Upgrade to remove ads
Only $2.99/month

ACC 540

Terms in this set (117)

What are the main points
o Managing and retaining big data
o Securing the IT environment
Ex. What Target should have done better
o Opportunities for CPA's advising clients about managing IT issues
Ex. Continuous auditing
How does it relate to the topics we are discussing in class
o Internal controls, Risk IT framework, ERM
What are the implications for a CIO or other key executives
o Management and executives must maintain a strong alignment between the organization's strategic goals (you want IT to line-up with strategy)
o Management must have a good understanding of how data flows through the organization
o Controls are in place to insure high quality data (accurate, complete, timely, and auditable)
o Understand the technology options available to support business intelligence related initiatives
Managing and Retaining Data
o Big Data
o Risk -> gathering and keeping irrelevant data means unnecessary costs
o Control -> having a database to organize data in
Securing the IT Environment
o Physical and access controls
o Hackers
o Risk -> losing valuable information (ex. Target)
o Control -> firewalls, limited number of password tries (ex. iCloud scenario)
Ensuring Privacy
o Target
o Protecting private data (health info, SS #'s)
o Risk -> information leaks (iCloud pictures)
o Control -> limited number of password attempts
o Litigation for non-compliance - HIPAA
Managing IT Risks and Compliance
o Part of ERM (understand strategy)
o Alight strategy with IT
o Risk -> not being compliant and going to jail/paying fines
o Control -> continuous auditing, IT specialists, best practices summary handbook
Preventing and Responding to Computer Fraud
o Financial Statement Fraud (contracts, collusion)
o Misappropriations of Assets (theft)
o Risk -> issuing materially misstated financial statements
o Control -> having an audit
Managing System Implementations
o Most have problems
o Many fail
o Risk -> spending too much money on something that fails
o Control -> testing the new system prior to implementation
Managing Vendors and Service Providers
o Service level agreements
o Cloud service provider
o Risk -> you take on the 3rd party provider's poor control environment (without doing much research or due diligence)
o Control -> thoroughly research 3rd party service provider, have a service level agreement (carefully read through it and understand/agree to all terms)- SOC 1 reports
Leveraging Emerging Technologies
o Disruptive technology, BYOD, Big Data
o Risk -> it could totally disrupt your current business model (for better or worse)
o Control -> keeping an open mind, having an easily adaptable business model
Governing and Managing IT Investment and Spending
o Related costs of implementation
o Risk -> spending too much on a bad investment
o Control -> cost/ benefit analysis
Enabling Decision Support and Analysis
o Data Analytics
o Risk: incompetent individuals/employees operating data analytic software
o Control: hiring qualified individuals, having multiple individuals perform same tasks
What are the Top Technology Initiatives
Managing and Retaining Data, Securing the IT Environment, Ensuring Privacy, Managing IT Risks and Compliance, Preventing and Responding to Computer Fraud, Managing System Implementations, Managing Vendors and Service Providers, Leveraging Emerging Technologies, Governing and Managing IT Investment and Spending, Enabling Decision Support and Analysis
According to COSO, what is necessary for the long-term success of an organization
o Good risk management and internal controls are necessary for long term success
o Implementation of ERM framework and IC framework to improve management and governance
In what setting is the ERM framework applied
o Strategic setting (strategic objective) and risk response
In what setting is the Internal control framework applied
o To achieve established objectives and reduce risk (tactical)
Describe the components of the conceptual business model
BoD oversightoStrategy setting- executives and BoD articulate plansoBusiness planning- planoExecution- do, control activitiesoMonitor- checkoAdapting- act, event identification, risk assessmento(Plan, Do, Check, Act) easy way to remember
Describe the separate and distinct roles of the BoD and executive management in governing the organization
o BoD approves strategic decisions, establishes boundaries, oversees execution, ensures accountability, fairness and transparency. (strategic)
o Executive management aligns strategy, processes, people, reporting, and technology to accomplish the mission (tactical)
Describe the following ERM components
o Objective Setting: establish strategy related objectives
o Event Identification: identify risks and opportunities
o Risk Response: decide whether to avoid, accept, share, or mitigate risks
The frameworks can help companies adapt to disruptive technologies, disruptive market forces and emerging threats. Give examples of each and how the frameworks can help.
o Disruptive technology example: insect drones, 3d printing
o Disruptive market forces example: significant demographic changes
o Emerging threats example: cyber security issues
o The frameworks help position the organization to identify risks and opportunities so that they may be resilient and agile to withstand an economic event
What is IT Governance
o An integral part of enterprise governance that provides the direction and control needed to ensure that IT investments bring value to the enterprise, IT resources are used responsibly, and risks are mitigated properly
What challenges exist to the value creation of IT
o The value an IT investment can deliver is challenged by
Increasing costs
Globalization of business and competition
Insufficient number of IT staff
Value delivery of service to the business
What responsibilities does the CISO have in regard to value delivery through IT
o Chief Information Security Officer (CISO) is responsible for implementing a process which identifies, evaluates, and prioritizes projects that deliver value to the business. He must ensure a value delivery model by managing actual costs and maximizing ROI on IT investments
What are managed risks
o Risks which are minimized by management to an acceptable level. Where controls are in place to mitigate risks
What are unmanaged risks
o Risks for which management has not implemented processes, controls, or technology to minimize or eliminate said risk
o Ex. Natural disasters
What 3 governance issues should be considered as IT environments are impacted by cloud computing
○ Governance issues that impact IT environments are (1) data privacy, (2) regulatory impact, and (3) test capability.
■ Data Privacy - Firm ensures that access to sensitive data is properly identified, monitored and secured (iCloud breach)
■ Regulatory Impact - Firm IDs and assess the regulatory impact of cloud computing on its environments
■ Test Capability - Firm ensures that applications can be developed and validated prior to promotion
How can continuous auditing enhance governance frameworks
○ Continuous auditing directly links enterprise risks and IT strategies and allows managers to monitor system reliability on a continuous and electronic basis (real-time)
Why does ISRM needs its own strategy, Isn't it already part of ERM
○ To ensure its ability to appropriately support business goals and to mature and evolve effectively. It is a subset of ERM and thus should align itself with its goals.
What are the budget and staff considerations
○ If an organization does not have the staff, budget or interest in a robust or expansive ISRM capability, the budget must reflect the situation.
○ If conservative, delay implementation of enhanced capabilities and focus on minimum requirements.
○ If growth, derive business value from implementation of robust capabilities.
○ ISRM strategy should complement business goals while maintaining a responsible level of risk management and security.
On average, how long will it take to implement an ISRM
○ In most cases, strategic planning follows a prescriptive annual plan followed by a higher-level, rolling three-year plan. ISRM an ongoing activity!
Why is firm culture important
○ The use of consensus activities and open discussion of the strategy will be most effective. Specific guidance and messaging from senior leadership is necessary to drive adoption of strategy.
○ You have to understand how the firm operates. Do the employees work in a conversational/brainstorming environment where decisions are made together or do employees wait for orders from management?
How are KPIs used and give an example
○ KPI's (Key Performance Indicators) based on selected point of arrival are used to monitor value and effectiveness. Example: Data on how many times hackers attempted to gain access to an organization's database and how many times the succeeded. (KPI's are any past data an organization may use to help predict the future)
What should the ISRM align with (hint: more than one)
○ Aligned with strategy, business process, Internal Controls, ERM
What is the risk with sourcing
○ Third parties cannot assume the risk of the organization.
○ Lack of consistency of services.
○ consulting resources are usually the first to go in the case of budget cuts.
What is a CMM assessment
○ CMM (Capability Maturity Model) provides a simple yet effective scale that the organization can use to understand quickly which of its capabilities are functioning adequately and which need improvement to increase efficiency, reduce cost of operation and increase value to the organization.
○ CMM is first used, then benchmarking.
○ It's like expectations grading
What is the function of an oversight board
○ To ensure business alignment. should meet monthly or quarterly.
○ review key metrics and requests for approval of activities or any other pertinent materials in regard to the organizations strategy and business process.
What are the main requirements of SOX Section 302
○ CEO and CFO certify that the financial statements are fair and internal controls have been designed and implemented properly and any significant deficiencies, material weaknesses, and fraud have been reported.
Who is primarily responsible for meeting the requirements of SOX Section 302
○ CEO and CFO
What does SOX Section 302 assert about Internal Controls
○ That internal controls have been designed and implemented properly and any significant deficiencies, material weaknesses, and fraud have been reported.
● How often should SOX Section 302 requirements be asserted?
○ Quarterly and annually
Read Section 906 of SOX - what are the penalties if the certifications are false
○ 10-20 years jail time
○ $1-$5 million in penalties
What are the main requirements of this SOX Section 404
○ Report on assessment of ICFR (internal control over financial reporting)
What is management's responsibility from SOX Section 404
○ Management must sign report on assessment of ICFR
What is the auditor's responsibility from SOX Section 404
○ Report on assessment of internal controls designed and implemented by management in accordance with PCAOB and COSO
Which types of internal controls are in scope of SOX Section 404
○ Those controls over Financial Reporting
What issue is the focus of the Center on Audit Quality Letter
○ They argued small companies (public float <$75 mil) should not be exempt from SOX Sections 302 (Corporate responsibility for financial reports) and 404 (Management assessment of internal controls)
What is the opinion of the CAQ, CFA, and CII in the Center on Audit Quality Letter
○ Section 404 provides benefits that are valuable regardless of company's size.
○ Compliance costs decline by approximately 30 percent.
○ Median market capitalization of companies experience fraudulent events totalling approximately $100 million.
What are some of the audit cost trends related to Section 404(b) in Center on Audit Quality Letter
○ Average Section 404(b) Cost declined ~30%
○ Median cost declined ~42% for smaller public companies
○ 73% of companies noted that Section 404 compliance improved the quality of their internal controls.
○ 49% noted that it improved the quality of a company's financial reporting.
○ 48% noted that it improved the company's ability to prevent and detect fraud.
For whom is the SEC Guidance on IC intended
○ Management
In the SEC Guidance on IC which types of controls are to be considered
○ Management considers entity level controls when identifying financial reporting risks and related controls for financial reporting.
In the SEC Guidance on IC what is the level of assurance sought, Why not more
○ Reasonable assurance.
○ Absolute assurance is impossible due to inherent limitations;
In the SEC Guidance on IC what are the two core principles in the guidance
○ 1)Management should evaluate whether it has implemented controls that adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in timely manner. (Design and implementation)
○ 2)Management's evaluation of evidence about the operation of its controls should be based on its assessment of risk. (gather evidence to support evaluation)
In the SEC Guidance on IC does mgt examine all controls and How does management determine which controls to examine
○ Management does not examine all controls.
○ Management focus on evaluating controls on areas posing the highest ICFR risk.
What is the core objective of internal control over financial reporting
○ To provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.
What type of internal control framework does the SEC say is suitable for use when assessing the company's IC
○ COSO framework.
What are "entity-level controls" and why does the guidance suggest considering them first
○ ELC are controls that affect the company as a whole. Entity level controls have pervasive impact on all other aspects of ICFR.
What characteristic of entity-level controls make them less effective
○ Some entity level controls may be designed to identify possible breakdowns in lower-level controls, but would not, by themselves address them.
○ Manual
○ Not enforced
What should management first consider when beginning their evaluation
○ Management should consider both the risk characteristics of the financial reporting elements to which the controls relate and the risk characteristics of the controls themselves in making judgments about the nature and extent of evidence necessary to provide reasonable basis for the assessment.
○ Management should identify the risks to reliable financial reporting, evaluate whether control exist to address those risks, and evaluate evidence about the operation of the controls
What would keep management from saying IC is effective
○ When there is a reasonable possibility that a material misstatement of the company's annual or interim F/S will not be prevented or detected on timely basis by ICFR.
○ If any material weaknesses are found
What would constitute a "design deficiency" in internal control
○ (a) control necessary to meet the control objective is missing or
○ (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.
What would constitute a "operating deficiency" in internal control
○ properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.
How does management obtain evidence about the operation of controls
○ Through on-going monitoring, self-assessments, and direct testing
For whom is this guidance intended
○ auditor who performs and audit of management's assessment of the effectiveness of ICFR
Which types of controls are to be considered
○ internal controls over financial reporting
■ examples of entity level controls, walkthroughs...
What is the level of assurance sought, Why not more
○ reasonable assurance is given. Auditors do not use the controls on a daily basis, which management does.
What is the role of risk assessment in the audit of IC
○ risk assessment underlies the entire audit process described by this standard, including the determination of significant accounts and disclosures and relevant assertions.
○ a direct relationship exists between the degree of risk that a material weakness could exist and the amount of audit attention that should be devoted to that area.
○ Allows the auditor to determine the timing, extent and scope of testing
What is meant by a "top-down approach" to the audit of IC
○ top down approach is used to select which controls to test
○ the auditor starts at the financial reporting level with an understanding of the overall risks to ICFR. Then focuses on entity level controls and works down to significant accounts and disclosures and their relevant assertions.
○ this process directs the auditor to accounts, disclosures, and assertions that present a reasonable possibility of material misstatement
○ describes the sequential thought processes in identifying risks and the controls to test (but not the order or the procedures)
What are the 3 categories of "entity-level controls", What are some examples
○ Direct-detect and prevent (ex. Controls over Period-end Reporting, Controls over management override, change management)
○ Indirect-help prevent (ex. Separation of Duties, hiring and retention policies→ HR policies, ITGC)
○ Monitoring-Help Detect (ex. Whistle Blower Hotline, internal audit)
What are the five financial statement assertions and why does the auditor need to consider them
○ If these assertions are not met, there is a reasonable possibility of the financial statements containing a misstatement.
■ existence or occurrence
■ completeness
■ valuation or allocation
■ rights and obligations
■ presentation and disclosure
○ If the assertions aren't met, the auditor cannot provide a "clean" opinion
What might the auditor think about to determine likely sources of misstatements
○ auditor will think about significant accounts→ assertions→ "what could go wrong" aka Risks → are there controls in place to mitigate noted risks?
○ determine the following objectives:
■ understand the flow of transactions related to relevant assertions
■ identify the points in a company's process at which a misstatement could arise
■ identify controls that management has initiated to address potential misstatements
■ identify controls that management has put in place over prevention or timely detection of unauthorized acquisition, use, or disposition of a company's assets
○ understand how IT affects the flow of transactions
○ perform walkthroughs (most effective way to achieve objective)
What is meant by a "walkthrough"
○ follows a transaction from origination through the company's process until it is reflected in financial records
What is meant by "testing design effectiveness" and "testing operating effectiveness"
○ Design: operating as prescribed by persons possessing the necessary authority and competence to perform the control effectively
○ operating: whether the control is operating as designed and whether the person's performing the control possess the necessary authority and competence to perform the control
How are risk and evidence connected
○ the evidence necessary to persuade the auditor on the effectiveness of the IC is based on the risk associated with the control
What is meant by a "benchmarking strategy" - see paragraph B28.
○ Some controls do not have to be tested each year. An auditor should ask himself the following questions to determine whether testing may be passed on in any given year:
■ Are ITGC still strong (must always test ITGC AKA entity level controls)
■ Is the process entirely automated→ automated controls are usually not subject to breakdown due to human failure
■ Was there a change in the process from the prior year
■ Was there a change in personnel completing the process from the prior year
■ Were there any findings in the prior year
What are the three levels of IC deficiencies
○ control deficiency
○ significant deficiency
○ material weakness
What keeps the auditor from concluding the controls operate effectively
○ a material weakness
What is the COSO definition of internal controls
○ Internal Control is the process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.
What objectives are controls designed to help achieve
○ operation objectives - pertain to the effectiveness and efficiency of an entity operations
○ compliance - pertains to following the laws and objectives
○ reporting - pertain to internal and external financial a nonfinancial reporting
Explain the categories of reporting objectives.
○ reliability- to extent that information can be depended upon
○ timeliness- is it done and reported within the proper time frame
○ transparency- that the reports have the full amount of information and there are no hidden agendas
Give an example of how the objective categories overlap.
○ closing financial reporting with five business days
■ Supports efficiency of operational objective
■ supports timely reporting
■ supports the time limit for regulatory agencies (you're being compliant)
What is the difference between entity-level objectives and sub-objectives
○ entity level objectives - consistent with prior practices and performance, linkage is usually known
○ sub-Objectives -more specific than entity level objectives
■ needs to be specific, measurable/observable, attainable, relevant and time bound
■ as a part of the strategy setting process and relate to the entity and subunit and functional activities
What are the five components of IC, How are they related
○ control environment - standards, processes that provide the basis for carrying out internal controls across the organization
○ Risk Assessment - identify and analyzing the risks to achieving the entity's objectives
○ control activities - actions to help ensure management directives to mitigate risk to achieve the company's objectives
○ Information and Communication -
■ information - necessary to carry out internal controls
■ communication - internal and external so people understand the internal controls
○ monitoring activities - ongoing evaluations, separate evaluations, and a combo of the two
Give some examples of limitations in IC
○ limited to human error, judgement, and biases (judgment)
○ management ability to override internal controls (override)
○ external events beyond the organizational control (external events)
○ personnel ability to circumvent the internal controls (collusion)
Which components must be in place for IC to be effective
○ each of the five components are present(exist), functioning(achieving goal) and operating together (collectively reduce risk level)
What is a major deficiency
○ can't meet the requirement of an effective system of internal controls (wouldn't this only be the case if it were a material weakness? Lindsay Jenkins)
○ management determines that a component and one or more relevant principle is not present and working together
○ in one component- cannot be mitigated to an acceptable risk by the presence and functioning of another
■ same for relevant principles
When is it necessary to apply judgment in IC and Give examples.
○ selecting, developing, and deploying controls necessary to affect principles together
○ applying internal controls relative to categories of objectives and within the entity structure
○ specifying specific objectives and sub-objectives and assessing risks to achieving them
○ assessing whether components are present, functioning, and operating together
○ assessing whether principles are relevant to entity and present and functioning
○ assessing the severity of one or more internal control deficiency
What are some of the technology costs associated with selecting and developing internal controls
○ retraining employees
○ customizing new IT system
What are the levels of documentation requirements needed
○ for people outside the organization, including regulators and shareholders, to prove components and relevant principles are present, functioning and operating together
○ documentations to help auditor support their assertions
What is the connection between the Risk Assessment component and Objectives
○ involves a dynamic and iterative process for identifying and assessing risks to the achievement of objectives
What are the principles related to risk assessment
6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives
7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
8. The organization considers the potential for fraud in assessing risks to the achievement of objectives
9. The organization identifies and assesses changes that could significantly impact the system of internal control
What should risk analysis consist of; That is, what should you think about
○ After risks have been identified, the process usually includes assessing the likelihood of the risk occurring and estimating its impact
■ likelihood represents the possibility that a given event will occur, while impact represents its effect
■ likelihood indicates possibility that a given risk will occur in qualitative terms (H, M, L), and probability indicating quantitative measure such as a percentage, frequency of occurrence, or other numerical metric
What are the external financial reporting objectives and related assertions
○ Understandability
○ Relevance
○ Reliability
○ Comparability
How do entity-level risks differ from transaction level risks
○ Entity-level risks
■ risks may arise from internal or external factors
○ Transaction-level risks
■ risks are identified at the transaction level within subsidiaries, divisions, operating units, or functions
What factors are considered when analyzing risks
○ Fraud Risk: Incentives and Pressures, Opportunity, Attitudes and Rationalizations
○ Risks differ for each assertion, for each account/transaction
How do control activities integrate with risk assessment
○ for each activity management assesses risk, decides to avoid or mitigate them, in which management chooses control activities based on its decisions
What is the function of a control activity
○ mechanisms of managing the achievement of management objectives
What are the various types of control activities
■ authorization - affirms that transaction is correct
■ approvals - by corresponding personnel
■ verifications - compare two or more items with each other or policy and perform follow up activities when they don't match
■ physical controls - periodical counts and compared with records
■ controls over standing data - controls over the processing to populate, update, and maintain the accuracy, completeness, and validity of date
■ reconciliations - compare two or more data elements and if differences are found then actions are taken to bring them together
■ supervisory controls - assess whether other transaction control activities are being performed completely, accurately, and according to policy
What are the various levels of control activities
■ transaction processing levels
■ business performance levels
■ analytical reviews
What is the relationship between IT general controls and application controls
○ General controls are controls over everything, and application controls are over certain processes. They interact because many application controls affect the overall business environment and general controls..
What are the principles related to information and communication
○ The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
○ The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
○ The organization communicates with external parties regarding matters affecting the functioning of internal control.
How are control activities related to information requirements
○ The information supports control activities that address mitigation procedures required when maximum levels are exceeded.
What are the characteristics of quality of information
○ Accessible--Information is easy to get by those who need it.
○ Correct--The information is accurate and complete.
○ Current--The data is updated often.
○ Protected--Sensitive information is restricted to authorized personnel.
○ Retained--The information is available over an extended period of time.
○ Sufficient--There is enough information at the right level of detail with relevance.
○ Timely--The information is available when needed.
○ Valid--The information is obtained from authorized sources.
○ Verifiable--The information is supported by evidence from the source.
What are monitoring controls and What's their purpose
Controls that assess whether each of the five IC components and relevant principles are present and functioning. Includes ongoing and separate evaluations. Used to find any deficiencies in an entity's IC
How does monitoring differ from "control activities"
A control activity responds to a specific risk, whereas a monitoring activity assesses whether controls in the five components are operating as intended.
What are the principles related to monitoring
○ Select, develop, and perform ongoing and/or separate evaluations
○ Evaluate and communicate IC deficiencies in a timely manner to parties responsible for taking corrective action, including senior management and BOD
Briefly explain the focus of each principle along with an example of how you might implement each.
● Select, develop, and perform ongoing and/or separate evaluations
○ Considers mix of ongoing and separate evaluations - use both
○ Considers rate of change - Banks anticipate regulatory changes
○ Establishes baseline understanding - knowing areas of high risk
○ Uses knowledgeable personnel - Internal Audit professionals
○ Integrates with business processes - built into processes
○ Adjusts scope and frequency - separate evaluations take into account the risk
○ Objectively evaluates - performed periodically without bias
Evaluate and communicate IC deficiencies in a timely manner to parties responsible for taking corrective action, including senior management and BOD
○ Assesses results - make changes based on results
○ Communicates deficiencies - the info is provided to those who can make changes
○ Monitors Corrective Actions - checking if changes have been implemented (based on monitoring activities)
What is difference in ongoing vs. separate evaluation monitoring controls
○ Ongoing: real time evaluations (creates independence issues)
○ Separate: conducted at differing times (more objective)
What is the role of the board of directors
○ The BoD is responsible for overseeing the system of internal control. With the power to engage or terminate the CEO, they have a key role in defining expectations about integrity and ethical values, transparency, and accountability for the performance of internal control responsibilities.
What are the 5 COBIT Principles
Meeting Stakeholder Needs, Covering the Enterprise End-to-end, Applying a Single Integrated Framework, Enabling a Holistic Approach, and Separating Governance from Management
How does COBIT 5 integrate with other frameworks
○ Aligns at a high level and thus can serve as an overarching framework for GEIT; many of the processes in COBIT are inspired by the guidance of other frameworks; high level of mapping occurs at the process level in COBIT 5
○ COBIT was developed to align with COSO→ you have to map them together
What is a domain and a process
○ Domain: setup using a lifecycle approach; start to finish
○ Process: a collection of practices influenced by the enterprise's policies and procedures that takes inputs from a number of sources (including other processes), manipulates the inputs and produces outputs (products and services)
What is the EDM domain
○ Evaluate, Direct, and Monitor domain; Governance layer in the that includes 5 processes; covers setting the governance framework, establishing responsibilities in terms of value (e.g., investment criteria), risk factors (e.g., risk appetite) and resources (e.g., resource optimization), and maintaining transparency on IT to stakeholders
What are the management layer domains and briefly explain each
○ APO (Align, Plan, and Organize)
■ concerns the identification of how IT can best contribute to the achievement of the business objectives (ex. IT strategy and tactics)
○ BAI (Build, Acquire, and Implement)
■ concerns the identification of how IT can best contribute to the achievement of the business objectives; also addresses organizational change, IT change management, etc.
○ DSS (Deliver, Service, and Support)
■ actual delivery of the IT services required to meet strategic and tactical plans; includes processes to manage operations, service requests and incidents, etc.
○ MEA (Monitor, Evaluate and Assess)
■ processes that are responsible for the assessment of process performance and conformance, evaluation of internal control adequacy, and monitoring of regulatory compliance
In your own words, describe what a process is according to COBIT 5.
A group of practices of a company that takes multiple inputs and transforms them into outputs (end result being products or services)
What is the difference between governance and management processes
○ Governance Processes: setting the framework, establishing responsibilities, risk factors, resources, maintaining transparency to stakeholders (EDM)
○ Management Processes: help to carry out the objectives established by governance *Plan, build, run, monitor
What is a RACI chart
○ A suggested assignment of level of responsibility for process practices to different roles and structures.
■ R: Responsible
■ A: Accountable
■ C: Consulted
■ I: Informed
THIS SET IS OFTEN IN FOLDERS WITH...