GTAG 12: Auditing IT Projects Failure Is Not an Option When It Comes to Your Organization’S IT Projects
Total Page:16
File Type:pdf, Size:1020Kb
Global Technology Audit Guide (GTAG) Written in straightforward business language to address a timely issue related to IT management, control, and security, the GTAG series serves as a ready resource for chief audit executives on different technology-associated risks and recommended practices. Information Technology Controls: Information Technology Outsourcing: Topics discussed include IT control Cffb`e^]fiÕ\o`Yc\@KXl[`kjkX]Ôe^6 )NFORMATION Discusses how to choose the right IT concepts, the importance of IT controls, 4ECHNOLOGY /UTSOURCING outsourcing vendor and key outsourcing =ifdjdXcc$jZXc\#]fZlj\[@KXl[`kk\jk`e^Xe[Xjj\jjd\ek`e`k`Xk`m\jkfcXi^\i$ the organizational roles and control considerations from the client’s jZfg\#Zfdgc\k\@KXl[`kZf$jfliZ`e^Xjj`jkXeZ\#flik\Xdf][\[`ZXk\[@KXl[`k responsibilities for ensuring effective IT and service provider’s operation. controls, and risk analysis and jg\Z`Xc`jkj_\cgpflXZ_`\m\Zfjk\]ÔZ`\eZ`\jk_XkXi\dfi\`dgfikXekk_Xe\m\i`e monitoring techniques. kf[XpËj\Zfefd`ZZc`dXk\%N`k_dfi\k_Xe,''i`jbXe[fg\iXk`fejgif]\jj`feXcj`e e\Xicp(''f]ÔZ\jeXk`fen`[\#n\Ëi\XmX`cXYc\n_\i\m\iXe[n_\e\m\ipfle\\[lj% Change and Patch Management Auditing Application Controls: Controls: Describes sources of change Fli]lccjl`k\f]Zf$jfliZ\[@KXl[`kj\im`Z\j`eZcl[\j1 Change and Patch Addresses the concept of application Management Controls: Critical for Auditing Organizational and their likely impact on business Application Success control and its relationship with general objectives, as well as how change and Controls 4 :f$jfliZ\[@KXl[`k 4 G\e\kiXk`fek\jk`e^ controls, as well as how to scope a risk- patch management controls help 4 Gifa\ZkdXeX^\d\ek&Xjj\jjd\ek 4 9lj`e\jjZfek`el`kpXjj\jjd\ek based application control review. manage IT risks and costs and what 4 J;C:i\m`\nj 4 G:@;XkXJ\Zli`kpJkXe[Xi[j\im`Z\j works and doesn’t work in practice. 4 J8J.'Xl[`k! 4 JXiYXe\j$Foc\p@Kk\jk`e^ 4 @Kj\Zli`kpXe[ZfekifcjXjj\jjd\ek Continuous Auditing: Addresses the Identity and Access Management: role of continuous auditing in today’s nnn%ijddZ^cX[i\p%Zfd&@K$i`jbsKIDJ7ijd`%Zfds/''%-+/%+'*' Continuous Auditing: Covers key concepts surrounding identity Implications for Assurance, Identity and Access Monitoring, and Management Risk Assessment internal audit environment; the and access management (IAM), risks relationship of continuous auditing, associated with IAM process, detailed continuous monitoring, and continuous guidance on how to audit IAM processes, assurance; and the application and and a sample checklist for auditors. implementation of continuous auditing. Management of IT Auditing: Discusses Business Continuity Management: IT-related risks and defines the IT audit Defines business continuity management Management of IT Auditing Business Continuity universe, as well as how to execute and Management (BCM), discusses business risk, and manage the IT audit process. includes a detailed discussion of BCM program requirements. Managing and Auditing Privacy Risks: Developing the IT Audit Plan: Provides JZXcXYc\% Discusses global privacy principles and Managing step-by-step guidance on how to develop and Auditing frameworks, privacy risk models and Privacy Risks an IT audit plan, from understanding the controls, the role of internal auditors, top business, defining the IT audit universe, @ek\^iXk\[% 10 privacy questions to ask during the and performing a risk assessment, to course of the audit, and more. formalizing the IT audit plan. FYa\Zk`m\% Managing and Auditing IT Vulnerabilities: Among other topics, Managing and Auditing IT Vulnerabilities discusses the vulnerability management life cycle, the scope of a vulnerability management audit, and metrics to measure vulnerability management practices. IJDDZ>cX[i\p`jk_\f]ÔZ`XcXZZflek`e^#kXoXe[Ylj`e\jjZfejlck`e^Ôidf]K_\G>8f]8d\i`ZX% !8l[`kXe[Xkk\jkj\im`Z\j[\c`m\i\[YpDZ>cX[i\pGlcc\eCCGXgXike\i$fne\[:G8Ôid %IJDDZ>cX[i\pfg\iXk\j`eXeXck\ieXk`m\giXZk`Z\jkilZkli\n`k_DZ>cX[i\pGlcc\eCCG%K_fl^_ For more information and resources regarding technology related audit guidance, j\gXiXk\Xe[`e[\g\e[\ekc\^Xc\ek`k`\j#k_\knfÔidjnfibkf^\k_\ikfj\im\Zc`\ekjËYlj`e\jje\\[j%IJDDZ>cX[i\p@eZ%Xe[DZ>cX[i\pGlcc\eCCGXi\d\dY\ijf]IJD@ek\ieXk`feXcÇXe visit www.theiia.org/technology. X]Ôc`Xk`fef]j\gXiXk\Xe[`e[\g\e[\ekc\^Xc\ek`k`\j%)''0IJDDZ>cX[i\p@eZ%#8ccI`^_kjI\j\im\[ Global Technology Audit Guide (GTAG®)12: Auditing IT Projects Authors Karine Wegrzynowicz, Lafarge SA Steven Stein, Hewlett-Packard March 2009 Copyright © 2009 by The Institute of Internal Auditors, 247 Maitland Avenue, Altamonte Springs,Fla., 32701-4201. All rights reserved. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form by any means — electronic, mechanical, photocopying, recording, or otherwise — without prior written permission from the publisher. The IIA publishes this document for informational and educational purposes. This document is intended to provide information, but is not a substitute for legal or accounting advice. The IIA does not provide such advice and makes no warranty as to any legal or accounting results through its publication of this document. When legal or accounting issues arise, professional assistance should be retained. Table of Contents Letter from the IIA’s PresIDENT ................................................................................................................ 1 1. EXECUTIVE SUMMARY ........................................................................................................................................... 2 2. INTRODUCTION ......................................................................................................................................................... 3 2.1 What Exactly Is an IT Project? ................................................................................................................................... 3 2.2 Understanding the Impact .......................................................................................................................................... 3 2.3 Examples of Failed IT Projects ................................................................................................................................... 3 2.4 Historical Statistics on IT Project Success and Failure .............................................................................................. 3 2.5 Top 10 Factors for Project Success ............................................................................................................................. 4 2.6 Purpose and Benefits of Internal Audit Involvement ................................................................................................ 5 3. FiVE KEY FOCUS AREAS FOR PROJECT AUDITS ............................................................................................ 6 3.1 Business and IT Alignment ....................................................................................................................................... 6 3.2 Project Management .................................................................................................................................................. 6 3.3 IT Solution Readiness .............................................................................................................................................. 11 3.4 Organizational and Process Change Management .................................................................................................. 12 3.5 Post Implementation ................................................................................................................................................ 13 4. PROJECT AUDIT PLANNING .............................................................................................................................. 14 4.1 IT Projects and the Annual Internal Audit Plan .................................................................................................... 14 4.2 Internal Auditing’s Role ........................................................................................................................................... 15 4.3 Types of Project Audits ............................................................................................................................................ 16 4.4 External Auditor Considerations ............................................................................................................................. 17 APPENDIx A – Project MANAGEMENT .........................................................................................................18 A.1 Project Management Methodologies .................................................................................................................. 18 A.2 Project Management Life Cycle ......................................................................................................................... 18 APPENDIx B – IT PROJECT STAKEHOLDERS ..................................................................................................19 APPENDIX C – Project MANAGEMENT OFFIces’ STRUCTURE, ROLES, AND RESPONSIBILITIES ...20 APPENDIX D – MATURITY MODELS .................................................................................................................21 D.1 Capability Maturity Model ................................................................................................................................. 21 D.2 Project Management Maturity Models