1. Title of subject Information Systems Audit. 2. Subject code TSC Status of subject Major Subject. 4. Version September 2006

Size: px

Start display at page:

Download "1. Title of subject Information Systems Audit. 2. Subject code TSC Status of subject Major Subject. 4. Version September 2006"

Oliver Horton
6 years ago
Views:

1 1. Title of subject Information Systems Audit. Subject code TSC111. Status of subject Major Subject 4. Version September 006. Credit hour LAN Credit Hours Equivalence: Semester Trimester (Gamma Level) 7. Pre-Requisite TIS 11 Systems Analysis and Design 8. Methods of teaching 8 Hours of Lecture 14 Hours of Tutorial 9. Assessment 40% Coursework 60% Final Exam Total 100% 10. Teaching staff (Proposed) Subarmaniam Kannan Ho Yean Li 11. Objective of subject Students will understand various information systems controls and auditing techniques. It covers the management control framework and application control framework 1. Synopsis of subject The major areas of study include: Overview of Information Systems Auditing; Conducting an Information System Audit; Data Resource Management Auditing; Security Management Auditing; Operations Management Auditing; Quality Assurance Management Auditing; Boundary Auditing; Input Auditing; Communications Auditing; Processing Auditing; Database Auditing; Output Controls and Audit Software. 1

2 Bidang pengajian meliputi: Pengenalan audit sistem informasi, Pengendalian audit sistem informasi, Kawalan dan audit pengurusan sumber data, kawalan dan audit pengurusan sekuriti, Kawalan dan audit pengurusan operasi, Kawalan dan audit pengurusan kepastian kualiti, Kawalan dan audit boundri, Kawalan dan audit input, Kawalan dan audit komunikasi, Kawalan dan audit pemprosesan, Kawalan dan audit pangkalan data, Kawalan dan audit output, Perisian audit. 1. Learning Outcomes By the end of the subject, students should be able to: Identify and appraise the need for control and audit of computer based information systems. Describe the basic steps to be undertaken in the conduct of information systems audit Identify major threats to information function and Design, implement, operate and maintain controls that reduce losses from these threats to an acceptable level. Programmes Outcomes Ability to apply soft skills in work and career related activities Degree of Contribution (%) Good understanding of fundamental concepts Acquisition and mastery of knowledge in specialized area Acquisition of analytical capabilities and problem solving skills 0 1 Adaptability and passion for learning Cultivation of innovative mind and development of entrepreneurial skills Understanding of the responsibility with moral and professional ethics 14.Details of subject Topics Covered Hours 1. Overview of information Systems Auditing; Need for control and audit of computers, Effects of computers on internal controls, Effects of computer on auditing, foundations of information systems auditing.

3 . Conducting an Information Systems Audit ; Nature of controls, Dealing with complexity, Audit Risks, Types of Audit Procedures, Overview of Steps in Audit, Audit Around or through the computer. Data Resource Mangement Controls and Audit; Functions of DA and DBA, Data Repository Systems, Control over the DA and DBA 4. Security Management Controls and Audit; Conducting a Security Program, Major security Threats and remedial measures, Controls of last resort.. Operations Management Controls and Audit; Computer Operations, Network operations, data preparation and entry, Production control, File library, Management of outsourced operations. 6. Quality Assurance Management Controls and Audit; QA functions, organizations considerations 7. Boundary Controls and Audit; Cryptograhic controls and audit, access controls and audit, Personal identification numbers, digital signatures, plastic cards, audit trail controls. 8. Input and Output Controls and Audit; Data input methods, Source document design, datentry screen design, data code controls,check digits, batch controls, validation of input data, instruction input, validation of instruction input, audit trail controls and existence controls, Inference controls, batch output production and distribution controls, batch report design controls, online output production and distribution controls, audit trail controls and existence controls. 9. Communication Controls and Audit; Communication subsystem exposures, physical component controls, line error controls, flow controls, link controls, topological controls, channel access controls, controls over subversive controls, Internetworking controls, audit trail controls and exitence controls 10. Processing Controls and Audit; Processor controls, real memory controls, virtual memory controls, operating system integrity, application software controls, audit trail controls and exitence controls

4 11. Database Controls and Audit; Access controls, integrity controls, application software controls, concurrency controls, file handling controls, audit trail controls and exitence controls. 1. Risk management; Risk Strategies, Risk Identification, Risk Projection, Risk Monitoring and Management Verification and validation Measurement tracking and feedback mechanism Total quality management Risk management 1. Audit Software and Audit; Generalized audit software, industry specific audit software, high level languages, utility software, expert systems, neural network software, specialized audit software, control of audit software Total Contact Hours 8 1. Tutorial Students will be given tutorial questions and case studies based on topics covered. 1. Information Technology Control and 16.Text book Text book Audit, Second Edition by Frederick Gallegos, Daniel P. Manson, Sandra Senft, Carol Gonzales, Mar 6, 004 4

5 Reference Books 1. Information Technology Controls (Global Technology Audit Guide 1), The Institute of Internal Auditors Inc. (Paperback - Mar 1, 00). Core Concepts of IT Auditing by Hunton, James E., Stephanie Bryant, Wiley, Auditing EDP Systems (Second Edition), Donald A. Watne, Petter B. B. Turny, Prentice. 4. Information Systems Control and Audit, Ron A. Weber (Oct 9, 1998). Computer Security Management, Karen, A. Forcht, Project Management: Principles and Practices, Spinner, M. P., Prentice- Hall, Inroads to Software Quality, Jarvis, A. and Vern, C. Prentice Hall, Basic Computer Security, Deborah Russell, O Reilly and Associates, 1991.

City University of Hong Kong. Course Syllabus. offered by Department of Information Systems with effect from Semester A 2017 / 2018

City University of Hong Kong. Course Syllabus. offered by Department of Information Systems with effect from Semester A 2017 / 2018 City University of Hong Kong offered by Department of Information Systems with effect from Semester A 2017 / 2018 Part I Course Overview Course Title: Information Systems Infrastructure and Security Management