TFL Vsebine / Revija SIR*IUS

Challenges of software testing audit

Revizorji informacijskih sistemov se dostikrat znajdemo pred nalogo, ko je treba oceniti skladnost delovanja informacijskega sistema družbe glede na zakonske zahteve ali zahteve nadzornih institucij. Za vsak revizijski posel je treba v skladu s Hierarhijo pravil revidiranja informacijskih sistemov pripraviti revizijski načrt, katerega pomemben del je opredelitev obsega postopkov, potrebnih za izvedbo pregleda. Preslikava zakonodajnih zahtev v procese COBIT 5 olajša in pospeši razvoj načrta ter pripomore k njegovi usklajenosti z Okvirom dajanja zagotovil IT združenja ISACA. V prispevku so opisana izhodišča in metodologija preslikave zahtev predpisov v procese COBIT 5. Postopek preslikave vključuje vsebinske zahteve in zahteve, ki se nanašajo na zrelost poslovanja. Izvedena je preslikava Sklepa o upravljanju tveganj in izvajanju procesa ocenjevanja ustreznega notranjega kapitala za banke in hranilnice v kontrolne cilje COBIT 5. Rezultati preslikave so osnova za pripravo načrta pregleda, zasnovanega na COBIT 5. Tako pripravljen načrt je vodilo, ki revizorju informacijskih sistemov pomaga pri obvladovanju revizijskega tveganja in obsega pregleda v kombinaciji z oceno tveganja. Pričakovanje, da bo sama preslikava zožila obseg pregleda, se ni uresničilo. Zahteve sklepa s področja upravljanja in vodenja IT se preslikajo v vse procese COBIT 5, razen enega, ter na večino praks upravljanja in vodenja IT.

It is often a task of an IT auditor to assess whether the enterprise information system operates in compliance with laws and regulations. Definition of the scope and description of procedures are important parts of the audit plan that should be prepared for each assignment according to the Hierarchy of information system audit rules. Mapping of legislation requirements to COBIT 5 processes facilitates and accelerates the development of the audit plan and improves compliance with ISACA Information Technology Assurance Framework. The Article describes baselines and methodology of mapping the legislation requirements to COBIT 5 processes. The mapping procedure includes both substantive and operational maturity requirements. The Decision regulating risk management and implementation of the adequate internal capital assessment procedure for banks and savings banks has been mapped to COBIT 5 control objectives. The audit plan developed on the basis of such mapping then guides the information system auditor and supports him in managing the audit risk and the scope of audit in combination with the risk assessment. The expectation that mapping itself would narrow the scope of audit has not come true. The decision requirements concerning the IT management and governance are mapped to all COBIT 5 processes except one and to the majority of IT management and governance practices