Project report disa course

CERTIFICATE
Project Report of DISA 2.0 Course
This is to certify that, we have successfully completed the DISA 2.0 course training
conducted at: Hotel Woodland Retreat, Next to Hotel Tip Top Plaza, Opp. Raheja
Garden, LBS Road, Thane (W), Batch Id- THA1708091 from 05th August, 2017 to 03rd
September, 2017, and we have the required attendance. We are submitting the Project
titled:
Audit of Outsourced Software Development
We hereby confirm that we have adhered to the guidelines issued by CIT, ICAI for the
project. Also, certify that this project report is our original work and we have prepared
this project. We have not shared the project details or taken help in preparing project
report from anyone.
Sr. No. Name DISA No. Signature
1 CA. Dinesh Bhutra 51262
2 CA. Gauri Sovani 52027
3 CA. Gopal Danee 52463
Place: Mumbai
Date: 16th September, 2017

Project Report/DISA/THA1708091/Audit of Outsourced Software Development P a g e | 2
16th September, 2017
To,
The Management,
AMG Software,
India / USA
Subject: Submission of Audit & Assurance Report
Dear Sir/Madam,
We are pleased to attach herewith the Audit & Assurance Report carried out
at DLF, India premises in accordance to our audit engagement letter 31st July,
2017 with AMG Software.
We thank the entire management team and staff for the co-operation
extended during the course of audit.
We would be pleased to clarify any pertinent aspect.
With Best Regards,
Abraham & Associates,
Chartered Accountants
Place: Bangalore

Project Report of DISA 2.0 Course
Audit of Outsourced Software
Development

Table of Contents Page No.
A. Introduction 4
B. Brief on Project 5
C. Data & Details Provided 6
D. Scope of Assignment 7
E. Audit Methodology & Strategy 8
F. Risk Classification Criteria 9
G. Observation Classification Criteria 10
H. Organisation Structure 11
I. Documents Reviewed 12
J. Tests Performed 13
K. Audit & Assurance Report 14
1. Executive Summary
2. Detailed Audit Findings
L. References 24
M.Disclaimer & Limitations 25

A. Introduction
About the Client:
AMG Software is the world's leading provider of management solutions that
ensure the availability, performance, and recovery of business-critical
applications. AMG calls this application service assurance and it means that the
applications its customers rely on most stay up and running, around the clock. For
more than 20 years, the largest and most successful companies have relied on
AMG Software. The company has headquarter in Houston, Texas, with offices
worldwide. AMG has outsourced software development through ODS mode to
DLF.
AMG has supplied IT infrastructure for these services and has also recruited
required personnel who work at DLF for the software projects of AMG.
About us (the Auditors):
We (Abraham and Associates) are a practising CA firm registered with Institute of
Chartered Accountants of India based at Bangalore, having 12 FCA, 28 ACA & 250
Other staff, with presence across all metros and Tier 2 cities of India.
We are committed to provide consistent, customized and workable solutions to
our clients and strive to support our services with the highest level of
professionalism, efficiency and technology. We offer IS Assurance services with a
team of DISA and IT security professionals, who are well updated and have
expertise knowledge and an extensive experience.

B. Brief on Project:
AMG has outsourced software development through ODS mode to DLF. AMG has
supplied DLF:
▪ IT infrastructure for these services
▪ AMG Has also recruited required personnel who work at DLF for the
software projects of AMG.
AMG wanted an independent assurance:
▪ On the security and usage of the technology
▪ On protection of the IPR (Intellectual Property Rights) of AMG including
Assets
▪ That access to such provided assets (hardware, software, manuals, media,
etc.) of AMG used at the AMG labs at DLF in Bangalore are adequately
secured (physically and logically) from unauthorised and inappropriate use
through adequate and appropriate physical, environmental and logical
access controls
Hence, an independent review was to be conducted on the process and methods
in place at AMG labs at DLF so as to provide assurance that there are adequate and
appropriate safeguards and procedures that prevent unauthorized access,
mishandling and damage to any of the assets of AMG at AMG labs at DLF and all
the facilities provided by AMG are being used for the purposes of AMG's
operations by personnel authorised or assigned for AMG's operations only at DLF
allocated work site.

C. Data & Details Provided
Following related clauses from Service Level Agreement (SLA) have been
provided to us (the Auditors):
a. Clause 6.6: Maintenance of Records
b. Clause 10.4: Disaster Recovery
c. Clause 10.2: Backup and Storage
d. Clause 10.1: Generally
e. Clause 10.3: User and Access Restrictions

D. Scope of Assignment
Based on the detailed discussions with representative of AMG Mr. Ben Crocker
and visit to the AMG Labs at DLF, the primary objectives of the assignment of
Security Audit are finalised as follows:
▪ Provide assurance to AMG that the intellectual property of AMG including
assets and access to such assets (hardware, software, manuals, media, etc.)
used at the AMG labs at DLF in Bangalore are adequately secured (physically
and logically) from unauthorised and inappropriate use through adequate and
appropriate physical, environmental and logical access controls
▪ Review the process and methods in place at AMG labs at DLF so as to provide
assurance to AMG that there are adequate and appropriate safeguards and
procedures that prevent unauthorized access, mishandling and damage to any
of the assets of AMG at AMG labs at DLF
▪ Review whether all the facilities provided by AMG are being used for the
purposes of AMG's operations by personnel authorised or assigned for AMG's
operations only at DLF
▪ Validate the process and methods at AMG labs at BLF against available norms
and standards of AMG wherever available.

E. Audit Methodology & Strategy

F. Risk Classification Criteria
Type of Risk Organizational Impact
High
Requires Management Attention
Medium
Requires Corrective Action
Low
Opportunities for Improvement
H
M
L

G. Observation Classification Criteria
Root Cause Legend Explanation of Legend
Risks arising from a poor strategic business plans,
inappropriate policy guidelines & business decisions
and improper implementation of business decisions.
Relates to the achievement of an entity's basic business
objectives (including performance and profitability
goals) through effective and efficient utilization of
available resources and by safeguarding assets of the
entity.
Relates to complying with those laws and regulations to
which the entity is subject.
Relates to the preparation of reliable published financial
statements, including interim and condensed financial
statements and selected financial data derived from
such statements and reported publicly or to the
management.
Strategic
Operational
Inefficiency
Compliance
Deficiency
Reporting
Gap

H. Organisation Structure
MD & CEO
CFO
Accounts &
Taxation
Financial
Controllor
Treasury M&A
Secretarial
Procurement
& Inventory
COO
Business
Heads
HR & Admin
(CPO/CHO)
CMO
Online Mktg.
Team
Offline Mktg.
Team
CAE CTO

I. Documents Reviewed
▪ SLA Agreement
▪ Visitors Registers
▪ SoPs (Standard Operating Processes)
▪ Internal Policies & Processes
▪ IS Policy
▪ Audit Logs

J. Test Performed
Different tests were executed by using Caseware IDEA and CAAT Analytical
tool by getting all the data into the tool from the systems:
▪ Fuzzy Duplicate / Duplicate Transaction Identification
▪ Gap Detection
▪ Matching and Comparison Tests
▪ Missing Sequence Identification
▪ Statistical Calculations
▪ Data Queries, Sample Extraction and Analysis
▪ Utility software

K. Audit & Assurance Report
Executive Summary
Area Observations
Possibility of Unauthorised
Physical Access
▪ Lapse of Cross Checking System by the Security
Guards in the basement and possibility of
Misuse of Temporary Issued Card issued to DLF
Employees
▪ Absence of Automatic Lock Door at First Floor
may lead to access to unauthorised persons to
Lab
Lapses in Disaster Recovery
Plan (DRP)
▪ Absence of:
o Back Up Systems Available for the systems
supplied by AMG
o Redundancy for Telecom Equipment
o Standalone Generator for AMG operations
o Customised DRP for AMG Labs
o DRP for AMG Supplied Systems
o Annual Maintenance Contracts (AMC) for
AMG supplied machines
▪ Alternative Processing Capabilities of AMG not
identified
Lapses in Logical Access
Procedures
▪ Lack of Individual Accountability due to non-
creation of individual logins.
▪ Online Access of Source Code may lead
unauthorized access.

Detailed Audit Findings

A. Possibility of Unauthorised Physical Access Risk: High
Background:
As per the SLA DLF shall be responsible for ensuring that Systems, Deliverables and
other AMG data and materials in DLF’s custody are installed and used only on and/or
in combination with designated Systems installed at the Centre pursuant to this
Agreement as specified in the Contract Addenda.
DLF will restrict access to such Systems, deliverables, data and materials at all times
to DLF employees who have a “need to know” subject to acceptable undertakings of
confidentiality and non-disclosure. DLF shall establish and maintain security
measures and safeguards reasonably satisfactory to AMG
▪ To protect against the destruction,
▪ Loss, or alteration, and
▪ The unauthorized access, use, or disclosure,
Any Systems, Deliverables, or other data and materials which DLF from time to time
may have in DLF's possession, custody or control at the Centre or otherwise pursuant
to this Agreement.
Issue/Observation:
Our review revealed that:
1. No Cross Checking by the Security Guards and Misuse of Temporary Issued
Card:
There can be unauthorized access from the basement as the security guards do
not cross check the person and the swipe card with the employee and there are
temporary cards being issued before capturing of relevant details of the
employee.
2. No Automatic Lock Door at First Floor:
The door for the first-floor lab does not automatically lock itself after it has been
opened. If a user is not careful in ensuring the door is locked after he/she enters
or leaves the lab there could be opportunities for unauthorised users to enter the
lab without using the keypad device.
Root Cause:
▪ No Checking by Security Guards in
Recommendations:
▪ There should be only Single point of
Operational Inefficiency

Basement
▪ Absence of Automatic Door Lock at
First Floor
entrance which should be guarded by
separate security personnel who is
trained to cross check the person
entering the AMG labs at DLF
premises.
▪ There should be a biometric access
control at the entrance of AMG labs
which should be combined with ‘Dead
Man Doors’ entry.
Risks:
Unauthorised Access to Lab:
▪ From Basement using Temporary
Cards
▪ From First-Floor as there is no
Automatic Lock in the Door
Management Comments:
DLF has agreed with the flaws in the
Physical Access Control and has agreed to
implement the audit recommendations
with immediate effect.
Business / Security Impact:
Unauthorised Access may lead to:
▪ Theft of Data
▪ Physical and/or Logical Damage to
the Infrastructure
▪ Loss of Confidentiality, Integrity and
Availability
Responsibility & Timelines:
CEO jointly with CTO & with immediate
effect.

B. Lapses in Disaster Recovery Plan (DRP) Risk: High
Background:
As per SLA between AMG & DLF:
1. DLF shall follow AMG conventions for protection and back up of data,
including checking source code in to AMG's designated coordinator each week
on or before a specified day set by AMG.
2. As requested by AMG, DLF will establish and maintain off-site disaster
recovery capabilities that permit DLF to recover from a disaster and continue
providing Services to and carrying out Projects for AMG, including without
limitation:
▪ Storage of any AMG data, Work Product or Deliverables in an off-site
protected vault for such period as AMG specifies;
▪ Such off-site protected vault having security and environmental protection
systems to guard against theft, fire, humidity and temperature;
▪ Such security system providing controlled access and alarm systems
restricting access to DLF employees currently working on AMG Projects; and
▪ Implementation of disaster recovery capabilities in the event of any failure of
DLF information technology systems which may jeopardize AMG data,
Work Product or Deliverables. Upon request, DLF will provide AMG with
an executive summary of the current disaster recovery plan, which may
change from time to time. DLF shall test the operation and effectiveness of
DLF's disaster recovery plan at least annually. In addition, DLF shall
establish and maintain a backup power supply system to guard against
electrical outages so that lost or damaged data or materials can be
reconstructed,
3. DLF shall establish and maintain procedures for backup on magnetic tape or
other electronic media and storage at an off-site storage facility, as applicable,
of Systems, Deliverables and other AMG data and materials in DLF’s custody
and all storage media containing the same.

Issue/Observation:
1. No Back Up Systems Available:
There are no back-up systems available for the systems supplied by AMG.
2. No Redundancy for Telecom Equipment:
There is no redundancy for the telecommunication equipment.
3. Common Generator for all the operations at DLF:
The generator that is common for all the operations of DLF supplies power to the
computers in the event of continued power disruption. The generator facility has
enough stock of fuel to run continuously for a period of 6 days.
4. No Customised DRP for AMG Labs:
The documented generic disaster recovery plan is the same is applicable to DLF
as a whole and is not customised to AMG labs.
5. No DRP for AMG Supplied Systems:
There is no Disaster recovery plan for the systems that are supplied by
AMG and the communication capabilities of the labs.
6. Alternative Processing Capabilities of AMG not identified:
Alternative processing capabilities for the systems supplied by AMG are not
identified.
7. Lack of annual maintenance contracts (AMC) for AMG supplied machines:
There are no annual maintenance contracts (AMC) are in existence for AMG
supplied machines.
Root Cause:
▪ Weak DRP planning.
▪ Lack of complete understanding of
AMG requirement wrt DRP.
Recommendations:
▪ DLF should maintain back-up
systems available for systems
Strategic

Risks:
▪ There could be data loss of AMG Labs
at DLF, which can lead to extended
time required for re-developing the lost
data and to recover the data.
▪ There can be instances of data theft
also.
▪ Increase time will lead to rise in cost of
software development and untimely
delivery of software.
supplied by AMG.
▪ DLF should have an alternative
telecommunication equipment in
place to replace fault of ISPs.
▪ The generator facility should be
enhanced and should properly cover
the Recovery Point Objective(RPO)
and Recovery Time Objective(RTO).
▪ DLF should have a customized
recovery plan so that there least
impact on AMG Labs at DLF, its
systems and communication
capabilities.
▪ DLF should maintain alternative
processing capabilities for the systems
supplied by AMG.
▪ DLF should carry out annual
maintenance of AMG supplied
machines. AMG should also ensure
AMC of its machines are being done
timely and properly, otherwise there
could be physical and logical damage
to AMG supplied machines.
▪ As the software industry is changing
very rapidly a delay in software
delivery may make the software
obsolete in the market.
DLF has agreed with the observations of
the auditor and has agreed to implement
the audit recommendations with
immediate effect.
effect.

C. Lapses in Logical Access Procedures Risk: Medium
Background:
As per SLA between AMG & DLF:
1. Source code development is undertaken on an online basis through the
resources at the AMG facility in Houston. Configuration management tools that
are in use at AMG perform the configuration management of software under
development/maintenance. DLF here has no control over the
configuration/change management procedures that are to be followed during
the system development or maintenance phases of SDLC. Therefore in lieu of
such practices DLF does not maintain any records/documents that record the
changes incorporated to software during maintenance/ developmental
activities.
2. DLF shall establish and maintain security measures and safeguards reasonably
satisfactory to AMG
▪ To protect against the destruction,
▪ Loss, or alteration, and
▪ The unauthorized access, use, or disclosure,
any Systems, Deliverables, or other data and materials which DLF from time to
time may have in DLF's possession, custody or control at the Center or
otherwise pursuant to this Agreement.
3. DLF shall be responsible for ensuring that Systems, Deliverables and other AMG
data and materials in DLF’s custody are installed and used only on and/or in
combination with designated Systems installed at the Center pursuant to this
Agreement as specified in the Contract Addenda.
4. DLF will restrict access to such Systems, deliverables, data and materials at all
times to DLF employees who have a “need to know” subject to acceptable
undertakings of confidentiality and non-disclosure.

Issue/Observation:
1. No Individual Login Creation leads to No Individual Accountability:
There is no individual logins created and only group logins have been created
as there is no individual accountability assigned to the users.
2. Online Access of Source Code may lead unauthorized access:
The source code is to be accessed ONLINE and hence it could lead to any kind
of unauthorized logical access to data being transmitted online between AMG,
Houston and AMG Labs at DLF.
Root Cause:
▪ No Creation of Individual Logins
▪ Online Sharing of Source Codes
Recommendations:
▪ Each and every user should strictly have
a distinct user id and password in
addition to the individual workstation
user id and passwords.
▪ Online access to AMG, Houston servers
should be through secured and secluded
from the other networks of DLF. All
source codes should be transferred
through Secured Sockets Layer. A clause
should be added in the SLA to ensure
there is secured transmission of data.
Risks:
Unauthorised Logical Access:
▪ Non-creation of Individual Login
may lead to held responsible whole
group
having high risk of Wire Tapping,
Hacking, Phishing etc.
poses high chances of breach of IPR
of AMG
Unauthorised Access may lead to:
▪ Theft of Data
▪ Logical Damage to the
Infrastructure
▪ Loss of Confidentiality, Integrity
and Availability
▪ DLF as group at Risk of breach of
▪ DLF is changing its network
configuration to assign individual user
id and passwords to every user in AMG
labs at DLF.
▪ DLF has immediately secluded the
network for AMG Labs and is working
on implementing SSL.
Operational Inefficiency

IPR
▪ ABG as group at Risk of loss due to
breach of IPR
effect.

L. References
▪ www.cit.icai.org
▪ www.icisa.cag.gov.in
▪ www.isaca.org
▪ Institute of Chartered Accountants of India Publications on “Information
Systems Audit”, “SIA 14, on Internal Audit in Information Technology
Environment”
▪ “ISACA ITAF, 1201 “Engagement Planning”
▪ “Security, Audit and Control Features SAP® ERP, 3rd Edition”
▪ Information Systems Assurance Services of ICAI ISA-2 Reference.
▪ ITAF guidelines for audit of third party IT activities
▪ International Standard on Auditing
▪ Standards for IS audit and assurance issued by ISACA
o 1201: Engagement Planning
o 1202: Risk Assessment in Planning
o 1204: Materiality
o 1205: Evidence
▪ IS Auditing Guidelines
o 2201: Engagement planning
o 2202: Risk assessment in audit planning
o 2204: Materiality
o 2205: Evidence
▪ www.cloud-standards.org
▪ www.cloudaudit.org
▪ www.cloudsecurity.org

M. Disclaimer & Limitations
▪ This Report seeks to focus on some of significant issues arising from our review
based on the limited scope of work as mutually agreed upon, to the extent that
these may have significant impact on arrangements or matters material to the
operations of the Client. The review has been carried out in accordance with
and subject to the terms of engagement with the Client. It is the management’s
responsibility to develop and maintain sound systems of risk management,
internal control and governance. Internal audit work should not be seen as
substitute of management’s responsibilities for design and operation of these
systems.
▪ As the basis of sample selection for review is purely judgmental based on risk
based audit approach and existence of other internal controls, the outcome of
the analysis may not be exhaustive. This report does not comment on the
commercial nature or effect of the transactions undertaken, contemplated or
associated with any of the contracts reviewed or contractual relationships
revealed. This report does not comment upon any change/development which
may have taken place in the process and functioning of processes after audit
date (the last date of our field work). This report has to be read in conjunction
with such other reports, if any, issued separately in this regard and not in
isolation.
▪ The review was based on the information and data provided to us either in
physical or electronic form relating to the operations of the Client covered in
their books of account, financial statements, MIS reports etc. Thus, we cannot
comment on any liabilities (present or contingent) that may arise as a result of
omissions from, or misrepresentations in, the financial statements /
information and records provided to us by the client.
▪ It may be noted that our review was restricted to only the specific aspects of
the operations of the client covered in the specific location / divisions as
outlined in this Report on a standalone basis. The review is restricted to the
limited Scope of Work and the subsidiaries / associates / related parties /
other divisions of the Client, have not been covered within the ambit of this
review. The said review has been finalized based on the documents and
records produced before us and the discussions / views provided to us by the

Client’s management team.
▪ We endeavor to plan our work in such a manner so that we have reasonable
expectation of detecting significant control weaknesses. However, internal
audit procedures alone, even when carried out with due professional care, do
not guarantee that fraud will be detected and our examination as internal
auditors should not be relied upon to disclose all fraud, defalcations,
misappropriations, misrepresentations or other irregularities which may exist.
▪ This report is not intended to provide a summary of all financial, accounting,
tax, legal, technical, commercial, Information Technology, human resources
and / or any other issues relevant to the Client and aims only to highlight some
of the issues in respect of the Client, which, we feel may have a significant and
material impact on arrangements or matters material to the Client’s operations
based on scope of work being undertaken.
▪ This report is meant for use only by the Client management and the Board of
Directors of the Company and should not be quoted or referred to or copied,
stored, encrypted and distributed (either in physical form or in electronic form
either in full or in part) without our prior written consent. We hold
accountability only to the Client within the limited Scope of Work and to no
other person/s.
▪ This report has been prepared on the basis of the following assumptions:
o That all the opinions expressed by the Client management and its
advisors are honestly held by them and that all such opinions and views
expressed to us were made and continue to be based on reasonable
assumptions and that all statements of fact by any of the foregoing
persons were made and continue to be true, accurate, correct and not
misleading in any way.
o That all documents or copies thereof furnished / produced and
examined by us are true and (unless otherwise indicated) complete
copies of their originals of such documents were provided. That all
agreements, instruments and documents entered into, executed and/or
issued by or on behalf of the Client and reviewed by us, were duly
authorized and were validly executed and that the relevant parties
thereto had all necessary capacity under its or their constitutions to do
such things.
o That all information or documentation supplied to or examined in
connection with the preparation of this report, or from which this report
was compiled, was and remains true and is not misleading in any way.
This report and our view of the arrangements and documentation
contained herein are limited to certain significant regulations,
accounting standards etc. as are applicable under the Indian law. We are
not reporting on and express no opinion with respect to the laws of any
other jurisdiction or any documents or arrangements, which may be

subject to or governed by, the laws of any other jurisdiction. The review
shall not in any manner constitute to be a detailed audit / opinion /
certification / confirmation of the financial statements, books of
accounts, documents of the Client under any law or regulation.
o The review findings are based on our view of the current provisions of
the various regulations. Government or Judicial authorities may or may
not subscribe to the views expressed herein.
▪ Under no circumstances, our liability in respect of this engagement shall exceed
the fees received from the Client on the said matter or the actual damages
(excluding any penalties) suffered by the Client whichever is less, as
determined by the final court of competent jurisdiction in India.

Project report disa course

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Project report disa course

Ähnlich wie Project report disa course (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Project report disa course