IT Environment Audit ICQ

ENTITY NAME GOES HERE March 31, 20XX

IT ENVIRONMENT DOCUMENT

Purpo! o" Docu#!$% This is a PLANNING document that is intended to provide a high level overview of the general IT environment. It is important to note that the work documented is NOT sufficient, ! itself, to conclude that IT controls are operating effectivel!.

Client liaison contact:

OAG entity PX contact:

OAG entity Team lead contact:

OAG IT Audit Specialist:

ENTITY NAME GOES HERE March 31, 20XX

1& I$"or#a%'o$ R!ourc! S%ra%!() a$* P+a$$'$( C+'!$% Co$%ac%-. Po'$% o" /ocu # 1.1 ist t!e si"nificant financial systems$ %ein" used.

1.1.3

1.4 1.5

1.8

1.; 1.= 1.9

1.1 ?

1.11 1.1 -

o/ is t!e IT %ud"et dete*mined and cont*olled0 ae any *epo*ts %een issued %y inte*nal audit o* ot!e* pa*ties on t!e IT eni*onment o* on specific financial applications e.".2 ITS0$ If so2 /!at /e*e t!e main findin"s0 /u%ur! D'r!c%'o$ a$* I$'%'a%'!. A*e t!e*e si"nificant IT actiities outside t!e IT function0 6!at is t!e futu*e di*ection of IT /it!in t!e o*"ani7ation i.e. IT st*ate"y$0 Is t!e*e a documented and up to date IT st*ate"ic plan0 6!at mao* IT initiaties a*e planned2 /it!in t!e net 1mont!s and in t!e lon" te*m0 u'$!C+'!$% N!!*. o/ does non satisfaction0 6!at a*e t!e *esults of latest su*ey0 o/ does t!e IT function %enc!ma*@ its ope*ations /it! ot!e* o*"ani7ations0 Or(a$'4a%'o$ S%ruc%ur!. 6!at is t!e IT o*"ani7ation st*uctu*e0 6!o does t!e ead of IT *epo*t to0 o/ does mana"ement ensu*e t!e app*op*iate se"*e"ation of duties /it!in t!e IT function fo* eample2 data%ase administ*ato*2 net/o*@ administ*ato*2

Docu#!$%a%'o$

 Application &ame:

O!ra%'o$ a$* R!"!r!$c! 'ate Installed ( Ope*atin" System )p"*aded +e*sion &ame , +e*sion

'ata%ase &ame , +e*sion

ENTITY NAME GOES HERE March 31, 20XX

1& I$"or#a%'o$ R!ourc! S%ra%!() a$* P+a$$'$( C+'!$% Co$%ac%-. Po'$% o" /ocu # application p*o"*amme*2 system administ*ato*0$ 1.1 Is t!e*e an IT Stee*in" Committee0 If not2 t!en !o/ a*e 3 p*io*ities dete*mined0 1.1  A*e *oles and *esponsi%ilities fo* t!e IT functions clea*ly 4 defined0 If so2 !o/0 1.1 o/ does t!e o*"ani7ation ensu*e t!at IT staff maintain 5 t!ei* s@ills0

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

2& I#p+!#!$%a%'o$ a$* Ma'$%!$a$c!. App+'ca%'o$ S)%!#  So"%5ar! S)%!#  Da%aa! C+'!$% Co$%ac%-. Po'$% o" /ocu # Cha$(! Ma$a(!#!$% a$* Ma'$%!$a$c!. -.1 o/ does mana"ement ensu*e t!at c!an"es to t!e IT eni*onment e.".2 data%ase2 net/o*@2 ope*atin" system2 !a*d/a*e o* applications$ a*e mana"ed app*op*iately0

-.-.3

I#p+!#!$%a%'o$ a$* Ma'$%!$a$c!. App+'ca%'o$ S)%!#  So"%5ar! S)%!#  Da%aa! Is a fo*mal systems deelopment met!odolo"y used0 6!at ne/ financial systems !ae %een implemented0

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

3& u'$! Co$%'$u'%) C+'!$% Co$%ac%-. Po'$% o" /ocu # 3.1 as t!e o*"ani7ation add*essed %usiness continuity plannin" and disaste* *ecoe*y plannin" issues0 3.- as mana"ement put in place a system to test t!ese plans on a pe*iodic %asis0 6!en /as it last tested0 3.3 'oes mana"ement !ae a fo*mal p*ocess *e"a*din" t!e %ac@up of financial info*mation i.e. %ac@up f*euency2 %ac@up testin"2 *etention pe*iod and sto*a"e location$0

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

6& I$"or#a%'o$ S!cur'%) C+'!$% Co$%ac%-. Po'$% o" /ocu # 4.1 o/ does mana"ement ensu*e t!at Access to t!e IT eni*onment e.".2 data%ase2 net/o*@2 ope*atin" system2 !a*d/a*e o* applications$ a*e mana"ed app*op*iately0 4.'oes t!e o*"ani7ation !ae a secu*ity policy0 4.3 6!o is *esponsi%le fo* administe*in" t!e secu*ity policy0 4.4 o/ is t!e policy communicated to employees and cont*acto*s and enfo*ced0 4.5 o/ does mana"ement ensu*e t!at use*s *eceie app*op*iate education and t*ainin" on info*mation secu*ity0 4.8 6!en /as t!e most *ecent T!*eat and Bis@ Assessment TBA$ done0

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

7& I$"or#a%'o$ S)%!# Op!ra%'o$ C+'!$% Co$%ac%-. Po'$% o" /ocu # 5.1 o/ is info*mation *e"a*din" any p*o%lems /it! systems communicated to non
Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

8& R!+a%'o$h'p 5'%h Ou%ourc!* V!$*or C+'!$% Co$%ac%-. 9 Po'$% o" /ocu 8.1 Is use made of outsou*ced se*ice p*oide*s0 If so2 identify /!at @ey components !ae %een outsou*ced and p*oide Se*ice eel A"*eements. 8.- 6!o is *esponsi%le fo* monito*in" se*ice delie*y of t!e outsou*ced se*ice p*oide*0 8.3 A*e t!e*e *epo*ts fo* T!i*d Pa*ty Assu*ance p*oided %y a endo* o* !ost0 CICA Section 59;? o* SAS;?$

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!

ENTITY NAME GOES HERE March 31, 20XX

:& N!%5or; Suppor% C+'!$% Co$%ac%-. 9 Po'$% o" /ocu ;.1 'oes t!e o*"ani7ation !ae a net/o*@ dia"*am0 6!en /as it last updated0 ;.- 6!at p*ocess is in place to maintain t!e net/o*@ dia"*am e.".2 o/ne*2 f*euency0$

Docu#!$%a%'o$

O!ra%'o$ a$* R!"!r!$c!