Information System Assurance Practices in China

1. Information System Assurance Practices in China • Key players doing IS Assurance In China • Regulatory Regime and Professional Organizations • Regulatory Authorities • Professional Organizations • Standards and Regulatory Requirement Examples • Types of IS Related Services by Public Accounting Firms • Key Challenges and Trends Philip Yang

2. Key players doing IT Assurance In China • Accounting firms, with the big 4 being the key players. Local firms are lagging behind but starting to train their people and going after both assurance and consulting projects. • National Audit Office has a very large number of auditors with some focusing on IT audit. • Industry regulators, mainly bank regulator CBRC and insurance regulator CIRC. • Internal audit departments, depends on nature of business some have IT audit departments, e.g. large banks, insurance companies, telecom companies.

3. Regulatory Authorities • Ministry of Finance • Issues China accounting and reporting standards and explanations. • Internal control standards. • Industry and security regulators • CBRC • CIRC • CSRC • Standardization Administration of the People's Republic of China

4. Professional Organizations • China Institute of Certified Public Accountants • Issues China CPA assurance standards. • China CPA exams and certifications. • China Institute of Internal Auditors • Issues China internal audit standards, e.g. Internal Audit Standard No. 28–Information System Audit. • Agent of IIA on CIA exams and certifications. • ISACA China Chapter (running out of Hong Kong) • China Information Systems Auditor Union

5. F/S Audit Related CICPA Standards Related to IS • AS1211 – Understanding of client and its environments • AS1212 – Considerations on use of service organizations • AS1231 – Audit procedures to address significant risks • AS1314 – Sampling and other means of substantative tests • AS1421 – Use of specialists • AS1611 – Audit of commercial banks • AS1633 – Impacts of e-commerce to F/S audit

6. Other IS Related Assurance Standards • AS3101 – Standard on assurance of information other than historical financial information (CICPA) • Internal control audit guide (CICPA) • Internal Audit Standard No. 28–Information System Audit (CIIA)

7. China Enterprise Internal Control Standards Framework Companies Auditors Internal Control Assessment Guide (MOF) Internal Control Audit Guide (CICPA) Industry Regulator Requirements, e.g. Internal Control Guide for Commercial Banks (CBRC) Security Regulator and Stock Exchange Requirements, e.g. IPO requirements, Annual Report requirements Internal Control Application Guidelines (MOF) 18 Guidelines at this moment(see next page) The Basic Standard for Enterprise Internal Control (MOF)

8. China Enterprise Internal Control Standards Framework(cont’d)Internal Control Application Guidelines

9. IT Risk Management Guide for Commercial BanksChina Banking Regulatory Commission • Chapter 1, General Guidelines • Chapter 2, IT Governance • Chapter 3, IT Risk Management Framework • Chapter 4, Information Security • Chapter 5, IT Application Development, Test and Maintenance • Chapter 6, IT Operation • Chapter 7, Business Continuity Management • Chapter 8, Outsourcing • Chapter 9, Internal Audit • Chapter 10, External Audit • Chapter 11, Other Matters

10. IT Risk Management Guide for Commercial BanksChina Banking Regulatory Commission • Chapter 9, Internal Audit • Internal Audit Department should have auditors with relevant IT audit knowledge and experience • Internal Audit should decide audit scope and frequency based on nature of IT applications. A comprehensive IT audit should be done at least once in every 3 years. • Chapter 10, External Audit • Banks may engage external auditors to conduct IT audit.

11. E-banking Security Assessment Guidelines for Financial Institutions (CBRC) • Chapter 1, General Requirements • E-banking security assessment covers security strategy, control policies, risk responses, system security, client protection. • Financial institutions providing e-banking services should have an overall assessment at least once in every two years. Chapter 2, Assessment Agent • Either an independent specialists organization or a competent and independent internal department may perform the assessment. • An Institution may engage a security assessment organization certified by CBRC or those that are not.

12. E-banking Security Assessment Guidelines for Financial Institutions (CBRC) (cont’d) • Chapter 3, Execution of Security Assessment • Scope of the assessment: Security strategy, Internal control policy, Risk management status, System security, E-banking BCP, Contingency plans, Risk monitor and alert system • Assessment report should include at least:1) Time, scope and other key terms in the assessment contracts, 2) Assessment framework, procedures, approach; Bios of the assessors, 3) Definition and standard for risk weights, risk classification, and risk calculation, 4) Description of assessment subjects and assessment activities, 5) Conclusions, 6) Recommendations to the institution on e-banking security, 7) Any other matters worth mentioning, 8) Terminologies and international or domestic standards used, 9) Assessment work program as attachments, 10) Name list of assessors.

13. E-banking Security Assessment Guidelines for Financial Institutions (CBRC) (cont’d) • Chapter 4, Timing and Filing Requirements • An assessment needs to be done before the roll out of e-business by a financial institution. • An assessment needs to be done when the following events occur：1）System down by attacks, 2) Prolonged downtime after system changes, 3) Major hardware failures causing prolonged service interruptions, 4) Any other events that an assessment is deemed necessary. • Branches of foreign Fis in China does not need to do an separate assessment is their e-banking systems are located overseas and assessments are done by their parents. However, they still need to fill reports with CBRC on those assessments. • Upon completion of an assessment report, the FI should file the report with CBRC within one month.

14. Types of IS Related Services by Public Accounting Firms • Audit of IT for the purpose of F/S audit • Audit of IT as part of internal control audit • Compliance driven IT assurance work, especially for financial institutions such as banks and insurance companies • Audit report on internal controls of service organizations (ISAE3402) • Consulting projects: IT strategy, IT governance, IT risk, IT security, Data integrity, IT projects

15. Key Challenges and Trends • Talents • Standards • IT strategy and planning • IT investment management • IT cost management • IT GOVERNANCE IS Assurance in China, Philip Yang

16. Thank you... • Philip Yang, Partner • PricewaterhouseCoopers • philip.yang@cn.pwc.com • (86) 10 – 6533-7308