Internal Controls
Internal Controls explain the activities we perform at our organisation to deal with Risks and Compliance Requirements. We document what they do, how we test them and what Policies, Standards and Procedures govern them.
60
0%
Current Internal Controls
0
0%
New Internal Controls
0
0%
Updated Internal Controls
|
Actions
|
Title | Objective | Audit Methodology | Audit Success Criteria | Maintenance Task | Policies |
|---|---|---|---|---|---|---|
|
Transport of Media
|
Ensure that transport of media was correctly managed
|
Input:
- Inventory of stored media - Tickets for the Media queue Analysis: - Review all tickets for media transport and ensure the process has been properly followed. Output: - Spreadsheet with analysis |
All media has been accessed with a reason and all transported media has been transported according to our procedures.
|
NA
|
Media Handling Policy | |
|
User Access Maintenance Request
|
Ensure all requests for creation and amendment of user access to systems and data is appropriate and approved.
|
|
|
|
Account Management Procedures | |
|
Visitor Log Reviews
|
Ensure all visitors have been properly registered before allowing them access to the office
|
Input:
- CCTV footage of the entrance camera for the last 90 days - Visitor Logs Analysis: - Review %10 of all visitors entry and ensure the log corresponds with CCTV Output: - Screenshots and spreadsheet with the entries reviewed |
All items reviewed have corresponding CCTV footage that validates the visitor log was properly completed.
|
NA
|
Physical Security Standards | |
|
VPN Access
|
VPN access is available to all our employees
|
Input:
- VPN server configurations - List of VPN connections from our central log collector since last audit - List of employees that left the organisation since last audit Analysis: - Configurations on VPN servers enforce that only AD valid accounts can login - The comparison in between VPN logs and employees that left the organisation show no ex-employee ever connected to the VPN Output: - Spreadsheet with the analysis |
Only employees can (and have) VPN to the organisation.
|
NA
|
Hardening Standards Logging & Monitoring Standards | |
|
WPA2 Secured Wifi Networks
|
Ensure Wifi networks comply with our standards
|
Input:
- List of AP from system inventory; column A hostname - One txt file per AP with all its configuration settings - Hardening guide for Wifi systems Analysis: - Review each AP config to ensure standards are met (authentication; encryption; Etc) Output: - Spreadsheet with the analysis; check mark on column B if the device is correctly configured |
All AP are aligned to the standards defined.
|
NA
|
Hardening Standards System inventory | |
|
XERO Account Reviews
|
Make sure XERO accounts and roles are correct
|
Input:
- List of XERO Accounts - List of roles and permissions for each role Analysis: - Ensure only "esteban.ribicic" has "admin" role - Ensure only our accountants have "accounting" role - Ensure "Accounting" role can not create invoices - Ensure Maintenances tasks (review with accounting employees that left) have been completed Conclusion: - Screenshots and spreadsheet with the analysis |
Permissions and account %100 correct
|
Check with our accounting firm if all listed XERO accounts are still needed
|
Account Management Procedures |