Understanding and Conducting Information Systems Auditing

Preface xi
 
Acknowledgments xv
 
PART ONE: CONDUCTING AN INFORMATION SYSTEMS AUDIT 1
 
Chapter 1: Overview of Systems Audit 3
 
Information Systems Audit 3
 
Information Systems Auditor 4
 
Legal Requirements of an Information Systems Audit 4
 
Systems Environment and Information Systems Audit 7
 
Information System Assets 8
 
Classification of Controls 9
 
The Impact of Computers on Information 12
 
The Impact of Computers on Auditing 14
 
Information Systems Audit Coverage 15
 
Chapter 2: Hardware Security Issues 17
 
Hardware Security Objective 17
 
Peripheral Devices and Storage Media 22
 
Client-Server Architecture 23
 
Authentication Devices 24
 
Hardware Acquisition 24
 
Hardware Maintenance 26
 
Management of Obsolescence 27
 
Disposal of Equipment 28
 
Problem Management 29
 
Change Management 30
 
Network and Communication Issues 31
 
Chapter 3: Software Security Issues 41
 
Overview of Types of Software 41
 
Elements of Software Security 47
 
Control Issues during Installation and Maintenance 53
 
Licensing Issues 55
 
Problem and Change Management 56
 
Chapter 4: Information Systems Audit Requirements 59
 
Risk Analysis 59
 
Threats, Vulnerability, Exposure, Likelihood, and Attack 61
 
Information Systems Control Objectives 61
 
Information Systems Audit Objectives 62
 
System Effectiveness and Effi ciency 63
 
Information Systems Abuse 63
 
Asset Safeguarding Objective and Process 64
 
Evidence Collection and Evaluation 65
 
Logs and Audit Trails as Evidence 67
 
Chapter 5: Conducting an Information Systems Audit 71
 
Audit Program 71
 
Audit Plan 72
 
Audit Procedures and Approaches 75
 
System Understanding and Review 77
 
Compliance

VEENA HINGARH is Joint Director of the South Asian Management Technologies Foundation, a center for research, training, and application in the areas of finance and risk management, which provides training in areas including IS auditing, enterprise risk management, and risk modeling. Winner of numerous merit-based awards during her career, Hingarh's major areas of focus are IFRS and IS. She speaks frequently at conferences and platforms throughout Asia and the Middle East. Hingarh is a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI), Certified Company Secretary of the Institute of Company Secretaries of India (ICSI), and Certified Information System Auditor (CISA) from ISACA (USA).
 
ARIF AHMED is a professor at and Director of the South Asian Management Technologies Foundation as well as a Chartered Accountant from the Institute of Chartered Accountants of India (ICAI). He is an Information Security Management System Lead Auditor for the British Standards Institution. Ahmed's areas of focus are finance and risk management, and he has over two decades of postqualification experience in training and strategic consulting. He has been interviewed and quoted throughout the media and has spoken at various seminars and institutions, including the Institute of Chartered Accountants of India, XLRI, and the Institute of Company Secretaries of India.