PO10.3:

PO 10.3 Project Management Approach

Control Objective:

Establish a project management approach commensurate with the size, complexity and regulatory requirements of each project. The project governance structure can include the roles, responsibilities and accountabilities of the program sponsor, project sponsors, steering committee, project office and project manager, and the mechanisms through which they can meet those responsibilities (such as reporting and stage reviews). Make sure all IT projects have sponsors with sufficient authority to own the execution of the project within the overall strategic program.

Applicability:

Sarbanes-Oxley

HIPAA

GLBA

PCI

FISMA

NIST SP 800-66

Ditscap

DOI

Control Exception

User Defined

Risk Association Control Activities:

1. Risk: Business requirements are not met or inadequately tested. Systems produce inaccurate results or do not meet usability requirements. A project that does not meet business requirements for internal controls at a milestone may continue without review and approval.

a. SOX.1.2 IT management involves users in the design of applications, selection of packaged software and the testing thereof, to maintain a reliable environment.

2. Risk: A project that does not meet business requirements for internal controls at a milestone may continue without review and approval.

a. SOX.1.12 The organization has an acquisition and planning process that aligns with its overall strategic direction.

3. Risk: Business needs may not be met or adequate data safeguards may not be implemented or considered.

a. SOX.1.7 The SDLC methodology includes requirements that information systems be designed to include application controls that support complete, accurate, authorized and valid transaction processing.

KY DOI A.1 Is there an IS steering committee or other evidence that top management is involved in the IS function and, if so, who are the members? Please provide copies of the steering committee meeting minutes or other evidence (e.g., memos or agendas) of steering committee meetings held during the period under review.

Implementation Guide:

Management has approved each project milestone, and that approval is documented.

Process Narrative
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.

Process Illustration
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.

File:Someimage.jpg

Control Commentary
Insert a description of the control that is applicable to the existing control statement this commentary refers to.

Control Exception Commentary
All accounts that remain following the comparison to current system accounts should be investigated as they are most likely policy violations and the result of a breakdown with segregation of duties or possibly an instance of collusion.

Evidence Archive Location
Insert Evidence Description Here.

Control Status and Auditors Commentary
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.

File:Redlock.jpg

Remediation Plan
Insert remediation plan, applicability, or any information that indicates what needs to be done.

Supplemental Information:

Implementation guidance
Insert guidance in this section if it helps to elaborate upon the subject matter. Examples of evidence that would help guide the end user is desirable.

--Mdpeters 08:00, 23 June 2006 (EDT)