GTAG 10 - Business Continuity Management.pdfVIP专享VIP免费原创优质

BusinessContinuityManagementGlobalTechnologyAuditGuide(GTAG)WritteninstraightforwardbusinesslanguagetoaddressatimelyissuerelatedtoITmanagement,control,andsecurity,theGTAGseriesservesasareadyresourceforchiefauditexecutivesondifferenttechnology-associatedrisksandrecommendedpractices.InformationTechnologyControls:TopicsdiscussedincludeITcontrolconcepts,theimportanceofITcontrols,theorganizationalrolesandresponsibilitiesforensuringeffectiveITcontrols,andriskanalysisandmonitoringtechniques.ChangeandPatchManagementControls:CriticalforOrganizationalSuccessChangeandPatchManagementControls:Describessourcesofchangeandtheirlikelyimpactonbusinessobjectives,aswellashowchangeandpatchmanagementcontrolshelpmanageITrisksandcostsandwhatworksanddoesn’tworkinpractice.ContinuousAuditing:ImplicationsforAssurance,Monitoring,andRiskAssessmentContinuousAuditing:Addressestheroleofcontinuousauditingintoday’sinternalauditenvironment;therelationshipofcontinuousauditing,continuousmonitoring,andcontinuousassurance;andtheapplicationandimplementationofcontinuousauditing.ManagementofITAuditingManagementofITAuditing:DiscussesIT-relatedrisksanddefinestheITaudituniverse,aswellashowtoexecuteandmanagetheITauditprocess.ManagingandAuditingPrivacyRisksManagingandAuditingPrivacyRisks:Discussesglobalprivacyprinciplesandframeworks,privacyriskmodelsandcontrols,theroleofinternalauditors,top10privacyquestionstoaskduringthecourseoftheaudit,andmore.ManagingandAuditingITVulnerabilitiesManagingandAuditingITVulnerabilities:Amongothertopics,discussesthevulnerabilitymanagementlifecycle,thescopeofavulnerabilitymanagementaudit,andmetricstomeasurevulnerabilitymanagementpractices.����������������������������������InformationTechnologyOutsourcing:DiscusseshowtochoosetherightIToutsourcingvendorandkeyoutsourcingcontrolconsiderationsfromtheclient’sandserviceprovider’soperation.AuditingApplicationControlsAuditingApplicationControls:Addressestheconceptofapplicationcontrolanditsrelationshipwithgeneralcontrols,aswellashowtoscopearisk-basedapplicationcontrolreview.IdentityandAccessManagementIdentityandAccessManagement:Coverskeyconceptssurroundingidentityandaccessmanagement(IAM),risksassociatedwithIAMprocess,detailedguidanceonhowtoauditIAMprocesses,andasamplechecklistforauditors.DevelopingtheITAuditPlanDevelopingTheITAuditPlan:Providesstep-by-stepguidanceonhowtodevelopanITauditplan,fromunderstandingthebusiness,definingtheITaudituniverse,andperformingariskassessment,toformalizingtheITauditplan.VisitTheIIA’sWebsiteatwww.theiia.org/technologytodownloadtheentireseries.AuthorsDavidEverest,KeyBankRoyE.Garber,SafeAutoInsuranceCo.MichaelKeating,NavigantConsultingBrianPeterson,ChevronCorp.BusinessContinuityManagementJuly2008Copyright©2008byTheInstituteofInternalAuditors,247MaitlandAve.,AltamonteSprings,FL32701-4201,USA.Allrightsreserved.PrintedintheUnitedStatesofAmerica.Nopartofthispublica-tionmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformbyanymeans—electronic,mechanical,photocopying,recording,orotherwise—withoutpriorwrittenpermissionfromthepublisher.TheIIApublishesthisdocumentforinformationalandeducationalpurposes.Thisdocumentisintendedtoprovideinformation,butisnotasubstituteforlegaloraccountingadvice.TheIIAdoesnotprovidesuchadviceandmakesnowarrantyastoanylegaloraccountingresultsthroughit...