Category list

Employee Training

< Day Day Up >

Employee Training

Employee training procedures begin with the orientation of new employees and continue to help them meet the changing skills required by their jobs. IT employees are generally required to have specialized skills that quickly become obsolete, and for this reason they move on to other jobs that may provide the opportunity to acquire new skills. The scope of training is vast and covers an employee as he reports for his first day at work and continues throughout his professional career.

Records of employee training are begun during the initial orientation, and document education, skills, and experience before the employee enters the company. Documentation of all education and training should be kept and archived after the employee's departure from the organization. With this as a basis, future education and training benefiting the employee should be assessed and used, if necessary, to justify the individual's training program from in-house or outside resources.

Mentor Assignment

Sometimes a "personal touch" is a prudent step in employee development. An employee is assigned to a mentor to develop professional skills. The mentor should be positive, personable, someone who can make the employee comfortable about asking questions, and someone very knowledgeable in his area of expertise.

< Day Day Up >

Conclusion

The details of this chapter should make it very clear that policies, procedures, and standards play a critical role in determining legal and regulatory requirements, employee conduct, and system survivability . They must be carefully crafted to reflect the organization's strategic thinking. It is crucial that policies, procedures, and standards be formalized in all organizations regardless of their size and nationality . Not all policies and procedures apply to all employees, but it is imperative they be accessible and searchable by appropriate employees . Having them will save the organization's bacon when the need arises.

< Day Day Up >

Chapter 3: Auditing

Auditing for the Masses

In summary terms, risk management identifies, prioritizes, and safeguards critical assets, while policies, procedures, and standards address employee conduct. Auditing is the process of assessing whether employees and business operations are in compliance with the organization's policies and procedures as well as applicable laws and regulations. Auditing is the investigation and measurement of employee behavior and business operations based on collected evidence. Counted together, risk management, policies and procedures, and auditing form the first three integrated steps in proactively addressing critical incident management.

Auditing is the compliance extension of your risk management program where operations, policies, and procedures are examined to determine whether operations are lawful, effective, efficient, and profitable. Auditing will determine that the organization's critical assets are accounted for, prioritized with adequate safeguards, and whether recovery and restoration procedures are implemented and tested . Fundamentally, auditing is also a comparison and analytical process comprised of collecting and evaluating evidence regarding management assertions and the actual state of the organization's operations. In fact, the most-critical part of auditing is the degree of separation between an organization's assertions and established system-addressed risk criteria. Any differences between assertions and the actual-state falls into a category called the "gap."

Experience Note

Easy-to-digest definitions remove the mystery from the auditing process and permit stakeholders to understand it.

Information technology auditing is a carefully planned and executed business process involving the collection and evaluation of evidence to ascertain if a computer system safeguards critical assets and facilitates organizational goals being achieved.

Auditor Responsibilities

In the sense of their function, auditors must not have any direct responsibility or authority over any of the activities that they examine or could examine in the future. Operational assessments and employee performance appraisals do not, in any way, relieve employees of their professional responsibilities. Auditors must be authorized to have full and unrestricted access to relevant equipment and information including computer files, documents, records, property and employees. They must have a high degree of freedom in all audit-applicable business areas with the exception of specific restrictions imposed by law.

Internal Controls

Managing critical assets, their safeguards, controlling potential frauds and improving effectiveness and efficiency can best be achieved if senior managers establish a structure of internal controls. There really is not a great deal of universal details in this area as all organizations are different in their mission and function. Let's define internal controls here in the context of formal systems that prevent, detect, and correct policy violations, unlawful and abusive events. These are the three most important levels of general controls: prevention, detection, and correction.

General Controls

General controls are those internal controls having wide application to most areas of business operations. For the most part, they include but are not limited to specific system applications:

Planning and organization controls
Physical and logical access controls
Human resources
Risk management
Communications controls
System development controls

Specific Controls

In broad terms these are controls with application to specific applications:

Access controls
Data input controls (these include all system data inputs)
Processing controls
Output controls

The overarching governing structure for specific and general controls is that of CIA, confidentiality, integrity, and availability. In current auditing views, there are many components where internal controls apply for example, separation of duties and least privilege, clear lines of authority and responsibility, adequate documentation, access control, management supervision, individual accountability, performance checks, and audit trails to name a few.

Separation of Duties and Least Privilege

Separation of duties basically means that separate employees should be responsible for initiating transactions, processing transactions, recording those transactions, and maintaining custody of critical assets. Least privilege means that employees have the knowledge and authority to perform their jobs and nothing more. For example, in a small organization an accounts payable clerk has the responsibility of preparing billing payments. She reviews the billing for its correctness and prepares wire transfer documents. By observing the concepts of separation of duties and least privilege, she does not have the authority or the ability to release funds. So, she prepares a voucher with the attached billing documentation and submits these materials to the finance vice-president who authorizes the transfer of funds. In the event the payment amounts are over $10,000, the organization's policies and procedures mandate that two vice- presidents approve the electronic wire transfer. Once the payment is approved, the transaction information flows to another employee that is responsible for posting the transaction to the organization's financial records.

Authority and Responsibility

Clear and well-defined lines of authority and responsibility are essential in controlling systems. In today's business environment, the distinctions between authority and responsibility may not be clear. It is frequently difficult as many resources are shared among many users. For example, database use is common among many users in a business organization. When several authorized users have simultaneous access and, through some unknown means, the data becomes corrupted, it is not always easy to fix responsibility.

Documentation

Documents and records are essential in providing an audit trail of activities within any system. Electronic and paper-based documents are used to support the initiation, execution, payment, and recording of transactions. Documentation is intended to provide an accurate record of events and acts. Documents should provide a tangible record in which events can be reconstructed from their content. In a well-designed system, audit trails document the actions and events occurring during business operations as well as those documents required to administratively run the business.

Experience Note

"If it's not written, it doesn't exist."

Performance Checks and Accountability

Checks of performance and accountability are done by auditors because employees are likely to forget policies and procedures, make genuine mistakes, become careless and negligent, or intentionally fail to follow procedures. Individual employee accountability is tied to performance and competence as well as continuing responsibility.

< Day Day Up >