Recent Posts

Pages: [1]
1
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financial system in Nigeria. This comes on the heels of numerous fraudulent activities being perpetrated via the platform and the attendant geometric increase in fraud complaints reported. Consequently, and in order to reduce customers' expose to the platform, the CBN set daily transaction limit of N100,000.00 and a transaction cap of N20,000.00 above which a combination of PIN and token (2nd factor authentication) will be required to approve transactions effective June 1, 2018.
It further required that customers who want to exceed the N100,000.00 daily limit will execute an indemnity with their Deposit Money Banks (DMBs) accepting responsibility for fraud losses arising from such. DMBs and other stakeholders in the USSD payment ecosystem were also required to take measures to ensure security of the platform by implementing encryption and VPN tunneling at all levels/layers of transaction processing.

We all agree that the USSD platform has over the years gained momentum in its rivalry over other traditional payment channels such as ATM, POS, Online Banking, mobile banking, web payment and mobile money due to its simplicity and low cost. One of the foremost Deposit Money Banks [DMBs] in Nigeria recently celebrated N1trillion [$2.75bn] milestone in transaction volume on the USSD platform alone. This is indicative of the acceptance, penetration and explosion of the USSD platform in the Nigerian payment ecosystem.

In the light of the inherent risk associated with the platform, which are concerns of undue exposure of customers/cardholder information to theft due to lack of end-to-end encryption and the inability of operators at all levels to comply with PCIDSS requirement on the handling of cardholder data, the following questions beg for answers in resolving impasse that could arise from the regulation by the CBN.

Q1. DO YOU THINK THE CBN IS RIGHT IN INTRODUCING RESTRICTION IN THE PLATFORM?

Q2. Is the introduction of daily transaction limit and cap on the platform in addition to token authentication a regulatory overkill with the potential to stiffing innovation, convenience, simplicity and market penetration that the USSD platform has brought to bear in the Nigeria financial system?

Q3. Do you think stakeholders in the payment ecosystem were duly carried along before issuing this framework or are the CBN in conjunction with the NCC on overdrive and failed to balance security concerns vis-a-vis innovation on the platform?

Debate has emerged in several quarters that although the CBN intervention in the USSD operations was well intended due to rising cases of fraud and abuse witness in the system and failure of stakeholders to stem the tide, the policy will stiffing transaction volume, discourage users from using the platform and come to hunt the CBN's own financial inclusion policy, which has greatly leveraged the USSD platform for its success so far. Also, the introduction of 2nd factor authentication (token) for transactions above N20,000.00 will be counterproductive. There is an argument that soft token, which banks and other financial institutions have largely sold to its customers will not be practicable on this platform. This I find to be true. Where a user is running USSD session on the same smartphone that hold his/her soft token software, it will be impossible to quit/minimize the USSD session to go generate the soft token code. The phone won't allowed that except where different phones are used for both operations. Hence, hard token will be required and this will require banks to resume massive sale of hard token devices to customers who already have purchased the soft token meaning additional cost to customers and revenue to DMBs. This will eventually lead to a lot of frustrations.

On the other hand, stakeholders in the USSD payment ecosystem has done little to nothing to alleviate the concerns of customers and regulators on the security of the platform. Given the lack of end-to-end encryption in the platform and the risk it portends to the payment channel, there is an expectation that stakeholders (banks, payment service providers, mobile money operators, mobile network operators/Aggregators) could come together to agree and implement common framework to reduce the risk. Aside Banks, payment service providers/switches and Transaction Aggregators who are required by CBN to be PCIDSS certified/compliant, the TELCOs are not obligated to do so despite processing cardholder data via their network. There is also concerns that they could be storing card data in the process hence, the need for end-to-end encryption of the entire process. Remote encryption key technology (HSM) have not been implemented in some of the USSD payment gateways with secure key management practices that will enhance security. Also, radio signals between the users' mobile GSM device and the base switch centre and Master switching centre are not tunneled via VPN. These are gaps stakeholders need to close to alleviate the concerns of CBN and minimize the risk posed by the platform.

Hence, the CBN ought to have consulted widely with stakeholders who operate in the USSD space with a view to come up with a sustainable solution to the concerns identified in the USSD platform. This will ensure a collaborative effort and synergy to fix the issue and ensure a thriving platform for all rather than seemingly unilateral and unsustainable approach of stiffing the platform, which has a potential to drastically slow transaction volume and harm the platform.

Nwabueze Ohia
Tech Blogger and Author

Will appreciate your questions, comments and contributions to this post. For sponsorship, speaking opportunity and training bookings, please Contact US at  >>> http://oxleyconsults.com.ng/contact-us/ or Send us an email at info@oxleyconsults.com.ng. Remember that you need to first register and become a forum member before you can post a comment.
2
Protection of Automated Teller Machine (ATM) network end-to-end requires layered approach to security (i.e. implementing security at various levels or layers of the ATM endpoints, physical and logical network). While it is imperative to invest significantly in physically protecting the ATMs from burglary attacks and cash theft, the risk and impact of security compromise or breach of the ATM network is more severe and damaging than physical cash theft, which will be limited to the amount of cash available at the ATM as at the time of the attack. As such, it is important to adequately protect the ATM network rather than the individual ATM endpoints.

ATM security has remained a burning issue for banking institutions due to the interest and attraction of the ATMs to cybercriminals and fraudsters who continually feed on them by devising means and new ways of compromising security controls implemented around the ATMs for their continued survival. To remain afloat, fraudsters have become more sophisticated in their methods and ways of attacks while Security Analysts continue to play catch up to the cybercriminals to mitigate the risk and impact of attacks on the bank's brand and bottom-line. This requires a more holistic approach to ATM security where controls are implemented at ATM network level to protect the generality of the ATMs rather than pay more attention to the individual endpoints.

ATMs have continued to face these persistent threat to its operation, which are:

  • Threat to the ATM software targeting the entire ATM network, where attempts are made to compromise the ATM software at the network level to impair in its operations for purpose of cash theft via unsolicited remote administration of the machines.
  • Skimming: a malicious/fraudulent technology designed to steal or harvest ATM card data from unsuspecting cardholders, which are then used to steal money from their bank accounts. The skimming devices are physically installed at the ATMs in a manner that unsuspecting cardholders unknowingly swipe their cards through the skimming device, which collects their card information for use by the criminals.
  • Physical threat to the ATMs where criminals physically attacks the ATMs with the sole purpose of stealing physical cash loaded in the machines. This most times lead to physical damage of the machine or the use of stolen ATM physical keys or safe key combinations to gain unauthorized access to the machines.

The first threat (i.e. ATM software compromise) is an advance persistent threat (APT) where the cybercriminals employ various intrusion techniques to compromise the ATM controlling server that controls the workings of the ATMs. This require the attackers to first break into the bank's network, and then the ATM controller server, which eventually lead them to the individual ATM endpoints. They could easily install malicious codes (malware), which allows them to control the internal functions and commands of the ATMs. As such, they could easily change the command structure and configurations of the ATMs that affects the physical accessories of the machine. By doing so, cash could easily be dispensed to the criminals at specific ATM endpoints and locations within specific period by tinkering with the ATM cash dispense commands, which instructs the machine to dispense cash or altering the cassette configuration for currency denominations to influence the amount and number of notes the ATM dispense in favour of the criminals.

Fundamental ATM Network Protection Approach
Just like any other network of information assets, the ATM network consists of basic network devices such as switches, routers, ATM endpoints, ATM Controlling servers, communication link, etc. To detect and forestall unsolicited network access to the ATM network and controlling server, the bank must implement the following layered security controls to protect the ATM endpoints from compromise.

  • Put all ATMs in a Dedicated Domain: By aggregating all ATM endpoints/terminal in a dedicated domain, specific domain policy that will ensure protection of the machines end-to-end will be implemented without interfering with the default group policy of the bank's network where the ATM is in the same domain network as the organization. There could be group policy objects (GPO) implemented at the organization's enterprise domain, which might be detrimental or impair on the smooth workings/operation of the ATMs. Where the organization's primary domain network is too large and diverged, it might be difficult for domain group policies to easily reach/replicate to the ATM endpoints across the network given their physical locations and associated link/bandwidth challenges. As such, implementing a dedicated domain for ATMs only will ensure easy administration and dispatch of relevant policies that are specific to ATMs for overall security and optimization of the ATMs. Also, deployment of ATM specific patches and upgrades will be easily managed and controlled given that the ATMs are within the same domain network, which promotes interoperability. For details of domain controller/active directory baseline security configuration, visit http://oxleyconsults.com.ng/audit/audit-programs/windows-infrastructure/ or http://oxleyconsults.com.ng/risk_assessment/email_and_ad_infrastructure/
  • Use of Virtual Private Network (VPN) for Offsite ATMs: Here, VPN is used to tunnel traffic from offsite ATMs (i.e. ATMs that are not located within the bank's premises and not directly connected to the bank's network. To ensure security of the traffic originating from offsite ATMs and to prevent interception of signals, a tunnelled VPN connection is used to route ATM transactions from the offsite location (e.g. Shopping malls, hospitals, public buildings, airport, train station, gas station, etc.) to the bank's data center via an internet service provider (ISP). This is to ensure that ATM transactions (i.e. traffic) are not intercepted for malicious use. A router at the offsite location with specific configuration can be used to achieve this. For details of VPN and ATM router baseline security configuration, visit http://oxleyconsults.com.ng/risk_assessment/perimeter_network/
  • Perimeter Firewall: Installing perimeter firewall (a.k.a. frontend firewall) to separate the bank's network from the internet and prevent uncontrolled flow of internet traffic in and out of the bank's network. This is the first point of defense for the bank's network from malicious attacks from the internet. For details of baseline security hardening/configuration of perimeter firewall, visit http://oxleyconsults.com.ng/risk_assessment/perimeter_network/
  • IPS/IDS: Install intrusion prevent system (IPS) and intrusion detection system (IDS) to proactively prevent and detect intrusions into the network for prompt action.
  • Place the ATM network in the Demilitarized zone (DMZ) section of the Enterprise Network: The DMZ is a section of the network just behind the perimeter/frontend firewall. This is to ensure that ATM traffic coming from offsite locations, which passes through the internet via tunnel VPN are first allowed on the perimeter firewall before hitting the ATMs. The ATM network can still be further protected using a firewalls within the DMZ to further isolate them from the DMZ area were other third party application web servers, internet facing servers/applications and vendor/trusted party applications are situated. ATMs located within the bank's branch network are aggregated via the wide area network (WAN) router to the ATM network.
  • Vulnerability Management and Data Loss Prevention (DLP): Here, vulnerabilities are managed within the ATM network by installing anti-virus and anti-spyware software such as Symantec Norton in all endpoints within the network, including ATMs, servers and workstations. This way, threats such as viruses, Trojan horses and other forms of malware will be arrested and prevented from reaching endpoints or spreading on the network. Also, loss and theft of data via the ATM endpoints through USB devices, or remote control software (e.g. dameware, teamviewer, remote VNC, etc.) will easily be arrested using DLP tools like Symantec Norton. Also, patch deployment across all endpoints will be easily managed and coordinated centrally to ensure update of all endpoints.

Best Innovative Approach To ATM Security That Will Prevent Data Breaches within the ATM Network
The best innovative approach to ATM security is online real-time monitoring of the ATM network and endpoints using security information and event management (SIEM) solution such as Arcsight (https://software.microfocus.com/en-us/products/siem-security-information-event-management/overview/) and file integrity monitoring (FIM) solutions such as Tripwire or Cimtrack. This approach will largely address virtually all types of threats to the ATM. SIEM solution detect security breaches based on correlation rules written by SIEM Analysts to match security events to active rules and filters defined in the solution. However, false positive triggers could occur where rules/filters are not properly defined and fine-tuned to match specific events of interest, which could be misleading or result to slip of qualifying security events.

With the capability of detecting ATM card details that have been used in different locations (e.g. 10 km distances) within the shortest period of time (e.g. 5 minutes), which is practically almost impossible to achieve, the SIEM solution comes handy in detecting skimmed cards using anti-skimming correlation rules. Hence, giving the SIEM Analysts early warning signal of potential card breaches and unauthorized cash withdrawals from customers' bank accounts.

The SIEM solution receives audit/event logs of all ATM endpoints and controlling server into its CORE engine and converted for further analysis by Arcsight using relevant smart connectors that are capable of reading in ATM event logs. Entries into the network, installation and launching of unsolicited software/services/protocols, antivirus logs, syslog server consolidating logs of network devices are monitored by the Analysts using correlation rules in the SIEM.

Some of the correlation rules that SIEM Analysts need to build into the SIEM for effective monitoring and detection of suspicious activities within the ATM network and endpoints are not limited to the following.

  • Service Unavailability: Sudden Loss of connection or link unavailability to an ATM endpoint could mean a potential denial of service attack (DoS) or deliberate disconnection of the link to cause harm or service disruption. As such, monitoring of ATM link uptime is vital in ensuring that the ATM terminal delivers service to users. While link to an ATM terminal might be up and running, the ATM terminal might not be fulfilling service to users due to errors or malfunctioning that are local to the terminal, such as cash dispense error, cash jam, cash out, power outage, etc. It is therefore important that these other errors and glitches are monitored also for efficient running of all ATM terminals.
  • Unsolicited/unauthorized software installation and execution: Rules are set to monitor and detect attempted or successful installation of unauthorized software or service by privileged users. Detection of software not authorized for ATM endpoint operating system should be queried and escalated to management for action.
  • Integrity of ATM Software and Unauthorized Access: Rules are set to monitor digital signatures/certificates of ATM software components. Alteration is indicative of compromise of the software. Also, unauthorized access to ATM network through the use of nonstandard communication protocols or services (e.g. telnet or ftp) between software components is indicative of compromise, which should be flagged for further review.
  • Privileged user access: Rules to monitor every privileged access on all ATM endpoints is set up to detect configuration changes due to the likelihood of such users changing configurations or cause harm to the ATMs on the network.
  • Change in the Group Policy Object (GPO) of ATM domain network: Rules are set up to monitor and detect changes in the group policy of the ATM domain network. Of course, the audit GPO change log must first be activated in the default group policy setting of the ATM domain controller/active directory to ensure capture of these log on the SIEM solution.
  • Monitor specific configuration files of interest in the ATM network or endpoint using FIM solution: Specific files of interest can be further monitoring using FIM solution such as Tripwire or Cimtrack to detect changes to the files that could have adverse impact on the functioning of the ATM terminal and other network devices. FIM logs can always be imported/added to SIEM solution for active correlation to make sense of it.


Nwabueze Ohia
Tech Blogger and Self Publishing Author

Will appreciate your questions, comments and contributions to this post. For sponsorship, speaking opportunity and training bookings, please Contact US at  >>> http://oxleyconsults.com.ng/contact-us/ or Send us an email at info@oxleyconsults.com.ng. Remember that you need to first register and become a forum member before you can post a comment.
3
Financial technology (fintech) applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. The introduction of Online Banking application (a.k.a. internet banking application) brought about easy and convenient access to banking services and solutions that would have been done physically in the banking halls. Some of such services available/accessible via Online Banking app are self account to account funds transfer, funds transfer within same bank (intrabank transfer), funds transfer between two different banks (interbank transfer), Account Balance inquiry, Bills and utility Payment (e.g. electricity/energy bills, water bills, cable tv bills, govt tax payment, etc.), airtime and gsm subscription recharge, international funds transfer via SWIFT platform, cheque/check book requisition, ATM/debit card requisition, ATM/debit PIN issuance and reset, credit card requisition and PIN reset, hard/soft token (2nd factor authentication) request and reset, loans/facility request, appraisal and disbursement, among other services. Accessing these services via Online Banking or its mobile banking equivalent is critical to the survive of the business and rendering of 24/7 service with the convenience it provide to customers.

Would you imagine where these applications and solutions are not available/accessible and what will become of banking of today and how terrible banking service would have been? Online Banking and mobile banking applications have led to the decongestion of banking halls of today. Customers, from the comfort of their homes, offices or on the go can access banking services and do their transactions without having any interface with their banks. While this solutions provided a lot of convenience and flexibility to customers, it also presented lots of risk both to the banks and their customers, which if not check could lead to loss of funds and brand erosion. The greatest risk presented by Online Banking and Mobile Banking applications are the risk of confidentiality, integrity and availability (CIA). Because the solutions are available on the internet and mobile phones, they could easily be compromised by hackers with malicious intentions where the solutions are not hardened with appropriate security controls and defense techniques. Therefore, it is important that the solutions are reviewed/audited in line with the organization's information security policies, best practice and regulatory requirements to forestall any compromise and protect both the bank and their customers from financial losses and reputational damage.

To ensure a successful audit of Online Banking or Mobile Payment applications, the audit team must first develop an Audit Program - http://oxleyconsults.com.ng/audit/audit-programs/ebanking-payment-program/ where the objectives and scope of the audit are defined. The audit program also identifies the inherent risk associated with the application, existing controls in place to mitigate the risk and test procedures to be performed to confirm that the controls in place are able to address the risk. Where controls are inadequate, the residual risk are identified and communicated to management for action. New and emerging risk can also be identified during the audit and form part of the audit findings, which will eventually feed into the risk register of the organization to enable tracking of the risk.

Highlighted below are some of the areas of the application and IT infrastructure to be reviewed to confirm that controls are adequate or otherwise for the safe operation of the Online Banking application in addition to things to look out for in the course of auditing.

1. Application Security Review: Here, the application controls are reviewed in line with business rules set by management to drive the applications. Such business rules could be transaction limits (daily, weekly or monthly limits) for individuals and corporates, minimum authentication information (e.g. password, security questions and answers, geo tagging control, token/two factor authentication or One time password), etc. The functional requirement of the application are validated during the audit to confirm that the application is meeting the need of customers and other stakeholders. The applicable fees and deductions setup on the system are validated to ensure that customers are neither overcharged or undercharged on applicable transactions fees, which is a major revenue source for the financial institution. Given that Online Banking application does not function in isolation without integration with the core banking application of the financial institution, the interface through which the Online Banking application is integrated with core banking application most be reviewed to ensure that it complies with standard Service Oriented Architecture (SOA) web service integration best practice. The Audit team must also ensure that valid digital certificate signed by appropriate Certificate Authority (CA) are deployed on the web client interface of the Online Banking and Mobile Banking application for end-to-end encryption of transactions as well as communication/data exchange at all levels of the application.

2. Database Security Review: Here, the database controls are reviewed in line with baseline security configuration of the DMBS in use. Where Oracle, Microsoft SQL (MSSQL), Sybase, PostgreSQL, MySQL or other databases are used, applicable database security baselines - http://oxleyconsults.com.ng/audit/audit-programs/ are used to verify that the database security settings and controls are such that will ensure security of the database. The following general database controls should be looked at.

  • Users granted access to the database either locally or via the active directory (AD) are authorized and have need for such access.
  • Access must be on the need-to-do basis (i.e. least privilege principle for access) and access privileges must be based on job function.
  • Super users on the database must be identified to ensure that their access are authorized and required for their function.
  • All Service accounts on the database must be accounted for and their use must be verified to prevent unauthorized access or access creep.
  • Users must be given uniquely identifiable ids and passwords with which to access the database to ensure accountability and non-repudiation.
  • Password rules set for the database must be in line with the organization's chosen password policy (e.g. complexity requirement, length, reuse, expiration, lockout, etc.) to ensure use of strong passwords.
  • Database audit trail/log are activated and backed up externally for retention and use when needed.
  • Parameterization of the database is such that will ensure confidentiality, integrity and availability of the database.
  • Database backup are automatically scheduled in line with the recovery point object (RPO) and recovery time objective (RTO) of application data.
  • User access to the database are regularly reviewed for adequacy and relevant and exceptions escalated for management action.

3. Operating Systems (OS) Security Review: Here, the Online Banking Application Servers are reviewed for adequacy. Depending on the architecture of the application, the Online Banking app must have web servers (IIS, Apache or TomCat), Application Servers and Database Server physically and logically separated from each other for security purposes. Depending on the OS version or platform that the application is running on, applicable security baseline requirements for Windows, LINUX or UNIX (AIX/SOLARIS/HP) servers can be used to review the appropriateness of the servers.
For audit/security review checklists of various OS platforms, see below

                                 
Usually the web server is hosted in the DMZ section within the perimeter network, just behind the frontend firewall. This is to ensure easy and secured access of the client/web side of the Online Banking application by users on the internet while the application and database servers are located within the data center server farm configured within a specific/secured VLAN to protect it from being compromised by hackers. Of course, the data center server farm must be behind another firewall (a.k.a. backend firewall) and protected again with additional firewall (a.k.a. data center firewall). This layered security approach is to ensure adequate security at various levels of the network to prevent security breaches.

4. Logical Access Controls Review: Review of access of users who carry out admin and support functions on the Online Banking application and database to ensure that such access are still valid and relevant for their job functions. All disengaged staff (ex-staff) of the organization who perform admin or support functions on the Online Banking Application must be disabled/deactivated on the application to prevent unauthorized access. Also, support staff members who are on vacation/leave or re-assignment/redeployment to other functions must be disabled from the application. A procedure for access review must be put in place to ensure regular review of users' access to the application and invalid access promptly deleted to prevent unauthorized access. Also access logs or audit trails such as, login audit trail (successful/failed/attempted), logout audit trail, activity audit trail must be captured to aid in the investigation of security breaches in the application when the need arise. Also, IP addresses or hostnames from where users and other support personnel (administrators) access the application from must be captured for audit trail.

5. Password Security Review:The setting and use of password in the application must be easy and conform to the organization's adopted password policy. Password requirement such as, password length (e.g. minimum of 8 characters), alphanumeric and complexity requirement must be met, password reuse, ageing and lockout controls must be implemented as appropriate. This is to ensure that users are made to conform to the organization's password policy while selecting password to guarantee strong passwords.

6. Data Integrity:The development, test and live environments of the Online Banking application must be physically and logically separated (installed using different IP addresses) to prevent compromise and ensure segregation of duties among the operations, support and database teams. Application support function must be separated from database admin function on the application while user access management function must not be left with the operators to manage. Also, live data must not be used as test data in the test environment without obfuscation to prevent data leaks in the test environment since test environment are known to be open to vendors and third party employees and security is not always emphasized on the test area. Confidential customer information such as debit or credit card PAN and other critical data must be encrypted in the database when stored and while in transit in line with PCIDSS requirement.

7. Redundancy: The architecture adopted for Online Banking or electronic payment application being audited should be such that will ensure high availability for the application. Due to high volume of transactions witnessed on Online Banking application, the architecture should ensure high processing capacity by building redundancy into the application. To be able to handle high volume of requests/transactions from online users, the web server should be load balanced among say 3 to 4 servers (all virtual servers). Load balancing is where each of the servers are connected in a Mesh topology for even distribution of traffic or load on the application in a manner that unavailability of any of the servers will not bring about downtime of the application and will not be noticed by the application users. Same goes for the application server, which should be load balanced among say 3 to 4 servers (all virtual) connected in mesh topology. The live database can running on 2 servers that are in active-active replication (i.e. both servers are in sync with each other and update themselves in real-time such that at any given point in time, they are holding exactly the same level of data).

8. Business Continuity Management: Given the importance of the Online Banking and mobile banking application to the financial institution in delivering financial service to customers, the application must be part of the institution's business continuity plan. As such, the application must be recoverable in the institution's disaster recovery (DR) hot site. Hence, the application's infrastructure (servers) must be available at the DR site and an active replication established between the main processing facility and the DR site. The application should also be scheduled for testing as part of the institution's disaster recoverability testing plan where critical services, solutions and applications identified during the business impact analysis (BIA) assessment of the institution are periodically tested to ensure their recoverability in the event of disaster or service disruption. Evidence of such recoverability test must be requested and reviewed by the audit team for their adequacy. Lessons drawn from such test must be captured, internalized and used as a basis to improve on future tests while reports are sent to management accordingly. A disaster recovery procedure/plan should be developed for the Online Banking application and circulated among stakeholders for use during emergency.


Nwabueze Ohia
Tech Blogger and Self Publishing Author

Will appreciate your questions, comments and contributions to this post. For sponsorship, speaking opportunity and training bookings, please Contact US at  >>> http://oxleyconsults.com.ng/contact-us/ or Send us an email at info@oxleyconsults.com.ng. Remember that you need to first register and become a forum member before you can post a comment.
4
Investing in Information Technology is pivotal to the success of the business and realization of enterprise goals/objectives. To create value for the business using information technology, stakeholders most set clear and realizable goals and put in place necessary mechanism to track the realization of those goals. Stakeholders in thIS case could mean owners, investors/partners, employees, top management, customers as applicable.

The question; "How do I get value from the use of IT?" can also be replaced with "Are end users satisfied with the quality of the IT Service?" The two questions can neither be asked nor answered in isolation given that they are interdependent. Information Technology (IT) can only be said to be delivering value if and when end users are satisfied with the quality of Service(s) being rendered or enabled using IT. Therefore, we will look at these two questions as one and answer them as such.

Answering these two governance and management questions takes us back to COBIT 5 Goals Cascade (see figure 1 below), which links Enterprise Goals with Stakeholders Needs being driven by environmental changes (e.g. regulation, government policies, etc.), technology evolution (i.e. changes in technology), financial gains (i.e. quest for high profit), which are part of Stakeholder Drivers in the goals cascade diagram. Stakeholders needs in the context of COBIT 5 are Business Benefit Realization, Risk Optimization and Resource Optimization.

Now, to create value with or from the use of Information Technology (IT), the following enterprise goals should be in scope and be seen to be realized or being achieved.

1. Stakeholder value of business investment: This speaks to stakeholders needs as earlier enumerated. Different stakeholders have their various definitions of value for the business. Hence, to ensure that IT is delivering the right value for the business, the actual meaning of "value" for every stakeholder most be identified and documented. Different stakeholders in the context of COBIT 5 can be business owners, investors/partners, top management, employees, major suppliers, customers, etc. Value will mean different thing to the various stakeholders. For example, for the owners, it could mean higher returns on investment (in terms of high profit), for investors/partners, it could mean higher market share, for employees, could mean career growth, rewarding employment/higher pay, better working conditions, while value could mean better and efficient service to customers/end users. When these values as perceived by different stakeholders have been identified by the Governance and Management Bodies, then clear strategy on how to effective apply or use information technology to create those values and track their realization can be drawn up and implemented. Remember that it will be difficult to create or deliver value to the business when what value means to the business or stakeholders are not known and clearly understood. As such, could lead to wrong misapplication of technology and wastage of scarce resource. Therefore, for IT to be seen to be delivering value to the business, the value stakeholders attach to their investment in the business most be created and realized with the use of IT. For customers/end users who are also stakeholders in the value chain, quality and efficient service most be delivered to them aided by the deployment of IT for business service. They will be satisfied with how technology has been used to improve their lives and convenient access to service, which answers the second question ("Are end users satisfied with the quality of the IT Service"). The definition of value for customers/end users is convenience and quality of service and when/if deployment of technology has aided the realization of that value, then it will be said that value is being created with information Technology.


2. Portfolio of competitive products and services: This speaks more to the financial perspective of enterprise goals, which is about financial benefit realization via management of product and service portfolios. To create value for stakeholders, information technology (IT) should be use to create competitive products and services that will improve business efficiency and bottom-line. Mix of these products and services are managed in a manner that will create value and returns on investment for stakeholders.


3. Customer-oriented service culture: This speaks to customers' perspective of the enterprise goals as well as the alternate question on this subject, which is "Are end users satisfied with the quality of the IT service?". To ensure that IT create value for the business, the organization must set principle (core values and culture) and policies that will drive its service objectives. There must be a deliberate service culture/value that is customer-oriented, which considering the customer first and ensure that customers are in the center of every product and service innovation within the organization. As such, technology driven products and services provides convenience, simplicity, scale and satisfaction for the customers. Only then can it be said that IT is creating or delivering the right value to the business and meeting stakeholders needs.


4. Business service continuity and availability: The purpose of every business is to make its services/solutions available and accessible to its customers/clients and in turn meet the interest/goals of its stakeholders. To do so, service channels must be available and business continuity must be ensured in order to realize enterprise goals as well as stakeholders' needs. As such, the business must put in place service continuity and availability measures, which includes plans, policies, procedures and resources (people and technology) to realize these objectives. Business continuity and disaster recovery must be planned, tested, operated and reviewed to ensure its effectiveness. Contingency plans for all forms of business and service disruptions must also be established, operated and reviewed for adequacy. Only then can enterprise goals be achieve and stakeholder needs met as services and products running on technology platforms will be available and continuity of the business will be ensured.


5. Managed business change programmes: Managing business changes is in the center of survival of any enterprise. Given the ever changing and dynamic business environment brought about by change in regulation, economic and government policies, technology evolution, competition, innovation and customers growing needs, business changes and adjustments to meet these demands remain paramount to every business. As such, technology, services and processes are constantly changed and re-engineered to meet the needs of the business and stakeholders (owners, customers, employees, etc.). To ensure that technology meets these growing and ever dynamic needs and requirements of stakeholders, business changes must be managed in a manner that will ensure business continuity, minimal disruptions and mitigation/optimization of business risks arising from such changes for the realization of enterprise goals. Changes to process, service and technology must be scoped, assessed, tested, operated, maintained and ended such that will ensure business continuity and realization of value for stakeholders.


6. Skilled and motivated people: This is one of the critical factors to the survival of every business. Human resource management is critical resource to the realization of enterprise goals and delivery of value to stakeholders. The business (both governance and management) must ensure that the right persons are engaged to engineer the process, service and technology. It is to also ensure that the people (employees) are motivated and adequately compensated to drive the objectives of the business. Principles and core values most be established to guide and mold behavior of every employee and high ethical standard/value must be established, communicated and enforced. Policies should also be put in place and communicated to all and exemplary leadership must be ensured by top management and the governance body for the enforcement of the principle and values. Incentives and rewards for performance should be established to motivate and ensure willful compliance to core values and policies while consequence management measures are put in place as deterrent.


7. Product and business innovation culture: Continue improvement and innovation culture within the enterprise will drive the use technology for business service. Technology evolution and change customer taste and quest for new ways of service couple with pressure from competition drive innovation within an enterprise. As such the organization must institute a product and business innovation culture within the business and technology teams for relevance, competitive advantage and market penetration. Value is create for stakeholders via innovative changes to existing products and addition of new products and services that will increase market share, customer satisfaction, penetration and benefit realization.

5
I will be writing a series on how to map Governance and Management Questions to COBIT 5 Enterprise Goals. The series will attempt to answer most of the governance and management questions/concerns relating to the governance of enterprise IT. There are over twenty generic governance and management questions in COBIT 5 framework, which speak to stakeholder needs/expectations and effort will be made to answer them using COBIT 5 enterprise goals. COBIT 5 goals cascade (figure 1 below) demonstrates how Enabler Goals (a.k.a. Process Goals or Business Pain Points) links to IT related Goals and how IT related Goals links to Enterprise Goals, which then links to Stakeholder Needs and eventually Stakeholder Drivers.

Stakeholders in COBIT 5 framework are business owner, investor/business partner, employees, customers, major suppliers as applicable.

Follow the series on #COBIT5GovernanceQuestionsSeries Hashtag and please do not hesitate to ask questions or share expert knowledge that will improve the discus for the benefit of ALL.

Cheers

COBIT 5 Governance & Management Question #1 (How do I Get Value from Use of Information Technology) >>>> https://blog.oxleyconsults.com.ng/index.php/topic,276.0.html
6
Audit management software are used to automate the process of auditing. Most standardized audit management software like Morgan Kai Internal audit management software (www.mkinsight.com) or Wolters Kluwer, Teammate Audit Solutions (www.teammatesolutions.com) come handy with good audit process automation. First, the Auditors  need to define the audit universe for the audit. In the context of internal audit, the audit universe is basically the coverage and the mandate of the internal audit department as defined in its audit charter. Management and regulatory authorities would have authorized/empowered the internal audit department to cover all or certain areas of the organization's business, operations, processes and systems as part of its mandate to provide reasonable assurance on the effectiveness of controls implemented by the management to achieve business objectives. Hence the internal audit team defined its audit universe in the audit management software along the lines of its mandate from Executive management and regulatory compliance perspectives. For example, 2018 Financial Year (FY) Internal Audit Plan could be defined as the audit universe.

Secondly, the Audit Department defines the audit units or components, for example Strategic Business Audit, Subsidiary Audit, Branch/Regional Business Audit, Information Systems Audit, Retail Services Audit, etc., can be defined as the audit units under the audit universe as applicable.

Thirdly, the Auditors should defined the audit type, which can either be routine, adhoc, spot check, follow up, or special (investigation) audit. The audit type will determine the approach, resources, template and report formats that can be deployed to fulfil the audit.

Lastly, the audit area will need to be defined. Audit area for example can be Accounts and Financial control (FINCON) audit, Strategic Risk management audit, Treasury products and operations audit, Credit analysis and administration audit, Brand Assurance and Corporate communications audit, Foreign operations audit, physical security audit, Data center audit, IT Power and Infrastructure audit, Core Business Applications Audit, IT Operations and Infrastructure audit, Business Continuity Management and Disaster Recovery Assurance audit, Business Units among others.

After the above steps has been defined in the software (note: a robust audit management software should come with most of these features inbuilt), the Audit team will have to design its Audit Work Programs (AWP) - (please refer to link >>> http://oxleyconsults.com.ng/audit/audit-programs/ or http://oxleyconsults.com.ng/source/subscription.html for details on audit programs), which should capture the identified risk(http://oxleyconsults.com.ng/risk_assessment/ in the area being audited, controls to mitigate the identified risks, audit test procedures or Test of controls (TOC) that will be carried out to confirm that the controls implemented are working as expected or otherwise, the severity of the risk (Critical/very high, high, medium or low). The AWP can be uploaded into the audit software in the form of a template predefined in a format that the audit team can conform with. After the AWP has been uploaded in the audit management software under a defined audit area, then the audit can be approved for commencement by the audit management. Once the audit work program has been approved. It becomes an active/scheduled audit in the audit management software based on the effective date of commencement of the audit assignment. The AWP is the working document for the audit team during the audit assignment. The audit team populates the AWP with their findings and root causes of the noted exceptions based on their observation of the issues in the field. Appropriate corrective actions or recommendations are also provided based on observations. Thereafter the audit client (i.e. auditee) then provided their responses to the issues raised during the audit as well as the root cause and remedial actions. These responses can be fed into the audit management software if properly implemented or integrated with the organization's active directory and email systems, which gives room for the audit clients to give their response directly into the audit software. Where the provided responses are adequate and provide accurate account of the issues as observed/captured by the audit team, the audit team can then conclude the audit and submit same for review and adjustment by the audit management.

A robust audit management software also provide guide on the rating of the audit clients. There are several models or methodologies that can be adopted in determining the audit rating of an audit client. Some school of thought or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical severity, 4% for high severity, 3 for medium severity, 2 for low severity, 1 for very low severity and 0 for effective control). The applicable scores for each exception or nonconformity are deducted from a maximum score of 100 while the remain score after all deduction forms the final audit rating, which is usually banded for example, above 70% is low risk (Good rating), 30 to 60% is medium risk (opportunity for improvement or average rating) and below 30% is high risk (poor rating).
The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the audit rating of audit clients/auditee. Where the control(s) implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are Very high risk/very poor rating (0 -20%), high risk/poor rating (20-30%), medium risk/average rating (30-50%), low risk/good rating (50-70%), very low risk/very good rating (70-90%), no risk/outstanding (90-100%). The cumulative weighted score of each of the risk areas forms the audit rating for the client.

A good audit management software comes with pre-formatted reports and the report format will depend on what has been agreed and adopted by the Audit department with the software vendor at the point of implementation. Some of the reports comes with cover memo, executive/issue summary, main/detailed report (issues/findings, recommendations, root causes, closure timelines, etc.), rating sheet, consequence management report and audit work papers (i.e. AWP and appendices of audit evidences).

It is important to note that the audit template or what I call the AWP, which has been uploaded into the audit management software and used for the real audit field work can be in different states in the audit management software.
State I: In-Development (Offline)
State II: Under-review
State III: Active (Live)

Depending on the state, any member of the audit team assigned to carried out a given audit (audit area) can work on each of the AWPs or audit checklists at any time. All they need to do is to first checkout the audit work program or checklist (i.e. checking out active AWP into In-development state). While In-development state, the audit team can work on different versions of the AWP or audit checklist for a given audit area. After working on the AWP or checklist while In-Development state, the Auditor can check-in the program to become Active or Live in the software, which become the final version at any given time except updated. As such, the audit team members have the opportunity to do back-and-forth (i.e. amend/change) on their AWP or audit checklists till they agree on the final version that will be relevant for the job. Once they have agreed, the team lead can change the state of the final version by checking it in to become "Active" or send same to his/her superior for approval (i.e. "Under-review" state). Once reviewed and approved, it is then checked-in  as the final version (i.e. "Active" state).

When the audit work is completed, the final report is then generated via the audit management software for management review and Chief Audit Executive's (CAE) final approval and issue. The management review can either be done in software or offline depending on the choice of the CAE. Once the audit report has been issue to the organization's management or Board Audit Committee, the follow up process is kick-started. The team designated for this purpose is drive the process and ensure that the timeline specified by the Audit Client for closure of the audit exceptions/non-conformities are adhered to and closed with a status report sent to the follow up team for documented and management review.

This is pretty much what happens with audit management software and how an audit team or auditors can use audit management software to conduct an audit.

Contact US here >>>http://oxleyconsults.com.ng/contact-us/ for more details or Send us an email at info@oxleyconsults.com.ng. You can also drop your comments, opinions or objections by replying to this post. Remember, you have to first register to become a user.
Pages: [1]