IT audit in accordance with Cobit standardDalibor Radovanovi?, Tijana Radojevi?, Dubravka Lu?i?, Marko aracSingidunum UniversityDanijelova 32, Belgrade, SerbiaE-mail: [email protected], [email protected], [email protected] & Young BelgradeBulevar Mihajla Pupina 115d, Belgrade, SerbiaE-mail: [email protected] In todays market circumstances, the fact thatthe number of jobs that are taking place with the help of information systems constantly growing is indisputable. Managers often know very little about the information system andin that circumstance it is very difficult to them to effectivelyperform control function and successfully manage informations. This paper explains the concept of information systemsaudit and methodologies used. IT governance and information systems audit is imposed as an imperative for successfulbusiness. To improve the management of IT in accordancewith regulatory requirements, organizations are using bestpractice frameworks to facilitate the work. One of theseframeworks for IT governance is Cobit, which providesguidelines on what can be done in an organization in terms ofcontrol activities, measurement and documentation ofprocesses and operations.I. INTRODUCTIONCritical element important for the survival and successof the organization is effectively managing informationand communication technology or ICT, which is reflectedin the increase depending on the information and their associated systems, increased vulnerability and a wide rangeof threats to the ICT technology, the extent and cost of existing and future investments in ICT systems , the potentialof technology to change work organization and businesspractices, creating new opportunities and reduce costs.Fig 1. COBIT as consolidatorIT audit is the process of gathering and evaluating evidence based on which one can evaluate the performance ofIT systems, i.e, to determine whether the operation of information systems in the function of preserving the property and maintain data integrity. It is also necessary to determine whether IS enables effective achievement of business objectives and whether system resources are used inan effective and efficient manner. IT audit today representa modern and advisory function, right hand that helps themanagement on IT governance. Furthermore represent aprocedure used to assess whether the information technology acts in the function of successful accomplishment ofbusiness objectives.There are several methodologies and standards that dealwith this issue: COBIT, ITIL, ISO 27002 (ex ISO 17799)and ISO 9000. Organizations will consider and use a variety of IT models, standards and best practices. These mustbe understood in order to consider how they can be usedtogether (Fig 1.), COBIT with acting as the consolidator.II. COBITCOBIT (Control Objectives for Information and RelatedTechnologies) is the worldwide accepted standard whichprescribes areas and individual controls for IT governance,informatics and related IT processes. COBIT frameworkauthors are non-profit organization ISACA (InformationSystem Audit and Control Association) and ITGI (IT Governance Institute).COBIT combines business and IT goals, providing theability to monitor the maturity of the information metricsystem. COBIT enables management to optimize IT resources such as applications, information, infrastructureand people. The practice recommended by COBIT is themixture of knowledge of numerous experts as a result ofgood practice, applicable in any organization.Fig 2. Development COBIT framework [8]The first version of COBIT was created as a tool to inorder to support performance of audit of financial statements, but it continues further to develop following development of the IT role in business. By releasing second versions it became the most frequently used methodology foraudit of information systems worldwide. Through furtherdevelopment and publishing of third version in the year2004, COBIT became integrated framework for IT management, while the last version of COBIT 4.1 representsthe major framework and methodology for IT governance.Figure 2 shows the development of the COBIT frameworkand roles it has had through his development and upgrading.COBIT consists of 34 key business control processesdescribing each process model of maturity. It contains over300 detailed IT controls. The primary control objectivesare divided into four domains [6]:1) Planning and Organization PO, includes processes forplanning and design organization in the function ofachievement of business goals of the organization. Thisdomain includes risk assessment.2) Acquisition and Implementation AI, includes processesrelated to the acquisition and development of IT solutionsand manages changes of these solutions throughout thetime.3) Delivery and Support DS, includes the processes thataffect the actual delivery of IT services to organization.This domain includes the processes for manage problemsand incidents; manage security and other processes that affect the performance of IT.4) Monitoring and Evaluation ME, includes processes forregular review of IT processes and their successfulness inthe function of achievement of relevant IT controls objectives.Each of these domains shows the key control activitiesof information technology related to the area. Each ofthese processes offers a so-called RACI matrix (the acronyms of Responsible, Accountable, Consulted, Informed),representing a matrix which for each process determineswho is responsible and authorized for implementation ofparticular control activities and who only need to be informed and consulted.Fig 3. Interrelationships of COBIT ComponentsFor each of the key business and IT processes COBITdefines and provides (Fig 3.):x Maturity modelsx Critical success factors CSFx Key goal indicators KGIx Key performance indicators KPIx RACI chartx Control objectives and control tests.By using COBIT methodology management and corporate structures is easy to determine which of theseprocesses and in what extent are important. From the pointof control and information systems audit COBIT determines 18 applications and 6 of process controls. Assessments of maturity are based on the famous CMM model,only that in COBIT model marks are very detailed described and explained for each process. Assessment of maturity of IT governance processes are in the range of 0 to 5[2, 11]:x 0 There are no processes, process of IT governancedo not exist. Management did not recognize the importance of this concept; the decisions on investmentsin IT are uncontrolled, from case to case (ad hoc),outside the system supervision and risk assessmentand are completely in the hands of individuals.x 1 Initial processes, management is not aware of theimportance of IT governance, although there are noformal procedures, management and oversight of information technology is mostly based on individualand uncontrolled based, and actions are taken on caseby case basis. There are no standards, nor corporaterules, nor obligations and responsibilities regardingthis issue. Management generally is not aware of theimportance of IT risk. IT governance and its performance measurement are processes that are carried outonly within the IT department, and management ispassive, uneducated and not aware of this matter.x 2 Repeatable processes, IT governance processesexist, but it is uncoordinated and mainly initiated byIT department or some other operating level. It oftenhappens that many people perform the same task (segregation of duties issue); there is no systems supervision, coordination, or standardized procedures. Theresponsibility is left to individuals; corporate policiesdo not exist or are not presented to employees.x 3 Defined processes, IT governance procedures areprescribed and documented, and constantly improvedthrough formal trainings and education. Proceduresand corporate rules, although formally exists, are notsophisticated, mature nor customized to organizationbusiness.. They only represent the formalization ofexisting procedures. Although procedures exist, theresponsibility for its execution is on the individuals,and having in mind that there is no system supervision, it is unlikely that one can detect anomalies regarding this matter.x 4 Managed processes; except corporate policies andprocedures exist, it also is possible to constantlymonitor their execution, to measure their performanceand to take necessary corrections in accordance withneeds. Processes and activities are continuously improved. Very sophisticated IT governance objectivesclosely aligned with the business objectives are beingset. Using of current methods and frameworks(COBIT, IT BSC and ITIL) in performance measurement and IT audit is required.x 5 Optimized processes, IT governance processes arebrought to the optimal level and the company is aleader in the area. Performance and efficiency of ITas a business function is constantly measured, and theresults are compared with best practice and other organizations. Complete transparency in IT governancegoverns, corporate bodies have actual supervisionover information technology through a series of formal mechanisms. Information technology is used in astrategic purpose, as key business resource and information activities (investments, projects, risks, etc.)are optimally functioning align with the real businesspriorities.It is essential that the most important methods of IT governance and information systems audit such as ITIL,COBIT and Sarbanes-Oxley use the same range for assessment of IT processes maturity and effectiveness ofcontrols over them (from 0 to 5, with the same explanation).IT resourcesIT ProcessesBusiness objectivesApplicationsInformationInfrastructurePeople DomainsProcessesActivities EfficiencyEffectivenessConfidentialityIntegrityAvailabilityComplianceRealiabilityFig 4. The COBIT cubeTo satisfy business objectives, information needs to conform to certain control criteria, which COBIT refers to asbusiness requirements for information. Based on thebroader quality, fiduciary and security requirements, sevendistinct, certainly overlapping, information criteria are defined as follows [10, 11, 12]:x Effectiveness deals with information being relevantand pertinent to the business process as well as beingdelivered in a timely, correct, consistent and usablemanner.x Efficiency concerns the provision of informationthrough the optimal use of resources.x Confidentiality concerns the protection of sensitive information from unauthorized disclosure.x Integrity relates to the accuracy and completeness ofinformation as well as to its validity in accordancewith business values and expectations.x Availability relates to information being availablewhen required by the business process now and in thefuture. It also concerns the safeguarding of necessaryresources and associated capabilities.x Compliance deals with complying with the laws, regulations and contractual arrangements to which thebusiness process is subject, i.e., externally imposedbusiness criteria as well as internal policies.x Reliability relates to the provision of appropriate information for management to operate the entity andexercise its fiduciary and governance responsibilities.Summary of IT resources are managed by IT processesto achieve goals that meet the business requirements of organizations. This basic principle of COBIT framework isillustrated in Fig 4. The IT resources identified in COBITcan be defined as follows [6]:x Applications are the automated user systems and manual procedures that process the information.x Information is the data, in all their forms, input,processed and output by the information systems inwhatever form is used by the busi
ness.x Infrastructure is the technology and facilities (i.e.,hardware, operating systems, database managementsystems, networking, multimedia, and the environment that houses and supports them) that enable theprocessing of the applications.x People are the personnel required to plan, organize,acquire, implement, deliver, support, monitor andevaluate the information systems and services. Theymay be internal, outsourced or contracted as required.III. ITILThe UK Government recognized very early on the significance of IT best practices to Government and, for manyyears, has developed best practices to guide the use of ITin Government departments. These practices have now become common standards around the world in private andpublic sectors. ITIL was developed more than 15 years agoto document best practice for IT service management, withthat best practice being determined through the involvement of industry experts, consultants and practitioners.ITIL is based on defining best practice processes for ITservice management and support, rather than on defining abroad-based control framework. It focuses on the methodand defines a more comprehensive set of processes. Additionally, ITIL provides a business and strategic context forIT decision making and for the first time describes continual service improvement as the key activity which drivesmaintenance of value delivery to customers.IT service management is concerned with planning,sourcing, designing, implementing, operating, supportingand improving IT services that are appropriate to businessneeds. ITIL provides a comprehensive, consistent and coherent best practice framework for IT service managementand related processes, promoting a high-quality approachfor achieving business effectiveness and efficiency in ITservice management. ITIL is intended to underpin but notdictate the business processes of an organization. The roleof the ITIL framework is to describe approaches, functions, roles and processes, upon which organizations maybase their own practices and to give guidance at the lowestlevel that is applicable generally.Below that level, and to implement ITIL in an organization, specific knowledge of its business processes is required to drive ITIL for optimum effectiveness. In ITILV3, the most significant development has been the movefrom a process-based framework to a more comprehensivestructure reflecting the life cycle of IT services. In this newcontext, the key processes have been updated, but moresignificantly, ITIL now describes IT service managementfunctions, activities and organizational structure; strategicand sourcing concerns; and integration with the business,ITIL V3.Five volumes comprise the ITIL v3, published in May2007 [7]:x ITIL Service Strategyx ITIL Service Designx ITIL Service Transitionx ITIL Service Operationx ITIL Continual Service ImprovementIV. ISO 27002 AND ISO 27001 STANDARDThe international standard of IT security controls,ISO/IEC 27002:2005 was published by ISO and the IEC,which established a joint technical committee, ISO/IECJTC 1, ISO 27000 [5] Directory (2005). Its goal is to provide information to parties responsible for implementinginformation security within an organization. It can be seenas a best practice for developing and maintaining securitystandards and management practices within an organization to improve reliability on information security in interorganizational relationships. It defines 133 security controls strategies under 11 major headings. The standard emphasizes the importance of risk management and makes itclear that it is not necessary to implement every statedguideline, only those that are relevant.The guiding principles in ISO/IEC 27002:2005 are thestarting points for implementing information security.They rely on either legal requirements or generally accepted best practices. Measures based on legal requirements include: protection and non-disclosure of personaldata, protection of internal information and protection ofintellectual property rights. Best practices mentioned in thestandard include: information security policy, assignmentof responsibility for information security, problem escalation and business continuity management [1].V. . COMPARISON OF A COBIT, ITIL AND ISO27002A first difference of the three standards is the fact thatthey are issued by different organizations with different areas of activities and objectives. The general function of thestandards is also slightly different (Table 1.). COBIT provides best practices and tools for monitoring and mappingIT processes while ITIL aims to map IT service level management and ISO27002 provides guidelines for implementing a standardized information security framework.COBIT consists of 4 domains and 34 processes which arerequired for the implementation of the information systemaudit.Table 1. Overview of COBIT, ITIL and ISO27002 COBITITILISO27002Function Mapping ITProcessMapping ITService LevelManagementInformationSecurityFrameworkArea 34 Processes4 Domains 9 Processes 10 DomainsIssuer ISACA OGC ISO BoardImplementationInformationSystem AuditManage Service LevelCompliancewith securitystandardsConsultantAccountingCompany, ITConsultingCompanyIT ConsultingCompanySecurityCompany, ITand NetworkConsulting ITILs best practice framework covers a total of 9 processes and enables the implementation of IT service levelmanagement with focus on achieving business effectiveness and efficiency in IT service management.Table 2. Comparison of COBIT, ITIL and ISO 27002 COBIT CONTROL OBJECTIVESObjectiveswhich referto ISO27002Objectiveswhich referto ITILSTRATEGIC LEVELPO PLAN AND ORGANISETACTICAL AND OPERATIONAL LEVELDS DELIVER AND SUPPORTSTRATEGIC LEVELME MONITOR AND EVALUATE PO1 Define a strategic IT planPO2 Define the information architecture 9PO3 Determine technological direction 9 slightlyPO4 Define the IT processes,organization and relationships 9 slightlyPO5 Manage the IT investment slightlyPO6 Communicate management aimsand direction 9PO7 Manage IT human resources 9PO8 Manage quality 9PO9 Assess and manage IT risks 9PO10 Manage projectsDS1 Define and manage service levels 9 9DS2 Manage third-party services. 9 9DS3 Manage performance and capacity 9 9DS4 Ensure continuous service 9 9DS5 Ensure systems security 9DS6 Identify and allocate costs 9DS7 Educate and train users 9DS8 Manage service desk and incidents 9 9DS9 Manage the configuration 9 9DS10 Manage problems 9 9DS11 Manage data 9 9DS12 Manage the physical environment 9DS13 Manage operations 9 9AI ACQUIRE AND IMPLEMENTAI1 Identify automated solutions 9 9AI2 Acquire and maintain applicationsoftware 9 9AI3 Acquire and maintain technologyinfrastructure 9 9AI4 Enable operation and use 9 9AI5 Procure IT resources 9 9AI6 Manage changes 9 9AI7 Install and accredit solutions andchanges 9 9ME1 Monitor and evaluate ITperformance 9ME2 Monitor and evaluate internalcontrol 9ME3 Ensure compliance with externalrequirementsME4 Provide IT governanceThese three methodologies described are quite used inthe past few years by certain organizations and representbest practice, approved, developed and tested by expertsworldwide. Table 2 shows the correlation between controlobjectives presented through the COBIT framework withISO 27002 and ITIL methodology.In relation to the COBIT framework, ITIL describes indetail the procedures for delivery and support services (DSdomain Table 2), but does not support all the requirements for monitoring and evaluation of ICT within COBITmodel. Some control objectives COBIT model in the domain of planning and organization (PO domain Table 2)are treated superficially and displayed through ITIL. ITILmodel is not focused on describing what needs to be addressed in the management of ICT. The processes are detailed structured to indicate who and how to apply them(roles and responsibilities).In the period from 1 June to 31 July 2009 companyErnst & Young conducted a survey which included 1865companies from 61 countries, covering all major industries. This research belongs to the group of the oldest andmost respected researches of this type. It provides a comparison of companies in respect of major areas of information security and IT governance [4].COBIT are increasingly popular for planning IT auditactivity (Fig 5) and are adopted by 69 percent of respondents. These frameworks deliver a structured approach toplanning and focus the IT audit on the business and technological risks of the organization.Fig 5. Standards and frameworks that are used for planning IT audit activityVI. . CONCLUSIONSCOBIT, ITIL, ISO 17799 and ISO 27001 are the groupof most commonly used methodologies by companies inrespect of IT security and IT governance. They are usedparallel, which is not surprising, considering that representbest practices and experiences, which have been approved,developed and tested in companies around the world.Many organizations face a continually changing set ofpressures and dynamics in the current economic climate.Faced with shrinking markets, they can choose to rationalize, merge or contract. The technology thread which holdssystems and processes together is at risk. As a consequence, IT Internal Audit plays an integral role in maintaining discipline and rigor across functions and geographies.Internal Audit should have a direct line to executivemanagement and the Audit Committee. By cascading toplevel opinion on the value and content of Internal Auditsoutputs and by communicating information on the issuesthat affect the business, the function can heighten its visibility.To maintain that position, it needs to develop a closerrelationship with the business while maintaining its independence and objectivity. It also needs to work in closercooperation with the wider audit function to leverage understanding and efficiency. This powerful combination oftechnical and business know-how, underpinned by an understanding of operational and technology risk, can turnthe function from cost centre to value builder.IT audit as a discipline is maturing. To compete in thisnew and threatening environment, it needs to standardize,automate and speed up its analysis and reporting. It has tobecome more economic and efficient by reducing costsand using tools that improve the effectiveness and reliability of its output and its compliance and control.REFERENCES[1] Calder, A., & Watkins, S. 2008. A Managers Guide to Data Security and ISO 27001 / ISO 27002. Kogan Page.[2] Cannon, D. L. 2008. CISA Certified Information SystemsAuditor Study Guide. Sybex.[3] Davis, C., Schiller, M., & Wheeler, K. 2007. IT Auditing:Using Controls to Protect Information Assets. McGrawHill Osborne Media.[4] Ernst & Young. 2009. Global Information Security Survey.Available from Internet: http://www.ey.com/Publication//vwLUAssets/12th_annual_GISS/$FILE/12th_annual_GISS.pdf.[5] ISO. 2005. ISO/IEC 27001. Switzerland: International Organization for Standardization (ISO).[6] ITGI. 2007. CobiT 4.1 Framework, Control Objectives,Management Guidlines and Maturiy Models, USA: IT Governance Institute.[7] ITIL. 2007. An Introductory Overview of ITIL V3. London:The UK Chapter of the itSMF.[8] Min, Y. W. 2009. Understanding and Auditing IT Systems.Peking: Lulu.[9] Panian, Z., & Spremic, M. 2007. Korporativno upravljanjei revizija informacijskih sustava. Zagreb: Zgombi? & Partneri.[10] Publishing, V. H. 2008. IT Governance based on Cobit 4.1 A Management Guide. Van Haren Publishing.[11] Selig, G. J. 2008. Implementing IT Governance. Van HarenPublishing.[12] Senft, S., & Gallegos, F. 2009. Information TechnologyControl and Audit (Third ed.). Boca Raton, USA: Taylor &Francis Group.[13] Spremic, M. 2007. Methods of auditing infromation systems. Zbornik Ekonomskog fakulteta u Zagrebu, 295-312.View publication stats