WIXLIB

Module 2: Information SystemsAssurance Services2.0 OverviewCA A.Rafeq1

Modules of the DISA CourseNo.Name of ModuleWeightage (%)1Primer on Information Technology, IS Infrastructure andEmerging Technologies182Information Systems Assurance Services123Governance and Management of Enterprise InformationTechnology, Risk Management and Compliance Reviews124Protection of Information Systems Infrastructure andInformation Assets185Systems Development: Acquisition, Maintenance andImplementation.126Business Applications Software Audit127Business Continuity ManagementProject report6102

Structure of materialBackground MaterialContents as per module. Each of the module has 3 sections. Section 1: Overview Section 2: Contents Section 3: AppendixDISA 2.0 Course DVD The Reading material for the DISA 2.0 course includes a DVD whichis comprehensive collection of educational material Includes Background Material, Reference Material, e-Lectures,PowerPoint Presentations, Podcasts/MP3 Files and Self-AssessmentQuiz.3

Benefits of DISA 2.0 Course DVD Designed to be supplementary to backgroundmaterial. Useful for self-learning Training aideDISA candidates are strongly advised to usethis for studying for the ISA course.4

Section 1: Overview Detailed Table of Contents Module objective Task statements: Outline what DISAs will learn to do Knowledge statements: Oriented towards providing knowledge for specifictasks. Task and knowledge mapping statement: Provide relationship between each task to one/moreknowledge statement. Knowledge reference guide: Provides content reference from the chapters for eachof the knowledge statement/areas.5

Section 2 and 3 Section 2: Contents Provides content as per the chapter. Each of the chapter/parts has the learning objectivesfollowed by topics which are covered in brief or detailas required. At the end of each chapter, there are samplequestions followed by answers and explanations. References Section 3: Appendix Provides appendices which has checklist/templates asreferenced in the material6

Salient features of ISA Course 2.0Learning ObjectivesTask StatementsKnowledge StatementsRelationship between Task and knowledge statementsKnowledge Statement Reference GuideOrganisation of Chapters7

ObjectivesProvide IS assuranceorIT Enabled servicesandperform effective auditsin acomputerised environmentby usingrelevant standards, guidelines,frameworks and best practices.8

Learning ObjectivesProvide assurance or consultingservicesin the areas ofGovernance, Risk Management,Security, Controls and complianceby usingrelevant standards, guidelines,frameworks and best practices.9

Task Statements10

Task Statements 12.1 Develop and implement appropriate risk-based approach as perscope and objective of the assignment.2.2 Adapt and use relevant IT assurance standards, guidelines,frameworks and best practices.2.3 Plan assurance or consulting assignments covering specific stepssuch as: responding to request for proposal from client, submittingproposal, scoping of audit objectives, performing audit, evaluatefindings and reporting, covering the complete life cycle of theassignment.11

Task Statements 22.4 Document understanding of the enterprise technologydeployment, IT organisation structure, technology environmentincluding control architecture so as to analyse and assess IT risks.2.5 Perform assurance or consulting services covering the completeassurance life cycle including scoping, risk assessment, audit planning,audit program, audit procedures, using audit tools, performing auditas per audit objectives, obtaining and evaluating audit evidenceidentifying key areas of weaknesses, reporting findings, obtainingmanagement response and follow up of implementation.12

Task Statements 32.6 Use Computer Assisted Audit Techniques, tools and riskassessment techniques including sampling, data analysis, BusinessIntelligence and Business Analytics.2.7 Distinguish between IS Assurance assignments and auditingin a computerised environment and use the relevant frameworksand best practices for compliance and assurance assignments.2.8 Communicate/Report findings in specific format usingstandards/best practices as required.13

Task Statements 32.9 Conduct follow-up reviews or prepare status reports to ensureappropriate actions have been taken by management in a timely manner.2.10 Distinguish key steps and processes of Cyber Frauds investigationand Cyber Forensics.2.11 Create IS Assurance or consulting function in an enterprise/withinCA office by identifying key enablers and resources including identifyingrequired personnel with required competencies and skill sets.14

Knowledge Statements15

Knowledge Statements 12.1 Relevant IT assurance standards, guidelines, frameworks and bestpractices as per scope and objective of the assignment.2.2 Statements of auditing relating to auditing in a computerisedenvironment.2.3 Different aspects of IS Audit process - audit charter, audit planning,audit universe, risk-based audit approach, IS Audit standards, guidelines,regulations, procedures and audit reporting.2.4 Role and responsibilities of IS Audit function/department and keyenablers.16

Knowledge Statements 22.5 Documenting enterprise, technology deployment,organisation structure, technology environment includingcontrol architecture so as to analyse and assess Risks.2.6 Audit Risk management strategy and approach2.7 Assurance or consulting services including scoping, riskassessment, audit planning, audit program, audit procedures,using audit tools, analysis and reporting.17

Knowledge Statements 32.8 IS Audit process cycle from scoping toreporting2.9 Defining Audit scope and objectives2.10 Preparing request for proposal fromclient, submitting proposal18

Knowledge Statements 42.11 Audit documentation, obtaining and evaluating audit evidence2.12 Analysis of evidence, Risk Rating of findings/Controlweaknesses, reporting findings, obtaining management response andfollow up of implementation.2.13 Types of Internal control and related risks19

Knowledge Statements 52.14 Analytical procedures, compliance testing andsubstantive testing2.15 Types of IT enabled services, IS Assuranceassignments and auditing in a computerisedenvironment and using the relevant processes and bestpractices for compliance and assurance assignments20

Knowledge Statements 62.16 Cyber Frauds investigation and cybercrimes,specific process relating to Cyber Forensics.2.17 Audit tools and techniques including CAAT, toolsand risk assessment techniques including data analysis,Business Intelligence, sampling, Automation of ISAssurance, etc.21

Knowledge Statements 72.18 Using best practices frameworks suchCOBIT, ISO etc.2.19 Key provisions of Information TechnologyAct and Rules and impact on IS Assurance.2.20 Follow up review22

Relation of Task and KnowledgeStatements23

Task and Knowledge Statements MappingTask Statement2.1 Develop and implement appropriate risk-basedapproach as per scope and objective of theassignment.Knowledge Statement2.1.Relevant IT assurance standards,guidelines, frameworks and best practices as perscope and objective of the assignment.2.3.Different aspects of IS Audit process audit charter, audit planning, audit universe, riskbased audit approach, IS Audit standards, guidelines,regulations, procedures and audit reporting.2.6.Audit risk management strategy andapproach2.7.Assurance or consulting servicesincluding scoping, risk assessment, audit planning,audit program, audit procedures, using audit tools,analysis and reporting.2.18.Using best practices frameworks suchCOBIT2.19.Key provisions of InformationTechnology Act and Rules and impact on ISAssurance.2.20.Follow up review24

Task and Knowledge Statements MappingTask Statement2.2 Adapt and use relevant ITassurance standards, guidelines,frameworks and best practices.Knowledge Statement2.5.Documenting enterprise,technology deployment,organisation structure, technologyenvironment including controlarchitecture so as to analyses andassess Risks.2.7.Assurance or consultingservices including scoping, riskassessment, audit planning, auditprogram, audit procedures, usingaudit tools, analysis and reporting.2.18 Using Best practices such asCOBIT, ISO, etc.2.19 Key provisions of IT Act andRules and impact on IS Assurance25

Task and Knowledge Statements MappingTask Statement2.3. Plan assurance or consulting assignmentscovering specific steps such as: responding torequest for proposal from client, submittingproposal, scoping of audit objectives, performingaudit, evaluate findings and reporting, covering thecomplete life cycle of the assignment.Knowledge Statement2.3.Different aspects of IS Audit process audit charter, audit planning, audit universe, riskbased audit approach, IS Audit standards, guidelines,regulations, procedures and audit reporting.2.4.Role and responsibilities of IS Auditfunction/department and key enablers.2.6.Audit risk management strategy andapproach2.7.Assurance or consulting servicesincluding scoping, risk assessment, audit planning,audit program, audit procedures, using audit tools,analysis and reporting.2.8.reporting2.9.IS Audit process cycle from scoping toDefining audit scope and objectives26

Task and Knowledge Statements MappingTask Statement2.4.Documentunderstanding of theenterprise, technologydeployment, organisationstructure, technologyenvironment includingcontrol architecture so as toanalyze and assess Risks.Knowledge Statement2.5.Documentingenterprise, technologydeployment, organisationstructure, technologyenvironment includingcontrol architecture so as toanalyze and assess Risks.2.17. Types of Internalcontrol and related risks27

Task and Knowledge Statements MappingTask Statement2.5.Perform assurance or consultingservices covering the complete assurance life cycleincluding scoping, risk assessment, audit planning,audit program, audit procedures, using audit tools,performing audit as per audit objectives, obtainingand evaluating audit evidence identifying key areasof weaknesses, reporting findings, obtainingmanagement response and follow up ofimplementation.Knowledge Statement2.3.Different aspects of IS Audit process audit charter, audit planning, audit universe, riskbased audit approach, IS Audit standards, guidelines,regulations, procedures and audit reporting.2.4.Role and responsibilities of IS Auditfunction/department and key enablers.2.6.Audit risk management strategy andapproach2.7.Assurance or consulting servicesincluding scoping, risk assessment, audit planning,audit program, audit procedures, using audit tools,analysis and reporting.2.8.reporting2.9.IS Audit process cycle from scoping toDefining audit scope and objectives28

Task and Knowledge Statements MappingTask Statement2.6. Use ComputerAssisted Audit Techniques,tools and risk assessmenttechniques includingsampling, data analysis,Business Intelligence andBusiness Analytics.Knowledge Statement2.17 Audit tools andtechniques includingCAAT, tools and riskassessment techniquesincluding data analysis,Business Intelligence,sampling, Automation of ISAssurance, etc.29

Task and Knowledge Statements MappingTask Statement2.7. Distinguish between ISAssurance assignments andauditing in a computerizedenvironment and use therelevant processes and bestpractices for compliance andassurance assignments.Knowledge Statement2.2. Statements of auditingrelating to auditing in acomputerized environment.2.15 Types of IT enabledservices, IS Assuranceassignments and auditing in acomputerised environmentand using the relevantprocesses and best practicesfor compliance and assuranceassignments.30

Task and Knowledge Statements MappingTask StatementKnowledge Statement2.8 Communicate/Report findings 2.12 Analysis of evidence, riskin specific format using standards or rating of findings/controlbest practices as required.weaknesses, report findings,obtaining management response andfollow up of implementation2.9. Conduct follow-up reviews 2.20.or prepare status reports to ensureappropriate actions have been takenby management in a timely manner.Follow up review31