Share on Facebook

Share on Twitter

Share on LinkedIn

Share on Email

Share More

Neither to descriptive nor to brief. #pdf
845 times
383 KB

Download Other files in Exams category

File Content -

1. Concepts of Governance and Management of Information Systems 1.1 Key Concepts of Governance 1) Governance –  The term “Governance” is derived from the Greek verb meaning “to steer”.  Governance refers to "all processes of governing, whether undertaken by a government, market or network, whether over a family, tribe, formal or informal organization or territory and whether through laws, norms, power or language."  A governance system refers to all the means and mechanism that will enable multiple stakeholders in an enterprise to have an organized mechanism for evaluating options, setting direction and monitoring compliance and performance, in order to satisfy specific enterprise objectives. 2) Enterprise Governance –  Enterprise Governance can be defined as –  The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction,  ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the organization’s resources are used responsibly.  The enterprise governance constitutes the entire accountability framework of an organization as it involves establishing accountability for decision-making.  Enterprise Governance has two dimensions:  Corporate Governance or Conformance, and  Business Governance or Performance. i). Corporate Governance or Conformance –  Corporate Governance is defined as the system by which a company is directed and controlled to achieve the objective of increasing shareholder value by enhancing economic performance.  Corporate governance concerns the relationships among the management, Board of Directors, the controlling shareholders and other stakeholders.  This covers corporate governance issues such as: Roles of the chairman and CEO, Role and composition of board of directors, Board committees, Controls assurance and Risk management.  Good corporate governance contributes to sustainable economic development by enhancing the performance of companies and increasing their access to outside capital.  Good corporate governance requires sound internal control practices such as segregation of incompatible functions, elimination of conflict of interest, establishment of Audit Committee, risk management and compliance with the relevant laws and standards.  Regulatory requirements and standards generally address this dimension with compliance being subject to assurance and/or audit.  Good corporate governance is important and it is critical so that any weakness in this area is addressed properly. Good corporate governance by itself cannot make an company successful. ii). Business Governance or Performance –  The Business Governance is pro-active in its approach. It is business oriented.  This dimension focuses on strategy and value creation with the objective of helping the board to make strategic decisions, understand its risk appetite and its key performance drivers.  This dimension does not lend itself easily to a regime of standards and assurance as this is specific to enterprise goals and varies based on the mechanism to achieve them.  It is advisable to develop appropriate best practices, tools and techniques that can be applied intelligently for different types of enterprises as required.  The performance dimension in terms of the overall strategy is the responsibility of the full board but there is no dedicated oversight mechanism as comparable to the audit committee. 1.2 Benefits of Governance  The major benefits of governance are summarized as follows:  Achieving enterprise objectives by ensuring that each element of the mission and strategy are assigned and managed with a clear and transparent decisions rights and accountability framework;  Defining and encouraging desirable behavior in the use of IT and in the execution of IT outsourcing arrangements;  Implementing and integrating the desired business processes into the enterprise;  Providing stability and overcoming the limitations of organizational structure;  Improving customer, business and internal relationships and satisfaction, and reducing internal territorial strife by formally integrating the customers, business units, and external IT providers into a holistic IT governance framework; and  Enabling effective and strategically aligned decision making for the IT Principles that define the role of IT, IT Architecture, IT Infrastructure, Application Portfolio and Frameworks, Service Portfolio, Information and Competency Portfolios and IT Investment & Prioritization. 1.3 Corporate Governance and IT Governance  IT is a key enabler of corporate business strategy. Chief Executive Officers (CEO), Chief Financial Officers (CFO) and Chief Information Officers (CIO) agree that strategic alignment between IT and business objectives are a critical success factor for the achievement of business objectives.  IT has to provide critical inputs to meet the information needs of all the required stakeholders or it can be said that enterprise activities require information from IT activities in order to meet enterprise objectives. Hence, corporate governance drives and sets IT governance.  IT Governance is the system by which IT activities in a company or enterprise are directed and controlled to achieve business objectives with the ultimate objective of meeting stakeholder needs.  Hence, it can be said that there is an inseparable relationship between Corporate Governance and IT Governance or IT Governance is a sub-set of Corporate or Enterprise Governance. 1.4 IT Governance and Governance of Enterprise IT (GEIT)  Although the terms IT Governance and Governance of Enterprise IT (GEIT) are used inter-changeably, the term GEIT is more macro and broader in its scope of coverage. 1.4.1 IT Governance  The objective of IT Governance is to determine and cause the desired behavior and results to achieve the strategic impact of IT.  IT Governance refers to the system in which directors of the enterprise evaluate, direct and monitor IT management to ensure effectiveness, accountability and compliance of IT.  The active distribution of decision-making rights and accountabilities among different stakeholders in an organization and the rules and procedures for making and monitoring those decisions to determine and achieve desired behaviors and results. 1.4.2 Key practices to determine status of IT Governance  As per regulatory requirements and best practices frameworks of Governance of enterprise IT, it is important for the Board of Directors and senior management to play critical roles in evaluating; directing and monitoring IT Effectiveness of the IT governance structure and processes are directly dependent upon the level of involvement of the board and senior management.  Some of the key practices, which determine the status of IT Governance in the enterprise, are:  Who makes directing, controlling and executing decisions?  How the decisions are made?  What information is required to make the decisions?  What decision-making mechanisms are required?  How exceptions are handled?  How the governance results are monitored and improved? 1.4.3 Benefits of IT Governance  The benefits, which are achieved by implementing/improving governance or management of enterprise, IT would depend on the specific and unique environment of every enterprise.  At the highest level, these could include:  Increased value delivered through enterprise IT;  Increased user satisfaction with IT services;  Improved agility in supporting business needs;  Better cost performance of IT;  Improved management and mitigation of IT-related business risk;  IT becoming an enabler for change rather than an inhibitor;  =mproved transparency and understanding of =T’s contribution to the business;  Improved compliance with relevant laws, regulations and policies; and  More optimal utilization of IT resources.  For every defined benefit, it is critical to ensure that:  Ownership is defined and agreed;  It is relevant and links to the business strategy;  The timing of its realization of benefit is realistic and documented;  The risks, assumptions and dependencies associated with the realization of the benefits are understood, correct and current;  An unambiguous measure has been identified; and  Timely and accurate data for the measure is available or is easy to obtain. 1.4.4 Governance of Enterprise IT (GEIT)  Governance of Enterprise IT is a sub-set of corporate governance and facilitates implementation of a framework of IS controls within an enterprise as relevant and encompassing all key areas.  The primary objectives of GEIT are  to analyze and articulate the requirements for the governance of enterprise IT, and  to put in place and maintain effective enabling structures, principles, processes and practices, with clarity of responsibilities and authority to achieve the enterprise's mission, goals and objectives. 1.4.5 Benefits of GEIT  These are given as follows:  It provide a consistent approach integrated and aligned with the enterprise governance approach.  It ensures that IT-related decisions are made in line with the enterprise's strategies and objectives.  It ensures that IT-related processes are overseen effectively and transparently.  It confirms compliance with legal and regulatory requirements.  It ensures that the governance requirements for board members are met. 1.4.6 Key Governance Practices of GEIT  The key governance practices required to implement GEIT in enterprises are highlighted here: i). Evaluate the Governance System –  Continually identify and engage with the enterprises stakeholders, document an understanding of requirements and make judgment on current & future design of governance of enterprise IT; ii). Direct the Governance System –  Inform leadership and obtain their support, buy-in and commitment.  Guide the structures, processes and practices for the governance of IT in line with agreed governance design principles, decision-making models and authority levels. iii). Monitor the Governance System –  Monitor the effectiveness and performance of the enterprise’s governance of =T.  Assess whether the governance system and implemented mechanisms (including structures, principles and processes) are operating effectively and provide appropriate oversight of IT. 1.5 Corporate Governance, Enterprise Risk Management and Internal Controls  Various prominent frauds committed by some large enterprises across the world including India in the last two decades have awakened regulators to the need of mandating the implementation of corporate governance integrated with Enterprise Risk Management and Internal controls. 1.5.1 Corporate Governance  The concept of Corporate Governance has succeeded in attracting a good deal of public interest because of its importance for the economic health of corporations, protect the interest of stakeholders including investors and the welfare of society, in general.  Corporate Governance has been defined as the system by which business corporations are directed and controlled.  Some of the best practices of corporate governance include the following:  Clear assignment of responsibilities and decision-making authorities, incorporating an hierarchy of required approvals from individuals to the board of directors;  Establishment of a mechanism for the interaction and cooperation among the board of directors, senior management and the auditors;  Implementing strong internal control systems, including internal and external audit functions, risk management functions independent of business lines, and other checks and balances;  Special monitoring of risk exposures where conflicts of interest are likely to be particularly great, including business relationships with borrowers affiliated with the bank, large shareholders, senior management, or key decision-makers within the firm (e.g. traders);  Financial & managerial incentives to act in an appropriate manner offered to senior management, business line management and employee in the form of compensation and other recognition; and  Appropriate information flows internally and to the public. For ensuring good corporate governance, the importance of overseeing the various aspects of the corporate functioning needs to be properly understood, appreciated and implemented. 1.5.2 Enterprise Risk Management (ERM)  The Executive Summary of Enterprise Risk Management — Integrated Framework published by COSO of the Treadway Commission highlights the need for management to implement a system of risk management at the enterprise level.  Enterprise Risk Management deal with risks & opportunities affecting value creation or preservation.  Enterprise Risk Management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.  IT security and controls are a sub-set of the overall enterprise risk management strategy and encompass all aspects of activities and operations of the enterprise. 1.5.3 Internal Controls  The (The US Security and Exchange Commission) SEC’s final rules define “internal control over financial reporting” as a –  process designed by, or under the supervision of the company’s principal executive and principal financial officers, or persons performing similar functions, and  effected by the company’s board of directors, management and other personnel,  to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes  in accordance with generally accepted accounting principles.  It includes those policies and procedures that:  Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the company;  Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and are being made only in accordance with authorizations of management and directors of the company;  Provide reasonable assurance regarding timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.”  Under the final rules, a company’s annual report must include “an internal control report of management that contains:  A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company;  A statement identifying the framework used by management to conduct the required evaluation of the effectiveness of the company’s internal control over financial reporting;  Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including a statement as to whether or not the company’s internal control over financial reporting is effective; and  A statement that the registered public accounting firm that audited the financial statements included in the annual report has issued an attestation report on management’s assessment of the company’s internal control over financial reporting.  Responsibility for Implementing Internal Controls –  SOX made a major change in internal controls by holding Chief Executive Officers (CEOs) and Chief Financial Officers (CFOs) personally and criminally liable for the quality and effectiveness of their organization’s internal controls.  An organization must ensure that its financial statements comply with Financial Accounting Standards (FAS) and International Accounting Standards (IAS) or local rules via policy enforcement and risk avoidance methodology called “=nternal Control.”  There must be a system of checks and balances of defined processes that lead directly from actions and transactions reporting to an organization’s owners, investors, and public hosts.  Internal Controls as per COSO –  According to COSO, Internal Control is comprised of five interrelated components: i). Control Environment –  For each business process, an organization needs to develop and maintain a control environment including categorizing the criticality and materiality of each business process. ii). Risk Assessment –  Each business process comes with various risks. A control environment must include an assessment of the risks associated with each business process. iii). Control Activities –  Control activities must be developed to manage, mitigate, and reduce the risks associated with each business process. It is unrealistic to expect to eliminate risks completely. iv). Information and Communication –  These enable an organization to capture and exchange the information needed to conduct, manage, and control its business processes. v). Monitoring –  The internal control process must be continuously monitored with modifications made as warranted by changing conditions.  Clause 49 of the listing agreements issued by SEBI –  Clause 49 of the listing agreements issued by SEBI in India is on similar lines of SOX regulation and mandates inter alia the implementation of enterprise risk management and internal controls and holds the senior management legally responsible for such implementation.  Further, it also provides for certification of these aspects by the external auditors. 1.6 Role of IT in Enterprises  In an increasingly digitized world, enterprises are using IT not merely for data processing but more for strategic and competitive advantage too.  IT deployment has progressed from data processing to MIS to decision support systems to online transactions/services. IT has not only automated the business processes but also transformed the way business processes are performed. 1.6.1 IT Steering Committee  Depending on the size and needs of the enterprise, the senior management may appoint a high-level committee to provide appropriate direction to IT deployment and information systems and to ensure that IT deployment is in tune with the business goals and objectives, known as IT Steering Committee.  IT Steering Committee is ideally led by a member of the Board of Directors and comprises of functional heads from all key departments of the enterprise including the audit and IT department.  The role and responsibility of the IT Steering Committee and its members must be documented and approved by senior management.  The IT Steering Committee provides overall direction to deployment of IT and information systems in the enterprises.  The key functions of the committee would include of the following:  To ensure that long and short-range plans of the IT department are in tune with enterprise goals and objectives;  To establish size and scope of IT function and sets priorities within the scope;  To review and approve major IT deployment projects in all their stages;  To approve and monitor key projects by measuring result of IT projects in terms of ROI, etc.;  To review the status of IS plans and budgets and overall IT performance;  To review and approve standards, policies and procedures;  To make decisions on all key aspects of IT deployment and implementation;  To facilitate implementation of IT security within enterprise;  To facilitate and resolve conflicts in deployment of IT and ensure availability of a viable communication system exists between IT and its users; and  To report to the Board of Directors on IT activities on a regular basis. 1.7 IT Strategy Planning  Planning is basically deciding in advance ‘what is to be done’, ‘who is going to do’ and ‘when it is going to be done’.  There are three levels of managerial activity in an enterprise: i). Strategic Planning –  Strategic planning is the process by which top management determines overall organizational purposes and objectives and how they are to be achieved.  Corporate-level strategic planning is the process of determining the overall character and purpose of the organization, the business it will enter and leave, and how resources will be distributed among those businesses. ii). Management Control –  Management Control is defined as the process by which managers assure that resources are obtained and used effectively and efficiently in the accomplishment of enterprise's objectives. iii). Operational Control –  Operational Control is defined as the process of assuring that specific tasks are carried out effectively and efficiently. 1.7.1 IT Strategic Planning Process  The strategic planning process has to be dynamic in nature and IT management and business process owners should ensure a process is in place to modify the IT long-range plan in a timely and accurate manner to accommodate changes to the enterprise's long-range plan and changes in IT conditions.  Management should establish a policy requiring that IT long and short-range plan are developed and maintained.  IT management and business process owners should ensure that the IT long-range plan is regularly translated into IT short-range plans. Such short-range plans should ensure that appropriate IT function resources are allocated on a basis consistent with the IT long-range plan.  The short-range plans should be reassessed periodically and amended as necessary in response to changing business and IT conditions. The timely performance of feasibility studies should ensure that the execution of the short-range plans is adequately initiated. 1.7.2 Objective of IT Strategy  The primary objective of IT strategy is  to provide a holistic view of the current IT environment, the future direction, and  the initiatives required to migrate to the desired future environment by leveraging enterprise architecture building blocks and components  to enable nimble, reliable and efficient response to strategic objectives. 1.7.3 Classification of Strategic Planning  In the context of Information Systems, Strategic Planning refers to the planning undertaken by top management towards meeting long-term objectives of the enterprise.  IT Strategy planning in an enterprise could be broadly classified into the following categories: i). Enterprise Strategic Plan, ii). Information Systems Strategic Plan, iii). Information Systems Requirements Plan, and iv). Information Systems Applications and Facilities Plan. These aforementioned plans are discussed as follows: 1) Enterprise Strategic Plan  The enterprise strategic plan provides the overall charter under which all units in the enterprise, including the information systems function must operate.  It is the primary plan prepared by top management of the enterprise that guides the long run development of the enterprise.  It includes a statement of mission, a specification of strategic objectives, an assessment of environmental and organization factors that affect attainment of these objectives, a statement of strategies for achieving objectives, a specification of constraints and a listing of priorities.  In an IT environment, it is important to ensure that the IT plan is aligned with the enterprise plan. 2) Information Systems Strategic Plan  The IS strategic plan in an enterprise has to focus on striking an optimum balance of IT opportunities and IT business requirements as well as ensuring its further accomplishment.  This would require the enterprise to have a strategic planning process undertaken at regular intervals giving rise to long-term plans.  The long-term plans should periodically be translated into operational plans setting clear and concrete short-term goals.  Some of the enablers of the IS Strategic plan are:  Enterprise business strategy,  Definition of how IT supports the business objectives,  Inventory of technological solutions and current infrastructure,  Monitoring the technology markets,  Timely feasibility studies and reality checks,  Existing systems assessments,  Enterprise position on risk, time-to-market, quality, and  Need for senior management buy-in, support and critical review. 3) Information Systems Requirements Plan  The information system requirements plan defines information system architecture for the information systems department.  Based on the information architecture requirements of an enterprise, the Information Systems Requirements Plan has to be drawn up so as to meet the information requirements of enterprise.  Some of the key enablers of the information architecture are as follows:  Automated data repository and dictionary,  Data syntax rules,  Data ownership and criticality/security classification,  An information model representing the business, and  Enterprise information architectural standards. 4) Information Systems Applications and Facilities Plan  On the basis of the information system architecture and its associated priorities, the information systems management can develop an information systems applications and facilities plan.  This plan includes:  Specific application systems to be developed and an associated time schedule,  Hardware and Software acquisition/development schedule,  Facilities required, and  Organization changes required. 1.7.4 Key Management Practices for Aligning IT Strategy with Enterprise Strategy  Key management practices required for aligning IT strategy with enterprise strategy are as follows – i). Understand enterprise direction –  Consider the current enterprise environment and business processes, as well as the enterprise strategy and future objectives. Consider also the external environment of the enterprise. ii). Assess the current environment, capabilities and performance –  Assess the performance of current internal business and IT capabilities and external IT services, and develop an understanding of the enterprise architecture in relation to IT.  Identify issues currently being experienced and develop recommendations in areas that could benefit from improvement. iii). Define the target IT capabilities –  Define the target business and IT capabilities and required IT services.  This should be based on the understanding of the enterprise environment and requirements; the assessment of the current business process and IT environment and issues; and consideration of reference standards, best practices and validated emerging technologies or innovation proposal. iv). Conduct a gap analysis –  Identify the gaps between the current & target environments and consider alignment of assets with business outcomes to optimize investment and utilization of internal & external asset base. v). Define the strategic plan and road map –  Create a strategic plan that defines, in cooperation with relevant stakeholders, how IT- related goals will contribute to the enterprise’s strategic goals. =nclude how =T will support =T-enabled investment programs, business processes, IT services and IT assets. vi). Communicate the IT strategy and direction –  Create awareness and understanding of the business and IT objectives and direction, as captured in the IT strategy, through communication to appropriate stakeholders and users. 1.7.5 Business Value from Use of IT  Business value from use of IT is achieved by ensuring optimization of the value contribution to the business from the business processes, IT services and IT assets resulting from IT-enabled investments at an acceptable cost.  The key management practices, which need to be implemented for evaluating ‘Whether business value is derived from =T’, are highlighted as under: i). Evaluate Value Optimization –  Continually evaluate the portfolio of IT enabled investments, services and assets to determine the likelihood of achieving enterprise objectives and delivering value at a reasonable cost.  Identify and make judgment on any changes in direction that need to be given to management to optimize value creation. ii). Direct Value Optimization –  Direct value management principles and practices to enable optimal value realization from IT enabled investments throughout their full economic life cycle. iii). Monitor Value Optimization –  Monitor the key goals and metrics to determine the extent to which the business is generating the expected value and benefits to the enterprise from IT-enabled investments and services.  The success of the process of ensuring business value from use of IT can be measured by evaluating the benefits realized from IT enabled investments and services portfolio and how transparency of IT costs, benefits and risk is implemented. Some of the key metrics, used for such evaluation are:  Percentage of IT enabled investments where benefit realization monitored through full economic life cycle;  Percentage of IT services where expected benefits realized;  Percentage of IT enabled investments where claimed benefits met or exceeded;  Percentage of investment business cases with clearly defined and approved expected IT related costs and benefits;  Percentage of IT services with clearly defined and approved operational costs and expected benefits; and  Satisfaction survey of key stakeholders regarding the transparency, understanding and accuracy of IT financial information. 1.8 Risk Management  Enterprise Risk Management and IT Risk Management are key components of an effective IT governance structure of any enterprise.  Effective IT governance helps to ensure close linkage to the enterprise risk management activities, including Enterprise Risk Management (ERM) and IT Risk Management. 1.8.1 Information Systems Risks and Risk Management  Risk is the possibility of something adverse happening, resulting in potential loss/exposure.  Risk management is the process of assessing risk, taking steps to reduce risk to an acceptable level and maintaining that level of risk.  Risk management involves identifying, measuring, and minimizing uncertain events affecting resources. Any Information system based on IT has its inherent risks.  Based on the point of impact of risks, controls are classified as Preventive, Detective and Corrective. Preventive controls prevent risks from actualizing. Detective controls detect the risks as they arise. Corrective controls facilitate correction.  IS security is defined as "procedures and practices to assure that computer facilities are available at all required times, that data is processed completely and efficiently and that access to data in computer systems is restricted to authorized people". 1.8.2 Sources of Risk  The most important step in risk management process is to identify the sources of risk, the areas from where risks can occur. This will give information about the possible threats, vulnerabilities and accordingly appropriate risk mitigation strategy can be adapted.  Some of the common sources of risk are as follows:  Commercial and Legal Relationships,  Economic Circumstances,  Human Behavior,  Natural Events,  Political Circumstances,  Technology and Technical Issues,  Management Activities and Controls, and  Individual Activities.  Risk has the following characteristics:  Loss potential that exists as the result of threat/vulnerability process;  Uncertainty of loss expressed in terms of probability of such loss; and  The probability/likelihood that a threat agent mounting a specific attack against particular system. 1.8.3 Related Terms Various terminologies relating to risk management are given as follows: 1) Asset  Asset can be defined as something of value to the organization; e.g., information in electronic or physical form, software systems, employees.  Irrespective the nature of asset themselves, they all have one or more of following characteristics:  They are recognized to be of value to the organization.  They are not easily replaceable without cost, skill, time, resources or a combination.  They form a part of the organization’s corporate identity, without which, the organization may be threatened.  Their Data Classification would normally be Proprietary, Highly confidential or Top Secret. 2) Vulnerability  Vulnerability is the weakness in the system safeguards that exposes the system to threats.  It may be a weakness in information system/s, security system or other components that could be exploited by a threat. Vulnerabilities potentially “allow” a threat to harm or exploit the system.  Some examples of vulnerabilities are given as follows:  Leaving the front door unlocked makes the house vulnerable to unwanted visitors.  Short passwords (less than 6 characters) make the automated information system vulnerable to password cracking or guessing routines.  Normally, vulnerability is a state in a computing system (or set of systems), which must have at least one condition, out of the following: i). Allows an attacker to execute commands as another user or ii). Allows an attacker to access data that is contrary to specified access restriction for that data or iii). Allows an attacker to pose as another entity or iv). Allows an attacker to conduct a denial of service 3) Threat  Any entity, circumstance, or event with the potential to harm the software system or component through its unauthorized access, destruction, modification or denial of service is called a Threat.  A threat is an action, event or condition where there is a compromise in the system, its quality and ability to inflict harm to the organization.  Threat has capability to attack on a system with intent to harm. It is often to start threat modeling with a list of known threats and vulnerabilities found in similar systems.  Assets and threats are closely correlated. A threat cannot exist without a target asset. Threats are typically prevented by applying some sort of protection to assets. 4) Exposure  An exposure is the extent of loss the enterprise has to face when a risk materializes. It is not just the immediate impact, but the real harm that occurs in the long run.  For example - loss of business, failure to perform the system’s mission, loss of reputation, violation of privacy and loss of resources etc. 5) Likelihood  Likelihood of the threat occurring is the estimation of the probability that the threat will succeed in achieving an undesirable event.  The presence, tenacity and strengths of threats, as well as the effectiveness of safeguards must be considered while assessing the likelihood of the threat occurring. 6) Attack  An attack is an attempt to gain unauthorized access to the system’s services or to compromise the system’s dependability.  In software terms, an attack is a malicious intentional fault, usually an external fault that has the intent of exploiting vulnerability in the targeted software or system.  Basically, it is a set of actions designed to compromise CIA (Confidentiality, Integrity or Availability), or any other desired feature of an information system. 7) Risk  Risk can be defined as the potential harm caused if a particular threat exploits a particular vulnerability to cause damage to an asset.  Risk analysis is defined as the process of identifying security risks and determining their magnitude and impact on an organization.  Risk assessment includes the following:  Identification of threats and vulnerabilities in the system;  Potential impact or magnitude of harm that a loss of CIA, would have on enterprise operations or enterprise assets, should an identified vulnerability be exploited by a threat; and  The identification and analysis of security controls for the information system.  Information systems can generate many direct and indirect risks. These risks lead to a gap between the need to protect systems and degree of protection applied. The gap is caused by:  Widespread use of technology;  Interconnectivity of systems;  Elimination of distance, time and space as constraints;  Unevenness of technological changes;  Devolution of management and control;  Attractiveness of conducting unconventional electronic attacks against organizations; and  External factor such as legislative, legal & regulatory requirement or technological development  It means there are new risk areas that could have a significant impact on critical business operations, such as:  External dangers from hackers, leading to denial of service and virus attacks, extortion and leakage of corporate information;  Growing potential for misuse and abuse of information system affecting privacy ðical value;  Increasing requirements for availability and robustness. 8) Counter Measure  An action, device, procedure, technique or other measure that reduces the vulnerability of a component or system is referred as Counter Measure.  For example, well known threat ‘spoofing the user identity’, has two countermeasures: i). Strong authentication protocols to validate users; and ii). Passwords should not be stored in configuration files instead some secure mechanism should be used. 9) Residual Risk  Any risk still remaining after the counter measures are analyzed and implemented is called Residual Risk. Even when safeguards are applied, there is probably going to be some residual risk.  An organization’s management of risk should consider these two areas: acceptance of residual risk and selection of safeguards.  The risk can be minimized, but it can seldom be eliminated. Residual risk must be kept at a minimal, acceptable level. As long as it is kept at an acceptable level, the risk can be managed. 1.8.4 Risk Management Strategies  When risks are identified and analyzed, it is not always appropriate to implement controls to counter them. Some risks may be minor and it may not be cost effective to use expensive control processes.  Risk management strategy is explained and illustrated below: i). Tolerate/Accept the risk.  One of the primary functions of management is managing risk. Some risks may be considered minor because their impact and probability of occurrence is low.  In this case, consciously accepting the risk as a cost of doing business is appropriate, as well as periodically reviewing the risk to ensure its impact remains low. ii). Terminate/Eliminate the risk.  It is possible for a risk to be associated with use of a particular technology, supplier, or vendor.  The risk can be eliminated by replacing the technology with more robust products and by seeking more capable suppliers and vendors. iii). Transfer/Share the risk.  Risk mitigation approaches can be shared with trading partners and suppliers. A good example is outsourcing infrastructure management.  Risk also may be mitigated by transferring the cost of realized risk to an insurance provider. iv). Treat/mitigate the risk.  Where other options have been eliminated, suitable controls must be devised and implemented to prevent the risk from manifesting itself or to minimize its effects. v). Turn back.  Where the probability of the risk is very low, then management may decide to ignore the risk. 1.8.5 Key Governance Practices of Risk Management The key governance practices for evaluating risk management are given as follows: i). Evaluate Risk Management  Continually examine and make judgment on the effect of risk on the current and future use of IT in the enterprise.  Consider whether the enterprise's risk appetite is appropriate and that risks to enterprise value related to the use of IT are identified and managed; ii). Direct Risk Management  Direct the establishment of risk management practices to provide reasonable assurance that IT risk management practices are appropriate to ensure that the actual IT risk does not exceed the board’s risk appetite; and iii). Monitor Risk Management  Monitor the key goals and metrics of the risk management processes and establish how deviations or problems will be identified, tracked and reported on for remediation. 1.8.6 Key Management Practices of Risk Management Key Management Practices for implementing Risk Management are given as follows: i). Collect Data  Identify and collect relevant data to enable effective IT related risk identification, analysis and reporting. ii). Analyze Risk  Develop useful information to support risk decisions that take into account the business relevance of risk factors. iii). Maintain a Risk Profile  Maintain an inventory of known risks and risk attributes, including expected frequency, potential impact, and responses, and of related resources, capabilities, and current control activities. iv). Articulate Risk  Provide information on the current state of IT- related exposures and opportunities in a timely manner to all required stakeholders for appropriate response. v). Define a Risk Management Action Portfolio  Manage opportunities and reduce risk to an acceptable level as a portfolio. vi). Respond to Risk  Respond in timely manner with effective measure to limit magnitude of loss from IT related event. 1.8.7 Metrics of Risk Management  Enterprises have to monitor the processes & practice of IT risk management by using specific metrics. Some of the key metrics are as follows:  Percentage of critical business processes, IT services and IT-enabled business programs covered by risk assessment;  Number of significant IT related incidents that were not identified in risk Assessment;  Percentage of enterprise risk assessments including IT related risks; and  Frequency of updating the risk profile based on status of assessment of risks. 1.9 COBIT 5 Business Framework – Governance and Management of Enterprise IT  Control Objectives for Information and Related Technology (COBIT) is a set of best practices for Information Technology management developed by Information Systems Audit & Control Association (ISACA) and IT Governance Institute in 1996.  The latest =SACA’s globally accepted framework COBIT 5 is aimed to provide an end-to-end business view of the governance of enterprise IT that reflects central role of IT in creating value for enterprises.  COBIT 5 is the only business framework for the governance and management of enterprise Information Technology.  This evolutionary version incorporates the latest thinking in enterprise governance and management techniques, and provides globally accepted principles, practices, analytical tools and models to help increase the trust in, and value from, information systems. 1.9.1 Need for Enterprises to Use COBIT 5  COBIT 5 provides good practices in governance & management to address the critical business issues.  COBIT 5 is a set of globally accepted principles, practices, analytical tools and models that can be customized for enterprises of all sizes, industries and geographies.  It helps enterprises to create optimal value from their information and technology.  COBIT 5 provides the tools necessary to understand, utilize, implement and direct important IT related activities, and make more informed decisions through simplified navigation and use.  COBIT 5 is intended for enterprises of all types and sizes, including nonprofit and public sector and is designed to deliver business benefits to enterprises, including:  Increased value creation from use of IT;  User satisfaction with IT engagement and services;  Reduced IT related risks and compliance with laws, regulations and contractual requirements;  Development of more business-focused IT solutions and services; and  Increased enterprise wide involvement in IT-related activities. 1.9.2 Integrating COBIT 5 with Other Frameworks  COBIT 5 is based on an enterprise view and is aligned with enterprise governance best practices enabling GEIT to be implemented as an integral part of wider enterprise governance.  COBIT5 also provides a basis to integrate effectively other frameworks, standards and practices used such as Information Technology Infrastructure Library (ITIL), The Open Group Architecture Framework (TOGAF) and ISO 27001.  It is also aligned with The GEIT standard ISO/IEC 38500:2008, which sets out high-level principles for the governance of IT, covering responsibility, strategy, acquisition, performance, compliance and human behavior that the governing body (e.g., board) should evaluate, direct and monitor.  Thus, COBIT 5 acts as the single overarching framework, which serves as a consistent and integrated source of guidance in a non-technical, technology-agnostic common language.  The framework & resulting enabler should be aligned with and in harmony with (amongst other) the:  Enterprise policies, strategies, governance and business plans, and audit approaches;  Enterprise risk management framework; and  Existing enterprise governance organization, structures and processes. 1.9.3 Components in COBIT  Framework –  Organize IT governance objectives and good practices by IT domains and processes, and links them to business requirements.  Process Descriptions –  A reference process model and common language for everyone in an organization. The processes map to responsibility areas of plan, build, run and monitor.  Control Objectives –  Provide a complete set of high-level requirements to be considered by management for effective control of each IT process.  Management Guidelines –  Help assign responsibility, agree on objectives, measure performance & illustrate interrelationship with other processes.  Maturity Models –  Assess maturity and capability per process and helps to address gaps. 1.9.4 Benefits of COBIT 5  COBIT 5 frameworks can be implemented in all sizes of enterprises.  A comprehensive framework such as COBIT 5 enables enterprises in achieving their objectives for the governance and management of enterprise IT.  The best practices of COBIT 5 help enterprises to create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk levels and resource use.  Further, COBIT 5 enables IT to be governed and managed in a holistic manner for the entire enterprise, taking in the full end-to-end business and IT functional areas of responsibility, considering the IT related interests of internal and external stakeholders.  COBIT 5 helps enterprises to manage IT related risk and ensures compliance, continuity, security and privacy.  COBIT 5 enables clear policy development and good practice for IT management including increased business user satisfaction.  The key advantage in using a generic framework such as COBIT 5 is that it is useful for enterprises of all sizes, whether commercial, not-for-profit or in the public sector.  COBIT 5 supports compliance with relevant laws, regulations, contractual agreements and policies. 1.9.5 Customizing COBIT 5 as per Requirement  COB=T 5 can be tailored to meet an enterprise’s specific business model, technology environment, industry, location and corporate culture.  Enterprises can select required guidance and best practices from specific publications and processes of COBIT 5.  Because of its open design, it can be applied to meet needs related to:  Information security,  Risk management,  Governance and management of enterprise IT,  Assurance activities,  Legislative and regulatory compliance, and  Financial processing or CSR reporting. 1.9.6 Five Principles of COBIT 5  The five key principles for governance and management of enterprise IT in COBIT 5 taken together enable the enterprise to build an effective governance and management framework that optimizes information and technology investment and use for the benefit of stakeholders.  These principles are discussed below – 1) Principle 1: Meeting Stakeholder Needs  Enterprises exist to create value for their stakeholders by maintaining a balance between the realization of benefits and the optimization of risk and use of resources.  COBIT 5 provides all of the required processes and other enablers to support business value creation through the use of IT.  Because every enterprise has different objectives, an enterprise can customize COBIT 5 to suit its own context through the goals cascade, translating high‐level enterprise goals into manageable, specific, =T‐related goals and mapping these to specific processes and practices. 2) Principle 2: Covering the Enterprise End‐to‐End  COBIT 5 integrates governance of enterprise IT into enterprise governance. It covers all functions and processes within the enterprise.  COB=T 5 does not focus only on ‘=T function’, but treats information and related technologies as assets that need to be dealt with just like any other asset by everyone in the enterprise.  =t considers all =T‐related governance and management enablers to be enterprise‐wide and end‐ to‐end. 3) Principle 3: Applying a Single Integrated Framework:  COBIT 5 is a single and integrated framework as it aligns with other latest relevant standards and frameworks, thus allows the enterprise to use COBIT 5 as the overarching governance and management framework integrator.  It is complete in enterprise coverage, providing a basis to integrate effectively other frameworks, standards and practices used. 4) Principle 4: Enabling a Holistic Approach:  Efficient and effective governance and management of enterprise IT require a holistic approach, taking into account several interacting components.  COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance and management system for enterprise IT.  Enablers are defined as anything that can help to achieve the objectives of the enterprise. 5) Principle 5: Separating Governance from Management:  The COBIT 5 framework makes a clear distinction between governance and management.  These two disciplines encompass different types of activities, require different organizational structures and serve different purposes. 1.9.7 Seven Enablers of COBIT 5  Enablers are factors that, individually and collectively, influence whether something will work – in this case, governance and management of the enterprise IT.  Enablers are driven by the goals cascade, i.e., higher level =T related goals define ‘what the different enablers should achieve’.  The COBIT 5 framework describes seven categories of enablers : 1) Principles, policies and frameworks are the vehicle to translate the desired behaviour into practical guidance for day-to-day management. 2) Processes describe an organized set of practices and activities to achieve certain objectives and produce a set of outputs in support of achieving overall IT-related goals. 3) Organizational structures are the key decision-making entities in an enterprise. 4) Culture, ethics and behaviour of individuals and of the enterprise are very often underestimated as a success factor in governance and management activities. 5) Information is pervasive throughout any organization and includes all information produced and used by enterprise. Information is required for keeping the organization running & well governed, but at the operational level, information is very often the key product of the enterprise itself. 6) Services, infrastructure and applications include the infrastructure, technology and applications that provide the enterprise with information technology processing and services. 7) Skills and competencies are linked to people and are required for successful completion of all activities for making correct decisions and taking corrective actions. 1.9.8 Using COBIT 5 Best Practices for GRC  A GRC program (project) can be implemented primarily from a compliance perspective.  GRC program implementation requires the following:  Defining clearly what GRC requirements are applicable;  Identifying the regulatory and compliance landscape;  Reviewing the current GRC status;  Determining the most optimal approach;  Setting out key parameters on which success will be measured;  Using a process oriented approach;  Adapting global best practices as applicable; and  Using uniform and structured approach which is auditable.  The responsibility of senior management in implementing and monitoring functioning of requisite GRC measures is not only a regulatory requirement but it also makes business sense.  Using best practices frameworks such as COBIT 5 can help in discharging this responsibility by ensuring that all aspects of GRC are implemented.  Successful implementation of GRC in enterprise can be measured in general by the assurance provided to the senior management on the adequacy of controls implemented.  Specific success of a GRC program can be measured by using the following goals and metrics:  The reduction of redundant controls and related time to execute (audit, test and remediate);  The reduction in control failures in all key areas;  The reduction of expenditure relating to legal, regulatory and review areas;  Reduction in overall time required for audit for key business areas;  Improvement through streamlining of processes and reduction in time through automation of control and compliance measures;  Improvement in timely reporting of regular compliance issues and remediation measures; and  Dashboard of overall compliance status and key issues to senior management on a realtime basis as required. 1.10 IT Compliance Review  Failures of some large enterprises in the last decade due to lack of adequate level of ERM has compelled regulators to mandate its enforcement thus necessitating compliance with Governance, Risk and Compliance (GRC).  Effective implementation of ERM requires consideration of multiple factors such as using a holistic approach, which encompasses enterprise from end-to-end, top down approach, best practices framework, technology deployment, related regulatory requirements and business needs.  In the US, Sarbanes Oxley Act has been passed to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, and for other purposes.  In India, Clause 49 of listing agreement issued by Security and Exchange Board of India (SEBI) mandates similar implementation of enterprise risk management and internal controls as appropriate for the enterprise.  The Information Technology Act, 2000 identifies various types of cyber-crimes and has imposed specific responsibilities on corporate. Hence, it can be rightly said that implementing Governance, Risk, security and controls is not only a management requirement but is mandated by law, too.  Reporting on Internal control requirements are mandated by the Indian Companies Act, 1956 for all companies and a separate annexure to the audit report has to be provided by auditors as per Companies (Auditor's Report) Order, 2003 (CARO). Hence, implementing internal controls is mandated by law not only for listed companies but all companies. 1.10.1 Compliance in COBIT 5  The Management domain of “Monitor, Evaluate and Assess (MEA)” contains a compliance focused process: “MEA03 Monitor, Evaluate and Assess Compliance with External Requirements”.  This process is designed to evaluate that IT processes and IT supported business processes are compliant with laws, regulations and contractual requirements.  This require that the enterprise has processes in place to obtain assurance and that these requirements have been identified and complied with, and integrate IT compliance with overall enterprise compliance.  The primary purpose of this process is to ensure that the enterprise is compliant with all applicable external requirements.  In addition to MEA03, all enterprise activities include control activities that are designed to ensure compliance not only with externally imposed legislative or regulatory requirements but also with enterprise governance-determined principles, policies and procedures.  The COBIT 5 framework includes the necessary guidance to support enterprise GRC objectives and supporting activities.  In fact, COBIT combined with COSO has been the most widely used framework for implementing IT controls as part of enterprise risk management to meet governance requirements. 1.10.2 Key Management Practices of IT Compliance  COBIT 5 provides key management practices for ensuring compliance with external compliances as relevant to the enterprise. The practices are given as follows: i). Identify External Compliance Requirements  On a continuous basis, identify and monitor for changes in local and international laws, regulations and other external requirement that must be complied with from an IT perspective. ii). Optimize Response to External Requirements  Review and adjust policies, principles, standards, procedures and methodologies to ensure that legal, regulatory and contractual requirements are addressed and communicated. iii). Confirm External Compliance  Confirm compliance of policies, principles, standards, procedures and methodologies with legal, regulatory and contractual requirements. iv). Obtain Assurance of External Compliance  Obtain and report assurance of compliance and adherence with policies, principles, standards, procedures and methodologies.  Confirm that corrective actions to address compliance gaps are closed in a timely manner. 1.10.3 Key Metrics for Assessing Compliance Process  Sample metrics for reviewing the process of evaluating and assessing compliance with external laws & regulations and IT compliances with internal policies are given as under: 1) Compliance with External Laws and Regulations These metrics are given as follows:  Cost of IT non-compliance, including settlements and fines;  Number of IT related non-compliance issues reported to the board or causing public comment or embarrassment;  Number of non-compliance issues relating to contractual agreements with IT service providers;  Coverage of compliance assessments. 2) IT Compliance with Internal Policies These metrics are given as follows:  Number of incidents related to non compliance to policy;  Percentage of stakeholders who understand policies;  Percentage of policies supported by effective standards and working practices; and  Frequency of policies review and updates. 1.11 Information System Assurance  In the rapidly changing digital world, enterprises are inundated with new demands, stringent regulations and risk scenarios emerging daily, making it critical to effectively govern and manage information and related technologies. This has resulted in enterprise leaders being under constant pressure to deliver value to enterprise stakeholders by achieving business objectives. 1.11.1 Evaluating IT Governance Structure and Practices by Internal Auditors  IT Governance can be evaluated by both external as well internal auditors. The following guidance is from internal audit perspective as issued by The Institute of Internal Auditors (IIA).  It outlines specific areas and critical aspects relating to governance structure and practices, which can be reviewed as part of internal audit.  These are briefly explained here. 1) Leadership: The following aspects need to be verified by the auditor:  Evaluate the relationship between IT objectives and the current/strategic needs of the organization and the ability of IT leadership to effectively communicate this relationship to IT and organizational personnel.  Assess the involvement of IT leadership in the development and on-going execution of the organization’s strategic goals.  Determine how IT will be measured in helping the organization achieve these goals.  Review how roles and responsibilities are assigned within the IT organization and how they are executed.  Review the role of senior management and the board in helping establish and maintain strong IT governance. 2) Organizational Structure: The following aspects need to be assessed by the auditor:  Review how organization management and IT personnel are interacting and communicating current and future needs across the organization.  This should include the existence of necessary roles and reporting relationships to allow IT to meet the needs of the organization, while providing the opportunity to have requirements addressed via formal evaluation and prioritization. 3) Processes: The following aspects need to be checked by the auditor:  Evaluate IT process activities and the controls in place to mitigate risks to the organization and whether they provide the necessary assurance regarding processes and underlying systems.  What processes are used by the IT organization to support the IT environment and consistent delivery of expected services? 4) Risks: The following aspects need to be reviewed by the auditor:  Review the processes used by the IT organization to identify, assess, and monitor/mitigate risks within the IT environment.  Additionally, determine the accountability that personnel have within risk management and how well these expectations are being met. 5) Controls: The following aspects need to be verified by the auditor:  Assess key controls that are defined by IT to manage its activities and the support of the overall organization.  Ownership, documentation, and reporting of self-validation aspects should be reviewed by the internal audit activity.  Additionally, the control set should be robust enough to address identified risks based on the organization’s risk appetite and tolerance levels, as well as any compliance requirements. 6) Performance Measurement/Monitoring: The following aspects need to be verified by the auditor:  Evaluate the framework and systems in place to measure and monitor organizational outcomes where support from IT plays important part in internal outputs in IT operation & development. 1.11.2 Sample Areas of GRC for Review by Internal Auditors  IIA provides areas, which can be reviewed by internal auditors as part of review of Governance, Risk and Compliance (GRC) areas.  These are given as follows: 1) Scope  The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach. 2) Governance  The internal audit activity must assess and make appropriate recommendations for improving the governance process in its accomplishment of the following objectives:  Promoting appropriate ethics and values within the organization;  Ensuring effective organizational performance management and accountability;  Communicating risk and control information to appropriate areas of the organization; and  Coordinating the activities of and communicating information among the board, external and internal auditors, and management. 3) Evaluate Enterprise Ethics  The internal audit activity must evaluate the design, implementation, and effectiveness of the organization’s ethics related objectives, programs, and activities. 4) Risk Management –  The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. 5) Interpretation  Determining whether risk management processes are effective in a judgment resulting from the internal auditor’s assessment that:  Organizational objectives support and align with the organization’s mission;  Significant risks are identified and assessed;  Appropriate risk responses are selected that align risks with the organization’s risk appetite;  Relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities. 6) Risk Management Process  The internal audit activity may gather the information to support this assessment during multiple engagements. Risk management processes are monitored through on-going management activities, separate evaluations, or both. 7) Evaluate Risk Exposures  The internal audit activity must evaluate risk exposures relating to the organization’s governance, operations, and information systems regarding the:  Achievement of the organization’s strategic objectives;  Reliability and integrity of financial and operational information;  Effectiveness and efficiency of operations and programs;  Safeguarding of assets; and  Compliance with laws, regulations, policies, procedures, and contracts. 8) Evaluate Fraud and Fraud Risk  The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk. 9) Address Adequacy of Risk Management Process  During consulting engagements, internal auditors must address risk consistent with the engagement’s objectives and be alert to the existence of other significant risks.  Internal auditors must incorporate knowledge of risks gained from consulting engagements into their evaluation of the organization’s risk management processes. 1.11.3 Sample Areas of Review of Assessing and Managing Risks  This review covers the Controls over the IT process of assessing and managing risks and is expected to provide assurance to the management that the enterprise has identified all the risks relevant to the enterprise/business as relevant to IT Implementation.  In addition, it is also expected to provide assurance that it has appropriate risk management strategy to mitigate these risks.  This review broadly considers whether enterprise is engaging itself in IT risk-identification and impact analysis, involving multi-disciplinary functions and taking cost-effective measures to mitigate risks.  The specific areas evaluated are:  Risk management ownership and accountability;  Different kinds of IT risks (technology, security, continuity, regulatory, etc.);  Defined and communicated risk tolerance profile;  Root cause analyses and risk mitigation measures;  Quantitative and/or qualitative risk measurement;  Risk assessment methodology; and  Risk action plan and Timely reassessment. 1.11.4 Evaluating and Assessing the System of Internal Controls  COB=T 5 has specific process: “MEA 02 Monitor, Evaluate and Assess the System of Internal Control”, which provides guidance on evaluating and assessing internal controls implemented in an enterprise.  The objective of such a review is to:  Continuously monitor and evaluate the control environment, including selfassessments and independent assurance reviews;  Enable management to identify management deficiencies and inefficiencies and to initiate improvement actions; and  Plan, organize and maintain standards for internal control assessment and assurance activities.  The key management practices for assessing and evaluating the system of internal controls in an enterprise are given as follows: a) Monitor Internal Controls  Continuously monitor, benchmark and improve the IT control environment and control framework to meet organizational objectives. b) Review Business Process Controls Effectiveness  Review the operation of controls, including a review of monitoring and test evidence to ensure that controls within business processes operate effectively.  This provides the business with the assurance of control effectiveness to meet requirements related to business, regulatory and social responsibilities. c) Perform Control Self-assessments  Encourage management and process owners to take positive ownership of control improvement through a continuing program of self-assessment to evaluate the completeness and effectiveness of management’s control over processes, policies and contracts. d) Identify and Report Control Deficiencies  Identify control deficiencies and analyze and identify their underlying root causes. Escalate control deficiencies and report to stakeholders. e) Ensure that assurance providers are independent and qualified  The entities performing assurance should demonstrate an appropriate attitude & appearance, competence in the skills and knowledge necessary to perform assurance, and adherence to codes of ethics and professional standards. f) Plan Assurance Initiatives  Plan assurance initiatives based on enterprise objectives & conformance objectives, assurance objectives and strategic priorities, inherent risk resource constraints and sufficient knowledge of the enterprise. g) Scope assurance initiatives  Define and agree with management on the scope of the assurance initiative, based on the assurance objectives. h) Execute assurance initiatives  Execute the planned assurance initiative. Report on identified findings. Provide positive assurance opinions, where appropriate, and recommendations for improvement.

Trending Downloads

Follow taxation Exam20 Book Book

Popular Files