Alluriam Quality Integrated Health Network IT Auditing Process Project *** Plagiarism is not acceptable *** Overview of Project –For this assignment, you w

Alluriam Quality Integrated Health Network IT Auditing Process Project *** Plagiarism is not acceptable *** Overview of Project –For this assignment, you will tackle the comprehensive task of auditing the IT and IS for an organization operating in a domain of your choice. You will apply the IT auditing process to a selected case study. The case study I have chosen is Alluriam Quality Integrated Health Network Instructions: Research Paper in in APA format. Plagiarism is not acceptable. (Please consider this top priority). For Week 1 to Week 4 project complete instructions are specified. All instructions or tasks must be addressed.(Try to address all the information specified in each task ) Kindly Review the attached documents. Paper must be included APA format References only and in-text citations. The references you cite should be credible, scholarly, or professional sources and Not older than 3 year Weeks 1–5 Project Overview
For this assignment, you will tackle the comprehensive task of auditing the IT and
IS for an organization operating in a domain of your choice. You will apply the IT
auditing process to a selected case study for your organization. You will first
define the scope of your organization, describe its IT capability, and explain how
it supports the organization’s critical mission. You will then conduct an evaluation
of how the IT capability aligns with the organization’s goa ls. Your evaluation will
examine IT/IS practices and operations in your organization. Your evaluation will
include an assessment of internal controls within the IT environment to assure
validity, reliability, and security of information, as well as an asse ssment of the
efficiency and effectiveness of the IT capability. Finally, you will describe your
findings and discuss recommendations in terms of specific controls improvements
to key IT processes for your selected case study. Your main objective is to
formulate a solution in the form of decisions that will aim at assuring the integrity
of your organization’s information assets.
You will be completing this assignment in five weeks. In each week, you will work
on a component of the report. By the end of Week 5, you will integrate these
separate components into a final report.
The final project deliverable will be a report reviewing the organization’s
enterprise goals, IT-related goals, architecture, and summarizing the findings
based on your evaluation, and your final analysis and recommendations (in the
form of decisions). The report will include:
•
•
•
•
•
A description of the organization’s main business and mission, including the
enterprise goals
The IT/IS capability for your organization, including IT/IS infrastruc ture, systems,
and applications, as well as the organization’s IT-related goals
An evaluation of IT/IS practices and operations in your organization, including an
assessment of internal IT controls in terms of achieving IT assurance for your
organization
A description of the findings and an analysis of the risks and remedial measures,
arriving at specific, qualifiable decisions (that can be verified when implemented)
A summary of how your IT auditing will achieve greater IT assurance and will
ensure a stronger alignment of the IT-related goals with the enterprise goals
Include a copy of all the references used in APA format.
The following is the modular breakdown of the project:
o
Week 1:
?
Conduct a preliminary review of your case study’s organization. This rev iew
should include business mission, organizational structures, culture, IS, products
and services, infrastructure and applications, people skills, and competencies.
?
?
?
o
?
?
?
?
o
?
?
?
?
o
?
?
?
?
o
Explain the need for an IT audit of your organization. Support your analysis in IT
governance terms. Identify the stakeholders for your case study.
Identify enterprise goals and IT-related goals for your case study and then create
a mapping of the two sets, indicating primary relationships and secondary
relationships.
Start developing an IT audit plan that addresses the following components: Define
scope, state objectives, structure approach, provide for measurement of
achievement (identify the areas you intend to measure; specific metrics will be
addressed later), address how you will assure comprehensiveness, and address
how you will provide approach flexibility.
Week 2:
Discuss how you will apply a single auditing framework like COBIT 5 to structure
your IT audit.
Describe the IT audit procedures that you will rely on in your IT audit.
Start defining a balanced scorecard that lists IT-related goals and tracks some
performance metrics against the goals.
Review and revise your IT audit plan as needed by improving components in your
plan based on additional insight you have developed.
Week 3:
Identify your case study’s IT processes in key areas of the IS lifecycle and
describe them according to the major domains.
Conduct a preliminary evaluation of internal IT processes, focusing primarily on
project management and software development.
Refine your balanced scorecard as needed, possibly expanding the IT -related
goals and the performance metrics.
Create a process RACI chart that maps management practices to their related
roles and indicate levels of responsibility for each role.
Week 4:
Conduct an evaluation of internal controls for service management.
Conduct an evaluation of internal controls for systems management.
Conduct an evaluation of internal controls for operations management.
Refine your balanced scorecard as needed, possibly expanding the IT-related
goals and the performance metrics.
Week 5:
Using the three-phase model of IT assurance initiative provided in the online
lectures, build and execute an IT assurance initiative as follows:
o
o
o
Identify potential IT-related issues based on documented assumptions and your
evaluation of your case study in Weeks 1–4.
Scope the IT assurance initiative based on the subset of the organizational
system that should be targeted.
State relevant enablers and suitable assessment criteria to perform the
assessment.
o
Integrate the totality of your work from Weeks 1–4 and report the results of your
assessment including your findings and recommendations.
Running head: IT audit plan_ IT Assurance Findings and Recommendations
1
Recommendations:
1. Bildk should establish required copyrights certificates from federal government inside USA,
to get the exclusive rights for this new technology inside USA.
2. Bildk should establish a physical branch inside USA, to manage legal responsibilities and
protect its rights.
3.
Bildk should establish an external audit at begin and join its internal audit team in this audit
to get experience and knowledge.
4. Bildk should establish a test on its product on real students in South university to recognize
minimum and maximum number of students which can use their product without technical
problems.
5. Transparency is the cornerstone to start new work and this culture should be among teams in
Bildk, from top management to the last employee in the enterprise.
6. Bildk should establish required SLA with telecommunication providers to secure a high
quality of their services.
7. Bildk should establish required copyrights agreements with all expected customers to protect
investment rights.
8. Bildk should establish required teams for maintenance, training, help desk and technical
support.
9. Bildk should establish required manuals for using
10. Bildk should start online classes to introduce this technology on social media such as
LinkedIn, Facebook, and Twitter.
IT audit plan_ IT Assurance Findings and Recommendations
IT audit plan_ IT Assurance Findings and Recommendations
•
2
“Conduct a preliminary review of our case study’s organization. This review should
include business mission, organizational structures, culture, IS, products and
services, infrastructure and applications, people, skills, and competencies.”
? Organization Name: Bildk.
? Business mission:
Bildk is a company founded in Delaware and domiciliated in Texas US, that envisions to
become the reference provider for the healthcare industry. It is managed and advised by a
multidisciplinary team of professionals with extensive experience in the practice of: computer
science, biomedicine, medicine, and business development.
Nowadays, more than 4 billion medical imaging studies per year are being carried out and
managed by the main actors of the healthcare system (beneficiaries, providers and payers)
worldwide.
? Organizational structures:
The Information Technology organization is led by a Chief Technology Officer who
reports to the Chief Financial Officer and Executive VP. The office of the CIO is responsible
for establishing corporate-wide policies for the use of information services throughout the
enterprise.
? Products and services:
Bildk is developing an innovative platform entirely based on the cloud that allows its
stakeholders to manage and share medical imaging studies on a highly and efficient fashion,
overcoming the limitations that afflict this process.
•
“Explain the need for an IT audit of your organization. Support your analysis in IT
governance terms. Identify the stakeholders for your case study.”
IT audit plan_ IT Assurance Findings and Recommendations
?
3
The need for an IT audit:
The need for the review is to provide an independent assessment of the enterprise compliance
with legal and regulatory requirements. (Senft, Gallegos, & Davis, 2013)
?
Identify the stakeholders for our case study:
The stakeholders are Chief Technology Officer, Chief Financial Officer, and Executive VP.
(Senft, Gallegos, & Davis, 2013)
•
“Identify enterprise goals and IT-related goals for your case study and then create a
mapping of the two sets, indicating primary relationships and secondary
relationships.”
?
The main issue (stakeholder needs):
1. Does IT support the enterprise in complying with regulations and service levels?
2. How do I know whether I am compliant with all applicable regulations?
? Identify COBIT 5-Enterprise Goals:
Per the COBIT 5 Goals, Cascade Overview illustrated in Figure 3 (ISACA, 2018, p.03),
we need to use the COBIT 5 Enterprise Goals illustrated in Figure 4 (ISACA, 2018, p. 04). There
we can recognize these risk optimization enterprise goals as appropriate for our problem:
“4. Compliance with external laws and regulations”
“15. Compliance with internal policies”
? Suggested COBIT 5 Enterprise and IT topic solutions to solve main issue;
Using the COBIT 5 Enterprise Goals from Figure 4, we can identify the IT-Related Goals
from Figure 17, which is Mapping COBIT 5 Enterprise Goals to IT-related Goals (ISACA, 2018,
p.09):
IT audit plan_ IT Assurance Findings and Recommendations
4
– (Enterprise Goals)
“04. Compliance with external laws and regulations”
“15. Compliance with internal policies”
– (IT Related Goals) – primary relationships
“02. IT compliance and support for business compliance with external laws and
regulations”
“10. Security of information, processing infrastructure, and applications”
“15. IT compliance with internal policies”
– (IT Related Goals) – secondary relationships
“04. Managed IT-related business risk”
“07. Delivery of IT services in line with business requirements”
“14. Availability of reliable and useful information for decision making”
? Important COBIT 5 processes and sub-processes which are used:
“Evaluate, Direct and Monitor (EDM)”
“Align, Plan, and Organize (APO)”
“Build, Acquire and Implement (BAI)”
“Deliver, Service and Support (DSS)”
“Monitor, Evaluate and Assess (MEA)”
? Our recommended COBIT 5 processes and sub-processes which can solve the issue:
? Identify Processes:
Per the Mapping COBIT 5 IT-related Goals to Processes illustrated in Figure 18 (ISACA,
2018, p.p. 14-15):
we can recognize:
IT audit plan_ IT Assurance Findings and Recommendations
5
“EDM03 Ensure Risk Optimization”
“APO01 Manage the IT Management Framework”
“APO12 Manage Risk”
“APO13 Manage Security”
“BAI10 Manage Configuration”
“DSS05. Manage Security Services”
“MEA02 Monitor, Evaluate and Assess the System of Internal Control”
“MEA03 Monitor, Evaluate and Assess Compliance with External Requirements”
, as our required Processes.
Also, additional processes can be addressed such as:
“BAI06 Manage Changes”
“MEA01 Monitor, Evaluate and Assess Performance and Conformance”
These processes will meet the requirements and completing the COBIT 5 processes’ cycle.
•
“Start developing an IT audit plan that addresses the following components: Define
scope, state objectives, structure approach, provide for measurement of achievement
(identify the areas you intend to measure; specific metrics will be addressed later),
IT audit plan_ IT Assurance Findings and Recommendations
6
address how you will assure comprehensiveness, and address how you will provide
approach flexibility.”
1. Define audit subject: Compliance with legal and regulatory requirements. (ISACA, 2016,
p.p. 11-15)
2. Define audit objective: The objective of the review is to provide management with an
independent assessment of the assuring compliance with legal and regulatory
requirements. (ISACA, 2016, p.p. 11-15)
3. Set audit scope: The review will focus on enterprise compliance with legal and regulatory
requirements in the United States (ISACA, 2016, p.p. 11-15). The review will rely on
several sources:
•
Legislations or regulations applicable to the audit subject.
•
Relationships with third parties
•
Organization charts
•
Risk assessments
•
Previous audit reports
4. Perform preaudit planning (ISACA, 2016, p.p. 11-15):
a) Identify locations or facilities to be audited: One branch office located in the
United States.
b) Identify sources of information for test or review (including policies, standards and
procedures): The review will rely on possible sources include:
•
Interview with the auditees
•
Organization charts
IT audit plan_ IT Assurance Findings and Recommendations
7
•
Previous audit reports
•
Security policy
•
Security strategy or strategies
•
Security procedures and standards
•
New employee training materials relating to security.
•
Relevant legal and regulatory information related to security and information
access
•
Vendor contracts, SLAs
•
Supplier due diligence selection criteria, process.
•
Business impact analysis (BIA), business continuity plans (BCPs), disaster
recovery plans (DRPs) and all plans relating to continuity of operations.
•
HR onboarding/offboarding procedures and standards
•
Information security access policies, procedures, and standards
•
Information security computing policies, procedures, and standards
•
Information security acceptable use policies, procedures, and standards
•
Incident response policies, procedures, and standards
•
Monitoring and audit policies, procedures and standards
•
Risk assessments
•
Previous audit reports
5. Determine audit procedures and steps for data gathering (ISACA, 2016, p.p. 11-15):
a) Define and record the audit approach that will be used for the specific audit or assurance
engagement. (Determine audit structure approach):
The approach for this audit/assurance engagement consists of the following steps:
IT audit plan_ IT Assurance Findings and Recommendations
8
1. Issue audit chart. ISACA (ITAF Standard 1001) (ISACA, 2014)
2. Understand the enterprise’s internal and external environment
3. Review documentation.
4. Understand the internal control environment.
– Regulatory statutes
– Control environment
– Control risk assessment
– Control procedures
– Equation of total risk
5. Test controls, document results and conclusions, and gather supporting evidence.
ISACA (ITAF Standard 1205) (ISACA, 2014)
6. Conduct a closing meeting to brief management on the preliminary findings of the
engagement. ISACA (ITAF Standard 1201) (ISACA, 2014)
7. Draft the report and recommendations.
8. Prepare the report and provide it to stakeholders for review and comment.
9. Issue the final report. ISACA (ITAF Standard 1401) (ISACA, 2014)
b) Identify a list of individuals to interview: Possible approaches include:
•
ISACA (ITAF Standard 1201) (ISACA, 2014)
•
Obtain and review the current organization chart.
•
Identify the key legal administration staff, the security manager and the key
stakeholders.
c) Identify methods (including tools) to perform the evaluation:
•
COBIT 5 framework
IT audit plan_ IT Assurance Findings and Recommendations
9
d) Identify criteria for evaluating the test:
•
ISACA (ITAF Standard 1008) (ISACA, 2014)
•
COBIT 5 framework
e) Define a methodology to evaluate that the testing and its results are accurate (and
repeatable if necessary) (Develop audit tools and methodology to test and evaluate internal
controls):
•
ISACA (ITAF Standard 1205) (ISACA, 2014)
f) Define and record the audit approach/strategy:
The approach can consist of the following steps as below;
•
Review documentation.
•
Interview key individuals.
•
Establish audit criteria.
•
Conduct visits to the data center.
•
Conduct a review of high-risk areas.
•
Document findings.
•
Prepare the report and provide it to stakeholders for review and comment.
•
Issue the final report.
g) Identify sources of information to expand the understanding of the audit area/subject
(Identify and request documentation related to the audit subject):
•
Previous audit reports
•
SLAs
•
Internal policies, standards, and procedures
•
Training manuals
IT audit plan_ IT Assurance Findings and Recommendations
•
Supplier websites
•
International standards for specific technologies
10
h) Identify the business risk for the failure to comply with external regulatory:
– ISACA (ITAF Standard 1202) (ISACA, 2014)
– Public relations issues with the customers or the public (reputational risk)
– Inability to comply with regulatory processing requirements (regulatory and financial risk)
– Inability to perform critical business functions (operational and financial risk)
– Inability to maintain payroll and employee privacy (regulatory and reputational risk)
– Inability to meet contractual SLAs with third parties or customers (contractual risk)
1. Scope and assurance initiative assignment
Assurance Topic:
The topic covered by this document is:
Enterprise compliance with legal and regulatory requirements. (Senft, Gallegos, & Davis, 2013).
IT audit plan_ IT Assurance Findings and Recommendations
11
Goals of the Assurance Engagement:
The objective of the review is to provide management with an independent assessment of the
assuring compliance with legal and regulatory requirements. (ISACA, 2016, p.p. 11-15)?
Board/audit committee
The governance body that is charged with evaluating, directing and monitoring the organization’s
audit, risk management and control functions. The board (or the equivalent function that is
charged with the governance of the enterprise) often delegates responsibility for providing
assurance to the audit committee, whose members are usually drawn from the board (nonexecutives). Final accountability, however, stays with the board.
Scoping:
The review will focus on enterprise compliance with legal and regulatory requirements in the
United States (ISACA, 2016, p.p. 11-15). The scope of the assurance engagement is expressed in
function of the seven COBIT 5 enablers, as per the following table.
Phase – A
Phase A—Determine the Scope of the Assurance Initiative
Ref.
A
Assurance Step
Determine scope of the assurance initiative.
Guidance
IT audit plan_ IT Assurance Findings and Recommendations
A-1
12
Determine the stakeholders of the assurance initiative and their stake, i.e., the drivers
for the assurance engagement.
A-1.1
Identify the
Intended user(s) of the assurance
Board/audit
intended user(s)
report
committee: Provide
of the assurance
the board/audit
report and their
committee with an
stake in the
independent
assurance
assessment of the
engagement.
assuring compliance
This is the
with legal and
assurance
regulatory
objective.
requirements.
(ISACA, 2016, p.p.
11-15)
A-1.2
Identify the
Accountable and Responsible parties
interested parties
for the subject matter
The stakeholders are:
•
Chief
accountable and
Technology
responsible for
Officer,
the subject
•
matter over
which assurance
needs to be
provided.
Chief Financial
Officer, and
•
Executive VP.
IT audit plan_ IT Assurance Findings and Recommendations
A-2.1
13
Understand enterprise
Business mission: Bildk i…
Purchase answer to see full
attachment