IT Change Management

ITGCs - IT Manage Change

• New IT applications or changes may fail due to inadequate testing
• Control: Changes should be validated directly after installation
• Test: Obtain a list of changes
• New IT applications or changes may be unsuitable for the business or IT environment
• Control: Changes need approval and testing by business management before implementation
• Test: Inspect evidence and lists of changes
• Programs in production may be unsecured, leading to unauthorized or untested changes
• Control: Test environment programs needs limited access to authorized personnel without development duties
• Test: Review lists of user IDs
• Configuration changes by IT staff may be inappropriate or unauthorized
• Control: Configurations are logged and reviewed
• Test: Check configuration settings
• Multiple instances of an IT application should be identical
• Control: Changes gets pushed to every instance simultaneously; comparisons should occur periodically
• Test: Inspect settings
• Implementation failures of new systems, upgrades, or key integrations can impact financial reporting controls
• Control: The SDLC process is reviewed/updated periodically

ITGCs - IT Access (aka Manage Access or Logical Access)

• Typical risks include users of the IT environment being unintended due to inadequate authentication and security
• Access granted might not match approved access levels, or users may be generally inappropriate
• Concerns arise in segregation of duties due to IT user access
• Combining IT application functions into roles can cause segregation of duties issues, risking misstatements
• Direct data changes are made without authorization
• Authentication and validation concepts are in place for authorized users
• Validated users are restricted to authorized actions aligned with their roles (authorization/access rights)
• Controls, such as password resets every 90 days and annual user access reviews, need evaluation

Deloitte Review Slides - Considerations for Acceptable Deviation Levels

• Risk associated with the control
• Complexity
• Extent of reliance on the control
• Testing approach
• Nature of the control

Common GITC (ITGC) Deficiency Themes

• Lack of consistent IT governance
• Cybersecurity breach leading to compromise of financial systems
• Management of end-user segregation of duties
• Highly privileged access management
• Developer access to production environments
• SDLC failures due to major system implementation issues

Identity Management

• Defines who, what, where, and how of an identity within an organization
• It defines what an identity is, what it can do, and how to track and report on the entity
• IDM systems include info systems used for enterprise or cross-network identity management

Third-Party Risk

• Outsourcing includes IT services, HR functions, and bookkeeping
• Benefits include lower capital expenditures on hardware, software, and data centers
• Global scale provides the right amount of IT resources and capacity
• Regularly updated cloud services improves performance
• Updated security via a broad set of policies and technologies
• Speed provides vast computing resources on demand
• Productivity enables focus on core business goals by removing the need to "rack and stack" additional resources
• Reliability with built-in data backup, disaster recovery, and business continuity
• Risks include costs exceeding benefits and failure to perform
• Vendor exploitation and reduced security can occur
• A loss of strategic advantage and reduced ability to reestablish outsourced function is a possibility
• Lower employee loyalty, quality, consistency, and oversight issues are risks

Cloud Computing/Service Types

• Public clouds are owned and operated by a third-party cloud provider
• Hybrid clouds combine public and private clouds, sharing data via technology
• Private clouds are exclusively for a single business or organization
• IaaS is the most basic, involving renting IT infrastructure
• PaaS supplies an on-demand environment for developing, testing, delivering, and managing applications
• SaaS is a method for delivering software applications over the internet

SOC Reports

• SOC reports are included under the SOC Suite of Service Offerings
• Organizations may need SOC reports for various reasons
• SOC 1 reports are used by customers and auditors to conduct audits of financial statements
• SOC 1 includes ICFR, Type 1 (as of a specific date), and Type 2 (throughout a period)
• SOC 2 reports on controls related to security, availability, processing integrity, confidentiality, or privacy
• SOC 2 includes Type 1 (design of controls) and Type 2 (design and operating effectiveness)
• Customers utilize these reports to understand processing controls
• SOC 2+ includes the criteria of SOC 2 alongside additional criteria
• SOC 3 reports provide confidence to stakeholders regarding a service organization's systems
• SOC 3 reports are intended for general use
• Trust Services Criteria are used in SOC 2 and 3 engagements
• SOC 1 and SOC 2 reports have 5 sections
• CUECs are complimentary user entity controls, where the service organization assumes controls will be implemented by user entities
• CUECs Example: User Access, Sign-on credentialing such as PWs and multifactor authentication
• CSOCs are supplementary subservice organization controls, where the service organization assumes controls will be implemented by the subservice organization
• CSOCs Example: Physical Security, Data Backup and Recovery