Audit Service Provider Briefing Portside Conference Centre 19 - - PDF document
19/02/2019 Audit Service Provider Briefing Portside Conference Centre 19 February 2019 Agenda Item Time Welcome 9:30am Address by the Deputy Auditor-General Lessons learnt and Government reporting and compliance developments Morning tea
19/02/2019 1
Item Time Welcome 9:30am Address by the Deputy Auditor-General Lessons learnt and Government reporting and compliance developments Morning tea 10:30am Audit oversight – key changes Key contract requirements Data analytics and innovation Information Security and data breaches Other business Close workshop / Lunch 12:30pm
19/02/2019 2
Item Time
audits 1:30pm Close workshop 3:00pm
19/02/2019 3
Our activity is driven by our Corporate Plan, which includes six strategic initiatives:
together
innovation
19/02/2019 4
This initiative is focused on defining what our work will look like into the future, what capabilities we require and the culture and conditions we need to create.
19/02/2019 5
19/02/2019 6
19/02/2019 7
Using experts
methodology
adopted, how use of relevant observable inputs is maximised Intervening years
values reflect fair value. Communication
19/02/2019 8
Systemic findings across both inhouse and ASP audit files:
to respond by:
assessed risk
Systemic findings across both inhouse and ASP audit files:
including the business processes, relevant to the financial reporting, including:
19/02/2019 9
Systemic findings across both inhouse and ASP audit files:
rationale for its exclusion
privileged user access
19/02/2019 10
31 May
Audit Office provides observations and feedback on early close procedures to the agency
23 April
Agency provides results to the Audit Office and Treasury
31 March
Agency performs all early close procedures in Appendix B
23 April
Agency provides final valuation report with management’s review report.
January
Agency provides listing & position paper on assets not recorded in financial statements.
Agency mandatory deliverables to the Audit Office
19/02/2019 11
Government Sector Audit Act 1983 (GSA Act) Government Sector Finance Act 2018 (GSF Act)
governance and performance
delegations, financial arrangements and performance information
proposed to commence progressively from the 2019/20 financial year (inclusive)
19/02/2019 12
relevant to resource allocation to facilitate better informed budget and State financial management decisions
information agencies are required to keep. This reform supports outcome budgeting
delegated) than is permitted under the existing framework Further information on the reforms is available on NSW Treasury’s website: https://www.treasury.nsw.gov.au/budget-financial-management/reform/government- sector-finance-act-2018-0
19/02/2019 13
10:30 – 11:00am
19/02/2019 14
19/02/2019 15
Audit planning Deliverables
Audit execution Deliverables
Drafted:
Audit completion Deliverables
Drafted:
Audit planning Deliverables
Audit execution Deliverables
Drafted:
Audit completion Deliverables
Drafted:
19/02/2019 16
19/02/2019 17
19/02/2019 18
AASB 9 ‘Financial Instruments’ AASB 15 ‘Revenue from Contracts with Customers’ (for-profit agencies) AASB 16 ‘Leases’ AASB 1058 ‘Income of Not-for-Profit Entities’ AASB 15 ‘Revenue from Contracts with Customers’ (not-for-profit agencies)
30 JUNE 2019 30 JUNE 2020 30 JUNE 2018
KEY DATES
19/02/2019 19
19/02/2019 20
What do we want to achieve from these arrangements?
Audit Office’s vision
the public expect from an Auditor-General
Office’s Corporate Plan, strategic initiatives and operating principles
ASP agreement
ASPs to attend key meetings (clauses 10.3 and 10.4) Compliance with ASP manual (clause 7.2(f) ASP representation letter (clause 10.8(a) Access to quality monitoring records (clause 11.8) WHS
(clause 14.4) Contribute AG report content clause (10.8(d)
19/02/2019 21
appointed auditor
the principles set out in the Audit Office’s:
independence requirements including APES 110 ‘Code of Ethics for Professional Accountants’
provide any other service
Hospitality policy.
with-us/audit-service- providers/resources-for-audit-service- providers
non-audit related services
threats in the context of APES 110
19/02/2019 22
number
travel costs
accounts.payable@audit.nsw.gov.au
ASPs
7.15)
compensation cover (clause 14.3)
interest or the risk of a conflict of interest arise
the subject of disciplinary action
performance framework
previous ‘Form D’ before 30 June 2019
include:
reporting to the Audit Office
relationships
Performance framework
ASP annual workshop (Feb) Mid-year performance check-in (May-June) Mid-year ASP Workshop (if required) (May-June) Formal performance review – post audit (Oct-Dec) Quality monitoring program (Dec-Feb)
19/02/2019 23
end of the 30 June 2019 and 31 December 2019 audit cycles
coming months to determine whether the audits remain contracted out or come in-house. We will also look at the audits we currently do in-house.
19/02/2019 24
19/02/2019 25
19/02/2019 26
Internal More efficient
free up capacity
challenge last year’s approach
high risk areas
More effective
assurance
to controls based
External Better experience
plan the audit
and realise their potential
More insights
to focus on
increase their impact
Process Output Innovation capability
Innovation capability to foster and realise new ideas Collaboration culture to unleash the capability of
Data and technology to enable insight driven audits Planning and approach to focus and rebalance
Defining the foundations
0 – 18 months
Changing the way we work
18 – 36 months
Building the future
36 + months
19/02/2019 27
Investment focus People and capability Process Data and technology Quality and risk appetite
19/02/2019 28
Continuous Financial Statement auditing Automation of testing Big Data Data Visualisation Curate and standardise data collection and basic analysis (risk assessment)
Standardisation and centralisation of collection and curation + embedding basic data analytics Data rich visualisations in reports + visualisation to support audit planning risk assessment Leveraging open source and operational data sets
Automating substantive and control procedures Conducting continuous audit procedures over automated flow of data
19/02/2019 29
Unstructured Data Data Visualisation Dedicated data team involved in all scoping
Data rich visualisations in reports + opportunities for readers to engage in underlying report data Involvement of Data & Analytics Team to identify and capitalise on data
Use of unstructured data mining to harvest all relevant agency data + improved environmental scanning
19/02/2019 30
ISMS Policy Refresh
Information Security Policy Third Party Security Policy Security Incident Handling Policy
Data Breach Protection
Infrastructure Managed Service Data Breach Management Policy AI supported recipient verification
Third Party Assessments
Software as a Service (SaaS) risk assessments Self‐Service Security Assessments
19/02/2019 31
Data breach discovered or suspected Contain the Breach Notify the Deputy Auditor‐General Response coordinator identified Evaluate associated risks Consider notifying affected individuals/organisations Prevent a repeat
ASPs should consider seeking independent legal advice on their liability under the Privacy Act 1988 (Cth). ASPs must also be aware of their responsibility to comply with the secrecy provisions in section 38 of the Public Finance and Audit Act 1983. ASPs, on discovery of a breach related to data collected on behalf of the Audit Office must immediately contact governance@audit.nsw.gov.au.
19/02/2019 32
The following principles are recognised as fundamental to ensuring relationships with third parties support the Audit Office requirements for the security of its data:
Audit Office
Party Security Policy and our Information Security Management System (ISMS)
19/02/2019 33
19/02/2019 34
Local Government Session commences: 1:30pm
19/02/2019 35
Principles
The fundamentals of our approach to audits should be consistent across the sector:
This will drive the quality of our audits and the value of our insights. A single workstream feeding two products – audit opinions and the AG’s report.
Area Control areas for Councils – FY19
Governance Policy framework & currency of policies Management and reporting to business of IT Risks and Incidents Access to Programs & Data Starters/Transfers/Leavers User Access Reviews Managing & monitoring privileged user activity Unique user IDs Passwords Program Change Approval of changes Testing of changes Segregation of Duties between promoting change to PROD and developing/initiating change Computer Operation Disaster Recovery Planning
Nature of work
Design effectiveness assessed per ASA 315? Operating effectiveness assessed?
Potentially Potentially Potentially Potentially Potentially Potentially Potentially Potentially Potentially Potentially Potentially
Rationale
As per ASA 315: “In understanding the entity’s control activities, the auditor shall obtain an understanding of how the entity has responded to risks arising from IT”. Given the pervasive nature of IT and its importance to the financial reporting process, all entities should therefore have these IT control activities (or similar) in place and they are relevant to the audit (regardless of approach). As such, a design effectiveness assessment should be performed over these controls “by performing procedures in addition to enquiry of the entity’s personnel”, as per ASA 315, for all audit relevant systems.
Key points
Government team
19/02/2019 36
Area Control areas for Councils – FY19
Governance Policy framework & currency of policies Management and reporting to business of IT Risks and Incidents Access to Programs & Data Starters/Transfers/Leavers User Access Reviews Managing & monitoring privileged user activity Unique user IDs Passwords Program Change Approval of changes Testing of changes Segregation of Duties between promoting change to PROD and developing/initiating change Computer Operation Disaster Recovery Planning
Example of Issue
No formal IT Security policy The Council does not have a formal IT Security policy. An IT Security policy sets out the Council’s security requirements for digital information. The policy and supporting procedure documents provide guidelines for both standard user and privileged access management. Inadequate reporting of IT risks & incidents to management The Council has no formal process in place to ensure that known and emerging IT risks and issues are regularly communicated to senior management (i.e. outside of the IT department). For example, our audit found that the operating system hosting the general ledger has passed end-of-life support. The associated risks this brings were not communicated to management and those charged with governance.
Area Control areas for Councils – FY19
Governance Policy framework & currency of policies Management and reporting to business of IT Risks and Incidents Access to Programs & Data Starters/Transfers/Leavers User Access Reviews Managing & monitoring privileged user activity Unique user IDs Passwords Program Change Approval of changes Testing of changes Segregation of Duties between promoting change to PROD and developing/initiating change Computer Operation Disaster Recovery Planning
Example of Issue
User access provisioning process needs to be enhanced Our audit identified that [insert number] users were granted access to council systems where no evidence of appropriate prior approval could be provided. Untimely access removal The Council has no formal controls in place to ensure that user account privileges for financially relevant systems are removed when no longer required. Periodic user access review process needs to be formalised. User access review is a key management control ensuring currency (accounts belong to staff currently employed) and appropriateness of user access on the business
financially relevant systems. Privileged user key activities should be recorded and reviewed Our review of IT access controls identified that while audit logs of privileged IT access activities within the system are maintained and secured from amendment, they are not reviewed. Unsupervised use of generic user accounts During our audit, we noted that when posting manual journals, [insert number] finance staff could access the general ledger system using a shared user account. All actions performed using this user account are logged but not reviewed. Insufficient password configuration Our audit identified that general ledger password parameters did not comply with the Council’s IT Security policy or good practice guidelines. The following settings are not enforced:
19/02/2019 37
Area Control areas for Councils – FY19
Governance Policy framework & currency of policies Management and reporting to business of IT Risks and Incidents Access to Programs & Data Starters/Transfers/Leavers User Access Reviews Managing & monitoring privileged user activity Unique user IDs Passwords Program Change Approval of changes Testing of changes Segregation of Duties between promoting change to PROD and developing/initiating change Computer Operation Disaster Recovery Planning
Example of Issue
Program change management requires improvement Our audit noted that there is no formal procedure to ensure that all changes made to [insert name of system] are subject to appropriate testing and approval prior to implementation. For a sample change selected, management could not provide any supporting documentation as evidence that changes to [insert name of system] were appropriately tested and approved prior to being implemented. Segregation of duties need to be implemented in program change management process Our audit noted that a member of the IT team responsible for developing changes to the general ledger system can migrate their own changes from the [development/test] environments to the production with no intervention or oversight from other users.
Area Control areas for Councils – FY19
Governance Policy framework & currency of policies Management and reporting to business of IT Risks and Incidents Access to Programs & Data Starters/Transfers/Leavers User Access Reviews Managing & monitoring privileged user activity Unique user IDs Passwords Program Change Approval of changes Testing of changes Segregation of Duties between promoting change to PROD and developing/initiating change Computer Operation Disaster Recovery Planning
Example of Issue
Disaster recovery plan should be formalised and tested Council’s Information Technology Disaster Recovery Plan (DRP) has not been reviewed or tested since 2012.
19/02/2019 38
Item Time
audits 1:30pm Close workshop 3:00pm
19/02/2019 39
Annual Engagement Plans are due: 28 February 2019
19/02/2019 40