Please enable JavaScript.

Coggle requires JavaScript to display documents.

10 by 4 (Effectiveness and efficiency of IT personnel (Operator work…

- - - - exceptions may indicate:
        
        – Poor understanding of business requirements
        
        – Poor application design, development or testing
        
        – Inadequate operation instructions–
        
        – Inadequate operator training or performance monitoring
        
        – Inadequate sequencing of tasks
        
        – Inadequate system configuration
        
        – Inadequate capacity management
        
        Inadequate operations support
  - - - Because of the size and complexity of the
        logs, it is difficult to manually review them.
        
        Programs have been developed that analyze the system log and report on specifically defined items
        
        the auditor can carry out tests to ensure that:
        
        – Only approved programs access sensitive data. :cd: :capital_abcd:
        
        – Only authorized IT personnel access sensitive data. :male-technologist::skin-tone-2: :capital_abcd:
        
        – Software utilities that can alter data files and program libraries are used only for authorized purposes. :keyboard: :left_right_arrow:
        
        – Approved programs are run only when scheduled and, conversely, unauthorized runs do not take place. :clock7:
        
        – The correct data file generation is accessed for production purposes. :check:
        
        – Data files are adequately protected. :guardsman:
  - - - Operator responses should be reviewed by IS management :man_in_business_suit_levitating:
        
        to determine whether
        operator actions were appropriate
        
        whether additional training should be
        provided to operators.
- - - - internal IT department
        
        business may acquire IT services from an internal IT organization, such as email services, an intranet, an enterprise resource planning (ERP) system, etc
      - external IT service provider
        
        business may acquire IT services from an external IT service provider, such as Internet connectivity, hosting of the public website, etc.
    - - characteristics include
        
        accuracy :star:
        
        Completeness :black_circle:
        
        timeliness :timer_clock:
        
        Security :guardsman:
    - - are often tied to chargeback systems, in which a certain percentage of the cost is apportioned from the end-user department to the IT department
    - - hardware and software performance targets
        
        such as user response time and hardware availability
      - other performance measures
        
        financial performance measures (e.g., year-to-year
        incremental cost reduction)
        
        human resources measures (e.g., resource
        planning, staff turnover, development or training)
        
        risk management measures (e.g., compliance with control objectives).
      - monitoring of service level
        
        to ensure that the objectives of IS operations are achieved
        
        important to review the impact on the customers and other stakeholders of the organization
        
        example: ATM availability, or email and internet service availability
        
        Monitoring of service levels is essential for outsourced services, particularly if the third party is involved in directly providing services to an organization’s customers
        
        a fraud due to control weakness at a third party may result in reputation loss for the organization.
        
        because only responsibility for serviced provision is outsourced—accountability is not and still rests with the organization.
        
        IS auditor should determine how management gains assurance that the controls at the third party are properly designed and operating effectively.
        
        techniques can be used by management, including
        questionnaires, onsite visits or an independent third-party assurance report,
  - - - it includes
        
        production and maintenance of the service catalog,
        
        service review meetings
        
        service improvement plans (SIPs) for areas that
        are not achieving their SLAs
    - - to maintain and improve customer
        satisfaction :smiley: :v:
      - to improve the service delivered to the customer. :leaves: :arrow_right: :deciduous_tree:
    - - because of this
        
        IT organization or service provider can design
        the service based on the service level :the_horns:
        
        customer can monitor the
        performance of the IT services :eyes:
- - - - The processes, after defined, can be better managed through SLAs that serve to maintain and improve customer satisfaction :page_with_curl:
        
        possibility of a gap between customer expectations and the services offered, and this is narrowed by the SLA,
        
        which completely defines the nature, type, time and other relevant information for the services being offered
        
        supported by operational level
        agreements (OLAs), :black_circle_for_record:
        
        internal agreements covering the delivery of
        services that support the IT organization in its delivery of services. INPUT SERVICES FOR SERVICE PROVIDERS IT ORGANIZATION
    - - business deliverables :books:
      - covers infrastructure management of IT applications that support and deliver these IT services :building_construction:
    - - fine tuning IT services to meet the changing
        demands of the enterprise :musical_score:
      - measuring and demonstrating improvements in
        the quality of IT services offered :leaves: :arrow_right: :deciduous_tree:
      - reduction in the cost of service in the
        long term :money_mouth_face:
- - - - changes are needed
        
        required change
        
        originated as a solution to a problem
        
        or as an enhancement
      - cost-benefit and feasibility studies before changes are approved and accepted
      - risk of the changes should be
        studied, and a fallback plan should be developed.
      - change management group of the process/program can provide a supporting role after consulting the configuration management group
        
        The configuration can be maintained at the system level, the program level or the module level.