【正文】 Continuous Controls Monitoring Chapter 3 Systems and Infrastructure Life Cycle Management 2020 CISA REVIEW Move to Next Level Zhaoyang Wang CISSP, CISA 2 Chapter Overview ? Business Realization ? Project Management Structure ? Project Management Practices ? Business Application Development ? Alternative Application Development Approaches ? Alternative Forms of Software Project Organization ? Alternative Development Methods ? Infrastructure Development/Acquisition Practices ? Information Systems Maintenance Practices ? System Development Tools and Productivity Aids ? Process Improvement Practices ? Application Controls ? Auditing Application Controls ? Auditing Systems Development, Acquisition and Maintenance ? Business Application Systems 3 Chapter Objective Ensure that the CISA candidate… ―Understands and can provide assurance that the management practices for the development/acquisition, testing, implementation, maintenance, and disposal of systems and infrastructure will meet the organization’s objectives.‖ 4 Chapter Summary ?16% of the CISA examination ?Around 32 questions 5 Business Realization ? Portfolio/Program Management – Program management ? Program scope, program financials, program schedules, and program objectives and deliverables ? Program context and environment ? Program munication and culture ? Program organization – Portfolio management ? Optimization of the results of the project portfolio ? Prioritizing and scheduling projects ? Resource coordination ? Knowledge transfer throughout the projects – Difference between project portfolio and program – Project/program management focus on procedures (activities and tasks), not content 6 Business Realization ?Business Case Development and Approval – A business case provides the information required for an organization to decide whether a project should process. – The business case should also be a key element of the decision process throughout the life cycle of any projects. – Either the first step in a project or a precursor to the mencement of a project. 7 Business Realization ?Benefits Realization Techniques – Increasingly, a majority of business benefits are obtained through changes enabled by technology. – Benefits realization is a continuous process, must be part of governance and management of projects. – Benefits realization requires…. 8 Project Management Structure ?General Aspects – Definition of ―project‖ – Project Management should be a business process of the projectoriented organization – Project Management begins with the project charter and ends with the pletion of the project. 9 Project Management Structure ?Project Context and Environment – A project context can be divided into a time and a social context. In the analysis of the contents dimension of the context, the following must be taken into account: ? Importance of the project in the organization ? Connection between the organization’s strategy and the project ? Relationship between the project and other projects ? Connection between the projects to the underlying business case 10 Project Management Structure ?Project Organizational Forms – 3 major forms of organizational alignment for project management can be observed: ? Influence project organization – the project manager has only a staff function without formal management authority ? Pure project organization – the project manager has formal authority over those taking part in the project ? Matrix project organization – management authority is shared between the project manager and the department heads – Requests for major projects should be submitted to, and prioritized by, the IS steering mittee. – The project manager should be identified and appointed by the IS steering mittee. 11 Project Management Structure ? Project Communication and Culture – Depending on the size and plexity of the project and the affected parties, munication when initiating the project management project process may be achieved by: ? One–on–one meetings – helps to facilitate twoway munication between the project team members and the project manager ? Kick–off meetings – informs the team on what has to be done for the project ? Project start workshops – helps to develop both the big picture of the project and the project culture ? A bination thereof 12 Project Management Structure ?Project Objectives – SMART principle: ? specific, ? measurable, ? achievable, ? relevant ? time bound – Difference between the object breakdown structure (OBS) and work breakdown structure (WBS). 13 Project Management Structure ?Roles and Responsibilities of Groups and Individuals – Senior Management – User Management – Project Steering Committee – Project Sponsor – Systems Development Management – Project Manager – Systems Development Project Team – User Project Team – Security Officer – Quality Assurance 14 Project Management Practices Cost and Resources Deliverables Time (Duration) Project 15 Project Management Practices ? Initiation of a Project – Terms of reference/Charter – PID/PRD 16 Project Management Practices ? Project Planning – Software Size Estimation – Lines of Source Code – Not good for plex apps. – Function Point Analysis – Different inputs/outputs – FPA Feature Point Analysis – For WebEnabled – Cost Budgets ? Personnel Hours ? Machine Hours ? Other Costs (3rd Party software, licencing, contractor, etc.) – Software Cost Estimation ? System divided into main ponents ? Cost Drivers are established 17 Project Management Practices ?Project Planning (cont.) – Scheduling and Establishing Time Frame – Critical Path Methodology (CPM) – Shortest possible pletion time. Longest