IS Control Objectives

This topic is related to information systems auditing. Every organization has controls in place. Controls are normally composed of policies, procedures, practices and organizational structures that are implemented to reduce risks to the organization. The board of directors and seniors management are responsible for establishing the appropriate culture to facilitate effective and efficient internal control system. There are two aspects of controls: What should be achieved and what should be avoided. Internal controls address business and operational objectives. 

Control objectives are statements of the desired result or purpose to be achieved by implementing the control activities which are in the form of processes and procedures. Control objectives apply to all controls whether they are manual, automated or combination. Control objectives need to be addressed relevant to specific IS-related processes. A control measure is defined as an activity contributing to the fulfilment of a control objective. In other words, a control measure is an action aimed to eliminate a hazard or at least reduce the risk of exposure to an acceptable level as defined in the control objective.

IS control objectives provide complete set of high-level requirements to be considered by the management for effective control of each IT process area.

IS control objectives include:

• Safeguarding assets
• Ensuring that SDLC (Software Development Life Cycle) processes are established, in place and operating effectively.
• Ensuring integrity of general OS environments including network management and operations.
• Ensuring integrity of sensitive and critical application systems by authorization of the input, validating the input, accuracy and completeness of processing transactions and reliability of overall information processing activities
• Ensuring appropriate identification and authentication of users of IS resources.
• Ensuring efficiency and effectiveness of operations.
• Complying with user's requirements, organizational policies and procedures, and applicable laws and regulations.
• Ensuring availability of IT services by developing efficient business continuity plan (BCP) and disaster recovery plan (DRP) that include backup and recovery processes.
• Enhancing protection of data and systems by developing an incident response plan.
• Ensuring integrity and reliability of systems by implementing effective change management procedures.
• Ensuring that outsourced IS processes and services have clearly defined service level agreements and contract terms and conditions to ensure the organization's assets are properly protected and meet business goals and objectives

An IS Auditor also assesses the strengths and weaknesses of the controls evaluated and determines if they are effective in meeting the control objectives. Established as part of audit planning processes. In some instances, a strong control may compensate for a weak control in another area. Generally, a group of controls when aggregated together may act as a compensating controls, and thereby minimize the risk. An IS auditor should always review for compensating controls prior to reporting of control weakness.