290 likes | 306 Views
Learn about SysTrust assurance services developed by AICPA and CPA Canada, covering principles like security and availability. Understand control criteria, audit differences, and user roles. Dive into SysTrust audit reports, drivers, and detailed audit processes.
E N D
Session 11Other Assurance Services Sys Trust Payment Card Industry security standard compliance EECS4482 2015 David Chan
SysTrust • A system assurance service developed by American Institute of Certified Public Accountants (AICPA) and Chartered Professional Accountants Canada (CPA Canada). • Audits have been on new systems in an organization or systems shared by a number of partner organizations • High control assurance EECS4482 2015 David Chan
SysTrust Principles • The Availability Principle addresses accessibility to the defined system, products, or services as advertised or committed by contract, service-level, or other agreements. • The Security Principle requires an entity to meet high standards for the protection of the system components from unauthorized access, both logical and physical. EECS4482 2015 David Chan
Main Trust Principles • Processing Integrity Principle requires an entity to meet high standards for the completeness, accuracy, timeliness, and authorization of system processing including the processing of electronic commerce transactions. All three principles must be satisfied. EECS4482 2015 David Chan
Optional Trust Principles • Confidentiality – no unauthorized viewing • Privacy – confidentiality of personal info EECS4482 2015 David Chan
Sys Trust Audit • The auditor has to be licensed by AICPA or CPA Canada specifically for SysTrust engagements. • The outcome of the audit consists of a report and an unqualified opinion on the internal controls to support the system. • High control assurance. EECS4482 2015 David Chan
Control Criteria • Operating organization of the system selects criteria (objectives) from the list provided by CPA Canada or AICPA to satisfy each main principle and each selected optional principle. Unless a criterion does not apply to the environment, it must be selected. There is no wording change to criteria. • Each control criterion is supported by control activities (procedures), which can be manual or automated, developed by management. EECS4482 2015 David Chan
Difference Between SysTrust and CSAE 3416 • Each stated criterion in the report must be met by controls in order to get an unqualified SysTrust report. • CSAE 3416 report has restricted distribution. • Sys Trust addresses system reliability, whereas CSAE 3416 addresses financial statement assertions. • CSAE 3416 is more flexible, as it uses control objectives instead of principles prescribed by CPA Canada and AICPA. EECS4482 2015 David Chan
SysTrust Users • Hosting organization • User organizations • Trading partners, e.g., automated vendor inventory replenishment • Financial statement auditors EECS4482 2015 David Chan
SysTrust Report • An opinion on management’s asserted controls. • Opinion does not cover system description, although system description is often included in the report. But if the auditor knows that system description is misleading, s/he should not issue an opinion on the controls. • Opinion covers the reporting period of not more than one year. EECS4482 2015 David Chan
Drivers for SysTrust Audit • The potential conflict of interest between the system operator and system user or owner. • The complexity of systems, requiring expertise to conduct an audit that would provide a reasonable degree of assurance about their conformity with system reliability principles and criteria. EECS4482 2015 David Chan
Drivers for SysTrust Audit • The remoteness of users from systems requiring an independent objective representative to observe the system on their behalf. • The consequences of system unreliability. • The four conditions above may contribute individually to the need for assurance services related to the reliability of an entity’s key information system(s) and they may also interact to increase the need for such assurance. EECS4482 2015 David Chan
Process of a Sys Trust Audit • System hosting organization decides to pursue a Sys Trust audit. • System hosting organization hires an accounting firm. • System hosting organization selects optional principles as well as criteria for the mandatory and optional principles. • Management develops control activities for each criterion. EECS4482 2015 David Chan
Process of a Sys Trust Audit • Accounting firm assesses the adequacy of control criteria and procedures. • Accounting firm conducts testing. • Accounting firm provides report to system hosting organization. • System hosting organization shares report with user organizations. EECS4482 2015 David Chan
Options to Address Control Deficiency • Fix the control if there is still time. • Replace the control with another existing control. • Remove an optional principle. • Cancel the engagement. EECS4482 2015 David Chan
Payment Card Industry (PCI) Security Standard Developed by the PCI Security Council formed by major card issuers: Visa, MasterCard, American Express, Diners Club, JCB International and Discover Card. All issuing financial institutions and merchants that take credit card transactions on the Internet have to comply. Failure to comply may lead to financial penalty. EECS4482 2015 David Chan Chan
PCI Security Standard • Visa and MasterCard require major merchants and IT service organizations (over 1 million transactions annually or over 20,000 eTransactions annually) to have an annual external validation for compliance. EECS4482 2015 David Chan
PCI Standards 1.Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor supplied defaults for system passwords and other security parameters. 3. Protect stored cardholder data, including encryption. 4. Encrypt transmission of cardholder data across the Internet EECS4482 2015 David Chan
PCI Standards 5. Use regularly updated anti-virus software 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business on a need-to-know basis 8. Assign a unique ID to each person with computer access EECS4482 2015 David Chan
PCI Security Standard 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security EECS4482 2015 David Chan
Conclusion • SysTrust engagements are increasing because of increasing use of externally hosted systems. • PCI is gaining prominence because the PCI Council (credit card companies) are now starting to enforce this standard. EECS4482 2015 David Chan
Review Questions • Map the SysTrust principles to the control matrix we discussed in Chapter Six. • What are the management options to avoid a qualified SysTrust audit opinion when a control deficiency is identified by the auditor? • What parties can benefit from a SysTrust audit report? EECS4482 2015 David Chan
Review Questions 4.What kinds of organizations are held to comply with the Payment Card Industry Security Standard? 5. What kinds of organizations are required to provide an annual external validation of compliance with the PCI Security Standard? EECS4482 2015 David Chan
Review Questions 6.According to the PCI Security Standard, what kind of access has to be monitored? 7. How does the PCI Security Standard affect the financial statement audits of large retail merchants? 8. How does the PCI Security Standard affect the profit of large retail merchants? EECS4482 2015 David Chan
MC Question Which of the following is an optional SysTrust principle? • A. Confidentiality • B. Security • C. Processing integrity • D. Availability EECS4482 2015 David Chan
MC Question Who is the primary audience of a SysTrust report? • A. Service organization management • B. Shareholders’ auditors of service organization • C. User organization(s) management • D. Shareholders’ auditors of user organization(s) EECS4482 2015 David Chan
MC Question Who is responsible for developing control procedures in a SysTrust audit? • A. External auditors • B. Service organization management • C. Internal auditors • D. User organization management EECS4482 2015 David Chan
MC Question Which SysTrust principle addresses application controls? • A. Security • B. Confidentiality • C. Processing integrity • D. Availability EECS4482 2015 David Chan
MC Question What kind of access to cardholder data must be monitored by a bank? • A. All • B. Update • C. External • D. Create EECS4482 2015 David Chan