Computer Auditing Guideline and Exposure Drafts

[Al Mac <macwheel99@xxxxxxxxxxx>]

--
[ Picked text/plain from multipart/alternative ]
I think others in the computing profession would be interested in seeing
these attempts at standards for the computer auditor profession.
<http://www.isaca.org/standard/draft2.htm>www.isaca.org/standard/draft2.htm.
I am a bit disappointed.  I thought the computer auditing profession was
much more advanced than this.

I think these proposed standards are quite superficial, particularly the
one on auditing ERP systems http://www.isaca.org/standard/guide29.htm but
any standards have to start somewhere.  I answered the questionnairre,
stating that I believe an audit cannot be complete without auditors who
know something significant about the computer systems being used.  For
example, we use BPCS on an IBM Midrange Computer.

I have briefed past bosses on how embezzlement could be done, security
risks in general, how security can be audited, the fact that Unbeaten Path
International has an inexpensive manual specifically for BPCS auditors,
that alerts auditors to areas of common BPCS misconceptions where they
should pay particular attention to highest risk of human error.  I have
also briefed co-workers in various departments regarding bugs that I
consider to be so systemic that fixing them is the obligation of the
vendor, and failing that, which is now the case, fixing them is potentially
a major expenditure, and what I am doing as a work around.  In my opinion,
systemic bugs have the potential for much more damage than deliberate human
mischef, so long as we remain in the IBM world that is not at risk of
viruses or hackers.  I can't see how a thorough audit could be done by
personnel who are in ignorance of such information.

>From: "Michael Patterson"
>Subject: [e-com-sec] Auditing Guideline and Exposure Drafts
>Reply-To: e-com-sec@yahoogroups.com
>
>The US Auditing Standards Board of the Information Systems Audit and
>Control Association (ISACA) has issued the documents located at the
>following URL internationally for general public comment:
><http://www.isaca.org/standard/draft2.htm>www.isaca.org/standard/draft2.htm.
>
>
>Whether or not members wish to respond to ISACA with comments, they do
>make interesting reading.
>
>
>Michael Patterson

-
Al Macintyre (macwheel99@sigecom.net via Eudora)
Al's diary http://radio.weblogs.com/0107846/
Cure cancer. http://members.ud.com/about/


--