Project Report of DISA 2.0 Course
1e g a P
1
Project report of DISA 2.0 Course This is to certify that we have successfully completed the DISA 2.0 course training conducted at: Centre of Excellence, Gachibowli, Hyderabad from Hyderabad from 16/12/2017 to 21/01/2018 and we have the required attendance. We are submitting the Project titled: IS Audit of ERP Software
We hereby confirm that we have adhered to the guidelines issued by CIT, ICAWE for the project. We also certify that this project report is the original work of our group and each one of us have actively participated and contributed in preparing this project. We have not shared the project details or taken help in preparing project report from anyone except members of our group.
1. Name:
Mekala Leela Raghavendra Prasad
DISA No.
2. Name:
Dinakar Ch
DISA No.
3. Name:
Santhosh Kumar Sunkara
DISA No.
53515 51258 53500
Signed Signed Signed
Place: HYDERABAD Date: 06/02/2018
2e g a P
2
Table of Contents 1
Details of Case/Project
2
Introduction
3
Auditee Environment
4
Background
5
Situation
6
Terms and scope of assignment
7
Logistics arrangements required
8
Methodologies and Strategy adapted for execution of assignment
9
Documents reviewed
10
References
11
Deliverables
12
Format of Report/Findings Report/Findings and Recommendations
13
Summary/Conclusion 3e g a P
3
Project Report Title: IS Audit of ERP Software M/S ABM LIMITED
1. Details of Case Study/Project ABM Limited (ABM) has (ABM) has been using Information Technology as a key enabler for facilitating business process Owners and enhancing services to its customers. The senior management of ABM has been very proactive in directing the management and deployment of Information Technology. Most of the mission critical applications in the company have been computerized and networked. ABM selected SAP Business Suite to bring a more integrated and seamless approach to internal processes. SAP deployment in ABM posed unique challenges arising out of the need to integrate multiple units across different locations, involving extensive procedures and large volumes of data. The family of business applications provides better insight into enterprise-wide analysis based on real time data and key performance indicators, improved quality and on-time delivery, reduction in inventory cost and enhanced customer service. ABM proposes to have a comprehensive audit of the Information Systems (ERP Audit) in the Company. The objective of IS audit is to identify areas for improvement of controls by benchmarking against global best practices. Further, any specific risks identified are expected be mitigated by implementing controls as deemed relevant to ensure that SAP implementation is secure and safe and provide assurance to the senior management of ABM.
4
P
a
g
4e
2. Introduction Client: ABM limited ABM Limited (ABM) is (ABM) is one of the Leading Public Sector Undertaking Undertaking having Multi Manufacturing Divisions and Regional Offices spread all over India. ABM operates on three major business verticals for associated equipment manufacturing:
Mining & Construction; Con struction; Defence, and Rail & Metro.
In addition to the th e above there are three Strategic Business Units (SBUs):
Technology Division for providing end-to-end engineering solutions; Trading Division for dealing in non-company non -company products and International Business Division for export activities. ABM has eight manufacturing manufacturing units spread over four locations.
ABM’s Mission Mission is to improve competitiveness through organizational transformation and collaboration / strategic alliances / joint ventures in technology. To ensure the same ABM has implemented ERP with effect from October 2010 across the company. ABM has successfully implemented SAP ERP and went live in a quick quick time span of 12 months. In a first of its kind project project in the country, ABM consolidated its operations across multiple locations spread across India, with all units going live simultaneously.
Audit Firm: MSD & Co LLP We are MSD MSD & Co LLP (“Firm”), (“Firm”), a professional firm since since 1995 and providing providing services like Information System Audit (“IS Audit”), Statutory Audit, Internal Audit, Tax Audit, Consultancy for Project Finance Finance and other related services. In our Firm we have 23 qualified chartered accountants and 46 semi qualified chartered accountants. Out of the 23 CAs, We have 9 CISA/DISA Qualified. Our firm was providing IS Audit services since 10 years and we have totally 3 Groups 5
P
a
g
5e
(Each group 3 CAs having CISA/DISA and 4 Semi Qualified) headed by the following team leaders.
S.no
Name of the Team Qualification Leader
Experience
1
Mr. M
CA, CWA, CS, DISA, 10 Years of experience in CISA IS Audit, ERP Audit and Central Bank Audit
2
Mr.S
CA, DISA, CISA, FAFD, 15 Years of experience in FRM IS Audit, ERP Audit and Forensic Audit
3
Mr.D
CA. DISA, CISA, CS
9 Years of experience in IS Audit and Other Regular Statutory Audits
3. Auditee Environment
The primary objective of the assignment is to conduct Information Systems Audit of SAP implementation and develop related IS Audit checklists for future use, through external consultants by using the globally recognized IS Audit standards and best practices. The IS audit of SAP would be with the objective of providing comfort on the adequacy and appropriateness of controls and mitigate any operational risks thus ensuring that the information systems implemented through SAP provide a safe and secure computing environment. Further, specific areas of improvement would be identified by benchmarking with the globally recognized best IT practices of COBIT framework. The initial assignment could primarily focus on the identified areas of SAP Implementation. a
g
6e P
6
4.Background ABM proposes to have a comprehensive audit of the Information Systems (ERP Audit) in the Company. While the Information Systems Audit to be done covers both audit of ERP System and review of its implementation, the IS Audit is expected to be in compliance with the IS Auditing Standards, Guidelines and Procedures. The proposed IS Audit is further subjected to applicable Auditing Standards of ICAI. The objective is to identify areas for improvement of controls by benchmarking against global best practices. Further, any specific risks identified are expected be mitigated by implementing controls as deemed relevant to ensure that SAP implementation is secure and safe and provide assurance to the senior management of ABM Limited. Further, IS Auditors are expected to develop an IS Audit checklist for future use.
7
P
a
g
7e
5. Situation Business Model is:
ABM LIMITED BUSINESS: EQUIPMENT MANUFACTURING FOR THE USE IN • Mining & Construction; • Defence; and • Rail & Metro. • Production Division
• Technology Division
• Trading Division
• International Business Division 8e
• Production Division has 4 Manufacturing Location g a
Location 1
Location 2
Location 3
P
Location 4
• Each Location has two manufacturing unit Mfg. 1
Mfg. 2
Mfg.3
Mfg.4
Mfg.5
Mfg. 6
Mfg. 7
Mfg. 8 8
• There are 500 SAP users in all.
Problem: ABM Limited is first time integrated all the business units located in different areas in India by adopting SAP-ERP, it may have the following problems
Integrating all all the Existing Existing data and application in to new SAP-ERP SAP-ERP leads loss of data It requires selection and Placing of Technical Technical staff Each location of operations may differ from other location of operations
Control Weakness: As the data and services will now provide by the SAP-ERP System, there are many control factors need need to be addressed. Authorized access, Data Storage, Segregation of Duties, Migrating data, Maintenance of Central Server, AMC Contracts Etc.
9
P
a
g
9e
6. Terms and Scope of assignment MSD & Co LLP (“Firm”) have (“Firm”) have been appointed to conduct Information Systems Audit of SAP implementation and develop related IS Audit Checklists. The IS audit of SAP would be with the objective of providing comfort on the adequacy and appropriateness of controls and mitigate any operational risks thus ensuring that the information systems implemented through SAP provide a safe and secure computing environment. Further, specific areas of improvement would be identified by benchmarking with the globally recognized best IT practices of COBIT framework. These terms of reference are based on the preliminary discussion the assignment team had with the ABM team and is subject to further modification as required. Broadly the scope of review primarily from security\controls and would involve:
Access vulnerabilities of the SAP implementation to attacks from within and outside and suggest appropriate counter measures to safeguard against unauthorised use, disclosure or modification, damage or loss
To review the processes relating to granting access to systems, verify the logical access controls and assess whether the specified roles and responsibilities are aligned with the business to safeguard against unauthorized use, disclosure or modification, damage or loss
To assess that audit trails exist for ensuring effective monitoring of the mission critical systems and processes
To assess and evaluate management system relating to all changes requested and made to the existing production systems so as to minimize the likelihood of disruption, unauthorized alterations, and errors
To evaluate data collection, analysis and reporting on resource performance, application sizing and workload demand so as to ensure that adequate capacity is available
Assess the internal control framework in respect of specified SAP application, review of parameter settings and configuration management and suggest improvements so as to ensure that data remains complete, accurate and valid during its input, update and storage
10
P
a
g
1e
0
Review of IT Resources as relevant
Operating Software: Access controls Telecommunications Telecommunications Software: Access Controls RDBMS Database: Access Controls
SAP- Major focus area: Configuration of Parameters and Access Controls
Application controls at various stages such as Input, Processing, Output, Storage, Retrieval and transmission so as to ensure Confidentiality, Integrity and Availability Availability of data.
Organization structure policies, procedures and practices as mapped in the information systems. Review of policies, procedures and practices as relevant to areas of audit.
7. Logistic arrangements required IS Auditor requires the following tools for audit: a) Hardware: 1) Window based Systems, PDA and Laptops. 2) Printers & other Printing devices. 3) Scanners. 4) Storage media. b) System Software: System software will be selected according to client IT environment, so here auditor has to select the system software according to the IT environment in ABM Ltd. Auditor should use the original licensed version of system software, because it maintains the authenticity of data. c) CAAT tools : 1
1) Audit Software: 1e g a
a) IDEA Audit Software for data extraction P
b) Software Used at client site etc. c) Analyzer-Arbutus Software. d) Pivot Tables for using Sampling. 11
e) Benfold’s Law. f) Frequency Analysis. g) Audit log. d) Test data: a) Using Test Packs technique. b) Using Integrated Test Facility.
8. Methodology and Strategy adapted for execution of assignment One of the main challenge faced by companies that has implemented SAP ERP (any ERP) will be to get a clear understanding of the current ERP system. Two or three years after implementation what will be status of the system. The main areas of focus will be;
Whether all the management controls are working fine Whether all the postings are being done as per accounting standards Whether proper documentation is being maintained Whether critical business related activites are done accurately etc.
A lot of practical difficulties arise in doing a ERP post implementation audit. Main challenge is to frame the right set of questions and how to obtain answers for those. From my experience and research, WEhave prepared a question list of more than 500 questions both from the functional and technical side, which drill downs to the minutest level providing all the necessary data required for the audit. SAP has provided a very powerful framework in the standard ERP package for conducting Audits, evaluvating them and taking corrective actions. 2 1e g
User should have answer for the following questions before starting the Audit procedure; 1. 2. 3. 4.
a P
Kind of Audit to be Conducted (Technical or Functional) Number of questions for the Audit Structure of list of Questions Q uestions (Question drill down level) Valuation type of Questions 12
5. 6. 7. 8. 9.
Question Priorities What kind of Audit Controls to be implemented Audit purpose Audit Type Kind of rating for the questions
First we need to do few configuration configuration changes to tune the audit as per our requirement. Execute transaction SPRO – SPRO – > SAP reference IMG – IMG – > Cross-Application Components – Components – > Audit Management
Audit Management is divided into four categories.
Figure 1.0 For setting structure list of questions;
Figure 2.0 Create what kind of Question Profile is required. WE have created “Part-Sub “Part-Sub Part-Element-Sub Element-Sub Qu” for Qu” for the Audit purpose. 3 1e g a P
13
Figure 3.0 Once the question profile is created you have to create the drill down level for the profile. Below attached is the pictorial representation of the drill down level for questions WE created.
Figure 4.0
4 1e g a P
14
Figure 5.0 Similarly you can create drill down level level according to your requirement. requirement. After After defining the question hierarchy h ierarchy you have to specify the Valuation Valuation Specification and the scores to be awarded for each value.
Figure 6.0 WE have created valuation 8003 Valuation of PRD system. By selecting the created valuation profile double click on the “valuation” icon “valuation” icon on the right side. There we need to set the details of valuation and the scores we intend to provide for each.
15
P
a
g
1e
5
Figure 7.0 After valuation profile is entered enter en ter question priority.
Figure 8.0 Audit control / Audit Definition requirements has to be configured.
6 1e g a P
16
Figure 9.0 Now all the configuration configuration related to conducting the Audit has been configured. Following are the main objects used for the Audit; 1) Audit Plan The audit plan consists of all audits all audits planned for a particular period of time. For example, all audits that are to be executed in the space of one year are defined in an annual audit plan. There is always only one current version of an audit plan, where all date shifts and the degree of completion for the individual audits can be found.
2) Audit An audit, according to DIN EN ISO 9000, is a systematic, independent, and documented process used to obtain audit results and to evaluate these results objectively in order to determine to what extent the criteria of the audit have been fulfilled. 3) Question List Question lists are multilingual collections of questions that are answered during the execution of the audit the audit . The allowed valuation can be planned for each hierarchy level. 4) Corrective Actions These are actions that are deemed necessary to eliminate the cause of errors that were determined during the audit and to prevent the recursion of these 17
P
a
g
1e
7
errors. The corrective actions to be executed must be appropriate to the effects that the particular error has on the product. 5) Preventive Actions These are actions that are deemed necessary to eliminate the causes of possible errors before they occur. The preventive actions to be executed must be appropriate appropriate to the th e effects that the possible error could have on the product. An audit, according to DIN EN ISO 9000, is a systematic, independent, and documented process used to obtain audit results and to evaluate these results objectively in order to determine to what extent the criteria of the audit have been fulfilled. Execute transaction PLMD_AUDIT, first create the question list required for the audit with the components newly configured.
Figure 10.0 For example purpose WE have created questions up to 15 drill down level
8 1e g a P
18
Figure 11.0 Attaching one real scenario from my Audit question list.
Figure 12.0 Once the question list has been created, you have to release the question list.
9 1e g a P
19
Figure 13.0
Figure 14.0 Once the question list is attached to the audit we need to evaluate the questions. Evaluations will be based on the configuration done in SPRO. Evaluation: Execute transaction PLM_AUDITMONITOR. Select the required required fields and execute. 0 2e g a P
20
Figure 15.0
Select the required audit. Click on the Overview button. Click the Validate button for valuation.
1 2e
Figure 16.0 g a
The main success factor for any audit depends on the questions used for the audit. Let me add few of the topics under which WE have prepared the question list.
21
P
The main topics are;
System Overview Security & Access Protection Workbench Organizer Transport System Accessing and Logging DB Tables Job Request Procedure Documentations System Logs Batch Input Interface Master Data Changes Reconciling Posting Data Closing Invoice Checking and Posting Run Business Process Auditing BASIS Audit
Once the audit question list is created / uploaded to SAP\, user must create a sample set of check list to be submitted to the client. The Check list should contain; * All the documents that client has to Submit * All the questions client has to answer. Every company should run the audit at least twice a year to ensure that the system is working perfectly, no manipulations are done, to ensure 100% management control over the system their by over the employees.
2 2e g a P
22
9. Documents reviewed Following things are Reviewed:
Policies – Policies – Are Are the management guidelines which should be approved by the Top Management and should be reviewed at least once in each year?
Procedure – Procedure – Are Are the detailed documents based on the policies set by the top management? Procedures contain the detailed information about the process. All the procedure should be approved by the management and should be reviewed at least once in each year.
Flowcharts – Pictures are worth thousand words when it comes to understanding the interaction of various processes and how the transaction flow has the dependencies and branches that run in various directions.
Audit logs and Screenshots – Every organisation implements the monitoring control over the processes and the preserves the evidences of the same, in the form of system screenshots and system logs. This gives an added confidence to the Information System Auditor about the monitoring control established by the management.
Security Policies related to IT Operations
Existing Cost sheet related to IT operations.
SAP Implementation documentation.
Review of Error logs noted and corrected during the implementation of SAP ERP.
References
ISO 27001/27002 COBIT 5 WWW.ISACA.ORG WWW.CISCO.COM WWW.BUSINESSOFGOVERNMENT WWW.BUSINESSOFGOVERNM ENT .COM ISA 2.0 COURSE BACKGROUND MATERIAL WWW.BOOZ .COM 3 2e g a P
23
10. Deliverables Once SAP is implemented, implemen ted, auditor can rely on the following followi ng checklist for monitoring the implementation objectives, security controls, future changes, if any:
No.
Item Yes
1
Whether methodology for prioritising system change EXP Reference:
2
Whether emergency change procedures are addressed in EXP Reference:
3
Whether change control is a formal procedure for both EXP Reference:
4
Whether change control log ensures all changes shown EXP Reference:
5
Whether user is satisfied with turnaround of change EXP Reference:
6
Whether for a selection of changes on the change control log: that change resulted in programme and operations documentation change that changes were made as documented current documentation reflects changed environment EXP Reference:
Response No EXP
•
• •
7
Whether change process is being monitored for improvements in acknowledgment, responsetime, response-effectiveness and user satisfaction satisfaction with the process? EXP Reference:
8
Whether maintenance to Private Branch Exchange (PBX) EXP Reference:
9
Whether a service level agreement process is identified EXP Reference:
10
Whether user participation in process is required for
4 2e g a P
24
EXP Reference: No.
Item Yes
11
Whether responsibilities of users and providers are defined? EXP Reference:
12
Whether management monitors and reports on the achievement of the specified service performance EXP Reference:
13
Whether regular review process by management EXP Reference:
14
Whether recourse process is identified for nonperformance? EXP Reference:
15
Whether service level agreements include, but are not limited to having: definition of service cost of service quantifiable minimum service service level level of support from the IT function availability, reliability, capacity for growth continuity planning security requirements requirem ents change procedure procedure for any portion of the agreement written and formally formally approved approved agreement between provider and user of service effective period period and and new period review/renewal/nonreview/renewal/nonrenewal content and frequency of performance reporting and payment for services charges are realistic compared compared to history, industry, best practices EXP Reference:
Response No EXP
• • • • • • • •
•
•
•
•
16
Whether IT policies and procedures relating to thirdparty relationships exist and are consistent with EXP Reference:
5 2e g a P
17
Whether policies exist specifically for addressing need for contracts, definition of content of contracts, owner or relationship manager responsible responsible for ensuring contracts are created, maintained, EXP Reference: 25
No.
Item
18
Whether interfaces are defined to independent agents involved in the conduct of the project and any EXP Reference:
19
Whether contracts represent a full and complete record of EXP Reference:
20
Whether contracts are established for continuity of services specifically, and that these contracts include contingency planning by vendor to ensure EXP Reference:
21
Whether contract contents include at least the following: formal management and legal approval legal entity providing services services provided service level agreements both qualitative and quantitative cost of services and frequency of payment for services resolution of problem process penalties for non-perform ance dissolution process modification process reporting of service - content, frequency, and distribution roles between between contracting contracting parties parties during life of contract continuity assurances that that services will will be provided by vendor user of services and provider communications process and frequency duration of contract level of access provided to to vendor
Response Yes No EXP
• • • •
•
• • • • •
•
•
•
• •
6
non-disclosure guarantees right to access and right to audit EXP Reference: •
2e
•
22
Whether escrow agreements have been negotiated where EXP Reference:
23
Whether potential third-parties are properly qualified through an assessment of their capability to
g a P
26
No.
Item
Response Yes No EXP
EXP Reference: 24
Whether time frames and level of service are defined for EXP Reference:
25
Whether time frames and service levels reflect user requirements? EXP Reference:
26
Whether time frames and service levels are consistent with performance expectations of the EXP Reference:
27
Whether an availability plan exists, is current and reflects EXP Reference:
28
Whether ongoing performance monitoring of all equipment and capacity is occurring, reported upon, lack of performance addressed by management and performance improvement opportunities are formally addressed? EXP Reference:
29
Whether optimal configuration performance is being monitored by modeling tools to maximize EXP Reference:
30
Whether both users and operational performance groups are pro-actively reviewing capacity and EXP Reference:
31
Whether workload forecasting includes input from users on changing demands and from suppliers on EXP Reference:
32
Whether organisational policies require a continuity framework and plan to be part of normal operational requirements for both the IT EXP Reference:
33 34
7
Whether IT policies and procedures require: a consistent philosophy and framework relating to development of continuity plan development a prioritisation of applications with respect to timeliness of recovery and return
2e
•
g a P
•
27
No.
Item
Response Yes No EXP
risk assessment and insurance consideration for loss of business in continuity situations for the IT function as well as users of resources outline specific roles and responsibilities with respect to continuity planning with specific test, maintenance and update requirements formal contract arrangements arrangements with vendors to provide services services in event of need to recover, recover , including back-up site facility or relationship, in advance of actual need in each continuity plan minimum
•
•
•
•
¾
¾
¾
¾
¾
¾
Emergency procedures to ensure the safety of all affected staff members Roles and responsibilities of the IT function, vendors providing recovery services, users of services and support administrative personnel A recovery framework consistent with long-range plan for continuity Listing of systems resources requiring requirin g alternatives (hardware, peripherals, software) Listing of highest to lowest priority applications, required recovery times and expected performance norms Administrative functions for communicating and providing support services such as benefits, payroll,
¾
Specific equipment and supply needs are identified such as high speed printers, signatures, forms, communications equipment, telephones, etc., and a source and alternative source defined ¾ Training and awareness of individual and
8 2e g a P
28
No.
Item
Response Yes No EXP
¾ Itemisation of contracted service providers, services and response expectations ¾ Logistical Logistical information on location of key resources, including back-up site for recovery operating system, applications, data files, operating manuals and programme/system/user programme/system/user documentation ¾ Current names, addresses, telephone/pager numbers of key personnel ¾ Reconstruction plans are included for rerecovery at original location of all systems EXP Reference: 35
Whether regulatory agency requirements with respect to EXP Reference:
36
Whether user continuity plans are developed based on unavailability of physical resources for EXP Reference:
37
Whether the telephone system, VoiceMail, fax and image EXP Reference:
38
Whether image systems, fax systems, paper documents as well as microfilm and mass storage media are part EXP Reference:
39
Whether strategic security plan is in place providing centralised direction and control over information system security, along with user security requirements EXP Reference:
9 2e g a
40
P
Whether centralised security organisation is in place responsible for ensuring only appropriate EXP Reference:
29
No.
Item Yes
41
Whether data classification schema is in place and being used, that all system resources have an owner EXP Reference:
42
Whether user security profiles are in place representing "least access as required" and profiles are EXP Reference:
43
Whether employee indoctrination includes security awareness, ownership responsibility and virus protection protection requirements? EXP Reference:
44
Whether reporting exists for security breaches and formal problem resolution procedures are in place, and these reports include: unauthorised attempts to access system (sign on) unauthorised attempts to access system resources unauthorised attempts to view or change change security definitions and rules resource access privileges by user ID authorised security security definitions definitions and and rule changes authorised access to resources (selected (selected by user or resource) EXP Reference:
Response No EXP
•
•
•
• •
•
45
Whether cryptographic modules and key maintenance procedures exist, are administered centrally and EXP Reference:
46
Whether cryptographic key management standards exist EXP Reference:
47
Whether change control over security software is formal and consistent with normal standards of system EXP Reference:
48
0 3e
Whether the authentication mechanisms in use provide one or more of the following features: single-use of authenticat authentication ion data (e.g., passwords are never re-usable) multiple authentication (i.e., two or more different authentication mechanisms are g a P
•
•
30
No.
Item
Response Yes No EXP
policy-based authentication (i.e., ability to specify separate authentication procedures for specific events) on-demand authentication authentication (i.e., ability to re- authenticate the user at times after the initial authentication) EXP Reference: •
•
49
Whether the number of concurrent sessions belonging to EXP Reference:
50
Whether at log-on, an advisory warning message to users regarding the appropriate use the hardware, EXP Reference:
51
Whether a warning screen is displayed prior completing log-on to inform reader that unauthorised access may result in prosecution? EXP Reference:
52
Whether upon successful session establishment, a history of successful and unsuccessful attempts to EXP Reference:
53
Whether password policy includes: initial password password change on first use use enforced an appropriate minimum password length an appropriate and and enforced frequency of password changes password checking against list of not allowed values (e.g., dictionary checking) adequate protection of emergency passwords passwords EXP Reference:
to
• • •
•
•
54
Whether formal problem resolution procedures include: User ID is suspended after 5 repeated unsuccessful log-on attempts Date, time of last access and number of unsuccessful attempts is displayed to authorised user at log-on Authentication time is limited to to 5 minutes, after which the session is terminated User is informed of suspension, suspension, but not the EXP Reference: •
1 3e
•
g a P
•
•
31
No.
Item
55
Whether dial in procedures include dial-back or token based authentication, authentication, frequent changes of dialup numbers, software and hardware firewalls to restrict access to assets and frequent changes of EXP Reference:
56
Whether location control methods are used to apply EXP Reference:
57
Whether access to the VoiceMail service and the PBX system are controlled with the same physical and EXP Reference:
58
Enforcement of sensitive position policies occurs, including: employees in sensitive job positions positions are required to be away from the organisation for an appropriate period of time time every calendar year; during this time their user ID I D is suspended; and persons replacing the employee are instructed to notify management if any security-related abnormalities are noted unannounced rotation of personnel EXP Reference:
Response Yes No EXP
•
•
59
Whether security-related hardware and software, such as cryptographic modules, are protected against tampering or disclosure, and access is limited to a EXP Reference:
60
Whether access to security data such as security management, sensitive transaction data, passwords and cryptographic keys is limited to a EXP Reference:
61
Whether trusted paths are used to transmit nonencrypted EXP Reference:
62
2 3e
Whether to prevent denial of service due to an attack with junk faxes, protective measures are taken such as: limiting the disclosure disclosure of fax numbers outside the organisation to a "need-to-know" basis fax lines used used for solicitation solicitation of business are EXP Reference: g a P
•
•
32
No.
Item
63
Whether preventative and detective control measures have been established by management with EXP Reference:
64
Whether to enforce integrity of electronic value, measures are taken such as: card reader facilities are protected against destruction, disclosure or modification of the card information card information (PIN and other information) is protected against insider disclosure EXP Reference:
Response Yes No EXP
•
•
65
Whether to enforce protection of security features, measures are taken such as: the identification identificatio n and authentication authenticatio n process is required to to be repeated after after a specified period of inactivity a one-button one-button lock-up system, a force button button or a shut-off sequence can be activated EXP Reference: _ •
•
66
Whether IT function has a group responsible for reporting and issuing chargeback bills to users Procedures are in place that: develop a yearly development and maintenance plan with user identification of priorities for development, maintenance and operational expenses allow for a very high level of user determination of where IT resources are spent generate a yearly IT budget including: ¾ Compliance to organisational organisational requirements in budget preparation ¾ Consistency with what costs are to •
•
•
3 3e g a P
33
No.
Item
Response Yes No EXP
¾
User sign-off on all budget costs to be allocated by IT function ¾ Frequency of reporting and actual charging of costs to users track allocated costs of all IT resources of, but not limited to: ¾ Operational hardware ¾ Peripheral equipment ¾ Telecommunications usage ¾ Applications development and support ¾ Administrative overhead ¾ External vendor vendor service costs costs ¾ Help desk ¾ Facilities and maintenance ¾ Direct/indirect costs
•
for regular reporting to users on performance for the various cost categories report to users on external benchmarks regarding cost effectiveness so as to allow comparison to industry expectations, or user alternative sourcing for services for timely modification to cost allocations to reflect changing changing business needs formally approve and accept charges as received identify IT improvement opportunities to reduce EXP Reference: _ Whether reports provide assurance that chargeable items EXP Reference: _ Whether reports capture and highlight changes in the EXP Reference: _ Whether policies and procedures relating to ongoing EXP Reference: _ Whether there is an education/training education/training programme focusing on information systems security and EXP Reference: _ Whether new employees are made aware of security and control responsibility with respect to using and EXP Reference: •
•
•
•
67 68 69 70
71
4 3e g a P
34
No.
Item
72
Whether there are policies and procedures in effect relating to training and they are current with EXP Reference: _ Whether availability of in-house training opportunities EXP Reference: _ Whether availability of external technical technical training opportunities and frequency of employee EXP Reference: _ Whether a training function is assessing training needs of personnel with respect to security and controls, and translating those needs into in-house or external EXP Reference: _
73 74 75
76
Response Yes No EXP
Whether all all employees are are required to attend security and control awareness training on an ongoing basis that would include, but not be limited to: general system security principles ethical conduct conduct related related to to IT security practices to protect against harm from failures affecting availability, confidentiality, integrity and performance of duties in a secure manner responsibilities associated with custody and and use of IT resources EXP Reference: _ Whether security awareness training includes a policy on preventing the disclosure of sensitive information through conversations (e.g., by announcing the status of the information to all EXP Reference: _ Whether nature of help desk function (i.e., how requests for assistance are processed and assistance is EXP Reference: _ Whether actual facilities, divisions or departments are performing the help desk function and the EXP Reference: _ Whether level of documentation for help desk activities EXP Reference: • • •
•
77
78
79
80
81
5 3e g a P
Whether actual process for logging or registering requests for service and use of logs exists? EXP Reference:
35
No.
Item
Response Yes No EXP
82
Whether process for query escalation and management EXP Reference:
83
Whether time frame for clearing queries received is adequate? EXP Reference:
84
Whether procedures for tracking trends and reporting on EXP Reference:
85
Whether performance improvement initiatives formally identified and executed? EXP Reference:
86
Whether service level agreements and performance EXP Reference:
87
Whether user satisfaction level is periodically determined EXP Reference:
88
Whether
89
Whether functions for maintaining configuration baseline EXP Reference:
90
Whether process for controlling status accounting of purchased and leased resources - including EXP Reference:
91
Whether configuration control procedures include: configuration baseline integrity programmed access authorisation controls over the change management system the recovery of configuration items and change requests at any point in time completion of configuration and reports assessing the adequacy of configuration recording procedures procedur es
are
process for creating and controlling configuration baselines (the cut-off point in the design and development of a configuration item beyond which evolution does not occur without EXP Reference:
• •
•
6 3e
•
g a P
•
36
No.
Item
Response Yes No EXP
evaluations of the configuration recording function individuals responsible for reviewing configuration control have the requisite knowledge, skills and abilities procedures exist for reviewing access to software baselines EXP Reference: _ Whether periodic review of configuration with inventory EXP Reference: _ Whether configuration baseline has sufficient history for EXP Reference: _ •
periodic
•
•
92 93 94
Whether software change control procedures exist for: establishing and maintaining licensed application programme library ensuring licensed application application programme library is adequately controlled ensuring the reliability and integrity of of the software inventory ensuring the reliability and integrity of of the inventory of authorised software used and checking for unauthorised software assigning responsibility for unauthorised software control to a specific staff member recording use of unauthorised software and reporting to management for EXP Reference: _ Whether process for migrating developmental applications into the testing environment and ultimately ultim ately into production status interacts EXP Reference: _ •
•
•
•
•
•
95
96
7 3e
Whether the software storage process includes: defining a secure file storage area (library) for all valid software in appropriate phases of the system development life cycle requiring that software storage libraries are separated from each other and from development, testing and production file g a
•
P
•
37
No.
Item
Response Yes No EXP
requiring existence within source l ibraries that allow temporary location of source modules moving into production cycle period requiring that each member of all libraries has an assigned owner defining logical and physical physical access controls establishing software accountability establishing an audit trail detecting, documenting and reporting to management all instances of non-compliance with this procedure determining whether management took corrective EXP Reference: Whether coordination is occurring among applications development, quality assurance and operations EXP Reference: Whether software is labeled and periodically inventoried? EXP Reference: •
•
• • • •
97
98 99
Whether library management software is used to: produce audit trails of program changes maintain program version numbers record and report program changes maintain creation/date information for production modules maintain copies of previous versions EXP Reference: Whether there is a problem management process that ensures all operational events which are not part of standard operations are recorded, analysed and resolved in a timely manner, and incident reports EXP Reference: • • • •
•
100
101
Whether problem management procedures exist for: defining and implementing a problem management system recording, analysing, resolving in a timely manner all non-standard non-standard events establishing incident reports for critical events and reporting to users identifying problem types and prioritisation methodology allowing for varying resolution efforts based on risk •
8 3e
•
g a P
•
•
38
No.
Item
Response Yes No EXP
defining logical and physical control control of problem management information distributing outputs on a "need to know" basis tracking of problem trends to maximise resources, reduce turnaround collecting accurate, current, consistent and usable data inputs to reporting
•
•
•
notifying appropriate level of management for escalation and awareness determining if management periodically periodicall y evaluates the problem management process for increased effectiveness and efficiency sufficiency of audit trail for system problems integration with change, availability, EXP Reference: •
•
• •
102
103
Whether emergency processing are documented and require EXP Reference:
priorities
exist,
approval
Whether there are emergency and temporary access authorisation procedures which require: documentation of access on standard forms and maintained on file approval by by appropriate managers secure communication communication to the security function automatic access termination, after a predetermined period of time EXP Reference: _ •
• • •
104
For data preparation: data preparation procedures ensure completeness, accuracy and validity authorisation procedures procedures for all source documents exist separation of duties between between origination, approval and conversion of source •
•
•
9 3e
authorised data remains complete, accurate and valid through through source document origination data is transmitted in a timely manner periodic review of source documents for g
•
a P
• •
39
No.
Item
Response Yes No EXP
appropriate appropriate handling of erroneous source documents adequate control over sensitive information exists on source documents for protection from compromise comprom ise procedures ensure completeness and accuracy of source documents, proper accounting for source documents and timely conversion source document retention is sufficiently sufficiently long to allow reconstruction in event of loss, availability for review and audit, litigation EXP Reference: _ •
•
•
•
105
For data input: appropriate appropriate source document routing for approval prior to entry proper separation of duties among submission, approval, authorisation and data entry functions unique terminal or station codes and secure operator identification usage, maintenance maintenance and control of station codes and operator IDs audit trail trail to identify source of input routine verification or edit checks of inputted data as close to the point of origination as possible appropriate handling handling of erroneously input EXP Reference: _ •
•
•
•
• •
•
106
For data processing: Whether programmes contain error prevention, detection, correction routines: programmes must test input for errors (i.e., validation and editing) programmes must validate validate all transactions transactions against a master list of same programmes must disallow override override of error conditions EXP Reference: •
•
0 4e
•
107
g a P
Whether error handling procedures include: correction and resubmission of errors must be approved individual responsibility responsibility for suspense suspense files files is •
•
40
No.
Item
Response Yes No EXP
suspense files files generate generate reports for for nonnonresolved errors suspense file prioritisation scheme is available based on EXP Reference: •
108
Whether logs of programmes executed and transactions EXP Reference:
109
Whether a control group for monitoring entry activity and investigating non-standard events, along with balancing of record counts and control totals for all EXP Reference:
110
Whether that all fields are edited appropriately, even if EXP Reference:
111
Whether tables used in validation are reviewed on a frequent basis? EXP Reference:
112
Whether written procedures exist for correcting and resubmitting data in error including a nonEXP Reference:
113
Whether resubmitted transactions are processed exactly EXP Reference:
114
Whether responsibility for error correction resides with EXP Reference:
115
Whether Artificial Intelligence systems are placed in an interactive control framework with human EXP Reference:
116
For output, interfacing, and distribution: Access to output is restricted physically physically and logically to authorised people Ongoing review of need for outputs is occurring Output is routinely balanced balanced to relevant control totals •
1 4e
•
g a P
•
•
41
No.
Item •
•
•
•
•
•
•
•
Audit trails exist to facilitate facilitate the tracing of transaction processing and the reconciliation of disrupted data Output report accuracy is reviewed review ed and errors contained in output is controlled by cognisant personnel Clear definition definition of security issues during output, interfacing and distribution exist Communication of security breaches during any phase is communicated to management, acted upon and reflected in new procedures as appropriate Process and responsibility of output disposal is clearly defined Destruction is witnessed of materials used but not needed after processing All input and output media is stored in offoffsite location in event of later need Information marked as deleted is
EXP Reference: 117
Response Yes No EXP
_
For media library: Contents of media library are are systematically inventoried Discrepancies disclosed by the inventory are remedied in a timely manner Measures are taken taken to maintain the integrity of magnetic media stored in the •
•
•
Housekeeping procedures exist to protect media library contents contents Responsibilities for media library management have been assigned to specific members of IT staff Media back-ups back-ups and restoration strategy strategy exists Media back-ups are taken in accordance with the defined back-up •
•
•
2
•
•
4e g a
Media back-ups are securely stored and storage sites periodically reviewed regarding physical access security and security of data files and P
42
No.
Item
Response Yes No EXP
Retention periods and storage terms are defined for documents, data, programmes, reports and messages (incoming and outgoing) as well as the data (keys, certificates) used for their
•
In addition to the storage of paper source documents, telephone conversations are recorded and retained - if not in conflict with local privacy laws - for transactions or other activities that are part of the business activities traditionally conducted over telephones Adequate procedures are in place regarding the archival of information (data and programm es) in line with legal l egal and EXP Reference: _ •
•
118
For information authentication authentication and integrity: The integrity of the the data data files files is checked periodically Requests received from outside the organisation, via telephone or VoiceMail, are verified by call- back or other means A prearranged method is used for independent independen t verification of the authenticity authenticity of source and contents of transaction transaction requests received via fax or image system Electronic signature or certification certification is used to verify the integrity EXP Reference: •
•
•
•
3 4e g a P
43
13. Conclusion/Recommendation Recommendation # 1: 1: Implement targeted security monitoring over ERP support staff access in the production environment. Recommendation # 2: 2: Perform a risk assessment/cost benefit analysis over the access and system functions that pose the greatest risks to determine which controls merit the associated expense of generating logs or using personnel's time to regularly review. Automated review, such as the use of scripts to identify certain unauthorized or high risk activity should be used wherever possible to cut back on personnel time and log retention requirements. Recommendation # 3: Critical controls should have an automated trigger or alert such as an email generated from the use of a critical transaction, and sent to the appropriate party for review. Recommendation # 4: Risks, controls implemented/mitigated risk, method of implementation, and frequency of review should be documented in the monitoring portion of the SAP Security Policy. Recommendation # 5: Documented reviews of monitoring controls should be performed at least semiannually over the implemented monitoring to ensure that the monitoring defined through this exercise are adequate, effective and an d consistently in place. Recommendation # 6:
4
We recommend the security group clearly document technical roles within the SAP environments and enforce Segregation of Duties between technical roles wherever possible.
g
44
P
a
4e
Recommendation # 7: Access for each ERP support department staff should be restricted to only the access that user requires to perform their day to day functions. Recommendation # 8: ERP support department staff access should be reviewed at defined regular intervals on a semi annual basis at a minimum. Recommendation # 9: 9: Additional access beyond standardized support staff roles must be approved by management external to the ERP support department staff, and should be provided through a monitored account such as a Firefighter account. Recommendation # 10: Unmonitored generic accounts should not exist in the production (live financial) environment. Recommendation # 11: 11 : Logs generated from monitored accounts (such as firefighter accounts) should be reviewed at defined points and signed off by the supervising manager when they are in use. Simplified automation can be employed such as automating the generation and sending of the log to the manager via email, whose reply can serve as his auditable electronic sign-off. Recommendation # 12: Security logs should be stored in a location where the SAP IT teams do not have access to modify the logs. Recommendation # 13: Ensure that production client authentication settings meet and continue to meet the Standard authentication requirements defined in the Security Policy. 4e
5 g a P
45
Recommendation # 14: Management should take precautions to ensure that no user can increase or modify their own access. If it is not feasible to limit this capability to users required to provision access, controls such as monitoring their account permissions for modifications using a standardized methodology should be implemented to mitigate this security risk. Recommendation # 15: To mitigate the control weaknesses related to the vendor database, we have made the following recommendations: Recommendation # 16: Create and run a periodic report across non PO invoices looking for duplicate payments similar to the previous mitigating controls report that was in pl ace prior to the implementation of SAP. Recommendation # 17: Analyse the ABM'S vendor database and remove all duplicate vendor data. Recommendation # 18: Implement a required "unique identifier" for a vendor/business, such as the tax ID, for new vendors and create a process for adding the unique identifier to existing vendors. Recommendation # 19: Complete an evaluation for providing centralized continuing education, and ensure that at a minimum, classes addressing the core functions of SAP are provided on a periodic basis, and made available to the appropriate departments. Recommendation # 20: 6
Develop a training schedule for specific requirements based on the results of the survey they conducted.
46
P
a
g
4e
Recommendation # 21: Make the training schedule available to ABM Employees, using means such as email or the ABM’s intranet site. Further, a method for feedback after each training should be provided, such as a survey, to ensure the trainings remain effective. Recommendation # 22: Ensure enough resources are dedicated to provide on -going training. Recommendation # 23: Ensure that skilled employees have scheduled dedicated time to train users in their respective proficiency. This report is issued upon the request of management and to the best of our knowledge & belief. This report is issued without any prejudice prejudice & subject to terms & conditions of the engagement. Thanking & assuring you best of our attention at all points.
PREPARED AND SIGNATURE BY C.A. MEKALA LEELA RAGHAVENDRA PRASAD, M.NO.237875, ISA NO 53515 C.A. DINAKAR CH, M.NO.237078, ISA NO 51258 C.A. SANTHOSH KUMAR SUNKARA, M.NO 243365, ISA NO 53500
7 4e g a P
47
