Auditing IT Outsourced Environments

• Understand the benefits and risks of outsourcing
• Identify the specific risks and controls for the various outsourced environments
• Describe how to use a Third-Party Report as an audit tools
• Identify common issues that have arisen in both the process of outsourcing and how to audit the outsourced business processes

COURSE OUTLINE

Defining Outsourcing

• Outsourcing concepts/terms
• Outsourced scope
  • Applications
  • Infrastructure
  • Development
• Cloud Computing
• Comparing Company and Vendor Motivation for Outsourcing

General Risks

• Company risks
  • Strategic
  • Financial
  • Operational
  • Organizational
• Vendor Risks
• Additional Risks with Cloud Computing

Organizational Changes Required to Manage Outsourcing

• Issue Management
• Delivery Management Risks
• Relationship Management

Contracts

• Considerations in the New Contract
  • Intellectual Property
  • Auditability
  • SLAs
• Managing Audits with In-Force Contracts
• Regulatory Compliance
• Governance

Auditing the Outsourced Environment

• The effect on the audit universe
• Planning
• Scoping the audit to satisfy audit requirements
• Understanding the your limits in auditing the vendor
• Overcoming compliance issues
• Using Third-Party Reports
  • Understanding the Benefits and Limitations of the Third-Party Reports
  • Types of Third-Party Reports (SSAE16, SOC 1/2/3)
• Performing the audit
  • Gap analysis
  • Internal gap remediation
  • Vendor gap reporting and remediation
  • Auditing contract and service level compliance
  • Solving vendor/company differences
  • Auditing contract and service level compliance
• Relationship management

TRAINING METHODOLOGY

The training methodology combines lectures, discussions, group exercises and illustrations. Participants will gain both theoretical and practical knowledge of the topics. The emphasis is on the practical application of the topics and as a result participant will go back to the workplace with both the ability and the confidence to apply the techniques learned to their duties.