Question

1. Describe a Computer Operations internal control that you would implement to give you comfort that each of the following objectives is being met:

1. Controls provide reasonable assurance that data recorded, processed and reported remain complete, accurate and valid throughout the update and storage process.
2. Controls provide reasonable assurance that authorized programs are executed as planned and deviations from scheduled processing are identified and investigated, including controls over job scheduling, processing, error monitoring and system availability.
3. Controls provide reasonable assurance that any problems and/or incidents are properly responded to, recorded, resolved or investigated for proper resolution.

Answer 1

1. Controls provide reasonable assurance that data recorded, processed and reported remain complete, accurate and valid throughout the update and storage process.

• define Policies and procedures for the handling, distribution and retention of data and reporting output.
• protects sensitive information, logically and physically, in storage and during transmission against unauthorized access or modification.
• Retention periods and storage terms are defined for documents, data, programs, reports and messages , as well as the data used for their encryption and authentication.
• implement a strategy for cyclical backup of data and programs.
• establish Procedures to be  followed periodically test the effectiveness of the restoration process and the quality of backup media.
• Changes to data structures should do only by authorized person, made in accordance with design specifications and implemented in a timely manner.
• Controls provide reasonable assurance that authorized programs are executed as planned and deviations from processing are identified and investigated, including controls over job scheduling, processing, error monitoring and system availability.
• establish and document standard procedures for IT operations, including scheduling, managing, monitoring and responding to security, availability and processing integrity events.
• retain sufficient system event data retained to provide chronological information and logs to enable the review, examination and reconstruction of system and data processing
• design system event data to provide reasonable assurance as to the completeness and timeliness of system and data processing.
• establish End-user computing policies and procedures concerning security, availability and processing integrity to be followed
• End-user computing, including spreadsheets and other user-developed programs, are documented and regularly reviewed for processing integrity, including their ability to sort, summarize and report accurately.
• User-developed systems and data are regularly backed up and stored in a secure area.
• User-developed systems, such as spreadsheets and other end-user programs, are secured from unauthorized use.
• Access to user-developed systems is restricted to a limited number of users.
• Inputs, processing and outputs from user-developed systems are independently verified for completeness and accuracy.

• Controls provide reasonable assurance that any problems and/or incidents are properly responded to, recorded, resolved or investigated for proper resolution.
• IT management define and implement a problem management system to ensure that operational events that are not part of standard operation (incidents, problems and errors) are recorded, analyzed and resolved in a timely manner.
• The problem management system provides for adequate audit trail facilities, which allow tracing from incident to underlying cause.
• A security incident response process exists to support timely response and investigation of unauthorized activities.