are key exception reports reviewed and acted upon on a timely basis?
Comments
10
11 12
Viruses
1 2 3 4 5 6 7 Is there any formal written anti-virus policy? Is the policy effectively communicated to individuals in the organisation? Is there a list of approved software and suppliers? Is only authorised software installed on microcomputers? Is there a master library of such software? Are directories periodically reviewed for suspicious files? Are files on the system regularly checked for size changes?
Yes/No 8 Is anti-virus software installed on all microcomputers? Is anti-virus software regularly updated for new virus definitions? Are suspicious files quarantined and deleted from the terminals hard drive and network drive? Are diskettes formatted before re-use? Have procedures been developed to restrict or oversee the transfer of data between machines? Is staff prohibited from sharing machines? Is software reloaded from the master diskettes after machine maintenance? Has all staff been advised of the virus prevention procedures? Are downloads from internet controlled by locking the hard-drive and routing it through network drive to prevent the virus (if any) from spreading?
Comments
9 10
11 12
13 14 15 16
INTERNET 1 Is there any proper policy regarding the use of internet by the employees? Does the policy identify the specific assets that the firewall is intended to protect and the objectives of that protection? Does the policy support the legitimate use and flow of data and information? Is information passing through firewall is properly monitored? Determine whether management approval of the policy has been sought and granted and the date of the most recent review of the policy by management.
3 4 5
Yes/No 6 Is the policy properly communicated to the users and awareness is maintained? Have the company employed a Firewall Administrator? Is firewall configured as per security policy? Is URL screening being performed by Firewall? Is anti-virus inspection enabled? Are packets screened for the presence of prohibited words? If so, determine how the list of words is administered and maintained. Are access logs regularly reviewed and any action is taken on questionable entries?
PHYSICAL
Comments
7 8 9 10 11
12
Fire Hazard
Fire resistance:
Building materials fire resistant Wall and floor coverings non-combustible Separation from hazardous areas (e.g. fire doors) Separation from combustible materials (e.g. paper, fuel)
Yes/No
Comments
Smoking restriction Fire resistant safes (for tapes, disks and documentation)
Fire detection:
Smoke / Heat-rise detectors Detectors located on ceiling and under floor Detectors located in all key EDP areas Linked to fire alarm system
Fire extinction:
Halon gas system (for key EDP areas) Automatic sprinkler system Portable CO2, extinguishers (electrical fires) Ease of access for fire services
Fire emergency:
Fire instructions clearly posted Fire alarm buttons clearly visible Emergency power-off procedures posted Evacuation plan, with assignment of responsibilities
Fire practices:
Yes/No
Water Damage
EDP area located above ground level Building weather protected (eg. Storms, water leaks)
Comments
Air Conditioning
Monitoring of temperature and humidity in EDP area Heat, fire and access protection of sensitive air conditioning parts (eg. cooling tower) Air intakes located to avoid undesirable pollution Back-up air conditioning equipment
Power Supply
Reliable local power supply Separate computer power supply Line voltage monitored Power supply regulated (For voltage fluctuation) Uninterrupted power supply (eg. Battery system) available Alternative power supply (eg. Generator) Emergency lighting system
Yes/No
5 Communications Network
Physical protection of communications lines modems, multiplexors and processors Location of communication equipment separate from main EDP equipment
Comments
ACCESS CONTROL
Non-essential doors always shut and locked to the outside (eg. Fire exits) Air vent and daylight access location protected Use of all open doors controlled
Yes/No
Comments
Access Control:
Access restricted to selected employees Prior approval required for all other employees Entrance door controlled by:
Positive identification of all employees (eg. identification card) All unknown personnel challenged Verification of all items taken into and out of the computer room Access controlled on 24 hours basis including weekends (e.g. automatic control mechanism) Locks, combinations, badge codes changed periodically Is access to copies of the documentation kept in a secure location?
Visitor Control:
Positive identification always required Temporary badges issued, controlled and returned on departure All visits logged in and out Visitors accompanied and observed at all times
Yes/No
Comments
Terminal Security:
All terminals located in secure areas Alarm system used to control microcomputers from being disconnected or moved from its location. Sensitive applications e.g. payroll, maintained on machines in physically restricted area. Terminal keys/locks used Passwords changed regularly Identification labels been placed on each terminal.
General Security
Waste regularly removed from EDP area and sensitive data shredded Window and door alarm system Closed circuit television monitoring
C
1
PERSONNEL POLICIES
New employees recruited according to job description and job specification Employee identity cards issued Performance evaluation and regular counselling Continuing education program Training in security, privacy and recovery procedures All functions covered by cross training Critical jobs rotated periodically (e.g. operators, program maintenance)
2 3 4 5 6 7
Yes/No 8 9 10 Clean desk policy enforced Fidelity insurance for key personnel Contract service personnel vetted (e.g. cleaners) INSURANCE Does adequate insurance exist to cover:
Comments
D 1
Loss of data/assets (eg. Accounts receivable)? Business loss or interruption (business critical systems)? 2 Is adequate consideration given to cover additional cost of working and consequential losses?
E 1
Yes/No
Comments
Off-site Storage:
Secure separate location Adequate physical protection (see section A) Log maintained of off-site materials Off-site Inventory regularly reviewed File transportation under adequate physical protection Back-up files periodically tested
Data Files:
File criticality and retention procedure regularly reviewed
Tape
At least three generations of important tape files retained
Yes/No Copies of all updating transactions for above retained At least one generation and all necessary updating transactions in offsite storage Disc Checkpoint/restart procedures provided for Audit trail (log file) of transactions updating on-line files (data base) maintained Regular tape dumps of all disc files stored off-site Audit trail (log file) regularly dumped and stored off-site
Comments
Software:
Copies of following maintained at off-site storage: Production application programs Major programs under development System and program documentation Operating procedures Operation and system software All copies regularly updated Back-up copies regularly tested
Operations
Back-up procedure manual Priority assignments for all applications Procedures for restoring data files and software Procedures for back-up installation
Yes/No
Comments
F
1
3 3
8 9
10 11
Yes/No 12 Does the recovery plan ensure, in the event of failure: 13 No loss of data received but not processed No reprocessing of data already processed Files not corrupted by partially completed processing
Comments
U CA (FINAL)
P.VEL