The Benefits of Being an Audit, Err!?

That’s what most companies revert back with when you ask if they conduct regular IT audits.  According to Aun Ali Motani, a CISA CISSP and Manager Technology & Security Risk Services at Ernst & Young, IT audits are important because of our dependency on automation and technology. “IT systems are automated, processes are computerized and operations are dependent on computers in today’s world. Audits should be taken as a proactive approach rather than a traditional one. It also highlights the control weaknesses currently present in the system which could be exploited if not addressed in time. Conducting audits regularly gives an independent assurance from time to time that systems are secure, meeting business objectives, and that frauds are detected at earlier stages.”

Should Information Security professionals be part of the team that selects a specific solution based on its interoperability with the existing network configuration? Does this usually happen?

Indeed, they should be, and I am sure good companies use these processes to involve IS experts while selecting any solution.

InfoSec experts give independent expert advice, otherwise every solution provider rates their product as the best.

What is the trend like for IT Audits amongst Pakistani corporations? Is there enough awareness in the local enterprise space?

At this stage, in corporations, operations do not like any form of auditors, IT or Finance. Audits are still treated like investigations. Depending on the situation, at times, audits are conducted to investigate events which could be a bad portrayal of the organization and so there is a trend that usually executives do not give much respect to auditors in Pakistan. I can quote multiple examples from my experience. Having said that, there are only a handful of companies who understand the need for regular IT Audits. That is where the IT Auditors are taken seriously. But there are very few organizations that do so. Perhaps the message is not clear (In other words,) , the management hire auditors but resist to disclose the information, and in the end, the objectives are not achieved completely. Sometimes one of the two parties have to compromise on their views, just to settle down the issue.

The attitude of the auditor also matters when going into the field to conduct an IT audit.

Sometimes if the auditors is successful in passing the message that the audits will help secure your job and company, the management may consider being more cooperative. This awareness is growing among executives. Specifically in the case of banks, the State Bank of Pakistan issues circulars to banks to conduct IS audits and secure the computer network and applications. This is helping greatly in the financial sector.

Are there any legal, insurance or financial reasons why Risk Assessment should be part of an organization’s Best Practice?

If it is Risk Assessment only and not IT Risk Assessment, the answer to the question is: yes to some extent. As mentioned in my earlier response concerning the financial industry in Pakistan, the SBP, FBR and SECP regulates them and ask banks to conduct risk assessments.

What are some methodologies used in enterprise Risk Assessment?
If it is IT Risk Assessment, then organizations use, ISO27001:2005, OCTAVE and Microsoft IT Risk Management Methodologies.

Is this something that should be part of the local IT department? Or is it better to outsource the process?

IT departments in companies in countries like Pakistan are already engaged in multiple tasks. First, carrying out IT Risk assessments is a specialized task and organizations may not have expertise in executing it. Secondly, it is highly recommended that the process be outsourced to experts who have experience. Another strategy would be to engage consultants in a first time exercise, learn from them, assess the risk individually, and learn how to reduce, make and adopt a methodology. Then, while re-conducting the exercise, the IT management may do it on their own. Meanwhile, they can set-up a small department for this as well.

In your experience, if SQA or RA is outsourced, do companies (as clients) respond to proposals promptly?

In organizations where is there is some kind of regulation and enforcement of deadlines, this does happen. Enforcement of the legislation or policy is central to getting the work done on time.

In your opinion, are there a lot of security experts in Pakistan offering these services?
Not too many. Companies such as Ernst & Young and  PriceWaterhouseCoopers (PWC) have this expertise as part of their portfolio since they also have affiliations with their global companies. There are people who offer the services though they may not necessarily be experts. The exposure to the complex environments or lack thereof, is also a factor.