AUDIT ON IMPLEMENTATION OF SAP/HR WORK PROGRAMME FOR AUDIT FIELDWORK Mitigating Tests of design Tests of implementation Inherent Risk (before Controls/Attributes controls) (Expected) a Critical and An IT-security plan is Establish if there is an IT-security Establish the number of incidents confidential defined and maintained; plan; due to physical security breaches or information is not An identity management failures and the number of incidents withheld from those process is defined, Review the plans and see if of unauthorised access to computer DS5 who should not have established and it mitigating controls are described facilities; access to it. operates; Run PEN-test aimed at testing the Potential and actual mitigating controls that should security incidents are prevent loss of confidential monitored; information; User access rights and Interview key specialists which are responsible for the general controls privileges are periodically reviewed and validated; Establish if if procedures are related to confidentiality; The completeness, described related to information Interview key-users of the system. flow and data integrity. Review accuracy, validity and accessibility of stored data these procedures against the is maintained. mitigating controls. Technical and procedural Automated business controls to protect transactions and information across information exchanges networks are implemented cannot be trusted. and maintained;
AUDIT ON IMPLEMENTATION OF SAP/HR WORK PROGRAMME FOR AUDIT FIELDWORK Inherent Risk (before controls) Mitigating Controls/Attributes (Expected) Tests of design Tests of implementation DS5 Critical and confidential information is not withheld from those who should not have access to it. Automated business transactions and information exchanges cannot be trusted. An IT-security plan is defined and maintained; An identity management process is defined, established and it operates; Potential and actual security incidents are monitored; User access rights and privileges are periodically reviewed and validated; The completeness, accuracy, validity and accessibility of stored data is maintained. Technical and procedural controls to protect information across networks are implemented and maintained; Establish if there is an IT-security plan; Review the plans and see if mitigating controls are described Establish if if procedures are described related to information flow and data integrity. Review these procedures against the mitigating controls. Establish the number of incidents due to physical security breaches or failures and the number of incidents of unauthorised access to computer facilities; Run a PEN-test aimed at testing the mitigating controls that should prevent loss of confidential information; Interview key specialists which are responsible for the general controls related to confidentiality; Interview key-users of the system.
2.3_it_audit_case_working_program.docx