Information Systems Audit And Control Association Research Articles

Security Culture, Top Management, and Training on Security Effectiveness: A Correlational Study Without CISSP Participants

The purpose of this study was to analyze the relationships between four variables (predictive constructs of top management, awareness and training, security culture, and task interdependence) and an information program's security effectiveness. The difference between this study and previous research is the exclusion of information technology (IT) security professionals with Certified Information Systems Security Professional (CISSP) certifications. In contrast, participants in previous research were IT professionals with CISSP certifications. The research question asked to what extent is there a statistically significant correlation between each of the four predictive constructs and security effectiveness. This study made the same correlational determination between the independent variables and the dependent variable construct using a study population of 155 Information Systems Audit and Control Association (ISACA) members. This study used structural equation modeling (SEM) techniques to analyze relationships. The same previously used instruments were reused to reassess these particular participants. The results of SEM revealed that there was a significant relationship between security culture and security effectiveness. Similarly, significant relationships were found between top management, awareness and training, security culture, and security effectiveness, which repeated similar findings from previous research. A post hoc test was conducted using path analysis to reaffirm the direct causal relationship between security culture and security effectiveness that was also previously researched with similar results. The results demonstrated that security culture is a significant influence regardless of the participants' perception of a security professional with or without CISSP certification. The implications of this can greatly affect reorganizational structure changes focused on developing security culture as an investment and a much-targeted construct focused on by future researchers. This could result in humandepartments or functional managers realigning staff positions to concentrate on spreading security culture among fellow employees who affect cybersecurity either directly or indirectly in the workplace.

Complex information systems configuration using ISACA Design Guide into an Axiomatic Design approach

This paper describes the process of designing a customized governance solution for an enterprise information system using COBIT framework guidelines and an axiomatic design approach. COBIT (Control Objectives for Information and related Technology) is a generally accepted framework created by the ISACA (Information Systems Audit and Control Association) for governing and managing enterprise information and technology (IT). COBIT framework can be applied to any organization in any industry and was designed to help deliver value while managing better the risks associated with the IT processes. On the other side, the Axiomatic Design (AD) theory involves a continuous interplay between the design objectives (the needs/what we want to achieve) and the means capable of reaching those objectives (how we want to achieve) to determine the best configuration capable of satisfying the design intend. The AD theory requires a description of the design's objectives in terms of specific requirements, called Functional Requirements (FR). The development of a complete solution to a given problem starts by mapping the FRs to Design Parameters (DPs) in the solution domain. ISACA Design Guide proposes ten (10) Design Factors and forty (40) Governance Objectives; each objective (a set of Functional Requirements) can be achieved through several combinations of Design Parameters. From the Axiomatic Design theory perspective, this determines a coupled matrix. To decouple the matrix, the profile of each design factor is drawn, and the sub-factors will be taken only once within the factor where the sub-factor has the highest weight. A case study is presented.

La gestión documental en los modelos de gobernanza TIC: presencia y visibilidad de la normativa internacional en el modelo de referencia COBIT

La gobernanza y gestión de servicios y sistemas de información disponen de una serie de normas que reúnen las mejores prácticas desarrolladas por instituciones y empresas. Esta experiencia se presenta en la forma de marcos de referencia que definen objetivos, indicadores y procesos, y que se pueden usar como guía para definir los procesos internos y comparar la actuación de las organizaciones con las buenas prácticas de la industria. Entre ellos destacan el modelo COBIT desarrollado por ISACA (Information Systems Audit and Control Association) y la norma internacional ISO/IEC 38500, dedicados a la gobernanza TIC. En este artículo se analiza la presencia de las prácticas de gestión documental en el marco del modelo COBIT y la visibilidad de las normas específicas de gestión de documentos ISO 15489 e ISO 30300 en el mismo.

Role assigning and taking in cloud computing

The widespread use of cloud computing (CC) has brought to the forefront information technology (IT) governance issues, rendering the lack of expertise in handling CC-based IT controls a major challenge for business enterprises and other societal organizations. In the cloud-computing context, this study identifies and ranks the determinants of role assigning and taking by IT people. The study’s integrative research links CC and IT governance to humane arrangements, as it validates and ranks role assigning and taking components through in-depth interviews with twelve IT decision-makers and forty-four Information Systems Audit and Control Association (ISACA) members, engaged as panelists in a Delphi technique implementation. The empirical results recognize skills and competencies as prioritized determinants of IT controls, while IT security, risk and compliance emerge as capabilities crucial to evaluate and manage CC service providers. Despite the study’s generalizability limitations, its findings highlight future research paths and provide practical guidelines toward the high technology of open-market IT self-governance. The latter entails the humane flows of collegial control and responsibility, as opposed to the inhumane flows of authority and power, under the sequestered technique of the bureaucratically-hierarchized IT hetero-governance

An integrated approach to the audit procedures to be followed during the implementation of Product Data Management (PDM) software

Product Data Management (PDM) is a domain which comes under the umbrella of Product Lifecycle Management (PLM). While PLM covers entire life cycle of the structure taken for consideration, PDM focus only the hardware portion of it. The implementation of a system which involves product life cycle is a challenging process as it involves an entire changeover of existing working procedures. Moreover, this works in a domain which is dispersed geographically across multiple locations across the globe. In this context, diversification is keyword during the entire phase of operation. This context throws open challenges to find uniformity in procedures, practices, guidelines and documentation in every phase. The first step in defining uniformity is adhering to certain standards and practices which are universally acclaimed. In this context, procedures and directives mentioned in International Standards Organisation (ISO) and Information Systems Audit and Control Association (ISACA) become handy. Audit procedures can be broadly classified in PDM domain as direct and indirect. Direct audit practices are procedure, document and resource oriented while indirect audit focus on finance and infrastructure. In most phases there shall be overlapping relations between these two areas. Management of these aspects is discussed in individual phases of this engineering domain.

Software Development for Information System - Achieving Optimum Quality with Security

Information Systems acquisition, implementation, and development have been taking place in business organization to gain the competitive advantage. Rapid advancement of Technology is also popping up unethical issues involving violations of End users' data protection and privacy. This article discusses standard quality practices adhere to which a good quality software product is guaranteed while supporting the organizational strategic needs. It presents a framework that bridges Quality software development process improvement with strategic needs of an organization. Standard practices under consideration includes Capability Maturity Model for Development (CMMI-DEV) while using multi-model Process Improvement approach where an organization could use Balance Score Card technique while setting its strategic goals and monitoring their performance related to Information System development, and also link it with Information System management framework “Control Objectives for Information and Related Technology” (COBIT) - 5 released by Information Systems Audit and Control Association (ISACA), so that users could easily switch between the two standards. In last benefits are reported for using quality practices to realize attainment of competitive advantage.

INFORMATION TECHNOLOGY GOVERNANCE PROCESS MATURITY IN HIGHER EDUCATION INSTITUTIONS IN SOUTH AFRICA

The Department of Education, South Africa, published a white paper on the transformation of the higher education sector in 1997, to ensure that the sector would meet the criteria for the higher education agenda of the country. Governance of the higher education sector in South Africa is defined in an Act of parliament governing the sector, Act 101 of 1997, as amended. The Act defines the governance organs required. Whilst the corporate governance requirements are well defined and practiced, there is no formal requirement for the governance of information technology (IT). This paper investigates the maturity levels of IT governance processes in public higher education institutions in South Africa, using the COBIT 4.1 framework developed by the Information Systems Audit and Control Association (ISACA). Ten of the twenty-three public higher education institutions in South Africa participated in a survey requiring 78 responses each. The empirical results of this survey on the level of IT governance process maturity will be presented and discussed to better understand the factors contributing to IT governance process maturity levels in the public higher education sector in South Africa.

AUDITORÍAS INTEGRADAS: SITUACIÓN ACTUAL EN NICARAGUA

Las auditorias integradas han emergido con rapidez en las diferentes unidades de auditoría por los beneficios que brinda a las organizaciones. Instituciones que regulan la profesión de auditoria y directivos de diferentes organizaciones comenzaron a recomendar el enfoque integrado en las revisiones para que se evaluara holísticamente los riesgos y controles de los procesos de negocio. A través de una encuesta estructurada se conoció el estado del arte de las auditorias integradas en Nicaragua; Esta encuesta se diseñó bajo la referencia teórica de la Asociación de Auditoría y Control de Sistemas de Información (ISACA, por sus siglas en inglés). Se detectaron varias prácticas que fueron categorizadas bajo un enfoque integral y no integrado, sin embargo, la investigación aportó información para esclarecer ambos términos y así los profesionales de auditoria pueden realizar los ajustes pertinentes en sus procesos internos y mantener el enfoque integrado. Se propuso un nuevo concepto de auditoria integrada, de tal manera que sirva como referencia para lograr el enfoque integrado.DOI: http://dx.doi.org/10.5377/nexo.v27i01.1440

Key performance indicators for information technology (IT) operational management of financial industry in Taiwan

This paper used CobiT version 4.1, as published by the information systems audit and control association (ISACA), to investigate key performance indicators for IT operational management; IT managers in the financial industry were emphasized. This study enlisted the help of practicing experts in creating a summary of practical experience. The study illustrates the experts’ consensus regarding the six most important key performance indicators for IT operational management within the financial industry. They are as follows: 1) frequency of data verification, 2) changes that follow formal change control processes, 3) problems resolved within the required time period, 4) user satisfaction with data availability, 5) successful data restoration, and 6) monitoring of critical processes. This study compiled reference values for each indicator following informational interviews with the group of experts. Additionally, this research involved verification comparisons between the reference values and the numerical value of the key performance indicators obtained in the study. The results were unanimous, indicating that this research has a high level of practical value. The results of the study can provide IT managers in the financial industry with reference indicators useful in IT operational management. Key words: CobiT, Delphi method, IT management, performance indicators, IT governance.

정보시스템 서비스 평가를 위한 측정모형의 개발 및 실증적 검증 : 중국 SI 기업 사례

The controls of Information Systems (IS) have been an more critical issue controls as the sophistication and integration of IS is more proceeded. ITGI (The Information Technology Governance Institute) of ISACA (Information Systems Audit and Control Association) has suggested COBIT (Control Objectives for Information and related Technology) and this has been widely recognized the evaluation model of IS controls. In COBIT, IS was evaluated in terms of process, information quality, and IT resources. This study used COBIT in order to suggest and empirically test an evaluation model of IS service. The data was collated from one major Chinese SI (Systems Integration) company in four domains of processes : planning and organization, acquisition and implementation, delivery and support, and monitoring. Seven factors are extracted using an exploratory factor analysis as follows : Overall IT planning process, technological assessment process in IT planning of IT, cost-benefit assessment process in IT planning, implementation process, support process, monitoring process, post-implementation evaluation process. The results of confirmatory analysis of three alternative measurement models indicated that the measurement model with one inherent or conceptual variable has greater model fitness than the other models. This study suggests the logical and general way to test and apply COBIT in evaluating IS services.

Convergence: A holistic approach to risk management

All too often, security practitioners tend to think about security purely as a logical issue. Locking down firewalls and structuring access to user accounts is only one part of the puzzle, however; other aspects of security are just as important in the enterprise. Marrying physical security with computer security can help to strengthen an organisation's overall risk profile, but Kent Anderson, a member of the Certified Information Security Manager (CISM) board within the Information Systems Audit and Control Association (ISACA), argues that to be truly effective, we must beyond this and embrace the concept of enterprise risk management. How can this best be achieved, and what will the result look like? This article examines some of the drivers for this holistic form of risk management, and outlines some best practice principles to attain its goals. Today's security practitioners feel more pressure and accountability to perform, yet never seem to have the resources to get the job done. Consequently, ''executives just don't get it'' is probably the most common explanation among frustrated professionals, but have we ever stopped to ask if maybe we're the ones who don't get it?

IS practitioners' views on core concepts of information integrity

Based on a review of the literature on data quality and information integrity, a framework was created that is broader than that provided in the widely recognized international control guideline COBIT [ISACA (Information Systems Audit and Control Association) COBIT (Control Objectives for Information Technology) 3rd edition. Rolling Meadows, Il: ISACA, 2000], but narrower than the concept of information quality discussed in the literature. Experienced IS practitioners' views on the following issues were gathered through a questionnaire administered during two workshops on information integrity held in Toronto and Chicago: definition of information integrity, core attributes and enablers of information integrity and their relative importance, relationship between information integrity attributes and enablers, practitioners' experience with impairments of information integrity for selected industries and data streams and their association with stages of information processing, major phases of the system acquisition/development life cycle, and key system components. One of the policy recommendations arising from the findings of this study is that the COBIT definition of information integrity should be reconsidered. Also, a two-layer framework of core attributes and enablers (identified in this study) should be considered.

ISACA model curricula 2004

Part of the mission of the Information Systems Audit and Control Association (ISACA) is to improve the educational background of its members and potential members. In 1998, ISACA released the “Model Curricula for Information Systems Auditing at the Undergraduate and Graduate Levels” and in 2000 a task force was created to update the Model. The task force is composed of academics and professional IS auditors representing 11 countries and 5 continents. This paper reports on the efforts of this task force to create a new model that will be easier for universities around the globe to implement into their curricula and that will create a method for adopting universities to be recognized by ISACA. It describes the components of the model and the adoption procedures that should be considered by interested universities

The evolution of IT auditing and internal control standards in financial statement audits

The rapid escalation of technology and the use of computers in business practice result in more information technology (IT) auditing and internal control standards and guidelines to assist auditors in their roles and responsibilities. Several organizations, such as the American Institute of Certified Public Accountants (AICPA), the International Federation of Accountants and the Information Systems Audit and Control Association (ISACA), have issued standards in this area to be observed by their members in performing an IT audit. This paper traces the evolution of US IT auditing and internal control standards in financial statement audits and discusses their significance for the auditing profession. We primarily focus on the discussion of the IT audit standards issued by the AICPA and ISACA. As the use of computers in business data processing gets more widespread and the integration of IT in business processes gets more intricate, we expect to see more pronouncements of IT audit standards in the future. Auditors should well understand these pronouncements, standards and guidelines when performing an IT audit.