Audit of Data Centre Management

4.0 Appendix A — Audit Criteria Used

Appendix A — Audit Criteria Used

Criteria	Link to Accepted Source		Audit Results
	CMC	COBIT
Governance
A clear and effective organizational structure is established and documented	AC-3	PO4	Partially Met
The organization's accountability(ies) in support of collaborative initiatives are formally defined	AC-4	N/A	Met
Risk Management
Management has a documented approach with respect to risk management	RM-1	DS10	Met
Management identifies the risks that may preclude the achievement of its objectives	RM-2	PO9	Partially Met
Management identifies and assesses the existing controls which are in place to manage its risks	RM-3	M-2, PO9	Met
Management assesses the risks it has identified	RM-4	PO9	Met
Management formally responds to its risks	RM-5	PO9	Partially Met
Management appropriately communicates its risks and risk management strategies to key stakeholders	RM-6	N/A	Met
Planning and resource allocations consider risk information	RM-7	N/A	Met
Clear departmental policies and guidelines consistent with government policies	PP-1	N/A	Partially Met
Internal Control
Management, through their actions, demonstrate that the organization's integrity and ethical values cannot be compromised	PSV-1	N/A	Met
Formal channels of communication exist for people to report suspected improprieties	PSV-3	N/A	Met
A timely budget is developed at the appropriate level of detail	ST-3	DS6	Met
Forecasts are monitored on a regular basis	ST-4	N/A	Met
Assets are life-cycle managed	ST-8	PO5	Partially Met
Assets are protected	ST-9	DS5	Partially Met
Appropriate system application controls exist	ST-11	DS5	Met
There is appropriate segregation of duties	ST-13	N/A	Met
Processes and procedures exist to support the continuity of information and systems	ST-19	AI2, AI3, DS4	Partially Met
Management has established processes to identify, solicit, evaluate and manage third party contracts	ST-22	N/A	Met
The organization has processes and practices to ensure change initiatives are properly implemented	LICM-2	AI6	Partially Met
Change initiatives are well communicated	LICM-3	N/A	Met
The organization leverages information technology to enhance user service and access	CFS-4	AI1	Met