Des nouvelles normes pour mieux maîtriser les risques informatiques

L’association des auditeurs internes IIA a complété sa bibliothèque en intégrant 2 volumes traitant de la dimension informatique.

Le premier traite de la problématique des bases de données et des fichiers « tableur ». Cela représente certainement une dimension incontournable et complexe si l’on considère en particulier l’utilisation généralisées des fichiers Excel et leur faible niveau de sécurité intrinsèque.

Le deuxième volume traite quant à lui de la gouvernance de sécurité de l’information.

The IIA is releasing two new issues of its ongoing Global Technology Audit Guide (GTAG) series – both aimed at helping internal auditors and their management learn about and assess technology related risks.

Almost every organization uses some form of User Developed Applications (UDAs) such as spreadsheets and databases. They can be easily developed, cost effective to produce, and changed with relative ease.  However, risks such as data integrity, availability, and confidentiality can pose threats to an organization and internal auditors may consider auditing UDAs. New GTAG 14, Auditing User-developed Applications, explores, among other topics, how best to risk rate and scope a UDA audit. The 32-page GTAG also proffers a sample audit program, best practices for implementing controls over UDAs, and advice on how internal auditors can work in a consulting role to help management develop an effective UDA control framework

…

New28-page GTAG 15, Information Security Governance (ISG), explores internal auditing’s roles in and responsibilities for overseeing IT security. It assists organizations in incorporating an audit of ISG into the audit plan, focusing on whether the organization’s ISG activity delivers the correct behaviors, practices, and execution of information services.

via GTAGs 14 and 15 tackle spreadsheets, databases, and information security governance