Internal Controls

Internal Controls explain the activities we perform at our organisation to deal with Risks and Compliance Requirements. We document what they do, how we test them and what Policies, Standards and Procedures govern them.

60

0%
Current Internal Controls

0

0%
New Internal Controls

0

0%
Updated Internal Controls
Actions
Title
Objective
Audit Methodology
Audit Success Criteria
Maintenance Task
Policies
Active Directory User Reviews
Ensure that those employees that have left the organisation have no valid account in the AD and that his/her last login is previous to its last day in the office.
Input:
- HR needs to provide the list of employees that left the company since the beginning of the year and their last day in the company as columns A and B. The name of the employee must be its login name (john.foo)
- AD team needs to provide the list of disable accounts (column A) the date they were disabled and their last successfull login as column B and C.

Analysis:
- For each row in the list of employees verify if the account has been disabled and no logins existed after its last day of work.

Output:
- A merge of both spreadsheets showing all accounts are disabled and no logins occured after the last login.
All accounts have been disabled before the employee left the organisation.
NA
Account Management Procedures
AD Group Reviews
Ensure AD groups have been managed according to our policies.
Input:
- List of critical AD groups; group name in column A
- Members for each group; column A group name; column B group member login name
- Tickets for AD management queue
- Logs from the central collector with all AD changes

Analysis:
- Review that all AD changes have a ticket assigned; if they do not have a ticket check mark the item
- Review all tickets and ensure they have followed the standard procedure; if not check mark the item.

Output:
- Spreadsheet Analysis
All AD changes have a ticket and all tickets have followed our standard procedures.
NA
Account Management Procedures Hardening Standards Logging & Monitoring Standards Change Management Procedure
CRM Application - Account Reviews
Ensure that each user account in CRM belongs to the correct area and that each role has been granted for a ticket
Input:
- System logs that indicate account creations at the CRM system
- List of all tickets for CRM account management since the last audit

Analysis:
- For each log identify a ticket
- Review the ticket has followed our account management process

Output:
- Spreadsheet with analysis
All account creations have followed our procedures.
NA
Account Management Procedures Hardening Standards Logging & Monitoring Standards
Database Administrator Account Reviews
Ensure the database user logins on the following systems: CRM; ERM; Acme Drupal have not received login attempts from other sources than the application that they serve.
Input:
- Connection log for these three systems obtained from the central log collector
- DB account names used by the applications that use these databases

Analysis:
- For each log line; ensure no other account than the ones used by the application has successfully logged on the DB.

Output:
- Spreadsheet validating each database connection; a check mark if a fault is identified.
Only system applications service accounts have connected to the database.
NA
Account Management Procedures Hardening Standards Logging & Monitoring Standards
Employee Account Provisioning and Deprovisioning Review
This control ensures that the provisioning and deprovisioning of accounts on systems have followed our procedures in detail against our Active Directory which authenticates all user login attempts at all systems in the company. Additional reviews are performed on key systems.
Evidence:,
- List of employees that joined and left the company since the last audit,
- List of active AD user accounts,
,
Analysis:,
- Review no former employee has an active AD account,
- Review that new employee accounts have the Change Request ticket number as a description on their AD account, then review the ticket has followed the process on Service Desk including approvals,
,
Output:,
- Spreadsheet with the analysis,
- All dumps (employee and AD)
- No former employee has an account,
- The provisioning tickets reviewed have all followed the process
NA
Account Management Procedures Change Management Procedure
Google Apps 2-Factor
Input:
- Google apps account security report

Analysis:
- Ensure all accounts use 2-factor

Conclusion:
- Screenshots
Everyone must use 2factor
NA
Account Management Procedures Hardening Standards
High Privilege Service Accounts
Ensure that passwords are kept confidential.
Input:
- Passman logs from the central log collector
- List of tickets for the Passman queue; column A ticket number; column B date

Analysis:
- For each log ensure there is a ticket; if not check mark the item
- For each ticket; ensure the process for privilege account has been followed

Output:
- Spreadsheet with analysis
All access to privileged accounts have a ticket and all tickets have followed our standard procedures.
NA
Account Management Procedures Change Management Procedure Logging & Monitoring Standards
Service Accounts Reviews
Review service accounts to ensure they are still valid and were created following standard procedures.
Input:
- List of AD accounts where the "password expiration field" is set to "never"; account name on column A; creation date on column B.
- List of tickets for all AD changes

Analysis:
- For each account ensure there is a valid ticket; check mark the item if it has no valid ticket.

Output:
- Spreadsheet with analysis
No service accounts without a valid ticket and expiration
NA
Account Management Procedures Change Management Procedure Hardening Standards
User Access Maintenance Request
Ensure all requests for creation and amendment of user access to systems and data is appropriate and approved.
Account Management Procedures
XERO Account Reviews
Make sure XERO accounts and roles are correct
Input:
- List of XERO Accounts
- List of roles and permissions for each role

Analysis:
- Ensure only "esteban.ribicic" has "admin" role
- Ensure only our accountants have "accounting" role
- Ensure "Accounting" role can not create invoices
- Ensure Maintenances tasks (review with accounting employees that left) have been completed

Conclusion:
- Screenshots and spreadsheet with the analysis
Permissions and account %100 correct
Check with our accounting firm if all listed XERO accounts are still needed
Account Management Procedures