\f\f\fSystems Development The key concepts within systems development include the existenm of a new systems implementation methodology, project management. pre- and post-implementation reviews, quality control, adequate testing, and demonstrated compliance with the selected imple- mentation methodology. Based on this understanding, your team's primary concenis are: It Does FFC design, develop, and implement systems in a logical fashion? It Does tlte organization consider internal controls as an integral part of systems design or does it retro-fit them after implementation? Ir To what extent is FFC's internal Audit deparnnent involved in systems development activities? Is it part of the project review team? Is it a voting member of the team? ' in particular, llD'W well did PFC manage the development and implementation of its new ngerprint bio-coding payment system? Data Security The critical concepts within data security include adherence to an established infon motion security policy, azcess approval on a need-to-lutorw basis, periodic rotation or change of access controls, monitoring, exception reporting. and incident response. Dma security has both physical and logical aspects. Clo the physical side, data security includes physical access and environmental controls over the data center computer room. I'Jn the logical side, data security includes policies related to password conguration, change, and history re- suictions. Logical security also includes prompt review, modication, or removal of access due to personnel transfers, promotions, and. terminations. Your team's primary concerns are: ' How well does FFC control physical access to its data center computer room? * Es FFC's computer room adequme protected against environmental dangers, such as lire? 4* Does WC control logical access to its information systems? in particular, how does it control the logical access of terminated or nartsferred employees? Does FFC have a current IT security policy? Does FFC produce access violation reports? Do FFC 1T personnel adhere to [T policy and follow IT procedures? For example, do appropriate personnel review any access violation reports and take the prescribed action? Change Management Change Management's key concepts include documented change procedures, user au- thorization and approval, separation of duties in implementing changes, management re- view, quality control, and adequate testing. 1Your audit team's primary consents are: Ir Does FFC have {and follow] formal change management procedures? Ir in particular, did FFC follow these procedures when making any necessary changes to its current application programs because of the new bio-coding payment system? For example: Were the changes approved? Did the programmers adequame test the changes before putting them into production? Did the application progranuoeris] that made the code changes, test the changes, andt'or put tltem into production? Business Continuity Planning Key concepts of BCP are management's expectations regarding a tiroely recovery of processing capabilities, the existence of a written plan, the currency of the plan, offsite \f\f\f\f\f\f