IIA IIA-CIA-Part3 - Business Knowledge for Internal Auditing

Data relationships are assumed to exist and to continue where no known conflicting conditions exist

Analytical procedures are intended primarily to ensure the accuracy of the information being examined

Data relationships cannot include comparisons between operational and statistical data

Analytical procedures can be used to identify differences, but cannot be used to identify the absence of differences

Individual workstation computer controls are not as important as companywide server controls

Particular attention should be paid to housing workstations away from environmental hazards

Cybersecurity issues can be controlled at an enterprise level, making workstation-level controls redundant

With security risks near an all-time high, workstations should not be connected to the company network

Creating a comprehensive reporting system for vendors to demonstrate their ongoing due diligence in network operations

Drafting a strong contract that requires regular vendor control reports and a right-to-audit clause

Applying administrative privileges to ensure right-to-access controls are appropriate

Creating a standing cybersecurity committee to identify and manage risks related to data security

Review the list of people with access badges to the room containing the workstation and a log of those who accessed the room

Review the password length, frequency of change, and list of users for the workstation’s login process

Review the list of people who attempted to access the workstation and failed, as well as error messages

Review the passwords of those who attempted unsuccessfully to access the workstation and the log of their activity

Hot recovery plan

Warm recovery plan

Cold plan

Absence of recovery plan

Visibility, validity, vulnerability

Velocity, variety, volume

Complexity, completeness, constancy

Continuity, control, convenience

To ensure proper segregation of duties

To create a master repository of user passwords

To enable monitoring for systems efficiencies

To enable tracking of privileges granted to users over time

The business continuity management charter

The business continuity risk assessment plan

The business impact analysis plan

The business case for business continuity planning

The risk that users try to bypass controls and do not install required software updates

The risk that smart devices can be lost or stolen due to their mobile nature

The risk that an organization intrusively monitors personal information stored on smart devices

The risk that proprietary information is not deleted from the device when an employee leaves

To increase the ability to borrow additional funds from creditors

To reduce the organization’s free cash flow from operations

To improve the organization’s free cash flow from operations

To acquire the asset at the end of the lease period at a price lower than the fair market value