Module 5 Flashcards
(31 cards)
What are are IT General controls?
Policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems
Whole item system (bubble around)
E.g username password, backups
ITGC can be?
Manual
Automated
Combination of both
What are the 4 areas ITGCs commonly cover?
Access to programs and data
Program changes and development
Operations (computer)
Continuity of operations
What is the key risk for access to programs and data?
Loss, destruction or unauthorised use and alteration of data
What is the key risk for program changes and development?
Changes may be unsuitable
New programs may not be fit for purpose
What is the key risk for computer operations?
Problems with system fail to be resolved in a timely manner
What is the key risk for continuity of operations?
Unexpected distasters
What is access to programs and data?
Access restricted to authorised persons only
What is program changes and development?
Any changes or development must incorporate controls including appropriate authorisation and testing
What are computer operations?
Procedures are required to ensure the recording, analysis and timely resolution of problems
Day to day processing of information
Ensure efficiency to achieve objectives
What are continuity of operations?
Take precautions against potential hazards and implement suitable backup procedures
What are the components of access to programs and data?
Awareness of information security policies by all staff
Appropriate restrictions of access to IT resources
Segregation of duties within key processes
What are the common controls within restriction of access?
Physical access
User access
Administrator access
What do you need to consider to ensure changes and development are appropriate and don’t negatively affect?
Authorisation
Development
Testing
Approval
DATA
Change should be made where?
In separate test environments to avoid any negative impact on info processing and application controls
What should organisations consider with regards to computer operations?
Job processing (documented procedures) Backup and recovery procedures Incident and problem management procedures (doc)
The ability to carry on trading after a distaste involves formulation a?
Disaster recovery plan as well as procedures to avoid disaster occurring
How can the DRP be developed?
Internally or outsourced to a specialist
What steps does designing a good DRP involve?
Identifying IT risk events
Assessing threat and impact
Preventing and reducing risk
What are the objective of a good DRP?
Minimising interruption Securing alternative internet access Recovering lost data Providing recovery procedures Training employees
What are typical physical security measures for distasteful prevention?
Fire and smoke detectors Alarms Plastic equipment covers Air con Firewalls
4 key areas ITGCs cover?
Access to programs and data
Program changes and development
Operations computer
Continuity of operations
APOC
What do IT application controls apply to?
Processing of specific types of transactions
To ensure genuine accurate and compete transactions
At business process/transaction level
What is the key difference between a manual and IT application control?
IT application contains some element of automation or involvement of IT
