L4 · IT Service Delivery

Running IT as a service: policies, metrics, the help desk, SLAs, and the operating controls an auditor actually tests. Maps heavily to Domain 4 (Operations & Business Resilience).

Exam relevance. D4 is 26%. This lecture is the "controls in the machine room" half — access, data files, application processing, maintenance. Learn the control families, then classify any scenario into one.

IT operations as a service

• Technology is pervasive — no organisation exists without computers and telephones.
• An IT service is a commitment to manage technology as efficiently and effectively as possible, aligned with business change — which is the hard part.
• There is always a potential gap between service delivered and user expectation.
• IT management is accountable for availability, integrity and confidentiality.

The policy layer — who writes what

Trap: policy is intent ("what and why"), standard is the mandatory level ("how much"), procedure is the step-by-step ("how"). Job descriptions must be current — an outdated JD is a control finding, because accountability cannot be enforced against a role that no longer exists.

Risk and asset management

• IT carries a high level of inherent risk — e.g. incorrect or misleading information in accounting statements arising from something other than a control failure.
• IT assets: data, software licences, hardware, network equipment, facility space.
• Data is a capital asset in IS audit, because of the investment to create and maintain it (a customer list is the classic example).

Service to users

• The number-one representation of value is IT user satisfaction → a prompt, helpful, friendly help desk.
• Business users ask "how does IT solve my problem?"; customers want individual, problem-by-problem solutions.
• Light-out operations — running with minimal or no on-site staff, which raises the bar on monitoring and remote control.

IT Balanced Scorecard

A strategic methodology implemented by senior executives (CEO, CFO) that converts organisational objectives into defined metrics, aligns IT with business objectives, and eliminates activities with little or no strategic value.

Advantages and disadvantages (from the slides)

• Advantages: focuses on specific metrics in direct support of objectives; each employee can work from a personal scorecard; employee success → department success → organisation success.
• Disadvantages: requires careful selection by the CEO/CFO; metrics derived from a committee (different department heads) tend to fail; training is required before implementation.

For IT: mission (become the preferred supplier, obtain funding, deliver cost-efficient service) · strategy (control expenses, deliver business value, train, develop applications) · metrics (meaningful measures built on CSF and KPI).

CSF vs KPI: a CSF is what must go right for the objective to be achieved (a critical success factor); a KPI is the measure that tells you whether it is going right.

Metrics — four types, nine elements

Four principles for a good metric

1. Data for calculating it must be readily obtainable.
2. The process must be repeating and measurable, and represent value to the business.
3. It must demonstrate performance using quantifiable information — a number, average or percentage.
4. It can be derived by automatic or manual means.

Agree metrics with major stakeholders and limit them to a sustainable quantity — fewer than 5–10 per stakeholder. Data collection and reporting must be standardised.

The nine elements of a metric

The help desk

• Ad hoc assistance to business users; the single contact point for new support requests.
• Objective: high-quality, prompt service during appropriate work hours.
• Responsibility: to escalate trouble tickets in a timely manner — to the sysadmin, application support programmer, or third party.
• The ticket must be tracked until closed or resolved.

Auditor's approach: understand the function, review staff competency, and evaluate the log and tracking of service requests.

Service Level Agreements

An SLA records the understanding between users and the service provider, defining performance criteria by specifying quantity and quality of service desired by the customer. Mutual understanding by both parties is essential.

Trap: an SLA without a right-to-audit clause gives you a promise you cannot test. For third-party services, that clause is the control.

Monitoring controls — the four families

Internal controls are required during normal processing at every terminal or workstation.

1. System access controls
2. Data file controls
3. Application processing controls
4. Maintenance controls

1 · System access controls

• Least privilege throughout.
• Three login types: user login, privileged administrator, maintenance login.
• User login and account management must be linked to HR (joiners, movers, leavers).
• High-level systems should implement biometric authentication.
• Control attributes: warning banner · password requirements · account protection · audit log recording.

Privileged accounts: not to be used for anything other than administration and maintenance. System administrators should hold two separate accounts — one administrative, one ordinary user — which reduces the impact of errors and can be verified in the logs.

Maintenance accounts: every system ships default accounts for setup and maintenance. Attackers love accounts left open by careless administrators. Disable defaults or configure their security parameters.

2 · Data file controls

• Data access can occur through a perimeter control, direct file access, or middleware (software handling data between the user interface and the database).
• Standing data controls — information held in a file or database, protected by encryption.
• System control parameters — settings that customise configuration and applications; can alter performance, logging or file security.
• Logical access controls — access forced through authentication in a user rights management program. Users always ask for direct database access to read data or generate reports; that request is the risk.
• Transaction processing controls — authentication and validation checks. TP monitors ensure database activity does not overload available hardware.

3 · Application processing controls

4 · Maintenance controls

• Ensure hardware and software changes have minimum impact on processing schedules and availability.
• All maintenance approved by the change control process before it occurs.
• Blanket approval — formal written consent for an individual/entity to conduct an activity without further approval, for small low-risk changes; requires a signed form designating the authorised individuals and activities.

Change management vocabulary

Trap: emergency changes are not exempt from control — they are the highest-risk change and therefore need more testing and post-implementation review, not less documentation.

Maintenance of the estate

• Software licensing — licences are corporate assets; every computer needs a valid, lawfully obtained licence. The auditor observes the client's attitude toward licensing, not just the paperwork.
• Asset and media tracking — tagging and labelling are preventative; auditing the inventory tags is detective. Media containing software belongs in a physical asset programme.
• Asset disposal — data must be purged from all equipment before disposal so it can never be recovered.
• User training — new-hire orientation, security awareness, application training; reduces problem occurrence.
• Ineffective/inefficient controls — management review of existing controls, so bad controls are retired rather than inherited.

System monitoring, capacity and problem management

System monitoring

Continuous monitoring to uncover operational inconsistencies, errors and processing failures:

• Hardware — workload utilisation, errors, availability
• Software — event logging, successful and unsuccessful logins
• Syslog — centralised logs with a log-reading tool

Capacity management

Monitor current resources and plan for future availability. External changes in the SLA or in user numbers have a direct impact on available capacity.

Problem management

Trap: "jobs running too fast" is a red flag, not good news — it can indicate processing was skipped or records were suppressed.

TRAPS

• Policy / standard / procedure — authority level is the tell.
• Efficiency = timeliness. Effectiveness = did it work (satisfaction/outcome). These are swapped constantly in options.
• CSF ≠ KPI. Factor vs measure.
• Privileged users need two accounts, not one convenient one.
• Default maintenance accounts are the attacker's favourite door.
• Program libraries are read-only in production. Write access to production code is a finding.
• Emergency changes need extra testing, not waivers.
• Tagging = preventative; inventory audit = detective.
• Disposal requires purge before the asset leaves — not after.
• An SLA without right-to-audit cannot be assured.

60-second recall

• Policy (exec) · standard (managers, approved by exec) · procedure (staff) · current job description.
• Data = capital asset.
• Balanced scorecard: growth & learning · financial · business process · customer.
• Metric types: implementation · efficiency · effectiveness · impact.
• Metric elements (9): purpose · goal · objective · measurement type · data source · evidence · frequency · formula · indicators.
• Help desk = single contact point; owns escalation and tracking to closure.
• SLA components: availability · definition · personnel · security · data integrity · reporting · right to audit · change · cost.
• Four control families: system access · data file · application processing · maintenance.
• Access: least privilege; three login types; two accounts for admins; disable defaults.
• Application controls: input → processing → output.
• Change: major / minor / emergency (extra testing) / configuration control / authorisation.
• Disposal: purge first, then dispose.