COBIT and COSO/ERM Control Questionnaires

Plan and Organize (PO) Questionnaires by Marcus Stoll (Spring 2007)
Applies Throughout
General Control Questionnaire
http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesITGeneralControls
General IT Controls Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesGeneralITControlsQuestionnaire
1. PO1 Define a Strategic IT Plan
  Information Technology Infrastructure Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesInformationTechnologyInfrastructureQuestionnaire
  1. PO1.1 IT Value Management
  2. PO1.2 Business-IT Alignment
  3. PO1.3 Assessment of Current Performance
  4. PO1.4 IT Strategic Plan
  5. PO1.5 IT Tactical Plans
  6. PO1.6 IT Portfolio Management
2. PO2 Define the Information Architecture
  IT Data Management Self Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITDataManagementSAQ?OpenDocument&Login
  1. PO2.1 Enterprise Information Architecture Model
  2. PO2.2 Enterprise Data Dictionary and Data Syntax Rules
  3. PO2.3 Data Classification Scheme
  4. PO2.4 Integrity Management
3. PO3 Determine Technological Direction
  Information Technology Infrastructure Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesInformationTechnologyInfrastructureQuestionnaire
  1. PO3.1 Technological Direction Planning
  2. PO3.2 Technological Infrastructure Plan
  3. PO3.3 Monitoring of Future Trends and Regulations
  4. PO3.4 Technology Standards
  5. PO3.5 IT Architecture Board
4. PO4 Define the IT Processes, Organisation and Relationships
  Entity Level Controls - Control Environment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesELC-ControlEnvironment
  Information Technology General Controls - Preliminary Controls Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_ITGeneralControlsPreliminaryControlsAssessmentQuestionnaire
  1. PO4.1 IT Process Framework
  2. PO4.2 IT Strategy Committee
  3. PO4.3 IT Steering Committee
  4. PO4.4 Organisational Placement of the IT Function
  5. PO4.5 IT Organisational Structure
  6. PO4.6 Roles and Responsibilities
  7. PO4.7 Responsibility for IT Quality Assurance
  8. PO4.8 Responsibility for Risk, Security and Compliance
  9. PO4.9 Data and System Ownership
  10. PO4.10 Supervision
  11. PO4.11 Segregation of Duties
  12. PO4.12 IT Staffing
  13. PO4.13 Key IT Personnel
  14. PO4.14 Contracted Staff Policies and Procedures
  15. PO4.15 Relationships
5. PO5 Manage the IT Investment
  IT Asset Management Self Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITAssetManagementSAQ!OpenDocument
  1. PO5.1 Financial Management Framework
  2. PO5.2 Prioritisation Within IT Budget
  3. PO5.3 IT Budgeting Process
  4. PO5.4 Cost Management
  5. PO5.5 Benefit Management
6. PO6 Communicate Management Aims and Direction
  Chief Audit Executive IT Control Checklist
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsChiefAuditExecutiveCAEITControlChecklist
  1. PO6.1 IT Policy and Control Environment
  2. PO6.2 Enterprise IT Risk and Internal Control Framework
  3. PO6.3 IT Policies Management
  4. PO6.4 Policy Rollout
  5. PO6.5 Communication of IT Objectives and Direction
7. PO7 Manage IT Human Resources
  IT Organization Self Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITOrgSAQ
  1. PO7.1 Personnel Recruitment and Retention
  2. PO7.2 Personnel Competencies
  3. PO7.3 Staffing of Roles
  4. PO7.4 Personnel Training
  5. PO7.5 Dependence Upon Individuals
  6. PO7.6 Personnel Clearance Procedures
  7. PO7.7 Employee Job Performance Evaluation
  8. PO7.8 Job Change and Termination
8. PO8 Manage Quality
  Information Technology General Controls - Preliminary Controls Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_ITGeneralControlsPreliminaryControlsAssessmentQuestionnaire
  Information Technology General Controls - Preliminary Controls Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_ITGeneralControlsPreliminaryControlsAssessmentQuestionnaire
  1. PO8.1 Quality Management System
  2. PO8.2 IT Standards and Quality Practices
  3. PO8.3 Development and Acquisition Standards
  4. PO8.4 Customer Focus
  5. PO8.5 Continuous Improvement
  6. PO8.6 Quality Measurement, Monitoring and Review
9. PO9 Assess and Manage IT Risks
  User Relationship With IT Management: User Security Procedure Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_UserSecurityProcedureAssessmentQuestionnaire
  Business Risk Management Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesBusinessRiskManagementQuestionnaire
  Entity Level Controls - Risk Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesELC-RiskManagement?OpenDocument&Login
  1. PO9.1 IT and Business Risk Management Alignment
  2. PO9.2 Establishment of Risk Context
  3. PO9.3 Event Identification
  4. PO9.4 Risk Assessment
  5. PO9.5 Risk Response
  6. PO9.6 Maintenance and Monitoring of a Risk Action Plan
10. PO10 Manage Projects
  Information Technology General Controls - Preliminary Controls Assessment Questionnaire
  http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_ITGeneralControlsPreliminaryControlsAssessmentQuestionnaire
  1. PO10.1 Programme Management Framework
  2. PO10.2 Project Management Framework
  3. PO10.3 Project Management Approach
  4. PO10.4 Stakeholder Commitment
  5. PO10.5 Project Scope Statement
  6. PO10.6 Project Phase Initiation
  7. PO10.7 Integrated Project Plan
  8. PO10.8 Project Resources
  9. PO10.9 Project Risk Management
  10. PO10.10 Project Quality Plan
  11. PO10.11 Project Change Control
  12. PO10.12 Project Planning of Assurance Methods
  13. PO10.13 Project Performance Measurement, Reporting and Monitoring
  14. PO10.14 Project Closure
Acquire and Implement (AI) Questionnaires by Steven Gee (Spring 2007)
IT General Controls Questionnaire
http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesITGeneralControls!OpenDocument AI section
1. AI 1 Identify Automated Solutions
  Information Security Risk Assessment Questionnaire, based on ISO/IEC 17799:2005 http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesISO17799Questionnaire
  AI Risk Analysis Report System Implementation Risk Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsImplementationRiskAssessment
  AI Risk Analysis Report General Threat Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/dce93ca8c1f384d6862571420036f06c/4896b86cea506a08882571d50009e985/$FILE/General%20Threat%20Questionnaire.xls IT Risk section
2. AI 2 Acquire and Maintain Application Software
  IT Application Control Deficiency Decision Process Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesITApplicationControlDeficiencyDecision
3. AI 3 Acquire and Maintain Technology Infrastructure
  IT Infrastructure Control Deficiency Decision Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesITInfrastructureControlDeficiencyDecisionQuestionnaire
  Infrastructure Resource Protection and Availability
  Infrastructure Maintenance Technical Safeguards Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesAppenATechnicalSafeguards
4. AI 4 Enable Operation and Use
  User Relationship With IT Management: User Knowledge Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_UserKnowledgeAssessmentQuestionnaire
5. AI 5 Procure IT Resources
  Procurement and Accounts Payable: Segregation of Duties Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesProcurementandAP–SegregationofDuties
6. AI 6 Manage Change
  Entity Level Controls - Risk Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesELC-RiskManagement!OpenDocument Mange Change section
7. AI 7 Install and Accredit Solutions and Changes
  Implementation Review Scoping Checklist http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsImplementationReviewScoping
  Implementation Plan System Implementation Risk Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsImplementationRiskAssessment
Deliver and Support (DS) Stephen Gee (Spring 2007)
1. DS 1 Define and manage service levels IT Application Management Self Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITApplicationManagementSAQ
2. DS 2
3. DS 3 Manage performance and capacity IT Security Remediation – Self-Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITSecurityRemediation
4. DS 4 Ensure continuous service
  General IT Controls Review: Disaster Recovery Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesDRQuestionnaire
  E-business Risks: Availability. Questions for audit committees http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesE-businessrisksAvailabilityQuestionsforAC
  General IT Controls Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesGeneralITControlsQuestionnaire?OpenDocument&Login
5. DS 5 Ensure systems security
  Security Management Self-Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesSecurityManagementSAQ
  Ensure systems security Technical Safeguards Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesAppenATechnicalSafeguards
  Ensure systems security General IT Controls Review: Password Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesPswdQuestionnaire
7. DS 7 Educate and train users
  User Relationship With IT Management: User Computing Standards Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QU_UserRelationshipWithITManagementUserComputingStandardsAssessment
  IT Organizational Suitability Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesAppenAOrganizationalSuitability
9. DS 9 Manage the configuration
  E-business risks: Internal security. Questions for audit committees http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesE-businessrisksInternalSecurityQuestionsforAC
10. DS 10 Manage problems and incidents
  IT Operations Management Self Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITOperationsManagementSAQ!OpenDocument
11. DS 11 Manage data
  IT Data Management Self Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITDataManagementSAQ!OpenDocument
  Data Output Controls Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesDataOutputControlsQuestionnaire
  IT Infrastructure Control Deficiency Decision Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/QuestionnairesITInfrastructureControlDeficiencyDecisionQuestionnaire
  Record Retention Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesRecordRetentionQuestionnaire
12. DS 12 Manage facilities
  Physical Security Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesAppenAPhysicalSecurity
13. DS 13 Manage operations
  IT Operations Management Self Assessment Questionnaire http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/ChecklistsGuidesITOperationsManagementSAQ
Monitor and Evaluate (ME)

COSO ERM (Enterprise Risk Management) Michael PArrish (Spring 2007)

IIA's Enterprise Risk Framework slides

Entity Level Controls Questionnaires

Updated Apr 17, 2007