CISA REVIEW The material provided in this slide

Transcript:CISA REVIEW The material provided in this slide:
CISA REVIEW The material provided in this slide show came directly from Certified Information Systems Auditor (CISA) Review Material 2010 by ISACA. CISA REVIEW Chapter 4 – IT Service Delivery and Support Learning Objectives: Evaluate service level management practices to ensure that the level of service from internal and external service providers is defined and managed. Evaluate operations management to ensure that IT support functions effectively meet business needs. Evaluate data administration practices to ensure the integrity and optimization of databases. Evaluate change, configuration and release management practices to ensure that changes made to the organization's production environment are adequately controlled and documented. Evaluate problem and incident management practices to ensure that incidents, problems or errors are recorded, analyzed and resolved in a timely manner. CISA REVIEW Chapter 4 – IT Service Delivery and Support The overall responsibility for all operations within the IS department resides with IS management. The IS auditor is not expected to be a technical expert on computer operations. Rather, the auditor should understand the importance of management controls over operations in support of business functions. CISA REVIEW Chapter 4 – IT Service Delivery and Support The purpose of the IS department is to provide service for end users. Often, the level of service guaranteed to users of the IS facilities is documented in service level agreements (SLAs). SLAs are key to effective management of IT services. They should be used to ensure a clear understanding of the expectations and services offered. An SLA should fully define the nature, type, time and other relevant information for each service. Factors that should be considered in the delivery of these services include accuracy, completeness, timeliness and proper distribution of output related to application processing. SLAs should be used both for outsourcing agreements and internally – between the IS department and its end-user clients. This is especially important where there is a contractual relationship between the IS department and the end user or customer. An SLA may be linked to a chargeback system, in which a specified percentage of the cost is apportioned from the end-user department to the IS department. CISA REVIEW Chapter 4 – IT Service Delivery and Support SLAs must address a clear business need. For example, this might include: System availability – regular hours and arrangements for out-of-hours service and support Support availability – regular hours and arrangements for out-of-hours service and support Throughput –