Paper - 6: Information Systems Control and Audit: Answer

PAPER – 6: INFORMATION SYSTEMS CONTROL AND AUDIT
Question No. 1 is compulsory.

Candidates are also required to answer any five questions
from the remaining six questions.
Question 1
ABC Limited, a large enterprise with more than 12000 employees, plans to implement an MIS
to support middle and senior level management in administration and decision making. As an
expert, what would be your response to the following:
(a) Major limitations of a Management Information System (5 Marks)
(b) Important implications of an MIS in business (5 Marks)
(c) What are the categories of system maintenance? (5 Marks)
(d) What are the major aspects to be looked into by an IS Auditor? (5 Marks)
Answer
(a) Major Limitations of Management Information Systems (MIS) are as follows:
 The quality of the outputs of MIS is basically governed by the quality of input and
processes.
 MIS is not a substitute for effective management, which means that it cannot
replace managerial judgment in making decisions in different functional are as. It is
merely an important tool in the hands of executives for decision making and
problem solving.
 MIS may not have requisite flexibility to quickly update itself with the changing
needs of time, especially in fast changing and complex environment.
 MIS cannot provide tailor-made information packages suitable for the purpose of
every type of decision made by executives.
 MIS takes into account mainly quantitative factors, thus it ignores the non -
quantitative factors like morale and attitude of members of organization, which have
an important bearing on the decision making process of executives or senior
management.
 MIS is less useful for making non-programmed decisions. Such types of decisions
are not of the routine type and thus require information, which may not be available
from existing MIS to executives.
 The effectiveness of MIS is reduced in enterprises, where the culture of hoarding
information and not sharing with other holds.
© The Institute of Chartered Accountants of India

PAPER – 6: INFORMATION SYSTEMS CONTROL AND AUDIT 27
 MIS effectiveness decreases due to frequent changes in top management,

organizational structure and operational team.
(b) Following are some of the important implications of Management Information Systems
(MIS) in business:
 MIS supports the managers at different levels to take strategic (at top level) or
tactical (at middle level) management decisions to fulfill the organizational goals.
 An organization can survive and thrive in a highly competitive environment on the
strength of a well-designed Management Information system that provides flexible
and speedy access to accurate data.
 MIS helps in making right decision at the right time i.e. just on time.
 A good MIS may help in generating innovative ideas for solving critical problems.
 Knowledge gathered though MIS may be utilized by managers in unusual situations.
 MIS may be viewed as a process; it can be integrated to formulate a strategy of
action or operation.
 MIS provides reports to management that can help in making effective, structured
types as applicable to decisions of day-to-day operations.
(c) System Maintenance can be categorized in the following ways:
 Scheduled Maintenance: Scheduled Maintenance is anticipated and can be
planned for operational continuity and avoidance of anticipated risks. For example,
the implementation of a new inventory coding scheme can be planne d in advance,
security checks may be promulgated etc.
 Rescue Maintenance: Rescue maintenance refers to previously undetected
malfunctions that were not anticipated but require immediate troubleshooting
solution. A system that is properly developed and tested should have few occasions
of rescue maintenance.
 Corrective Maintenance: Corrective maintenance deals with fixing bugs in the
code or defects found during the executions. A defect can result from design errors,
logic errors coding errors, data processing and system performance errors.
Examples of corrective maintenance include correcting a failure to test for all
possible conditions or a failure to process the last record in a file.
 Adaptive Maintenance: Adaptive maintenance consists of adapting software to
changes in the environment, such as the hardware or the operating system. The
term environment refers to the totality of all conditions and influences, which act
from outside upon the system, for example, business rule, government policies,
work patterns, software and hardware operating platforms. The need for adaptive
maintenance can only be recognized by monitoring the environment.

28 FINAL EXAMINATION: MAY, 2017
 Perfective Maintenance: Perfective maintenance mainly deals with

accommodating to the new or changed user requirements and concerns functional
enhancements to the system and activities to increase the system’s performance or
to enhance its user interface.
 Preventive Maintenance: Preventive maintenance concerns with the activities
aimed at increasing the system’s maintainability, such as updating documentation,
adding comments, and improving the modular structure of the system.
(d) The major aspects that an Information Systems (IS) Auditor must consider while
implementing an MIS in a large enterprise ABC Limited, to support middle and senior
level management in administration and decision making are as follows:
An auditor must–
 Assess the extent to which the system being developed provides for adequate audit
trails and controls to ensure the integrity of data processed and stored;
 Ensure ‘what project control standards are to be complied with’ and determining the
extent to which compliance is being achieved;
 Examine system documentation such as functional specifications to arrive at an
opinion on controls;
 Provide a list of the standard controls, over operational concerns such as response
time, CPU usage, and random access space availability that he/she can use as an
assessment criteria;
 Review Feasibility Study Report and different work products of the Feasibility study
phase;
 Include technical experts to seek their opinion on the technical aspects of
development of MIS;
 Give control objectives, directives and in general, validate the opinion expressed by
technical experts;
 Review some of the control considerations like –
o Documented policy and procedures;
o Established Project team with all infrastructure and facilities;
o Developers/ IT managers are trained on the procedures;
o Appropriate approvals are being taken at identified mile-stones;
o Development is carried over as per standards, functional specifications;
o Separate test environment for development/ test/ production / test plans;
o Design norms and naming conventions are as per standards and are adhered
to;

o Business owners testing and approval before system going live; Version
control on programs;
o Source Code is properly secured;
o Adequate audit trails are provided in system; and
o Appropriateness of methodologies selected.
 Determine whether the system adequately meets earlier identified business
requirements and needs post -implementation review.
 Determine if the expected benefits of the new system are realized and whether
users are satisfied with the new system.
 Review which of the phases till implementation of MIS have not met desired
objectives and whether any corrective actions were taken in post implementation
review.
Question 2
(a) You are appointed as a member of the IT Steering Committee for IT implementation and
deployment in a large company. What are the major functions of this committee? (6 Marks)
(b) COBIT 5 has a specific process "MEA02 Monitor, Evaluate and Assess the system of
Internal Control." Discuss in brief any 6 key practices for assessing and evaluating the
system of Internal Control in an enterprise based on this process. (6 Marks)
(c) The Cloud Computing Architecture comprises of two parts. Briefly describe these two
parts. (4 Marks)
Answer
(a) The major functions of the IT Steering Committee would include the following:
 To ensure that long and short-range plans of the IT department are in tune with
enterprise goals and objectives;
 To establish size and scope of IT function and sets priorities within the scope;
 To review and approve major IT deployment projects in all their stages;
 To approve and monitor key projects by measuring result of IT projects in terms of
return on investment, etc.;
 To review the status of Information Systems’ plans and budgets and overall IT
performance;
 To review and approve standards, policies and procedures;
 To make decisions on all key aspects of IT deployment and implementation;
 To facilitate implementation of IT security within enterprise;

 To facilitate and resolve conflicts in deployment of IT and ensure availability of a

viable communication system exists between IT and its users; and
 To report to the Board of Directors on IT activities on a regular basis.
(b) The key practices for assessing and evaluating the system of internal controls in an
enterprise based on the process MEA 02 Monitor, Evaluate and Assess the System of
Internal Control are as follows:
 Monitor Internal Controls: Continuously monitor, benchmark and improve the IT
control environment and control framework to meet organizational objectives.
 Review Business Process Controls Effectiveness: Review the operation of
controls, including a review of monitoring and test evidence to ensure that controls
within business processes operate effectively. It also includes activities to maintain
evidence of the effective operation of controls through mechanisms such as periodic
testing of controls, continuous controls monitoring, independent assessments,
command and control centers, and network operations centers.
 Perform Control Self-assessments: Encourage management and process owners
to take positive ownership of control improvement through a continuing program of
self- assessment to evaluate the completeness and effectiveness of management’s
control over processes, policies and contracts.
 Identify and Report Control Deficiencies: Identify control deficiencies and
analyze and identify their underlying root causes. Escalate control deficiencies and
report to stakeholders.
 Ensure that assurance providers are independent and qualified: Ensure that
the entities performing assurance are independent from the function, groups or
organizations in scope. The entities performing assurance should demonstrate an
appropriate attitude and appearance, competence in the skills and knowledge
necessary to perform assurance, and adherence to codes of ethics and professional
standards.
 Plan Assurance Initiatives: Plan assurance initiatives based on enterprise
objectives and conformance objectives, assurance objectives and strategic
priorities, inherent risk resource constraints, and sufficient knowledge of the
enterprise.
 Scope assurance initiatives: Define and agree with management on the scope of
the assurance initiative, based on the assurance objectives.
 Execute assurance initiatives: Execute the planned assurance initiative. Report
on identified findings. Provide positive assurance opinions, where appropriate, and
recommendations for improvement relating to identified operational performance,
external compliance and internal control system residual risks.

(c) A Cloud computing architecture consists of two parts - a Front End and a Back End that
connect to each other through a network, usually the Internet. A central server is
established to be used for administering the whole system.
 Front End Architecture: The front end of the cloud computing system is the side -
the computer user sees and interacts through and comprises of the client’s devices
(or computer network) and some applications needed for accessing the cloud
computing system. All the cloud computing systems do not give the same interface
to users. Web services like electronic mail programs use some existing web
browsers such as Firefox, Microsoft’s internet explorer or Apple’s Safari. Other
types of systems have some unique applications which provide network access to
its clients.
 Back End Architecture: Back end is the “cloud” section of the system and refers to
some service facilitating peripherals. In cloud computing, the back end is cloud
itself, which may encompass various computer machines, data storage systems and
servers. Groups of these clouds make up a whole cloud computing system.
Theoretically, a cloud computing system can include any type of web application
program such as video games to applications for data processing, software
development and entertainment.
Question 3
(a) What should an IS Auditor evaluate while reviewing the adequacy of data security
controls? (6 Marks)
(b) "Information has become a key resource for any type of business activity." Briefly discuss
the various attributes of information. (6 Marks)
(c) List out the major activities to be carried out in the implementation of a Business
Continuity Plan. (4 Marks)
Answer
(a) An Information Systems (IS) Auditor is responsible to evaluate the following while
reviewing the adequacy of Data Security Controls:
 Who is responsible for the accuracy of the data?
 Who is permitted to update data?
 Who is permitted to read and use the data?
 Who is responsible for determining who can read and update the data?
 Who controls the security of the data?
 If the IS system is outsourced, what security controls and protection mechanism
does the vendor have in place to secure and protect data?

 Contractually, what penalties or remedies are in place to protect the tangible and
intangible values of the information?
 The disclosure of sensitive information is a serious concern to the organization and
is mandatory on the auditor’s list of priorities .
(b) Some of the important attributes of useful and effective information are as follows:
 Availability - Information is useless if it is not available at the time of need.
Database is a collection of files which is collection of records and data from where
the required information is derived for useful purpose.
 Purpose/Objective - Information must have purposes/objective at the time it is
transmitted to a person or machine, otherwise it is simple data. The basic objective
of information is to inform, evaluate, persuade, and organize. This indeed helps in
decision making, generating new concepts and ideas, identify and solve problems,
planning, and controlling which are needed to direct human activity in business
enterprises.
 Mode and format - The modes of communicating information to humans should be
in such a way that it can be easily understandable by the people and may be in the
form of voice, text and combination of these two. Format design should be simple,
relevant and should highlight important point in such a way that it assists in decision
making, solving problems, initiating planning, controlling and searching. According
to the type of information, the different formats can be used e.g. diagrams, graphs,
curves are best suited for representing the statistical data.
 Current/Updated - The information should be refreshed from time to time as it
usually rots with time and usage. For example, the running score sheet of a cricket
match available in Internet sites should be refreshed at fixed interval of time so that
the current score will be available.
 Rate - The rate of transmission/reception of information may be represented by the
time required to understand a particular situation. Useful information is the one
which is transmitted at a rate which matches with the rate at which the recipient
wants to receive. For example- the information available from internet site should be
available at a click of mouse.
 Frequency - The frequency with which information is transmitted or received affects
its value. For example- the weekly reports of sales show little change as compared
to the quarterly and contribute less for accessing salesman capability.
 Completeness and Adequacy - The information provided should be complete and
adequate in itself because only complete information can be used in policy making.
For example-the position of student in a class can be find out only after having the
information of the marks of all students and the total number of students in a class.

 Reliability - It is a measure of failure or success of using information for decision-

making. If information leads to correct decision on many occasions, we say the
information is reliable.
 Validity - It measures how close the information is to the purpose for which it
asserts to serve. For example, the experience of employee supports in evaluating
his performance.
 Quality - It means the correctness of information. For example, an over-optimistic
manager may give too high estimates of the profit of product which may create
problem in inventory and marketing.
 Transparency - It is essential in decision and policy making. For example, total
amount of advance does not give true picture of utilization of fund for decision about
future course of action; rather deposit-advance ratio is perhaps more transparent
information in this matter.
 Value of Information - It is defined as difference between the value of the change
in decision behaviour caused by the information and the cost of the information. In
other words, given a set of possible decisions, a decision-maker may select one on
basis of the information at hand. If new information causes a different decision to be
made, the value of the new information is the difference in value between the
outcome of the old decision and that of the new decision, less the cost of obtaining
the information.
(c) In the implementation of a Business Continuity Plan (BCP), the major activities that
should be carried out include the following:
 Defining the scope and context;
 Defining roles and responsibilities;
 Engaging and involving all stakeholders;
 Testing of program on regular basis;
 Maintaining the currency and appropriateness of Business Continuity Program;
 Reviewing, reworking and updating the Business Continuity Capability, Risk
Assessments (RA) and Business Impact Analysis (BIAs);
 Managing costs and benefits associated; and
 Convert policies and strategies into action.
Question 4
(a) Describe the categories of Information Systems Audits. (6 Marks)
(b) What are the major documents that should be mandatorily part of any Business
Continuity Management system? (6 Marks)

(c) IS Auditors review risks relating to IT systems and processes. Briefly discuss these risks.
(4 Marks)
Answer
(a) Information Systems Audits has been categorized into following types:
(i) Systems and Application: It is an audit to verify that systems and applications are
appropriate, are efficient, and are adequately controlled to ensure valid, reliable,
timely, and secure input, processing, and output at all levels of a system's activity.
(ii) Information Processing Facilities: This audit verifies that the processing facility is
controlled to ensure timely, accurate, and efficient processing of applications under
normal and potentially disruptive conditions.
(iii) Systems Development: It is an audit to verify that the systems under development
meet the objectives of the organization and to ensure that the systems are
developed in accordance with generally accepted standards for systems
development.
(iv) Management of IT and Enterprise Architecture: This audit verifies that IT
management has developed an organizational structure and procedures to ensure a
controlled and efficient environment for information processing.
(v) Telecommunications, Intranets, and Extranets: This is an audit to verify that
controls are in place on the client (end point device), server, and on the network
connecting the clients and servers.
(b) The following documents (representative only) are classified as being part of the
Business Continuity Management System:
 The Business Continuity Policy;
 The Business Continuity Management System;
 The Business Impact Analysis report;
 The Risk Assessment report;
 The aims and objectives of each function;
 The activities undertaken by each function;
 The Business Continuity strategies;
 The overall and specific Incident Management Plans;
 The Business Continuity plans;
 Change control, preventative action, corrective action, document control and record
control processes;
 Local Authority Risk Register;

 Exercise schedule and results;

 Incident log; and
 Training program.
(c) Information Systems (IS) Auditors review risks relating to IT systems and processes;
some of them are as follows:
 Inadequate information security controls. For example - missing or out of date
antivirus controls, open ports, open systems without password or weak passwords
etc.
 Inefficient use of resources, or poor governance. For example - Huge spending on
unnecessary IT projects like printing resources, storage devices, high power servers
and workstations etc.
 Ineffective IT strategies, policies and practices including a lack of policy for use of
Information and Communication Technology (ICT) resources, Internet usage
policies, Security practices etc.
 IT-related frauds that includes phishing, hacking etc.
Question 5
(a) Discuss "Authentication of Electronic Records" with reference to the IT Act. (6 Marks)
(b) In today's fiercely competitive business environment which allows for no downtime, a
comprehensive Business Continuity Plan is of paramount importance. What are the
various components of a BCM process? (6 Marks)
(c) What is a "Protected System" under the IT Act? (4 Marks)
Answer
(a) In IT Act, 2000, Section 3 defines “Authentication of Electronic Records”. This section
provides the conditions subject to which an electronic record may be authenticated by
means of affixing Digital Signature. This will enable anybody to verify whether the
electronic record is retained intact or has been tampered with since it was so fixed with
the digital signature. It will also enable a person who has a public key to identify the
originator of the message.
The provisions stated in the Act are as follows:
Authentication of Electronic Records
(1) Subject to the provisions of this section any subscriber may authenticate an
electronic record by affixing his Digital Signature.
(2) The authentication of the electronic record shall be effected by the use of
asymmetric crypto system and hash function which envelop and transform the initial
electronic record into another electronic record.

(3) Any person by the use of a public key of the subscriber can verify the electronic
record.
(4) The private key and the public key are unique to the subscriber and constitute a
functioning key pair. [Section 3]
(b) The various components of Business Continuity Management (BCM) Process are as
follows:
 BCM – Process: The management process enables the business continuity,
capacity and capability to be established and maintained. The capacity and
capability are established in accordance to the requirements of the enterprise.
 BCM – Information Collection Process: The activities of assessment process do
the prioritization of an enterprise’s products and services and the urgency of the
activities that are required to deliver them. This sets the requirements that will
determine the selection of appropriate BCM strategies in the next process.
 BCM – Strategy Process: Finalization of business continuity strategy requires
assessment of a range of strategies. This requires an appropriate response to be
selected at an acceptable level and during and after a disruption within an
acceptable timeframe for each product or service, so that the enterprise continues
to provide those products and services.
 BCM – Development and Implementation Process: Development of a
management framework and a structure of incident management, business
continuity and business recovery and restoration plans.
 BCM – Testing and Maintenance Process: BCM testing, maintenance and audit
testify the enterprise BCM to prove the extent to which its strategies and plans are
complete, current and accurate; and Identifies opportunities for improvement.
 BCM – Training Process: Extensive trainings in BCM framework, incident
management, business continuity and business recovery and restoration plans
enable it to become part of the enterprise’s core values and provide confidence in
all stakeholders in the ability of the enterprise to cope with minimum disruptions and
loss of service.
(c) In IT Act, 2000, Section 70 defines “Protected System” that is as follows:
Protected System
(1) The appropriate Government may, by notification in the Official Gazette, declare any
computer resource which directly or indirectly affects the facility of Critical
Information Infrastructure, to be a protected system.
(2) The appropriate Government may, by order in writing, authorize the persons who
are authorized to access protected systems notified under sub-section (1).

(3) Any person who secures access or attempts to secure access to a protected system
in contravention of the provisions of this section shall be punished with
imprisonment of either description for a term which may extend to ten years and
shall also be liable to fine.
(4) The Central Government shall prescribe the information security practices and
procedures for such protected system. [Section 70]
Question 6
(a) You are appointed as the IS Auditor of a large company with multiple locations across the
globe which are connected to a common platform. What are the steps you would take as
part of your preliminary evaluation to fully comprehend the technology environment and
control issues? (6 Marks)
(b) Discuss in brief the major concerns to be addressed by an auditor in the different
activities of the Programming Management Control Phase. (6 Marks)
(c) What are the key benefits of GEIT? (4 Marks)
Answer
(a) An important task for the auditor as a part of his preliminary evaluation is to gain a good
understanding of the technology environment and related control issues. This could
include consideration of the following:
 Analysis of business processes and level of automation;
 Assessing the extent of dependence of the enterprise on Information Technology to
carry on its businesses i.e. Role of IT in the success and survival of business;
 Understanding technology architecture which could be quite diverse such as a
distributed architecture or a centralized architecture or a hybrid architecture;
 Studying network diagrams to understand physical and logical network connectivity;
 Understanding extended enterprise architecture wherein the organization systems
connect seamlessly with other stakeholders such as vendors (SCM), customers
(CRM), employees (ERM) and the government;
 Knowledge of various technologies and their advantages and limitations is a critical
competence requirement for the auditor. For example, authentication risks relating
to e-mail systems; and
 Finally, Studying Information Technology policies, standards, guidelines and
procedures.

(b) Some of the major concerns that an Auditor should address under di fferent activities
involved in Programming Management Control Phase are as under:
Phase Audit Trails
Planning  They should evaluate whether the nature of and extent of
planning are appropriate to the different types of software
that are developed or acquired.
 They must evaluate how well the planning work is being
undertaken.
Control  They must evaluate whether the nature of an extent of
control activities undertaken are appropriate for the different
types of software that are developed or acquired.
 They must gather evidence on whether the control
procedures are operating reliably. For example - they might
first choose a sample if past and current software
development and acquisition projects carried out at different
locations in the organization they are auditing.
Design  Auditors should find out whether programmers use some
type of systematic approach to design.
 Auditors can obtain evidence of the design practices used
by undertaking interviews, observations, and reviews of
documentation.
Coding Auditors should seek evidence –
 On the level of care exercised by programming
management in choosing a module implementation and
integration strategy.
 To determine whether programming management ensures
that programmers follow structured programming
conventions.
 To check whether programmers employ automated facilities
to assist them with their coding work.
Testing  Auditors can use interviews, observations, and examination
of documentation to evaluate how well unit testing is
conducted.
 Auditors are most likely concerned primarily with the quality
of integration testing work carried out by information
systems professionals rather than end users.
 Auditors primary concern is to see that whole-of-program
tests have been undertaken for all material programs and
that these tests have been well-designed and executed.

Operation and  Auditors need to ensure that effective and timely reporting
Maintenance of maintenance needs occurs and maintenance is carried
out in a well-controlled manner.
 Auditors should ensure that management has implemented
a review system and assigned responsibility for monitoring
the status of operational programs.
(c) Benefits of Governance of Enterprise IT (GEIT) are as follows:
 It provides a consistent approach integrated and aligned with the enterpr ise
governance approach.
 It ensures that IT-related decisions are made in line with the enterprise's strategies
and objectives.
 It ensures that IT-related processes are overseen effectively and transparently.
 It confirms compliance with legal and regulatory requirements.
 It ensures that the governance requirements for board members are met.
Question 7
Write short notes on any four of the following:
(a) Time Bomb vs. Logic Bomb
(b) Cloud vs. Grid Computing
(c) Boundary Control techniques
(d) Community Cloud
(e) ISO 27001 (4 x 4 = 16 Marks)
Answer
(a) Time Bomb: These are the programs that cause perverse activity, such as disruption of
computer system, modifications, or destructions of stored information etc. on a date and
time for which it has been developed. In other words, time bomb lies idle until some date
or time triggers it. The computer clock initiates it.
Logic Bomb: These are the programs that are activated by combination of events. In
other words, logic bombs lie idle until some specified circumstances trigger it. Once
triggered, the bomb sabotages the system by destroying programs, data or both.
(b) Some pertinent differences between Grid Computing and Cloud Computing are as
follows:
Grid Computing Cloud Computing
Grid Computing enables heterogeneous Cloud computing provides the facility to
resources of computers to work access shared resources and common

cooperatively and collaboratively to solve infrastructure offering services on

a scientific problem. demand over the network to perform
operations that meet changing business
needs.
While the storage computing in the grid is While in cloud computing, we can store
well suited for data-intensive storage, it is an object as low as 1 byte and as large
not economically suited for storing as 5 GB or even several terabytes.
objects as small as 1 byte. In a data grid,
the amounts of distributed data must be
large for maximum benefit.
A computational grid focuses on Cloud computing offers two types of
computationally intensive operations. instances: standard and high-CPU.
(c) Major Boundary Control Techniques are as follows:
 Cryptography: It deals with programs for transforming data into cipher text that are
meaningless to anyone, who does not possess the authentication to access the
respective system resource or file. A cryptographic technique encrypts data (clear
text) into cryptograms (cipher text) and its strength depends on the time and cost to
decipher the cipher text by a cryptanalyst.
 Passwords: User identification by an authentication mechanism with personal
characteristics like name, birth date, employee code, function, designation or a
combination of two or more of these can be used as a password boundary access
control.
 Personal Identification Numbers (PIN): PIN is similar to a password assigned to a
user by an institution a random number stored in its database; independent to a
user identification details, or a customer selected number. Hence, a PIN may be
exposed to vulnerabilities while issuance or delivery, validation, transmission and
storage.
 Identification Cards: Identification cards are used to store information required in
an authentication process. These cards are to be controlled through the application
for a card, preparation of the card, issue, use and card return or card termina tion
phases.
 Biometric Devices: Biometric identification e.g. thumb and/or finger impression,
eye retina etc. are also used as boundary control techniques.
(d) Community Cloud: In Cloud Computing, the Community Cloud is the cloud
infrastructure that is provisioned for exclusive use by a specific community of consumers
from organizations that have shared concerns (eg. mission security requirements, policy,
and compliance considerations). It may be owned, managed, and operated by one or
more of the organizations in the community, a third party or some combination of them,

and it may exist on or off premises. This model is suitable for organizations that cannot
afford a private cloud and cannot rely on the public cloud either.
Community Cloud supports Collaborative and Distributive Maintenance, Partial Security,
cost Effectiveness, collaborative work on the cloud, sharing of responsibilities among the
organizations. The limitation of the community cloud is that the autonomy of the
organization is lost and some of the security features are not as good as the private
cloud. It is not suitable in the cases where there is no collaboration.
(e) ISO 27001: ISO 27001 is the international best practice and certification standard for an
Information Security Management System (ISMS). An ISMS is a systematic approach to
manage Information security in an IS environment through which an organization
identifies, analyzes and addresses its information security risks. It encompasses people,
processes and IT Systems. ISO 27001 defines how to organise information security in
any kind of organization, profit or non-profit, private or state-owned, small or large. This
standard is the foundation of information security management that enables an
organization to get certified, which means that an independent certification body has
confirmed that information security has been implemented in the organisation as defined
policies and procedures.
The ISO 27001 can act as the extension of the current quality system to include security;
provides an opportunity to identify and manage risks to key information and systems
assets; provides confidence and assurance to trading partners and clients; acts as a
marketing tool and allows an independent review and assurance to you on information
security practices.

Question 1
XYZ Appliances Ltd., is a popular marketing company, which has branches in any locations. It
does all its business activities on-line such as exchanging information relating to the buying
and selling of goods, distribution information and providing customer support. With the
increase in business activities and increase in regulations, the company is facing several
problems with its existing information system. It realizes that the existing Information System
has to be improved and proper controls have to be incorporated. It wishes to enhance the
existing Information System and put in sufficient measures to ensure security of data and
protect the company against breaches caused by security failures. The company has decided
to use a third party site for backup and recovery procedures. To develop the new system the
company formed a full-fledged System Development team. The team followed all the phases
in the SDLC and implemented the new system successfully.
The company was also satisfied with the post-implementation audit report. Answer the
following questions based on the above:
(a) As a system development team member, explain the areas that should be studied in
depth to understand the present system.
(b) Discuss the activities that deal with the Systems Development Management Controls in
the IT set-up.
(c) What are the issues that the security administrators should consider when drafting the
contract with a third party for a backup and recovery site?
(d) As an IS auditor, how do you evaluate the performance of the following Managerial
Controls: [i] Data Resource Management Controls and [ii] Security Management
Controls. (5 x 4 = 20 Marks)
Answer
(a) As a System development team member, following areas should be studied to
understand the present system:
♦ Reviewing Historical Aspects: The historical facts of an organization enable the
system analyst to identify the major turning points and milestones that have
influenced its growth. A review of annual reports and organization charts can
identify the growth of management levels as well as the development of various
functional areas and departments. The system analyst should investigate ‘what
system changes have occurred in the past including operations’ that have been
successful or unsuccessful with computer equipment and techniques.

♦ Analyzing Inputs: A detailed analysis of present inputs is important since they are
basic to the manipulation of data. Source documents are used to capture the
originating data for any type of system. The system analyst should be aware of
various sources from where the data are initially captured, keeping in view the fact
that outputs for one area may serve as an input for another area. The system
analyst must understand the nature of each form, ‘what is contained in it’, ‘who
prepared it’, ‘from where the form is initiated’, ‘where it is completed’, the
distribution of the form and other similar considerations.
♦ Reviewing Data Files: The analyst should investigate the data files maintained by
each department, noting their number and size, where they are located, who uses
them and the number of times per given time interval, these are used. Information
on common data files and their size will be an important factor, which will influence
the new information system. The system analyst should also review all on-line and
off-line files, which are maintained in the organization as it will reveal information
about data that are not contained in any outputs.
♦ Reviewing Methods, Procedures and Data Communications: Methods and
procedures transform input data into useful output. A procedure review is an
intensive survey of the methods by which each job is accomplished, the equipment
utilized and the actual location of the operations. Its basic objective is to eliminate
unnecessary tasks or to perceive improvement opportunities in the present
information system. A system analyst also needs to review and understand the
present data communications used by the organization. S/he must review the types
of data communication equipment including data interface, data links, modems, dial-
up and leased lines and multiplexers. The system analyst must understand how the
data-communications network is used in the present system so as to identify the
need to revamp the network when the new system is installed.
♦ Analyzing Outputs: The outputs or reports should be scrutinized by the system
analysts in order to determine “how well they will meet the organization’s needs”.
The analysts must understand what information is needed and why, who needs it
and when and where it is needed. Additional questions concerning the sequence of
the data, how often the form reporting is used, how long it is kept on file, etc. must
be investigated.
♦ Reviewing Internal Controls: A detailed investigation of the present information
system is not complete until internal control mechanism is reviewed. Locating the
control points helps the analyst to visualize the essential parts and framework of a
system. An examination of the present system of internal controls may indicate
weaknesses that should be removed in the new system. The adoption of advanced
methods, procedures and equipment might allow much greater control over the
data.

32 FINAL EXAMINATION: NOVEMBER, 2017
♦ Modeling the Existing System: As the logic of inputs, methods, procedures, data
files, data communications, reports, internal controls and other important items are
reviewed and analyzed in a top down manner; the processes must be properly
documented. The flow charting and diagramming of present information not only
organizes the facts, but also helps to disclose gaps and duplication in the data
gathered. It allows a thorough comprehension of the numerous details and related
problems in the present operation.
♦ Undertaking Overall Analysis of the Existing system: Based upon the aforesaid
investigation of the present information system, the final phase of the detailed
investigation includes the analysis of the present work volume; the current
personnel requirements; the present costs-benefits of each of these must be
investigated thoroughly.
(b) The activities that deal with Systems Development Management Controls in the IT setup
are as follows:
♦ System Authorization Activities: All systems must be properly authorized to
ensure their economic justification and feasibility. As with any transaction, system’s
authorization should be formal. This requires that each new system request be
submitted in written form by users to systems professionals who have both the
expertise and authority to evaluate and approve (or reject) the request.
♦ User Specification Activities: Users must be actively involved in the systems
development process. User involvement should not be ignored because of a high
degree of technical complexity in the system. Regardless of the technology
involved, the user can create a detailed written description of the logical needs that
must be satisfied by the system. The creation of a user specification document often
involves the joint efforts of the user and systems professionals.
♦ Technical Design Activities: The technical design activities in the Systems
Development Life Cycle (SDLC) translate the user specifications into a set of
detailed technical specifications of a system that meets the user's needs. The scope
of these activities includes systems analysis, general systems design, feasibility
analysis, and detailed systems design. The adequacy of these activities is
measured by the quality of the documentation that emerges from each phase.
♦ Internal Auditor’s Participation: The internal auditor plays an important role in the
control of systems development activities, particularly in organizations whose users
lack technical expertise. The auditor should become involved at the inception of the
SDLC process to make conceptual suggestions regarding system requirements and
controls. Auditor’s involvement should be continued throughout all phases of the
development process and into the maintenance phase.
♦ Program Testing: All program modules must be thoroughly tested before they are
implemented. The results of the tests are then compared against predetermined

results to identify programming and logic errors. To facilitate the efficient

implementation of audit objectives, test data prepared during the implementation
phase must be preserved for future use. This will give the auditor a frame of
reference for designing and evaluating future audit tests
♦ User Test and Acceptance Procedures: Just before implementation, the individual
modules of the system must be tested as a unified whole. A test team comprising
user personnel, systems professionals, and internal audit personnel subjects the
system to rigorous testing. Once the test team is satisfied that the system meets its
stated requirements, the system is formally accepted by the user department(s).
The formal test and acceptance of the system should consider being the most
important control over the SDLC.
(c) If a third-party site is to be used for backup and recovery purposes, security
administrators must ensure that a contract is written to cover issues such as -
♦ how soon the site will be made available subsequent to a disaster;
♦ the number of organizations that will be allowed to use the site concurrently in the
event of a disaster;
♦ the priority to be given to concurrent users of the site in the event of a common
disaster;
♦ the period during which the site can be used;
♦ the conditions under which the site can be used;
♦ the facilities and services the site provider agrees to make available; and
♦ What controls will be in place and working at the off-site facility?
(d) (i) To evaluate the performance of Data Resource Management Controls under
Managerial Controls, an IS Auditor -
 Should determine what controls are exercised to maintain data integrity. They
might also interview database users to determine their level of awareness of
these controls.
 Might employ test data to evaluate whether access controls and update
controls are working.
(ii) To evaluate the performance of Security Management Controls under Managerial
Controls, an IS Auditor -
 must evaluate whether security administrators are conducting ongoing, high-
quality security reviews or not;
 checks whether the organizations audited have appropriate, high-quality
disaster recovery plan in place; and

 Checks whether the organizations have opted for an appropriate insurance

plan or not.
Question 2
(a) What are the key management practices to be implemented for evaluating Business
Value from the use of IT? State any three-key metrics which can be used for such
evaluation.
(b) State any six objectives of the National Cyber Security Policy 2013 issued by the
Government of India.
(c) Briefly explain any four features of Electronic mail. (6 + 6 + 4 = 16 Marks)
Answer
(a) The key management practices, which need to be implemented for ‘evaluating business
value is derived from the use of Information Technology (IT)’, are highlighted as under:
♦ Evaluate Value Optimization: Continually evaluate the portfolio of IT enabled
investments, services and assets to determine the likelihood of achieving enterprise
objectives and delivering value at a reasonable cost. Identify and make judgment on
any changes in direction that need to be given to management to optimize value
creation.
♦ Direct Value Optimization: Direct value management principles and practices to
enable optimal value realization from IT enabled investments throughout their full
economic life cycle.
♦ Monitor Value Optimization: Monitor the key goals and metrics to determine the
extent to which the business is generating the expected value and benefits to the
enterprise from IT-enabled investments and services. Identify significant issues and
consider corrective actions.
Some of the key metrics, which can be used for such evaluation, are as follows:
♦ Percentage of IT enabled investments where benefit realization monitored through
full economic life cycle;
♦ Percentage of IT services where expected benefits realized;
♦ Percentage of IT enabled investments where claimed benefits met or exceeded;
♦ Percentage of investment business cases with clearly defined and approved
expected IT related costs and benefits;
♦ Percentage of IT services with clearly defined and approved operational costs and
expected benefits; and
♦ Satisfaction survey of key stakeholders regarding the transparency, understanding
and accuracy of IT financial information.

(b) Major objectives of the National Cyber Security Policy 2013 policy issued by the
Government of India are as follows:
♦ To create a secure cyber ecosystem in the country, generate adequate trust and
confidence in IT systems and transactions in cyberspace and thereby enhance
adoption of IT in all sectors of the economy;
♦ To create an assurance framework for design of security policies and for promotion
and enabling actions for compliance to global security standards and best practices
by way of conformity assessment (product, process, technology, and people);
♦ To strengthen the Regulatory framework for ensuring a Secure Cyberspace
ecosystem;
♦ To enhance and create National and Sectorial level 24x7 mechanisms for obtaining
strategic information regarding threats of Information and Communication
Technologies (ICT) infrastructure creating scenarios for response, resolution and
crisis management through effective predicative, protective, response and recovery
actions;
♦ To enhance the protection and resilience of Nation’s critical information
infrastructure by operating a 24x7 National Critical Information Infrastructure
Protection Center(NCIIPC) and mandating security practices related to the design,
acquisition, development and operation of information resources;
♦ To develop suitable indigenous security technologies through frontier technology
research, solution oriented research, proof of concept, and pilot development of
secure ICT products/processes in general and specifically for addressing National
Security requirements;
♦ To improve visibility of the integrity of Information and Communication Technology
products and services and establishing infrastructure for testing & validation of
security of such products;
♦ To create a workforce of 500,000 professional skilled in cyber security in the next 5
years through capacity building, skill development and training;
♦ To provide fiscal benefits to businesses for adoption of standard security practices
and processes;
♦ To enable protection of information while in process, handling, storage & transit so
as to Safeguard privacy of citizen’s data and for reducing economic losses due to
cybercrime or data theft;
♦ To enable effective prevention, investigation and prosecution of cybercrime and
enhancements of law enforcement capabilities through appropriate legislative
intervention;

♦ To create a culture of cyber security and privacy enabling responsible user behavior
& actions through an effective communication and promotion strategy;
♦ To develop effective public private partnerships and collaborative engagements
through technical and operational and contribution for enhancing the security of
cyberspace and
♦ To enhance global cooperation by promoting shared understanding and leveraging
relationships for furthering the cause of security of cyberspace.
(c) Various features of Electronic mail are stated below:
♦ Electronic Transmission: The transmission of messages with email is electronic
and message delivery is very quick, almost instantaneous. The confirmation of
transmission is also quick and the reliability is very high.
♦ Online Development and Editing: The email message can be developed and
edited online before transmission. The online development and editing eliminates
the need for use of paper in communication and facilitates the storage of messages
on magnetic media, thereby reducing the space required to store the messages.
♦ Broadcasting and Rerouting: Email permits sending a message to many target
recipients. Thus, it is easy to send a circular to all branches of a bank using Email
resulting in a lot of saving of paper. The email could be rerouted to people having
direct interest in the message with or without changing or and appending related
information to the message.
♦ Integration with other Information Systems: The E-mail has the advantage of
being integrated with the other information systems that helps in ensuring that the
message is accurate and the information required for the message is accessed
quickly.
♦ Portability: Email renders the physical location of the recipient and sender
irrelevant. The email can be accessed from any Personal Computer/tablet/smart
phones equipped with the relevant communication hardware, software and link
facilities.
♦ Economical: Email is one of the most economical modes for sending and receiving
messages. Since the speed of transmission is increasing, the time and cost on
communication media per page is very less. Thus, email is very helpful not only for
formal communication but also for informal communication within the enterprise.
Question 3
(a) Based on the Institute of Internal Auditors (IIA) guidance, briefly explain any six sample
areas which can be reviewed by Internal Auditors as part of the review of GRC.
(b) List the components of the Information Security Policy.
(c) What is meant by the Core Banking System (CBS)? List its elements. (6 + 6 + 4 Marks)

Answer
(a) Based on the Institute of Internal Auditors (IIA) guidance, the sample areas which can be
reviewed by Internal Auditors as part of review of Governance, Risk and Compliance
(GRC) are as follows:
♦ Scope: The internal audit activity must evaluate and contribute to the improvement
of governance, risk management, and control processes using a systematic and
disciplined approach.
♦ Governance: The internal audit activity must assess and make appropriate
recommendations for improving the governance process in its accomplishment of
the objectives like promoting appropriate ethics and values within the organization;
ensuring effective organizational performance management and accountability;
communicating risk and control information to appropriate areas of the organization;
and coordinating the activities of and communicating information among the board,
external and internal auditors, and management.
♦ Evaluate Enterprise Ethics: The internal audit activity must evaluate the design,
implementation, and effectiveness of the organization’s ethics related objectives,
programs, and activities. The internal audit activity must assess whether the
information technology governance of the organization supports the organization’s
strategies and objectives.
♦ Risk Management: The internal audit activity must evaluate the effectiveness and
contribute to the improvement of risk management processes.
♦ Interpretation: This determines whether risk management processes are effective
in a judgment resulting from the internal auditor’s assessment that organizational
objectives support and align with the organization’s mission; significant risks are
identified and assessed; appropriate risk responses are selected that align risks
with the organization’s risk appetite; and relevant risk information is captured and
communicated in a timely manner across the organization, enabling staff,
management, and the board to carry out their responsibilities.
♦ Risk Management Process: The internal audit activity may gather the information
to support this assessment during multiple engagements. The results of these
engagements, when viewed together, provide an understanding of the
organization’s risk management processes and their effectiveness. Risk
management processes are monitored through on-going management activities,
separate evaluations, or both.
♦ Evaluate Risk Exposures: The internal audit activity must evaluate risk exposures
relating to the organization’s governance, operations, and information systems
regarding the achievement of the organization’s strategic objectives; reliability and
integrity of financial and operational information; effectiveness and efficiency of

operations and programs; safeguarding of assets; and compliance with laws,

regulations, policies, procedures, and contracts.
♦ Evaluate Fraud and Fraud Risk: The internal audit activity must evaluate the
potential for the occurrence of fraud and how the organization manages fraud risk.
♦ Address Adequacy of Risk Management Process: During consulting
engagements, internal auditors must address risk consistent with the engagement’s
objectives and be alert to the existence of other significant risks. Internal auditors
must incorporate knowledge of risks gained from consulting engagements into their
evaluation of the organization’s risk management processes. When assisting
management in establishing or improving risk management processes, internal
auditors must refrain from assuming any management responsibility by actually
managing risks.
(b) The components of the Information Security Policy are as follows:
♦ Purpose and Scope of the Document and the intended audience;
♦ The Security Infrastructure;
♦ Security policy document maintenance and compliance requirements;
♦ Incident response mechanism and incident reporting;
♦ Security organization Structure;
♦ Inventory and Classification of assets;
♦ Description of technologies and computing structure;
♦ Physical and Environmental Security;
♦ Identity Management and access control;
♦ Information Technology (IT) Operations management;
♦ IT Communications;
♦ System Development and Maintenance Controls;
♦ Business Continuity Planning;
♦ Legal Compliances; and
♦ Monitoring and Auditing Requirements.
(c) Core Banking System (CBS) - Core Banking is a banking services provided by a group
of networked bank branches where customers may access their bank account and
perform basic transactions from any of the member branch offices. Core Banking System
(CBS) may be defined as a back-end system that processes daily banking transactions,
and posts updates to accounts and other financial records. These systems typically
include deposit, loan and credit-processing capabilities, with interfaces to general ledger

systems and reporting tools. Core banking functions differ depending on the specific type
of bank. Banks make these services available across multiple channels like ATMs,
Internet banking, and branches.
Elements of core banking include the following:
♦ Making and servicing loans.
♦ Opening new accounts.
♦ Processing cash deposits and withdrawals.
♦ Processing payments and cheques.
♦ Calculating interest.
♦ Customer Relationship Management (CRM) activities.
♦ Managing customer accounts.
♦ Establishing criteria for minimum balances, interest rates, number of withdrawals
allowed and so on.
♦ Establishing interest rates.
♦ Maintaining records for all the bank’s transactions.
Question 4
(a) While developing a Business Continuity Plan what are the key tasks that should be
covered in the second phase 'Vulnerability Assessment and General definition of
Requirement'?
(b) What is the definition of the following terms III the Information Technology, Act?
[i] Computer resource [ii] Digital signature [iii] Electronic record [iv] Private key [v] Public
key and [vi] Secure System.
(c) What are the key steps to be followed in a risk based approach to make an audit plan?
(6 + 6 + 4 = 16 Marks)
Answer
(a) Following key tasks should be covered in the second phase ‘Vulnerability Assessment
and General Definition of Requirements’ while developing a Business Continuity Plan
(BCP).
♦ A thorough Security Assessment of the computing and communications
environment including personnel practices; physical security; operating procedures;
backup and contingency planning; systems development and maintenance;
database security; data and voice communications security; systems and access
control software security; insurance; security planning and administration;
application controls; and personal computers.

♦ The Security Assessment will enable the project team to improve any existing
emergency plans and disaster prevention measures and to implement required
emergency plans and disaster prevention measures where none exist.
♦ Present findings and recommendations resulting from the activities of the Security
Assessment to the Steering Committee so that corrective actions can be initiated in
a timely manner.
♦ Define the scope of the planning effort.
♦ Analyze, recommend and purchase the recovery planning and maintenance
software required to support the development of the plans and to maintain the plans
current following implementation.
♦ Develop a Plan Framework.
♦ Assemble Project Team and conduct awareness sessions.
(b) The definitions as per Information Technology Act, 2000 (Amended) are as follows:
(i) "Computer Resource" means computer, communication device, computer system,
computer network, data, computer database or software.
(ii) "Digital Signature" means authentication of any electronic record by a subscriber
by means of an electronic method or procedure in accordance with the provisions of
Section 3 of the Act.
(iii) "Electronic Record" means data, record or data generated, image or sound stored,
received or sent in an electronic form or micro film or computer generated micro fiche.
(iv) “Private Key" means the key of a key pair used to create a digital signature.
(v) “Public Key" means the key of a key pair used to verify a digital signature and
listed in the Digital Signature Certificate.
(vi) “Secure System" means computer hardware, software, and procedures that are
reasonably secure from unauthorized access and misuse; provide a reasonable
level of reliability and correct operation; are reasonably suited to performing the
intended functions; and adhere to generally accepted security procedures.
(c) The steps that can be followed for a Risk-based approach to make an audit plan are as
follows:
♦ Inventory the information systems in use in the organization and categorize them.
♦ Determine which of the systems impact critical functions or assets, such as money,
materials, customers, decision making, and how close to real time they operate.
♦ Assess what risks affect these systems and the severity of the impact on the
business.

♦ Based on the above assessment, decide the audit priority, resources, schedule and
frequency.
Question 5
(a) How can Audit Trails be used to support security objectives? Briefly explain.
(b) With respect to Top Management and in IS management control, the major activities that
the senior management must perform are: Planning, Organising, Leading and Controlling
in the Information System functions. Explain the role of the IS auditor in any three of the
above-mentioned activities.
(c) What is BCP? What are the three areas it should cover? (6 + 6 + 4 = 16 Marks)
Answer
(a) Audit trails can be used to support security objectives in three ways:
♦ Detecting Unauthorized Access: Detecting unauthorized access can occur in real
time or after the fact. The primary objective of real-time detection is to protect the
system from outsiders who are attempting to breach system controls. A real-time
audit trail can be used to report on changes in system performance that may
indicate infestation by a virus or worm. Depending upon how much activity is being
logged and reviewed; real-time detection can impose a significant overhead on the
operating system, which can degrade operational performance. After-the-fact,
detection logs can be stored electronically and reviewed periodically or as needed.
When properly designed, they can be used to determine if unauthorized access was
accomplished, or attempted and failed.
♦ Reconstructing Events: Audit analysis can be used to reconstruct the steps that
led to events such as system failures, security violations by individuals, or
application processing errors. Knowledge of the conditions that existed at the time
of a system failure can be used to assign responsibility and to avoid similar
situations in the future. Audit trail analysis also plays an important role in accounting
control. For example, by maintaining a record of all changes to account balances;
the audit trail can be used to reconstruct accounting data files that were corrupted
by a system failure.
♦ Personal Accountability: Audit trails can be used to monitor user activity at the
lowest level of detail. This capability is a preventive control that can be used to
influence behavior. Individuals are likely to violate an organization’s security
policy if they know that their actions are not recorded in an audit log.
(b) With respect to Top Management and Information Systems Management Control, the
major activities that the senior management must perform are Planning, Organizing,
Leading and Controlling in the Information System functions. The Role of Information
Systems (IS) auditor at each activity is discussed below:

♦ Planning: Auditors need to evaluate whether top management has formulated a

high-quality Information System’s plan that is appropriate to the needs of an
organization or not. A poor-quality information system is ineffective and inefficient
leading to losing of its competitive position within the marketplace.
♦ Organizing: Auditors should be concerned about how well top management
acquires and manages staff resources for three reasons:
 The effectiveness of the IS function depends primarily on the quality of its staff.
The IS staff need to remain up to date and motivated in their jobs.
 Intense competition and high turnover have made acquiring and retaining good
information system staff a complex activity.
 Empirical research indicates that the employees of an organization are the
most likely persons to perpetrate irregularities.
♦ Leading: Generally, the auditors examine variables that often indicate when
motivation problems exist or suggest poor leadership – for example, staff turnover
statistics, frequent failure of projects to meet their budget and absenteeism level to
evaluate the leading function. Auditors may use both formal and informal sources of
evidence to evaluate how well top managers communicate with their staff. The
formal sources include IS plans, documents standards and policies whereas the
informal sources of evidence include interviews with IS staff about their level of
satisfaction with the top management. Auditors must try to assess both the short-run
and long-run consequences of poor communications within the information systems
function and to assess the implications for asset safeguarding, data integrity,
system effectiveness, and system efficiency.
♦ Controlling: Auditors should focus on subset of the control activities that should be
performed by top management – namely, those aimed at ensuring that the
information systems function accomplishes its objectives at a global level. Auditors
must evaluate whether top management’s choice to the means of control over the
users of IS services is likely to be effective or not.
(c) Business Continuity Planning (BCP): It is the creation and validation of a practical
logistical plan for how an enterprise will recover and restore partially or completely
interrupted critical (urgent) functions within a predetermined time after a disaster or
extended disruption. The logistical plan is called business continuity plan.
Alternate Definition of BCP: It refers to the ability of enterprises to recover from a
disaster and continue operations with least impact. It is imperative that every enterprise
has a business continuity plan as relevant to the activities of the enterprise.
Business Continuity Planning should cover the following areas:
♦ Business Resumption Planning: This is the operation’s piece of business
continuity planning.

♦ Disaster Recovery Planning: This is the technological aspect of business

continuity planning, the advance planning and preparation necessary to minimize
losses and ensure continuity of critical business functions of the organization in the
event of disaster.
♦ Crisis Management: This is the overall co-ordination of an organization’s response
to a crisis in an effective timely manner, with the goal of avoiding or minimizing
damage to the organization’s profitability, reputation or ability to operate.
Question 6
(a) What does RAD refer to? Briefly explain any five features of RAD.
(b) What are the various types of Application Controls? Explain each control with reference
to their performance and the reliability.
(c) Briefly explain the various Output Controls. (6 + 6 + 4 = 16 Marks)
Answer
(a) Rapid Application Development (RAD): RAD refers to a type of software development
methodology; which uses minimal planning in favor of rapid prototyping. The planning of
software developed using RAD is interleaved with writing the software itself. The lack of
extensive pre-planning generally allows software to be written much faster, and makes it
easier to change requirements.
The key features of RAD include the following:
♦ Key objective is fast development and delivery of a high-quality system at a
relatively low investment cost,
♦ Attempts to reduce inherent project risk by breaking a project into smaller segments
and providing more ease-of-change during the development process.
♦ Aims to produce high quality systems quickly, primarily using iterative Prototyping,
active user involvement, and computerized development tools. Graphical User
Interface (GUI) builders, Computer Aided Software Engineering (CASE) tools,
Database Management Systems (DBMS), Fourth generation programming
languages, Code generators and object-oriented techniques etc.
♦ Key emphasis is on fulfilling the business need while technological or engineering
excellence is of lesser importance.
♦ Project control involves prioritizing development and defining delivery deadlines or
“time boxes.” If the project starts to slip, emphasis is on reducing requirements to fit
the time box, not in increasing the deadline.
♦ Generally, includes Joint Application Development (JAD), where users are intensely
involved in system design, either through consensus building in structured
workshops, or through electronically facilitated interaction.

♦ Active user involvement is imperative.

♦ Iteratively produces production software, as opposed to a throwaway prototype.
♦ Produces documentation necessary to facilitate future development and
maintenance.
♦ Standard systems analysis and design techniques can be fitted into this framework.
(b) Various types of Application Controls are as follows:
♦ Boundary Controls,
♦ Input Controls,
♦ Communication Controls,
♦ Processing Controls,
♦ Database Controls, and
♦ Output Controls
These controls enhance the performance and provide greater reliability.
1. Boundary Controls: This maintains the chronology of events that occur when a
user attempts to gain access to and employ systems resources. The major controls
of the boundary system are the access control mechanisms. Access controls
mechanism links the authentic users to the authorized resources, they are permitted
to access. The access control mechanism has three steps of Identification,
Authentication and Authorization with respect to the access control policy. Major
Boundary Control techniques are Cryptography, Passwords, Personal Identification
Numbers (PIN), Identification Cards and Biometric Devices.
2. Input Controls: These controls are responsible for ensuring the accuracy and
completeness of data and instruction input into an application system. Controls
relating to data input are critical. It might be necessary to reprocess input data in the
event, master files are lost, corrupted, or destroyed. Controls relating to instructions
are often in the form of changes to data, which are recorded in the audit trail. Thus,
source documents or transaction listings are to be stored securely for longer periods
for reasons – compliance with statutory requirements. Input controls are divided into
Source Document Controls, Data Coding Controls, Batch Controls, and Validation
Controls which use different control procedures to achieve the objective.
3. Communication Controls: These controls emphasize upon exposures in the
communication subsystem; controls over physical components, communication line
errors, flows, and links; topological controls, channel access controls, controls over
subversive attacks, internetworking controls, and communication architecture
controls.

4. Processing Controls: The processing subsystem is responsible for computing,

sorting, classifying, and summarizing data. Its major components are the Central
Processor in which programs are executed, the real or virtual memory in which
program instructions and data are stored, the operating system that manages
system resources, and the application programs that execute instructions to achieve
specific user requirements. Processor Controls, Real Memory Controls, Virtual
Memory Controls and Data Processing Controls together ensure fast and reliable
processing of the data.
5. Database Controls: The controls that protect the integrity of a database when
application software acts as an interface to interact between the user and the
database are called Update Controls and Report Controls. Major update controls
are Sequence Check between Transaction and Master Files; Ensuring of processing
of all records on files, processing of multiple transactions for a single record in the
correct order and maintenance of a suspense account. Major Report Controls are
Standing Data, Print-Run-to Run Control Totals, Print Suspense Account Entries
and Existence/Recovery Controls.
6. Output Controls: These controls ensure that the data delivered to users will be
presented, formatted and delivered in a consistent and secured manner. Output can
either be a printed data report or a database file in a removable media such as a
CD-ROM or it can be a Word document on the computer’s hard disk. Whatever the
type of output, it should be ensured that the confidentiality and integrity of the
output is maintained and that the output is consistent. Various Output Controls are
Storage and logging of sensitive, critical forms, Logging of output program
executions, Spooling/queuing, Controls over printing, Report distribution and
collection controls and Retention controls.
(c) Various Output Controls are as follows:
♦ Storage and logging of sensitive, critical forms: Pre-printed stationery should be
stored securely to prevent unauthorized destruction or removal and usage. Only
authorized persons should be allowed access to stationery supplies such as security
forms, negotiable instruments, etc.
♦ Logging of output program executions: When programs used for output of data
are executed, these should be logged and monitored; otherwise
confidentiality/integrity of the data may be compromised.
♦ Spooling/queuing: “Spool” is an acronym for “Simultaneous Peripherals
Operations Online”. This is a process used to ensure that the user can continue
working, while the print operation is getting completed. When a file is to be printed,
the operating system stores the data stream to be sent to the printer in a temporary
file on the hard disk. This file is then “spooled” to the printer as soon as the printer
is ready to accept the data. This intermediate storage of output could lead to
unauthorized disclosure and/or modification. A queue is the list of documents

waiting to be printed on a printer; this should not be subject to unauthorized

modifications.
♦ Controls over printing: Outputs should be made on the correct printer and it
should be ensured that unauthorized disclosure of information printed does not take
place. Users must be trained to select the correct printer and access restrictions
may be placed on the workstations that can be used for printing.
♦ Report distribution and collection controls: Distribution of reports should be
made in a secure way to prevent unauthorized disclosure of data. It should be made
immediately after printing to ensure that the time gap between generation and
distribution is reduced. A log should be maintained for reports that were generated
and to whom these were distributed. Where users have to collect reports, the user
should be responsible for timely collection of the report, especially if it is printed in a
public area. A log should be maintained about reports that were printed and
collected. Uncollected reports should be stored securely.
♦ Retention controls: Retention controls consider the duration for which outputs
should be retained before being destroyed. Consideration should be given to the
type of medium on which the output is stored. Retention control requires that a date
should be determined for each output item produced. Various factors ranging from
the need of the output, use of the output, to legislative requirements would affect
the retention period.
Question 7
(a) Components in COBIT
(b) Constraints in operating MIS
(c) Fact finding tools and techniques
(d) The services provided by the SaaS model of Cloud Computing
(e) Back-end architecture of cloud computing (4 x 4 = 16 Marks)
Answer
(a) Components in COBIT are as follows:
♦ Framework -Organize IT governance objectives and good practices by IT domains
and processes, and links them to business requirements;
♦ Process Descriptions -A reference process model and common language for
everyone in an organization. The processes map to responsibility areas of plan,
build, run and monitor.
♦ Control Objectives - Provide a complete set of high-level requirements to be
considered by management for effective control of each IT process.

♦ Management Guidelines -Help assign responsibility, agree on objectives, measure

performance, and illustrate interrelationship with other processes
♦ Maturity Models -Assess maturity and capability per process and helps to address
gaps.
(b) Major constraints, which come in the way of operating Management Information Systems
(MIS) are as follows:
♦ Non-availability of experts, who can diagnose the objectives of the organization and
provide a desired direction for installing operating system. This problem may be
overcome by grooming internal staff, which should be preceded by proper selection
and training.
♦ Experts usually face the problem of selecting the sub-system of MIS to be installed
and operated upon. The criteria, which should guide the experts, depend upon the
need and importance of a function for which MIS can be installed first.
♦ Due to varied objectives of business concerns, the approach adopted by experts for
designing and implementing MIS is a non-standardized one.
♦ Non-availability of cooperation from staff is a crucial problem, which should be
handled tactfully. This task should be carried out by organizing lecturers, showing
films and also explaining to them the utility of the system. Besides this, some
persons should also be involved in the development and implementation of the
system.
(c) Various fact-finding techniques/tools used by the system analyst for determining
Systems’ needs/requirements are as below:
♦ Documents: Document means manuals, input forms, output forms, diagrams of
how the current system works, organization charts showing hierarchy of users and
manager responsibilities, job descriptions for the people, who work with the current
system, procedure manuals, program codes for the applications associated with the
current system, etc. Documents are a very good source of information about user
needs and the current system.
♦ Questionnaires: Users and managers are asked to complete questionnaire about
the information systems when the traditional system development approach is
chosen. The main strength of questionnaires is that a large amount of data can be
collected through a variety of users quickly. Also, if the questionnaire is skillfully
drafted, responses can be analyzed rapidly with the help of a computer.
♦ Interviews: Users and managers may also be interviewed to extract information in
depth. The data gathered through interviews often provide system developers with a
larger picture of the problems and opportunities. Interviews also give analyst the
opportunity to observe and record first-hand user reaction and to probe for further
information.

♦ Observation: In general, and particularly in prototyping approaches, observation

plays a central role in requirement analysis. Only by observing how users react to
prototypes of a new system, the system can be successfully developed.
(d) The services provided by Software as a Service (SaaS) Model of Cloud Computing are
as follows:
♦ Business Services: SaaS providers provide a variety of business services to
startup companies that include ERP, CRM, billing, sales, and human resources.
♦ Social Networks: Since the number of users of the social networking sites is
increasing exponentially, cloud computing is the perfect match for handling the
variable load.
♦ Document Management: Most of the SaaS providers provide services to create,
manage, and track electronic documents as most of the enterprises extensively use
electronic documents.
♦ Mail Services: To handle the unpredictable number of users and the load on e-mail
services, most of the email providers offer their services as SaaS services.
(e) Back End Architecture of Cloud Computing
The Cloud computing architecture consists of a Front End and a Back End connected to
each other through a network, usually the Internet. The Front End is the side, the
computer user sees and interacts through, and the Back End is the “cloud” section of the
system, truly facilitating the services. Back End refers to some service facilitating
peripherals. In cloud computing, the back end is cloud itself, which may encompass
various computer machines, data storage systems and servers. Groups of these clouds
make up a whole cloud computing system. Theoretically, a cloud computing system can
include any type of web application program such as video games to applications for data
processing, software development and entertainment. Usually, every application would
have its individual dedicated server for services.

Question 1
ABC Corporation desires to implement an Expert System to manage suspicious transactions,
financial forecast, etc. in order to facilitate informed decision making, by various stake holders
of the corporation. You have been appointed as IT manager to setup domain-specific and high
quality knowledge based system and to enhance internal controls to maintain data integrity and
security. Moreover, to help managers in making better decisions, the company decided to
develop and implement Information System following System Development Life Cycle (SDLC)
approach of system development. The top management of the Corporation is seeking your views
on the following issues to be explained in brief:
(a) Some of the business application areas of Expert System.
(b) Knowledge areas required by a business manager to operate Information System in
effective and efficient manner.
(c) Interrelated components of internal controls as per COSO (Committee of Sponsoring
Organization)
(d) Various evaluation methods in post implementation review in respect to user satisfaction
with the Information System. (4 x 5 = 20 Marks)
Answer
(a) Some of the business application areas of Expert Systems are as follows:
• Accounting and Finance - It provides tax advice and assistance, helping with credit-
authorization decisions, selecting forecasting models, providing investment advice.
• Marketing - It provides establishing sales quotas, responding to customer inquiries,
referring problems to telemarketing centers, assisting with marketing timing
decisions, determining discount policies.
• Manufacturing - It helps in determining whether a process is running correctly,
analyzing quality and providing corrective measures, maintaining facilities,
scheduling job-shop tasks, selecting transportation routes, assisting with product
design and faculty layouts.
• Personnel - It is useful in assessing applicant qualifications and assisting employees
in filling out forms.
• General Business - It helps in assisting with project proposals, recommending
acquisition strategies, educating trainees, and evaluating performance.

(b) To operate Information Systems (IS) effectively and efficiently, a business manager should
have knowledge in the following areas:
• Foundation Concepts – It includes fundamental business and managerial concepts
e.g. ‘what are components of a system and their functions’, or ‘what competitive
strategies are required’.
• Information Technologies (IT) – It includes operation, development and
management of hardware, software, data management, networks and other
technologies.
• Business Applications – It includes major uses of IT in business steps i.e.
processes, operations, decision making, and strategic/competitive advantage.
• Development Processes – It comprises how end users and Information Systems
specialists develop and execute business/IT solutions to problems.
• Management Challenges – It includes ‘how the function and IT resources are
maintained’ and utilized to attain top performance and build the business strategies.
(c) As per COSO (Committee of Sponsoring Organization), Internal Control is comprised of
following five interrelated components:
• Control Environment: This includes the elements that establish the control context
in which specific accounting systems and control procedures must operate. The
control environment is manifested in management’s operating style, the ways
authority and responsibility are assigned, the functional method of the audit
committee, the methods used to plan and monitor performance and so on. For each
business process, an organization needs to develop and maintain a control
environment including categorizing the criticality and materiality of each business
process, plus the owners of the business process.
• Risk Assessment: This includes the elements that identify and analyse the risks
faced by an organisation and the way the risk can be managed. Both external and
internal auditors are concerned with errors or irregularities that cause material losses
to an organisation. Each business process comes with various risks. A control
environment must include an assessment of the risks associated with each business
process.
• Control Activities: This includes the elements that operate to ensure transactions
are authorized, duties are segregated, adequate documents and records are
maintained, assets and records are safeguarded and independent checks on
performance and valuation of records. These are called accounting controls. Internal
auditors are also concerned with administrative controls to achieve effectiveness and
efficiency objectives. Control activities must be developed to manage, mitigate, and
reduce the risks associated with each business process. It is unrealistic to expect to
eliminate risks completely.

• Information and Communication: These are the elements, in which information is

identified, captured and exchanged in a timely and appropriate form to allow
personnel to discharge their responsibilities. These are associated with control
activities regarding information and communication systems of the entity that acts as
one of the components of internal accounting system. These enable an organization
to capture and exchange the information needed to conduct, manage, and control its
business processes.
• Monitoring: The internal control process must be continuously monitored with
modifications made as warranted by changing conditions. This includes the elements
that ensure internal controls operate reliably over time. The best internal controls are
worthless if the company does not monitor them and make changes when they are
not working.
(d) Various evaluation methods in post-implementation review in respect to user satisfaction
with the Information System include the following:
• Development Evaluation: Evaluation of the development process is primarily
concerned with whether the system was developed on schedule and within budget. It
requires schedules and budgets to be established in advance and that record of actual
performance and cost be maintained. However, it may be noted that very few
information systems have been developed on schedule and within budget. In fact,
many information systems are developed without clearly defined schedules or
budgets. Due to the uncertainty and mystique associated with system development,
they are not subjected to traditional management control procedures.
• Operational Evaluation: The evaluation of the information system's operation
pertains to whether the hardware, software and personnel are capable to perform
their duties. It tries to answer the questions related to functional aspects of the
system. Such an evaluation is relatively straightforward if evaluation criteria are
established in advance. For example, if the systems analyst lays down the criterion
that a system, which can support one hundred terminals should give response time
of less than two seconds, evaluation of this aspect of system operation can be done
easily after the system becomes operational.
• Information Evaluation: An information system should also be evaluated in terms of
information it provides or generates. This aspect of system evaluation is difficult and
it cannot be conducted in a quantitative manner, as is the case with development and
operational evaluations. The objective of an information system is to provide
information to a considerable extent to support the organizational decision system.
Therefore, the extent to which information provided by the system is supportive to
decision making is the area of concern in evaluating the system.

Question 2
(a) You have been appointed as the IS Auditor of a Company. Can you please explain the
different steps involved in the conduct of your Information System Audit. (6 Marks)
(b) What are the ways in which remote and distributed data processing applications can be
controlled in relation to issues and revelations related to logical access? (6 Marks)
(c) As an IS Auditor, what are the key areas you would verify during review of BCM
arrangement of an Enterprise? Write any four. (4 Marks)
Answer
(a) The different steps involved in the conduct of Information Systems Audit are as follows:
(i) Scoping and pre-audit survey: Auditors determine the main area/s of focus and any
areas that are explicitly out-of-scope, based on the scope-definitions agreed with
management. Information sources at this stage include background reading and web
browsing, previous audit reports, pre-audit interview, observations and, sometimes,
subjective impressions that simply deserve further investigation.
(ii) Planning and preparation: During which the scope is broken down into greater
levels of detail, usually involving the generation of an audit work plan or risk-control-
matrix.
(iii) Fieldwork: This step involves gathering of evidence by interviewing staff and
managers, reviewing documents, and observing processes etc.
(iv) Analysis: This step involves desperately sorting out, reviewing and trying to make
sense of all that evidence gathered earlier. SWOT (Strengths, Weaknesses,
Opportunities, and Threats) or PEST (Political, Economic, Social, and Technological)
techniques can be used for analysis.
(v) Reporting: Reporting to the management is done after analysis of evidence is
gathered and analysed. Analysis and reporting may involve the use of automated data
analysis tools such as ACL, IDEA, Excel, Access and hand-crafted SQL queries.
(vi) Closure: Closure involves preparing notes for future audits and follow up with
management to complete the actions they promised after previous audits.
(b) The ways in which remote and distributed data processing applications can be controlled
in relation to issues and revelations related to logical access are as follows:
• Remote access to computer and data files through the network should be
implemented.
• Having a terminal lock can assure physical security to some extent.
• Applications that can be remotely accessed via modems and other devices should be
controlled appropriately.

• Terminal and computer operations at remote locations should be monitored carefully

and frequently for violations.
• To prevent the unauthorized user’s access to the system, there should be proper
control mechanisms over system documentation and manuals.
• Data transmission over remote locations should be controlled. The location which
sends data should attach needed control information that helps the receiving location
to verify the genuineness and integrity.
• When replicated copies of files exist at multiple locations, it must be ensured that all
are identical copies contain the same information and checks are also done to ensure
that duplicate data does not exist.
(c) As an Information Systems (IS) Auditor, the key areas that would be verified during review
of BCM arrangement of an enterprise are as follows:
• All key products and services and their supporting critical activities and resources
have been identified and included in the enterprise’s BCM strategy;
• The enterprise’s BCM policy, strategies, framework and plans accurately reflect its
priorities and requirements (the enterprise’s objectives);
• The enterprise’ BCM competence and its BCM capability are effective and fit -for-
purpose and will permit management, command, control and coordination of an
incident;
• The enterprise’s BCM solutions are effective, up-to-date and fit-for-purpose and
appropriate to the level of risk faced by the enterprise;
• The enterprise’s BCM maintenance and exercising programs have been effectively
implemented;
• BCM strategies and plans incorporate improvements identified during incidents and
exercises and in the maintenance program;
• The enterprise has an ongoing program for BCM training and awareness;
• BCM procedures have been effectively communicated to relevant staff and that those
staff understand their roles and responsibilities; and
• Change control processes are in place and operate effectively.
Question 3
(a) What are the benefits of COBIT 5? (6 Marks)
(b) Integrated Test Facility (ITF) is one of the continuous audit tool. Explain how ITF is used
in continuous audit by an auditor. (6 Marks)
(c) Describe the provision related to 'Compensation for failure to protect data' under Section
43A and 'Penalty for failure to furnish information return, etc.' under Section 44 of the
Information Technology Act, 2000. (4 Marks)

Answer
(a) COBIT 5 frameworks can be implemented in all sizes of enterprises and have the following
benefits:
• A comprehensive framework such as COBIT 5 enables enterprises in achieving their
objectives for the governance and management of enterprise IT.
• The best practices of COBIT 5 help enterprises to create optimal value from IT by
maintaining a balance between realizing benefits and optimizing risk levels and resource
use.
• COBIT 5 enables IT to be governed and managed in a holistic manner for the entire
enterprise, taking in the full end-to-end business and IT functional areas of
responsibility, considering the IT related interests of internal and external
stakeholders.
• COBIT 5 helps enterprises to manage IT related risk and ensures compliance,
continuity, security and privacy.
• COBIT 5 enables clear policy development and good practice for IT management
including increased business user satisfaction.
• The key advantage in using a generic framework such as COBIT 5 is that it is useful
for enterprises of all sizes, whether commercial, not-for-profit or in the public sector.
• COBIT 5 supports compliance with relevant laws, regulations, contractual agreements
and policies.
(b) Following are the ways through which an auditor may use Integrated Test Facility (ITF) as
a continuous audit tool:
• Methods of Entering Test Data: The transactions to be tested must be tagged. The
application system should be programmed to recognize the tagged transactions and
have them invoke two updates - one to the application system master file record and
one to the ITF dummy entity. Auditors can also embed audit software modules in the
application system programs to recognize transactions having certain characteristics
as ITF transactions.
The auditors may also use test data that is specially prepared. Test transactions
would be entered along with the production input into the application system. In this
approach, the test data is likely to achieve more complete coverage of the execution
paths in the application system to be tested than selected producti on data and the
application system does not have to be modified to tag the ITF transactions and to
treat them in a special way.
• Methods of Removing the Effects of ITF Transactions: The presence of ITF
transactions within an application system affects the output results obtained. The
effects of these transactions must be removed. The application system may be
programmed to recognize ITF transactions and to ignore them in terms of any

processing that might affect users. Another method would be the removal of effects
of ITF transactions by submitting additional inputs that reverse the effects of the ITF
transactions. Another less used approach is to submit trivial entries so that the effects
of the ITF transactions on the output are minimal. The effects of the transactions are
not really removed.
(c) Section 43A of Information Technology Act, 2000 is as follows:
[Section 43A] Compensation for failure to protect data
Where a body corporate, possessing, dealing or handling any sensitive personal data or
information in a computer resource which it owns, controls or operates, is negligent in
implementing and maintaining reasonable security practices and procedures and thereby
causes wrongful loss or wrongful gain to any person, such body corporate shall be liable
to pay damages by way of compensation, to the person so affected.
Section 44 of Information Technology Act, 2000 is as follows:
[Section 44] Penalty for failure to furnish information return etc.
If any person who is required under this Act or any rules or regulations made there under
to -
(a) furnish any document, return or report to the Controller or the Certifying Authority,
fails to furnish the same, he shall be liable to a penalty not exceeding one lakh and
fifty thousand rupees for each such failure;
(b) file any return or furnish any information, books or other documents within the time
specified therefore in the regulations fails to file return or furnish the same within the
time specified therefore in the regulations, he shall be liable to a penalty not
exceeding five thousand rupees for every day during which such failure continues;
(c) Maintain books of account or records, fails to maintain the same, he shall be liable to
a penalty not exceeding ten thousand rupees for every day during which the failure
continues.
Question 4
(a) What are the key management practices to implement risk management? (6 Marks)
(b) Briefly describe the audit issues relating to operational layer with respect to the application
security control auditing, (6 Marks)
(c) State the advantages and disadvantages of Full Backup type. (4 Marks)
Answer
(a) The key management practices for implementing risk management are as follows:
• Collect Data: Identify and collect relevant data to enable effective IT related risk
identification, analysis and reporting.

• Analyze Risk: Develop useful information to support risk decisions that consider the
business relevance of risk factors.
• Maintain a Risk Profile: Maintain an inventory of known risks and risk attributes
including expected frequency, potential impact, and responses, and of related
resources, capabilities, and current control activities.
• Articulate Risk: Provide information on the current state of IT- related exposures and
opportunities in a timely manner to all required stakeholders for appropriate response.
• Define a Risk Management Action Portfolio: Manage opportunities and reduce risk
to an acceptable level as a portfolio.
• Respond to Risk: Respond in a timely manner with effective measures to limit the
magnitude of loss from IT related events.
(b) The audit issues relating to the Operational Layer with respect to the application security
control auditing are provided below. Auditor needs to check that there is no violation of the
below mentioned principles as any violation of these may have serious repercussions.
• User Accounts and Access Rights: This includes defining unique user accounts
and providing them access rights appropriate to their roles and responsibilities.
Auditor needs to always ensure the use of unique user IDs, and these needs to be
traceable to individual for whom created. In case, guest IDs are used, then test of
same should also be there. Likewise, vendor accounts and third-party accounts
should be reviewed. Users and applications should be uniquely identifiable.
• Password Controls: In general; password strength, password minimum length,
password age, password non-repetition and automated lockout after three attempts
should be set as a minimum. Auditor needs to check whether there are applications
where password controls are weak. In case such instances are found, then auditor
may look for compensating controls against such issues.
• Segregation of Duties: As frauds, due to collusions / lack of segregations increase
across the world, importance of the Segregation of Duties also increases .
Segregation of duties is a basic internal control that prevents or detects errors and
irregularities by assigning to separate individuals’ responsibility for initiating and
recording transactions and custody of assets to separate individuals. Example to
illustrate:
o Record keeper of asset must not be asset keeper.
o Cashier who creates a cash voucher in system, must not have right to authorize
payments.
o Maker must not be checker.

(c) Advantages of Full Backup type are as follows:

• Restores are fast and easy to manage as the entire list of files and folders are in one
backup set.
• Easy to maintain and restore different versions.
Disadvantages of Full Backup type are as follows:
• Backups can take very long as each file is backed up again every time the full backup
is run.
• Consumes the most storage space compared to incremental and differential
backups. The exact same files are stored repeatedly resulting in inefficient use of
storage.
Question 5
(a) What are the major data integrity policies followed by an organization? (6 Marks)
(b) What is Mobile Computing? Describe the main components of mobile computing
technology. (6 Marks)
(c) List out the valid consideration for acquisition of both hardware and software when Request
For Proposal is called from vendors. (4 Marks)
Answer
(a) Major Data integrity policies followed by an organization are as under:
• Virus-Signature Updating: Virus signatures must be updated automatically when
they are made available from the vendor through enabling of automatic updates.
• Software Testing: All software must be tested in a suitable test environment before
installation on production systems.
• Division of Environments: The division of environments into Development, Test,
and Production is required for critical systems.
• Offsite Backup Storage: Backups older than one month must be sent offsite for
permanent storage.
• Quarter-End and Year-End Backups: Quarter-end and year-end backups must be
done separately from the normal schedule for accounting purposes.
• Disaster Recovery: A comprehensive disaster-recovery plan must be used to ensure
continuity of the corporate business in the event of an outage.
(b) Mobile Computing: Mobile Computing refers to the technology that allows transmission
of data via a computer without having to be connected to a fixed physical link. Mobile voice
communication has very rapid increase in the number of subscribers to the various cellular
networks over the last few years. An extension of this technology is the ability to send and
receive data across these cellular networks. This is the fundamental principle of mobile

computing. Mobile data communication allows users to transmit data from remote locations
to other remote or fixed locations.
The main components of Mobile Computing are as follows:
• Mobile Communication: This refers to the infrastructure put in place to ensure that
seamless and reliable communication goes on. This would include communication
properties, protocols, data formats and concrete technologies.
• Mobile Hardware: This includes mobile devices or device components that receive or
access the service of mobility. They would range from Portable laptops, Smart Phones,
Tablet PCs, and Personal Digital Assistants (PDA) that use an existing and established
network to operate on. At the back end, there are various servers like Application
Servers, Database Servers and Servers with wireless support, WAP gateway, a
Communications Server and/or MCSS (Mobile Communications Server Switch) or a
wireless gateway embedded in wireless carrier’s network. The characteristics of
mobile computing hardware are defined by the size and form factor, weight,
microprocessor, primary storage, secondary storage, screen size and type, means of
input, means of output, battery life, communications capabilities, expandability and
durability of the device.
• Mobile Software: Mobile Software is the actual programme that runs on the mobile
hardware and deals with the characteristics and requirements of mobile applications.
It is the operating system of that appliance and is the essential component that makes
the mobile device operates. Mobile applications popularly called Apps are being
developed by organizations for use by customers but these apps could represent
risks, in terms of flow of data as well as personal identification risks, introduction of
malware and access to personal information of mobile owner.
(c) The following considerations are valid for acquisition of both hardware and software when
Request for Proposal (RFP) is called from vendors:
• Vendor Selection: Vendor selection is to be done prior to sending RFP and is a
critical step for success of process of acquisition of systems. The result of this process
is that ‘RFP are sent only to selected vendors’. For vendor selection, the things that
are kept in mind include the background and location advantage of the vendor, the
financial stability of vendor, the market feedback of vendor performance, in terms of
price, services etc.
• Geographical Location of Vendor: This is regarding the issue to look for whether
the vendor has local support persons or not? Otherwise, the proposals submitted by
vendor not as per RFP requirements need to rejected, with no further discussion on
such rejected proposals. This stage may be referred to as ‘technical validation’, that
is to check the proposals submitted by vendors, are technically complying with RFP
requirements.
• Presentation by Selected Vendors: All vendors, whose proposals are accepted

after “technical validation”, are allowed to make presentation to the System

Acquisition Team. The team evaluates the vendor’s proposals by using techniques.
• Evaluation of Users’ Feedback: The best way to understand the vendor systems is
to analyze the feedback from present users. Present users can provide valuable
feedback on system, operations, problems, vendor response to support calls.
Question 6
(a) Which aspects of environmental controls should be physically inspected by an information
system auditor, while auditing environmental controls? Write any six. (6 Marks)
(b) As an IT consultant, your client is seeking your advice whether to go for ISO 27001. Explain
the reasons for which company may adopt ISO 27001. (6 Marks)
(c) What are the objectives of performing BCP tests? (4 Marks)
Answer
(a) Following aspects of environmental controls should be physically inspected by an
Information System Auditor, while auditing environmental controls: The Auditor should
verify:
• The IPF (Infrastructure Planning and Facilities) and the construction about the type of
materials used for construction;
• The presence of water and smoke detectors, power supply arrangements to such devices,
and testing logs;
• The location of fire extinguishers, firefighting equipment and refilling date of fire
extinguishers;
• Emergency procedures, evacuation plans and marking of fire exists. There should be
half-yearly Fire drill to test the preparedness;
• Documents for compliance with legal and regulatory requirements with regards to fire
safety equipment, external inspection certificate and shortcomings pointed out by
other inspectors/auditors;
• Power sources and conduct tests to assure the quality of power, effectiveness of the
power conditioning equipment and generators. Also, the power supply interruptions
must be checked to test the effectiveness of the back-up power;
• Environmental control equipment such as air-conditioning, dehumidifiers, heaters,
ionizers etc.;
• Compliant logs and maintenance logs to assess if MTBF (Mean Time Between
Failures) and MTTR (Mean Time To Repair) are within acceptable levels; and
• Identify undesired activities such as smoking, consumption of eatables etc.
(b) A company may adopt ISO 27001 for the following reasons:
• It is suitable for protecting critical and sensitive information.

• It provides a holistic, risk-based approach to secure information and compliance.

• Demonstrates credibility, trust, satisfaction and confidence with stakeholders, partners,
citizens and customers.
• Demonstrates security status according to internationally accepted criteria.
• Creates a market differentiation due to prestige, image and external goodwill.
• If a company is certified once, it is accepted globally.
(c) In case of Development of BCP, the objectives of performing BCP tests are to ensure that:
• The recovery procedures are complete and workable.
• The competence of personnel in their performance of recovery procedures can be
evaluated.
• The resources such as business processes, systems, personnel, facilities and data are
obtainable and operational to perform recovery processes.
• The manual recovery procedures and IT backup system/s are current and can either be
operational or restored.
• The success or failure of the business continuity training program is monitored.
Question 7
(a) Misconceptions about MIS
(b) Characteristics of Public Cloud
(c) Trojan Horse
(d) Metrics of Risk Management
(e) Types of System Testing (4 x 4 = 16 Marks)
Answer
(a) Following are the major misconceptions about Management Information Systems (MIS):
o Any computer based information system is a MIS.
o Any reporting system is MIS.
o MIS is a management technique.
o MIS is a bunch of technologies.
o MIS is an implementation of organizational systems and procedures. It is a file
structure.
o The study of MIS is about use of computers.
o More data in generated reports refers more information to managers.

o Accuracy plays vital role in reporting.

(b) Characteristics of Public Cloud are as follows:
• Highly Scalable: The resources in the public cloud are large in number and the
service providers make sure that all requests are granted. Hence public clouds are
scalable.
• Affordable: The cloud is offered to the public on a pay-as-you-go basis; hence the
user must pay only for what he or she is using (using on a per-hour basis). This does
not involve any cost related to the deployment.
• Less Secure: Since it is offered by a third party and they have full control over the
cloud, the public cloud is less secure out of all the other deployment models.
• Highly Available: It is highly available because anybody from any part of the world
can access the public cloud with proper permission, and this is not possible in other
models as geographical or other access restrictions might be there.
• Stringent Service-Level Agreements (SLAs): As the service provider’s business
reputation and customer strength are totally dependent on the cloud services, they
follow the SLAs strictly and violations are avoided.
(c) Trojan Horse: These are malicious programs that are hidden under any authorized
program. Typically, a Trojan horse is an illicit coding contained in a legitimate program,
and causes an illegitimate action. A Trojan may:
• Change or steal the password; or
• May modify records in protected files; or
• May allow illicit users to use the systems.
Trojan Horses hide in a host and generally do not damage the host program. Trojans
cannot copy themselves to other software in the same or other systems. The Trojan may
get activated only if the illicit program is called explicitly. It can be transferred to other
system only if an unsuspecting user copies the Trojan program. Christmas card is a well-
known example of Trojan.
(d) Some of the key metrics of IT Risk Management are as follows:
• Percentage of critical business processes, IT services and IT-enabled business
programs covered by risk assessment;
• Number of significant IT related incidents that were not identified in risk assessment;
• Percentage of enterprise risk assessments including IT related risks; and
• Frequency of updating the risk profile based on status of assessment of risks.

(e) Different types of System Testing are as follows:

• Recovery Testing: This is the activity of testing ‘how well the application is able to
recover from crashes, hardware failures and other similar problems’. Recovery testing
is the forced failure of the software in a variety of ways to verify that recovery is liable
to be properly performed, in actual failures.
• Security Testing: This is the process to determine that an Information System
protects data and maintains functionality as intended or not. The six basic security
concepts that need to be covered by security testing are – Confidentiality, Integrity,
Availability, Authentication, Authorization and Non-repudiation. This testing technique
also ensures the existence and proper execution of access controls in the new
system.
• Stress or Volume Testing: Stress testing is a form of testing that is used to
determine the stability of a given system or entity. It involves testing beyond normal
operational capacity, often to a breaking point, in order to observe the results. Stress
testing may be performed by testing the application with large quantity of data during
peak hours to test its performance.
• Performance Testing: In the computer industry, software performance testing is
used to determine the speed or effectiveness of a computer, network, software
program or device. This testing technique compares the new system's performance
with that of similar systems using well defined benchmarks.

Question 1
The XYZ Company is marketing several household consumable products. It has several
branches throughout the country, which are well-connected with internet and intranet. Based on
the reports and feedbacks, the company understands that the present system is not able to
meet the requirements of its IS stakeholders. Hence, it wants to improve its IS performance and
availability of services, to minimize its loss in terms of revenue loss, loss of reputation and to
improve the customer satisfaction. It has felt the need for having reengineered business
processes and implementing BCM for assessing the potential threats and managing the
consequences. It wants to ensure to provide all users with a secure Information Processing
environment. Further it wants to provide continuous assurance about the quality of data by
employing continuous auditing technique SCARF. Hence, it engages a highly professional
System Development Team to study the present system for designing and implementing a new
system. The team follows and takes advantages of SDLC methods.
Read the above carefully and being a member of the team, answer the following:
(a) Briefly discuss the steps that involved in Business Process Design.
(b) Discuss the means for achieving Network Access Controls.
(c) Discuss:
(i) as to how an enterprise uses Training Process as a tool to initiate a culture of BCM
in all the stakeholders and
(ii) what supports are needed for the development of a BCM culture.
(d) Discuss the types of information that can be collected by SCARF. (4 x 5 = 20 Marks)
Answer
(a) Business Process Design involves a sequence of the steps described briefly below:
(i) Present Process Documentation: In this step, the present business process is
analyzed and documented. The key deliverable of this step includes the well-defined
short-comings of the present processes and the overall business requirements. This
step includes the following activities:
• Understanding the business and the objectives for which it exists;
• Documenting the existing business processes; and
• Analysis of the documented processes.

2 FINAL (OLD) EXAMINATION: NOVEMBER, 2018
(ii) Proposed Process Documentation: This step is to design the new process
requirements for the system. The design is based on the new system requirements
and the changes proposed. The activities include the following:
• Understanding of the business processes necessary to achieve the business
objectives;
• Designing the new processes; and
• Documentation of the new process, preferably using CASE tools.
(iii) Implementation of New Process: This step is to implement largely the new as well as
modified processes at the entity. The critical activities may include the following:
• Validating the new process;
• Implementing the new process; and
• Testing the new process.
(b) Network Access Control can be achieved through following means:
• Policy on use of network services: An enterprise wide policy applicable to internet
service requirements aligned with the business need for using the Internet services
is the first step. Selection of appropriate services and approval to access them should
be part of this policy.
• Enforced path: Based on risk assessment, it is necessary to specify the exact path
or route connecting the networks; e.g., internet access by employees will be routed
through a firewall and proxy.
• Segregation of networks: Based on the sensitive information handling function; say a
VPN connection between a branch office and the head-office, this network is to be isolated
from the internet usage service.
• Network connection and routing control: The traffic between networks should be
restricted, based on identification of source and authentication access policies
implemented across the enterprise network facility.
• Security of network services: The techniques of authentication and authorization
policy should be implemented across the organization’s network.
• Firewall: Organizations connected to the Internet and Intranet often implements an
electronic firewall to insulate their network from intrude. A Firewall is a system that
enforces access control between two networks. To accom plish this, all traffic between
the external network and the organization’s Intranet must pass through the firewall.
Only authorized traffic between the organization and the outside is allowed to pass
through the firewall. The firewall must be immune to penetrate from both outside and
inside the organization. In addition to insulating the organization’s network from

external networks, firewalls can be used to insulate portions of the organization’s

Intranet from internal access also.
• Encryption: Encryption is the conversion of data into a secret code for storage in
databases and transmission over networks. The sender uses an encryption algorithm
and the original message called the clear text is converted into cipher text. This is
decrypted at the receiving end. The encryption algorithm uses a key. The more bits
in the key, the stronger are the encryption algorithms. Two general approaches are
used for encryption viz. private key and public key encryption.
• Call Back Devices: It is based on the principle that the key to network security is to
keep the intruder off the Intranet rather than imposing security measure after the
criminal has connected to the intranet. The call- back device requires the user to enter
a password and then the system breaks the connection. If the caller is authorized, the
call back device dials the caller’s number to establish a new connection. This limits
access only from authorized terminals or telephone numbers and prevents an intruder
masquerading as a legitimate user. This also helps to avoid the call forwarding and
man-in-the middle attack.
• Recording of Transaction Log: An intruder may penetrate the system by trying
different passwords and user ID combinations. All incoming and outgoing requests
along with attempted access should be recorded in a transaction log. The log should
record the user ID, the time of the access and the terminal location from where the
request has been originated.
(c) (i) An enterprise with Business Continuity Management (BCM) uses training as a tool to
initiate a culture of BCM in all the stakeholders by:
• Developing a BCM program more efficiently;
• Providing confidence in its stakeholders (especially staff and customers) in its
ability to handle business disruptions;
• Increasing its resilience over time by ensuring BCM implications are considered
in decisions at all levels; and
• Minimizing the likelihood and impact of disruptions.
(ii) Development of a BCM culture is supported by:
• Leadership from senior personnel in the enterprise;
• Assignment of responsibilities;
• Awareness raising;
• Skills training; and
• Exercising plans.

(d) Auditors might use System Control Audit Review File (SCARF) to collect the following types
of information:
• Application System Errors: SCARF audit routines provide an independent check on the
quality of system processing, whether there are any design and programming errors as
well as errors that could creep into the system when it is modified and maintained.
• Policy and Procedural Variances: Organizations must adhere to the policies,
procedures and standards of the organization and the industry to which they belong.
SCARF audit routines can be used to check when variations from these policies,
procedures and standards have occurred.
• System Exception: SCARF can be used to monitor different types of application system
exceptions. For example, salespersons might be given some leeway in the prices they
charge to customers. SCARF can be used to see how frequently salespersons override
the standard price.
• Statistical Sample: Some embedded audit routines might be statistical sampling
routines, SCARF provides a convenient way of collecting all the sample information
together on one file and use analytical review tools thereon.
• Snapshots and Extended Records: Snapshots and extended records can be written
into the SCARF file and printed when required.
• Profiling Data: Auditors can use embedded audit routines to collect data to build profiles
of system users. Deviations from these profiles indicate that there may be some errors or
irregularities.
• Performance Measurement: Auditors can use embedded routines to collect data that is
useful for measuring or improving the performance of an application system.
Question 2
(a) An important task for the auditor as a part of the preliminary evaluation is to gain a good
understanding of the technology environment and related control issues. As the company
auditor which aspects you will include in your consideration to understand the technology?
(6 Marks)
(b) What are the goals and metrics that can be used to measure specific success of a GRC
program using COBIT 5? (6 Marks)
(c) What are the benefits of mobile computing? (4 Marks)
Answer
(a) An important task for the auditor as a part of his preliminary evaluation is to gain a good
understanding of the technology environment and related control issues. This could include
consideration of the following:

• Analysis of business processes and level of automation,

• Assessing the extent of dependence of the enterprise on Information Technology to
carry on its businesses i.e. Role of IT in the success and survival of business,
• Understanding technology architecture which could be quite diverse such as a
distributed architecture or a centralized architecture or a hybrid architecture,
• Studying network diagrams to understand physical and logical network connectivity,
• Understanding extended enterprise architecture wherein the organization systems
connect seamlessly with other stakeholders such as vendors (SCM), customers
(CRM), employees (ERM) and the government,
• Knowledge of various technologies and their advantages and limitations is a critical
competence requirement for the auditor. For example, authentication risks relating to
e-mail systems,
• And finally, Studying Information Technology policies, standards, guidelines and
procedures.
(b) Specific success of a Governance, Risk and Compliance (GRC) program using COBIT 5
can be measured by using the following goals and metrics:
• The reduction of redundant controls and related time to execute (audit, test and
remediate);
• The reduction in control failures in all key areas;
• The reduction of expenditure relating to legal, regulatory and review areas;
• Reduction in overall time required for audit for key business areas;
• Improvement through streamlining of processes and reduction in time through
automation of control and compliance measures;
• Improvement in timely reporting of regular compliance issues and remediation
measures; and
• Dashboard of overall compliance status and key issues to senior management on a
real-time basis as required.
(c) Benefits of Mobile Computing include the following:
• It provides mobile workforce with remote access to work order details, such as work
order location, contact information, required completion date, asset history relevant
warranties/service contracts.
• It enables mobile sales personnel to update work order status in real-time, facilitating
excellent communication.
• It facilitates access to corporate services and information at any time, from anywhere.

• It provides remote access to the corporate Knowledge base at the job location.
• It enables to improve management effectiveness by enhancing information quality,
information flow, and ability to control a mobile workforce.
Question 3
(a) In spite of having various controls as well as counter measures in place, cyber frauds are
happening and increasing on a continuous basis. Discuss any six types of Cyber Frauds.
(6 Marks)
(b) Write the objectives of Information Technology Act, 2000. (6 Marks)

(c) Describe any four ways in which system maintenance can be categorized. (4 Marks)
Answer
(a) Some of the major cyber frauds are as follows:
• Monetary cyber frauds: These include non-delivery of paid products purchased through
online auction etc.
• Phishing: It is the act of attempting to acquire information such as usernames,
passwords, and credit card details (and sometimes, indirectly, money) by
masquerading as a trustworthy entity in an electronic communication.
Communications purporting to be from popular social web sites, auction sites, online
payment processors or IT administrators are commonly used to lure the unsuspecting
public.
• Network Scanning: It is a process to identify active hosts of a system, for purpose of
getting information about IP addresses etc.
• Virus/Malicious Code: As per Section 43 of the Information Technology Act, 2000,
"Computer Virus" means any computer instruction, information, data or program that
destroys, damages, degrades or adversely affects the performance of a computer
resource or attaches itself to another computer resource and operates when a program,
data or instruction is executed or some other event takes place in that computer resource.
• Spam: E-mailing the same message to everyone on one or more Usenet News Group or
LISTSERV lists is termed as Spam. Spam can be used to spread computer viruses,
Trojan horses or other malicious software with malicious intention.
• Website Compromise/Malware Propagation: It includes website defacements. Hosting
malware on websites in an unauthorized manner.
• Cracking: Crackers are hackers who practice hacking of computer systems with
malicious intentions.
• Eavesdropping: It refers to the listening of the private voice or data transmissions, often
using a wiretap.

• E-mail Forgery: Sending e-mail messages that look as if someone else sent it is termed
as E-mail forgery.
• E-mail Threats: Sending a threatening message to try and get recipient to do something
that would make it possible to defraud him is termed as E-mail threats.
• Scavenging: This is regarding gaining access to confidential information by searching
corporate records.
• Hacking: It refers to unauthorized access and use of computer systems, usually by
means of personal computer and a telecommunication network. Normally, hackers do not
intend to cause any damage.
• Data Diddling: Changing data before, during, or after it is entered into the system in order
to delete, alter, or add key system data is referred as Data Diddling.
• Data Leakage: It refers to the unauthorized copying of company data such as computer
files.
• Denial of Service (DoS) Attack: It refers to an action or series of actions that prevents
access to a software system by its intended/authorized users; causes the delay of its time-
critical operations; or prevents any part of the system from functioning.
• Internet Terrorism: It refers to the using Internet to disrupt electronic commerce and to
destroy company and individual communications.
• Logic Time Bombs: These are the program that lies idle until some specified
circumstances or a particular time triggers it. Once triggered, the bomb sabotages the
system by destroying programs, data or both.
• Masquerading or Impersonation: In this case, perpetrator gains access to the system
by pretending to be an authorized user.
• Password Cracking: Intruder penetrates a system’s defense, steals the file containing
valid passwords, decrypts them and then uses them to gain access to system resources
such as programs, files and data.
• Piggybacking: It refers to the tapping into a telecommunication line and latching on to a
legitimate user before s/he logs into the system.
• Round Down: Computer rounds down all interest calculations to 2 decimal places.
Remaining fraction is placed in account controlled by perpetrator.
• Social Engineering Techniques: In this case, perpetrator tricks an employee into giving
out the information needed to get into the system.
• Super Zapping: It refers to the unauthorized use of special system programs to bypass
regular system controls and performs illegal acts.
• Trap Door: In this technique, perpetrator enters in the system using a back door that
bypasses normal system controls and perpetrates fraud.

(b) The objectives of the Information Technology Act, 2000 are as follows:
• To grant legal recognition for transactions carried out by means of electronic data
interchange and other means of electronic communication commonly referred to as
“electronic commerce” in place of paper based methods of communication;
• To give legal recognition to Digital signatures for authentication of any information or
matter, which requires authentication under any law;
• To facilitate electronic filing of documents with Government departments;
• To facilitate electronic storage of data;
• To facilitate and give legal sanction to electronic fund transfers between banks and
financial institutions;
• To give legal recognition for keeping of books of accounts by banker’s in electronic form;
and
• To amend the Indian Penal Code, the Indian Evidence Act, 1872, the Banker’s Book
Evidence Act, 1891, and the Reserve
(c) System Maintenance can be categorized in the following ways:
• Scheduled Maintenance: Scheduled maintenance is anticipated and can be planned
for operational continuity and avoidance of anticipated risks. For example, the
implementation of a new inventory coding scheme can be planned in advance,
security checks may be promulgated etc.
• Rescue Maintenance: Rescue maintenance refers to previously undetected
malfunctions that were not anticipated but require immediate troubleshooting solution.
A system that is properly developed and tested should have few occasions of rescue
maintenance.
• Corrective Maintenance: Corrective maintenance deals with fixing bugs in the code
or defects found during the executions. A defect can result from design errors, logic
errors coding errors, data processing and system performance errors. The need for
corrective maintenance is usually initiated by bug reports drawn up by the end users.
Examples of corrective maintenance include correcting a failure to test for all possible
conditions or a failure to process the last record in a file.
• Adaptive Maintenance: Adaptive maintenance consists of adapting software to
changes in the environment, such as the hardware or the operating system. The term
environment in this context refers to the totality of all conditions and influences, which
act from outside upon the system, for example, business rule, government policies,
work patterns, software and hardware operating platforms. The need for adaptive
maintenance can only be recognized by monitoring the environment.
• Perfective Maintenance: Perfective maintenance mainly deals with accommodating
to the new or changed user requirements and concerns functional enhancements to

the system and activities to increase the system’s performance or to enhance its user
interface.
• Preventive Maintenance: Preventive maintenance concerns with the activities aimed
at increasing the system’s maintainability, such as updating documentation, adding
comments, and improving the modular structure of the system. The long-term effect
of corrective, adaptive and perfective changes increases the system’s complexity. As
a large program is continuously changed, its complexity, which reflects deteriorating
structure, increases unless work is done to maintain or reduce it. This work is known
as preventive change.
Question 4
(a) How does Information Technology Act, 2000 define the term Electronic Signature? State
under what conditions any electronic Signature or Electronic Authentication technique shall
be considered reliable as per Section 3A of Information Technology Act, 2000. (6 Marks)
(b) Discuss the key management practices that are required for aligning IT strategy with
Enterprise strategy. (6 Marks)
(c) What are the important characteristics of Computer Based Information System (CBIS)?
(4 Marks)
Answer
(a) As per Information Technology Act, 2000; the definition of Electronic Signature is as
follows:
"Electronic Signature" means authentication of any electronic record by a subscriber by
means of the electronic technique specified in the second schedule and includes digital
signature.
[Section 3A (2) of IT Act, 2000] Electronic Signature
Any Electronic Signature or Electronic Authentication technique shall be considered
reliable if-
(a) the signature creation data or the authentication data are, within the context in which
they are used, linked to the signatory or, as the case may be, the authenticator and
of no other person;
(b) the signature creation data or the authentication data were, at the time of signing,
under the control of the signatory or, as the case may be, the authenticator and of
no other person;
(c) any alteration to the electronic signature made after affixing such signature is
detectable;
(d) any alteration to the information made after its authentication by electronic
signature is detectable; and

(e) it fulfills such other conditions which may be prescribed.

(b) The key management practices, which are required for aligning Information Technology
(IT) Strategy with Enterprise Strategy are as below:
• Understand enterprise direction: Consider the current enterprise environment and
business processes, as well as the enterprise strategy and future objectives. Consider
also the external environment of the enterprise (industry drivers, relevant regulations,
basis for competition.)
• Assess the current environment, capabilities and performance: Assess the
performance of current internal business and IT capabilities and external IT services,
and develop an understanding of the enterprise architecture in relation to IT. Identify
issues currently being experienced and develop recommendations in areas that could
benefit from improvement. Consider service provider differentiators and options and
the financial impact and potential costs and benefits of using external services.
• Define the target IT capabilities: Define the target business and IT capabilities and
required IT services. This should be based on the understanding of the enterprise
environment and requirements; the assessment of the current business process and
IT environment and issues; and consideration of reference standards, best practices
and validated emerging technologies or innovation proposals.
• Conduct a gap analysis: Identify the gaps between the current and target
environments and consider the alignment of assets with business outcomes to
optimize investment in and utilization of the internal and external asset base.
Consider the critical success factors to support strategy execution.
• Define the strategic plan and road map: Creates a strategic plan that defines, in
co-operation with relevant stakeholders, how IT - related goals will contribute to the
enterprise’s strategic goals. This includes how IT will support IT -enabled investment
programs, business processes, IT services and IT assets. IT should define the
initiatives that will be required to close the gaps, the sourcing strategy, and the
measurements to be used to monitor achievement of goals, then prioritize the
initiatives and combine them in a high-level road map.
• Communicate the IT strategy and direction: Create awareness and understanding
of the business and IT objectives and direction, as captured in the IT strategy, through
communication to appropriate stakeholders and users throughout the enterprise.
(c) T he important characteristics of Computer Based Information Systems (CBIS) are as
follows:
• All systems work for predetermined objectives and the system is designed and
developed accordingly.

• In general, a system has several interrelated and interdependent subsystems or

components. No subsystem can function in isolation; it depends on other subsystem s
for its inputs.
• If one subsystem or component of a system fails; in most of the cases, the whole
system does not work. However, it depends on ‘how the subsystems are interrelated’.
• The way a subsystem works with another subsystem is called Interaction. The
different subsystems interact with each other to achieve the goal of the system.
• The work done by individual subsystems is integrated to achieve the central goal of
the system. The goal of individual subsystem is of lower priority than the goal of the
entire system.
Question 5
(a) State and explain any six key management practices for assessing and evaluating the
System of Internal Controls in an enterprise. (6 Marks)
(b) In the System Development phase, application programs re written, tested and
documented. What are the characteristics required for a good coded application software?
(6 Marks)
(c) List any two advantages of each: [i] Private Cloud and [ii] Public Cloud. (4 Marks)
Answer
(a) The key management practices for assessing and evaluating the system of internal
controls in an enterprise are as follows:
• Monitor Internal Controls: Continuously monitor, benchmark and improve the IT
control environment and control framework to meet organizational objectives.
• Review Business Process Controls Effectiveness: Review the operation of
controls, including a review of monitoring and test evidence to ensure that controls
within business processes operate effectively. It also includes activities to maintain
evidence of the effective operation of controls through mechanisms such as periodic
testing of controls, continuous controls monitoring, independent assessments,
command and control centers, and network operations centers. This provides the
business with the assurance of control effectiveness to meet requirements related to
business, regulatory and social responsibilities.
• Perform Control Self-assessments: Encourage management and process owners
to take positive ownership of control improvement through a continuing program of
self- assessment to evaluate the completeness and effectiveness of management’s
control over processes, policies and contracts.

• Identify and Report Control Deficiencies: Identify control deficiencies and analyze
and identify their underlying root causes. Escalate control deficiencies and report to
stakeholders.
• Ensure that assurance providers are independent and qualified: Ensure that the
entities performing assurance are independent from the function, groups or
organizations in scope. The entities performing assurance should demonstrate an
appropriate attitude and appearance, competence in the skills and knowledge
necessary to perform assurance, and adherence to codes of ethics and professional
standards.
• Plan Assurance Initiatives: Plan assurance initiatives based on enterprise
objectives and conformance objectives, assurance objectives and strategic priorities,
inherent risk resource constraints, and sufficient knowledge of the enterprise.
• Scope assurance initiatives: Define and agree with management on the scope of
the assurance initiative, based on the assurance objectives.
• Execute assurance initiatives: Execute the planned assurance initiative. Report on
identified findings. Provide positive assurance opinions, where appropriate, and
recommendations for improvement relating to identified operational performance,
external compliance and internal control system residual risks.
(b) A good coded application software should have the following characteristics:
• Reliability: It refers to the consistency with which a program operates over a period
of time. However, poor setting of parameters and hard coding of some data,
subsequently could result in the failure of a program after some time.
• Robustness: It refers to the applications’ strength to uphold its operations in adverse
situations by taking into account all possible inputs and outputs of a program in case
of least likely situations.
• Accuracy: It refers not only to ‘what program is supposed to do’, but should also take
care of ‘what it should not do’. The second part becomes more challenging for quality
control personnel and auditors.
• Efficiency: It refers to the performance per unit cost with respect to relevant
parameters and it should not be unduly affected with the increase in input values.
• Usability: It refers to a user-friendly interface and easy-to-understand
internal/external documentation.
• Readability: It refers to the ease of maintenance of program even in the absence of
the program developer.
(c) (i) The advantages of Private Clouds include the following:
• It improves average server utilization;

• It allows usage of low-cost servers and hardware while providing higher

efficiencies; thus, reducing the costs that a greater number of servers would
otherwise entail.
• It provides a high level of security and privacy to the user.
• It is small in size and controlled and maintained by the organization.
(ii) The advantages of Public Clouds are as follows:
• It is widely used in the development, deployment and management of
enterprise applications, at affordable costs.
• It allows the organizations to deliver highly scalable and reliable applications
rapidly and at more affordable costs.
• There is no need for establishing infrastructure for setting up and maintaining
the cloud.
• Strict Service-Level Agreements (SLAs) are followed.
• There is no limit for the number of users.
Question 6
(a) What are the factors influencing an organization towards control and audit of computers
and the impact of the information systems?
(b) A company uses a third party site for backup and recovery purposes after having a written
contract. Being a security administrator, you must ensure that the contract covers the
security issues. List down the issues to be covered. (6 Marks)
(c) What is asynchronous attack? Explain Subversive threats to an Information System.
(4 Marks)
Answer
(a) Factors influencing an organization towards controls and audit of computers and the impact
of the information systems audit function on organizations are as below:
• Organisational Costs of Data Loss: Data is a critical resource of an organisation
for its present and future process and its ability to adapt and survive in a changing
environment.
• Cost of Incorrect Decision Making: Management and operational controls taken by
managers involve detection, investigations and correction of the processes. These
high-level decisions require accurate data to make quality decision rules.
• Costs of Computer Abuse: Unauthorised access to computer systems, malwares,
unauthorised physical access to computer facilities and unauthorised copies of

sensitive data can lead to destruction of assets (hardware, software, data, information
etc.)
• Value of Computer Hardware, Software and Personnel : These are critical
resources of an organisation, which has a credible impact on its infrastructure and
business competitiveness.
• High Costs of Computer Error: In a computerised enterprise environment where
many critical business processes are performed, a data error during entry or process
would cause great damage.
• Maintenance of Privacy: Today, data collected in a business process contains
private information about an individual too. These data were also collected before
computers but now, there is a fear that privacy has eroded beyond acceptable levels.
• Controlled evolution of computer Use: Use of Technology and reliability of complex
computer systems cannot be guaranteed and the consequences of using unreliable
systems can be destructive.
The impact of information Systems on an organization are as follows:
• Information Systems play a vital role in an enterprise collaboration and management and
strategic success of businesses that must operate in an inter-networked global
environment and facilitate E-business and E-commerce operations.
• With the help of information systems; enterprises and individuals can use computers to
collect, store, process, analyse, and distribute information.
• Three basics activities of an Information System – Input, Processing and Output helps
enterprise in making decisions, control operations, analyse problems and create new
products or services as an output that helps management in taking important decisions to
carry out the business successfully.
(b) If a third-party site is to be used for backup and recovery purposes after having a written
contract, security administrators must ensure that a contract covers issues such as -
• how soon the site will be made available subsequent to a disaster;
• the number of organizations that will be allowed to use the site concurrently in the
event of a disaster;
• the priority to be given to concurrent users of the site in the event of a common
disaster;
• the period during which the site can be used;
• the conditions under which the site can be used;
• the facilities and services the site provider agrees to make available; and
• what controls will be in place and working at the off-site facility.

(c) Asynchronous Attacks: They occur in many environments where data can be moved
asynchronously across telecommunication lines. Numerous transmissions must wait for
the clearance of the line before data being transmitted. Data that is waiting to be
transmitted are liable to unauthorized access called Asynchronous Attack. These attacks
are hard to detect because they are usually very small pin like insertions.
Subversive Threats: An intruder attempts to violate the integrity of some components in
the sub-system. Subversive attacks can provide intruders with important information about
messages being transmitted and the intruder can manipulate these messages in many
ways. An intruder attempts to violate the integrity of some components in the sub-system
by:
• Invasive tap: By installing it on communication line, s/he may read and modify data.
• Inductive tap: It monitors electromagnetic transmissions and allows the data to be
read only.
Question 7
(a) Benefits of Expert System
(b) Inherent limitations of IS Audit
(c) Advantages of BYOD
(d) Role of IS Auditor in Physical Access Control
(e) Limitations of MIS (4 x 4 = 16 Marks)
Answer
(a) The key benefits of Expert Systems are as follows:
• Expert Systems preserve knowledge that might be lost through retirement,
resignation or death of an acknowledged company expert.
• Expert Systems put information into an active-form so it can be summoned almost as
a real-life expert might be summoned.
• Expert Systems assist novices in thinking the way experienced professional do.
• Expert Systems are not subjected to such human fallings as fatigue, being too busy,
or being emotional.
• Expert Systems can be effectively used as a strategic tool in the areas of marketing
products, cutting costs and improving products.
(b) Inherent Limitations of Information Systems (IS) Audit are as follows:
• The nature of financial reporting;
• The nature of audit procedures;

• The need for the audit to be conducted within a reasonable period of time and at a
reasonable cost.
• The matter of difficulty, time, or cost involved is not in itself a valid basis for the auditor
to omit an audit procedure for which there is no alternative or to be satisfied with audit
evidence that is less than persuasive.
• Fraud, particularly fraud involving senior management or collusion.
• The existence and completeness of related party relationships and transactions.
• The occurrence of non-compliance with laws and regulations.
• Future events or conditions that may cause an entity to cease to continue as a going
concern.
(c) Advantages of Bring Your Own Device (BYOD) are as follows:
• Happy Employees: Employees love to use their own devices when at work. This also
reduces the number of devices an employee must carry; otherwise he would be
carrying his personal as well as organization provided devices.
• Lower IT budgets: Could involve financial savings to the organization since
employees would be using the devices they already possess thus reducing the outlay
of the organization in providing devices to employees.
• IT reduces support requirement: IT department does not have to provide end user
support and maintenance for all these devic es resulting in cost savings.
• Early adoption of new Technologies: Employees are generally proactive in
adoption of new technologies that result in enhanced productivity of employees
leading to overall growth of business.
• Increased employee efficiency: The efficiency of employees is more when the
employee works on his/her own device. In an organization provided devices,
employees have to learn and there is a learning curve involved in it.
(d) Auditing physical access requires the auditor to review the physical access risk and
controls to form an opinion on the effectiveness of the physical access controls. This
involves the following:
• Risk Assessment: The auditor must satisfy him/herself that the risk assessment
procedure adequately covers periodic and timely assessment of all assets, physical
access threats, vulnerabilities of safeguards and exposures there from.
• Controls Assessment: The auditor based on the risk profile evaluates whether the
physical access controls are in place and adequate to protect the IS assets against the
risks.

• Review of Documents: It requires examination of relevant documentation such as

the security policy and procedures, premises plans, building plans, inventory list and
cabling diagrams.
(e) Major limitations of Management Information Systems(MIS) are as follows:
• The quality of the outputs of MIS is basically governed by the quality of input and
processes.
• MIS is not a substitute for effective management, which means that it cannot replace
managerial judgment in making decisions in different functional areas. It is merely an
important tool in the hands of executives for decision making and problem solving.
• MIS may not have requisite flexibility to quickly update itself with the changing needs
of time, especially in fast changing and complex environment.
• MIS cannot provide tailor-made information packages suitable for every type of
decision made by executives.
• MIS considers mainly quantitative factors thus it ignores the non-quantitative factors
like morale and attitude of members of organization, which have an important bearing
on the decision-making process of executives or senior management.
• MIS is less useful for making non-programmed decisions. Such types of decisions
are not of the routine type and thus require information, which may not be available
from existing MIS to executives.
• The effectiveness of MIS is reduced in enterprises, where the culture of hoarding
information and not sharing with other holds.
• MIS effectiveness decreases due to frequent changes in top management,
organizational structure and operational team.


Paper - 6: Information Systems Control and Audit: Answer

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Paper - 6: Information Systems Control and Audit: Answer

Hochgeladen von

Copyright:

Verfügbare Formate

PAPER – 6: INFORMATION SYSTEMS CONTROL AND AUDIT

Question No. 1 is compulsory.

© The Institute of Chartered Accountants of India

 MIS effectiveness decreases due to frequent changes in top management,

© The Institute of Chartered Accountants of India

 Perfective Maintenance: Perfective maintenance mainly deals with

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

 To facilitate and resolve conflicts in deployment of IT and ensure availability of a

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

 Reliability - It is a measure of failure or success of using information for decision-

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

 Exercise schedule and results;

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

cooperatively and collaboratively to solve infrastructure offering services on

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

results to identify programming and logic errors. To facilitate the efficient

© The Institute of Chartered Accountants of India

 Checks whether the organizations have opted for an appropriate insurance

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

operations and programs; safeguarding of assets; and compliance with laws,

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

♦ Planning: Auditors need to evaluate whether top management has formulated a

© The Institute of Chartered Accountants of India

♦ Disaster Recovery Planning: This is the technological aspect of business

© The Institute of Chartered Accountants of India

♦ Active user involvement is imperative.

© The Institute of Chartered Accountants of India

4. Processing Controls: The processing subsystem is responsible for computing,

© The Institute of Chartered Accountants of India

waiting to be printed on a printer; this should not be subject to unauthorized

© The Institute of Chartered Accountants of India

♦ Management Guidelines -Help assign responsibility, agree on objectives, measure

© The Institute of Chartered Accountants of India

♦ Observation: In general, and particularly in prototyping approaches, observation

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

• Information and Communication: These are the elements, in which information is

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

• Terminal and computer operations at remote locations should be monitored carefully

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India

© The Institute of Chartered Accountants of India