CCWIS IVV Attachment C - IT Audit Template.docx

This document is being provided as a guide to aid offeror’s understanding of this portion of the scope. This document is only a sample and is subject to change at any time.

TABLE OF CONTENTS

STATE OF ILLINOIS

ATTACHMENT C – IT AUDIT PRE-IMPLEMENTATION TEMPLATE

Illinois Department of Children and Family Services Enhanced Independent Verification & Validation Services for CCWIS Project DCFS PO19-165 – BidBuy Bid #s B-24914 & B-24915

INTRODUCTION/BACKGROUND

The Division/Office of Internal Audit (D/OIA) will conduct a pre-implementation review of [insert project name]. This review was selected by the D/OIA for review because it meets the definition of a major system development. This review will be conducted as part of the Internal Audit's Fiscal Year 20[xx] audit plan.

[Instructions for completing this section. You must delete these instructions before generating the audit program/report.]

List a brief description of the area reviewed which identifies the agency, organizational units and activities reviewed and any other relevant explanatory statistical or financial information, which would provide the reader with at least a basic understanding of the area and the process audited. Summarize the system narrative or flowchart of the process/program.

State the date of the last internal/external review. Describe the previous internal/external review findings or affirmatively state none were previously cited. Note their current status of resolution or implementation of previous recommendations.

SCOPE AND OBJECTIVES

[Keep one of the following two paragraphs.]

This review will be conducted as part of the Internal Audit’s two-year audit plan required by the Fiscal Control and Internal Auditing Act (30 ILCS 10/2003) and in accordance with the International Standards for the Professional Practice of Internal Auditing promulgated by the Institute of Internal Auditors. FCIAA also requires “reviews of the design of major new electronic data processing systems and major modifications of those systems before their installation to ensure the systems provide for adequate audit trails and accountability." Thus this review was also conducted in accordance with the Control Objectives and Audit Guidelines for Information and Related Technology (COBIT), which was developed as generally applicable and accepted standards for Information Technology (IT) Control.

[or]

This review was conducted at the request of ____________________and will be completed in accordance with the International Standards for the Professional Practice of Internal Auditing promulgated by the Institute of Internal Auditors. Special review requests were included as part of the Internal Audit’s two-year plan, which is required by the Fiscal Control and Internal Auditing Act (30 ILCS 10/2003). FCIAA also requires “reviews of the design of major new electronic data processing systems and major modifications of those systems before their installation to ensure the systems provide for adequate audit trails and accountability." Thus this review was also conducted in accordance with the Control Objectives and Audit Guidelines for Information and Related Technology (COBIT), which was developed as generally applicable and accepted standards for Information Technology (IT) Control.

[Keep the following paragraphs. Only update fields surrounded by [ ] before generating the review program/report.]

The review includes tests and procedures considered necessary for the purpose of determining with reasonable, but not absolute, assurance whether the agency established proper controls and complied with applicable laws, rules, regulations, grant or contractual agreement and policy.

The scope of this review is to conduct a systems development review of the [Project Name] to determine if this system is being appropriately implemented. The review includes procedures and tests considered necessary for the purpose of determining with reasonable, but not absolute, assurance whether the system will function as intended and that controls are in place to ensure that the system includes; adequate audit trails and accountability, data confidentiality, and system integrity. The review period began on [insert month, date, and year] and is planned to be completed on [insert month, date, and year].

Specifically, the review objectives were to:

REVIEW TESTS

A: Planning and Organization

B: Acquisition and Implementation

Inputs can include: validity of data formats (i.e. dates, zip codes, etc.), completeness checks, (i.e. required fields), and range checks (i.e. birthdates must occur in the past etc.)

Outputs can include: Batch job completeness (i.e. balancing reports are available to employees), date/time checks (i.e. making sure dates are current on reports etc.) (Objective 2)

Step B.14 If applicable for the development, determine if a parallel run was used prior to the actual switchover to a new system. Verify that run-to-run totals were produced during the parallel runs and that any discrepancies were investigated. (Objective 2)

C: Delivery and Support

1. there is proper version control,

2. access to migration tool is limited, and

3. documentation of customizations is maintained. (Objective 2)

Step C.6 Interview project staff and determine the plan in place to detect unauthorized access to Production program libraries is adequate, by completing the following steps:

1. Identify what is needed to gain access to Production program libraries. (Who has access to the Production libraries)

2. Identify what security monitoring exists on production program libraries. (Objective 2)

D: Monitoring