TFL Vsebine / Revija SIR*IUS

Audit of information system key controls

V reviziji informacijskih sistemov se srečujemo s pojmom vseobsegajočih kontrol. To so kontrole, ki pri pomanjkljivostih v svojem delovanju vplivajo tudi na zanesljivost podrobnih kontrol informacijskega sistema. Zato je delovanje teh kontrol ključno za celotno kontrolno okolje, upravljanje in vodenje informacijskega sistema. Zaradi splošne narave COBIT 5 ni nobenega zadržka, da tega okvira ne bi bilo mogoče uporabiti kot osnovo za revidiranje vseobsegajočih kontrol. Te kontrole upravljamo s procesi v domenah EDM in MEA, ki sta dovolj splošni, da lahko pri njunem pregledu aktivno sodelujejo tudi notranji in pooblaščeni revizorji.

In the information systems auditing we are faced with the notion of pervasive controls. These are controls that, if deficient in their performance, also affect the reliability of detailed controls. Therefore, the operation of these controls is crucial to the overall control environment, governance and management of the information system. Due to the general nature of COBIT 5 there is no reason that control framework cannot be used as a basis for the audit of pervasive controls. These controls are managed by the processes in EDM and MEA domains that are general enough to allow active involvement of internal and financial auditors.