The IIA Advanced Technology Committee, the GTAG Series and GAIT Steve Hunt ATC Chair April 16, 2010

2. Today�s Agenda ATC and the GTAG series What is the ATC, activities and deliverables Global Technology Audit Guides (GTAG) Upcoming GTAGs IPPF GTAG Resources and Information Q & A Break

3. Today�s Agenda, cont.

4. Who is the ATC? Advanced Technology Committee International committee of the IIA One of 6 Professional Practices Committees of the Professional Practices Council 26 members from companies, accounting firms and consulting firms from around the world All members have several years of in-depth experience in the IT risk and assurance space as well as heavily credentialed The vast majority of IIA guidance is written by these 6 committees

6. What is the ATC? Mission As the global advanced technology committee of The IIA, we identify, research, and assist in the development of strategies and implementation of programs to position The IIA as a leading provider of information technology guidance to internal auditors

7. Major ATC Activities Develop pertinent guidance for our members regarding information risk management, control and governance practices Work with the Internal Audit Standards Board and the Professional Issues Committee to develop professional guidance Advise education related committees on technology issues for continuing professional development Work with The IIA Research Foundation on technology issues through related research

8. Major ATC Deliverables GAIT � Guide to the Assessment of IT General Controls Scope Based on Risk GAIT I � The GAIT Methodology Set of IT Principles and Methodology that was designed to scope IT general controls for SOX 404 Initial Principles released in 12/06 Initial Methodology released in 02/07 GAIT II � GAIT for IT General Control Deficiency Assessment GAIT-R or GAIT III � GAIT for Business and IT Risk Guidance on scoping the entire population of IT controls based on a top-down risk based approach GAIT Case Study � PCI Scoping using GAIT-R

9. Major ATC Deliverables Global Technology Audit Guide Provide easy-to-understand IT audit guides Target audience Chief Audit Executives, Audit Committees and Executive Management Audit guides published on a global scale in English, French and Spanish Under the new International Professional Practices Framework (IPPF) they fall into the �Strongly Recommended Guidance� category Publish 2 to 4 GTAGs per year 13 published in multiple languages since 2005

10. Why GTAG? Many CAEs face the challenge of: Understanding risks posed by information technology How to help their organizations manage IT risk How to audit IT The majority of the prevailing IT risk/IT audit guidance comes from ISACA, but is written at a much more granular, technical level Given the broad responsibility of CAEs, the GTAG series provides them a high level overview on particular IT risk management and control topics

11. GTAG Development Process Advanced Technology Committee Select topics based on IIA member input Co-authoring Oversee guide development Professional Practices Committee (6) IIA Partners AICPA, Center for Internet Security (CIS), Carnegie Mellon, ISSA, ITPI, NACD and SANS Institute IIA global affiliates Concept to Publish = about 52 weeks

12. Thirteen GTAGs Published

13. Thirteen GTAGs Published, cont

14. Thirteen GTAGs Published, cont

15. GTAGs to be Released in 2010 or 2011 Auditing User Developed Applications Q2 2010, June International Conference Auditing Security Governance Q3 or Q4 2010 IT Governance Q3 or Q4 2010 Technology Product Development Lifecycle Q4 2010 Data Analysis Tools and Technologies/CAATs Q4 2010

16. GTAGs to be Released in 2010 or 2011, cont.

17. Authoritative guidance is technical guidance authored and endorsed by The IIA, following due process. It actually is restricted to the guidance developed and strictly controlled by the technical committees of The Institute. AUTHORITATIVE GUIDANCE: Definition Code of Ethics International Standards Practice Advisories AND THE IPPF BRINGS TWO NEW CATEGORIES INTO THE FRAMEWORK: Position Papers Practice guides Authoritative guidance is technical guidance authored and endorsed by The IIA, following due process. It actually is restricted to the guidance developed and strictly controlled by the technical committees of The Institute. AUTHORITATIVE GUIDANCE: Definition Code of Ethics International Standards Practice Advisories AND THE IPPF BRINGS TWO NEW CATEGORIES INTO THE FRAMEWORK: Position Papers Practice guides

18. GTAG Resources and Information Members ONLY!!! .pdf download from the IIA website for zero cost Non-Members .pdf download from the IIA bookstore for $25 www.theiia.org/guidance/technology Purchase printed copy from the IIA Bookstore Only GTAGs 1-11. GTAG 12 forward will not be available for purchase in printed hardcopy (US$ 25 for IIA members) (US$ 30 for non-members)

20. 10 minute break

21. GAIT The What and Why Evolution, Principles and Methodology GAIT I � The GAIT Methodology GAIT II � ITGC Deficiency Assessments GAIT III or GAIT-R - Business and IT Risk Case Study � PCI scoping using GAIT III Resources and Information Q & A

22. What is GAIT Guide to the Assessment of IT General Controls Scope Based on Risk Four principles and a methodology for top-down, risk-based scoping of IT general controls SOX �404 IT Audits Business Audits PCI

23. Why GAIT and its History GAIT I � Methodology Initially created to address the lack of ITGC scoping guidance for �404 Available guidance was control focused, not risk focused Significant compliance and audit costs Developed by members of the Advanced Technology Committee (ATC of the IIA), other committee members and industry professionals Advisory Board oversight consisting of CPA firms, SEC registrants and the PCAOB Initial principles released under AS/2 in February 2006 Initial methodology released under AS/2 in February 2007 Updated for AS/5

24. Why GAIT and its History GAIT II � ITGC Deficiency Assessment The �9 Firm document� A Framework for Evaluating Control Exceptions and Deficiencies needed some clarification Expanded the �9 Firm document� by providing additional guidance on how to evaluate ITGC exceptions or deficiencies Developed by members of the Advanced Technology Committee (ATC of the IIA) and CPA firms Published March 2008

25. Why GAIT and its History GAIT III or R � Business and IT Risk Focuses on identifying the key IT controls across the enterprise that are essential to achieving business goals and objectives Primarily developed for internal auditors Improves the efficiency and effectiveness of internal audits through minimizing attention to IT risks that are not critical to the business and the achievement of its objectives Developed by members of the Advanced Technology Committee (ATC of the IIA) and other committee members Published March 2008

26. What is GAIT I � Methodology GAIT is a reasoned thinking process that continues the top-down, risk-based approach in AS/5 to assess ITGC risks It helps identify risk in IT processes that could affect critical functionality needed to prevent/detect material errors Control objectives are identified in GAIT, but not specific key controls

27. Top-DownRisk-Based

28. How Does the GAIT Methodology Work? Two main parts The Four Principles Implementation Methodology

29. GAIT Principle 1 The identification of risks and related controls in IT processes should be a continuation of the top-down, risk-based approach used to identify significant accounts, risks to those accounts, and key controls in the business processes

30. GAIT Principle 2 The IT general control process risks that need to be identified are those that affect critical IT functionality in financially significant applications and related data

31. GAIT Principle 3 The IT general control process risks that need to be identified exist in processes and at various IT layers: application program code, databases, operating systems, and network

32. GAIT Principle 4 Risks in IT general control processes are mitigated by the achievement of IT control objectives, not individual controls

33. The GAIT Methodology

34. GAIT Methodology � Question 1 What IT functionality in the financially significant applications is critical to the proper operation of the business process key controls that prevent/detect material misstatement?

35. GAIT Methodology � Question 2 For each IT process at each layer in the IT stack, (operating systems, networks, databases and application program code) is there a reasonable possibility that a process failure would cause the critical functionality to fail � indirectly representing a risk of material misstatement?

36. GAIT Methodology � Question 3 If such IT business process risks exist, what are the relevant IT control objectives?

37. GAIT Methodology Phase 1 � Identify the critical IT functionality Phase 2 � Identify the significant applications where ITGCs need to be tested Phase 3 � Identify ITGC process risks and related control objectives Phase 4 � Identify the ITGCs that meet the control objectives Phase 5 � Perform a �reasonable� person review

38. Methodology � Phase 1 Continuation from previous step from AS/5 �Identify controls to test that prevent or detect errors or fraud on a timely basis� Identify the critical IT functionality Review key controls, reports, and other functionality in the company�s business processes and determine which are manual and which are automated Develop a list of critical IT functionality Confirm key automated controls Determine whether there is additional critical IT functionality not identified as a key control

39. Methodology � Phase 2 Identify the [significant] applications where ITGCs need to be tested Sort the critical IT functionality by application Identify the financially significant applications that are in scope for ITGCs Continue only with financially significant applications

40. Methodology � Phase 3 Identify ITGC process risks and related control objectives Obtain additional information for each significant application Identify and assess the risk of ITGC process failures at each layer of the stack and identify related control objectives

41. GAIT Matrix

42. GAIT Matrix � Partially Completed

43. GAIT Matrix � Partially Completed

44. Methodology � Phase 4 Identify ITGCs to test that meet the control objectives Consider the pervasiveness of ITGCs Are there risks that may affect multiple applications and their functionality? Select key ITGCs for reliance and testing

45. Methodology � Phase 5 Perform a �reasonable person� review Confirm the risks and key controls represent a reasonable view of risk to financial reporting Ensure the selection of risks is reasonable, given the organization�s risk tolerance in their SOX �404 scope

46. PCI Scoping using GAIT Members of the ATC and others noted that PCI compliance guidance lacked adequate scoping guidance Published case study based GAIT III or -R September 16, 2008 Presented the case study and the GAIT III or -R methodology to the PCI Security Standards Council on September 25, 2008

47. GAIT Resources and Information http://www.theiia.org/guidance/ technology/gait All 3 GAITs and the PCI compliance case study Ask Dr. GAIT drgait@theiia.org

48. Summary GAIT very useful for scoping SOX 404 and any IT audit work The proper use of GAIT results in reduced IT scope, reduction in the number of key controls resulting in hard dollar savings GAIT and GAIT III or -R can be used in any audit project where technology is involved