IS Standards, Guidelines and Procedures for Auditing and Control ...

G11 Effect of Pervasive IS Controls continued2.4.6 An audit of the adequacy of security parameters in a system, for example UNIX, Windows NT, RACF, should includeconsideration of management’s security policies (PO6), allocation of security responsibilities (PO4), risk assessmentprocedures (PO9) and procedures for monitoring compliance with its security policies (M1). Even where the parameters donot comply with the IS auditor’s view of “best practice”, they may be evaluated as adequate in the light of the risk identified bymanagement and the management policies which direct how that level of risk should be addressed. Any auditrecommendations for improvement should then be directed at the risk management or policies, as well as the detailedparameters themselves.3. PLANNING3.1 Approach to Relevant Pervasive IS Controls3.1.1 The IS Auditing Guideline G15 Planning states that the IS auditor should perform a preliminary assessment of control over thefunction being audited. This preliminary assessment should include identifying and evaluating relevant pervasive IS controls. Thetesting of pervasive IS controls may take place on a different cycle to the specific IS audit being performed since by theirnature they cover many different aspects of IS usage. The IS auditor should therefore consider whether any previous auditwork in this area could be relied upon to identify and evaluate these controls.3.1.2 Where audit work indicates that pervasive IS controls are unsatisfactory, the IS auditor should consider the effect of thisfinding on the planned approach to achieving the audit objective:• Strong pervasive IS controls can contribute to the assurance which may be obtained by an IS auditor in relation todetailed IS controls• Weak pervasive IS controls may undermine strong detailed IS controls or exacerbate weaknesses at the detailed level3.2 Sufficient Audit Procedures3.2.1 Where pervasive IS controls have a significant potential effect on the audit objective, it is not sufficient to plan to audit only thedetailed controls. Where it is not possible or practical to audit the pervasive IS controls, this restriction of scope should bereported.3.2.2 The IS auditor should plan to test the relevant pervasive IS controls where this will contribute to achieving the audit objective.3.3 Relevant Controls3.3.1 Relevant pervasive IS controls are those which have an effect on the specific audit objectives for the assignment. For example,where the audit objective is to report on the controls around changes to a specific program library, pervasive IS controls relating tosecurity policies (PO6) will be relevant, but pervasive IS controls relating to determination of the technological direction (PO3) maynot be relevant.3.3.2 In planning the audit, the IS auditor should identify which of the total population of pervasive IS controls have an effect on thespecific audit objectives, and should plan to include these in the audit scope. COBIT’s control objectives for the “Plan andOrganise” and “Monitor and Evaluate” domains may help the IS auditor to identify relevant pervasive IS controls.3.4 Audit Evidence3.4.1 Pervasive IS controls may not necessarily be documented, but the IS auditor should plan to obtain audit evidence thatrelevant controls are operating effectively. Potential tests are outlined in the Performance of Audit Work section.3.5 Approach to Relevant Detailed IS Controls3.5.1 Where IS audit work indicates that pervasive IS controls are satisfactory, the IS auditor should consider reducing the level oftesting planned for detailed IS controls, since the audit evidence of strong pervasive IS controls will contribute to theassurance which may be obtained by an IS auditor in relation to detailed IS controls.3.5.2 Where IS audit work indicates that pervasive IS controls are not satisfactory, the IS auditor should carry out sufficient testingof detailed IS controls to provide audit evidence that they are working effectively in spite of weaknesses in the relevantpervasive IS controls.4. PERFORMANCE OFAUDIT WORK4.1. Testing Pervasive IS Controls4.1.1 The IS auditor should carry out sufficient testing to provide assurance that relevant pervasive IS controls were operatingeffectively in the audit period or at a specific point in time. Test procedures which may be appropriate include:• Observation• Corroborative inquiries• Review of relevant documentation (policies, standards, meeting minutes, etc.)• Re-performance (using CAATs, for example)4.1.2 If the testing of the relevant pervasive IS controls indicates that they are satisfactory, the IS auditor should proceed with theplanned audit of the detailed IS controls which are directly applicable to the audit objective. The level of such testing may beless than would be appropriate if the pervasive IS controls were not operating satisfactorily.39