# Changelog

VersionDetails:
-Updated reference to 'Information System Risk Assessment tool' web page on ato.gov.au
-Added TitleText to questions on the Report-ByItem and Report-Comments views


VersionDetails:
-Updated calculations for report views, so they all use the percentages from the underlying source data to generate a rating


VersionDetails:
-Fixed some spelling errors in questions


# Scores

Variable:
Data Reconciliation & Exception Reporting


# tOptions

OptionText:
Off the shelf/cloud product or vendor developed && vendor maintained


OptionText:
Custom built by vendor && maintained by vendor


OptionText:
Jointly developed && in-house maintained


OptionText:
Relational data management system (RDMS)


OptionText:
In-house developed, delivered and maintained


OptionText:
Externally owned, provided and maintained


OptionText:
In-house developed, provided and maintained


OptionText:
Over 10 years - supported and maintained


OptionText:
Both system generated data reconciliation && exception reporting  - full transaction audit trail


OptionText:
Only system generated data reconciliation && exception reporting - no or limited transaction audit trail


OptionText:
Data audit trail only - no system generated data reconciliation or exception reporting


OptionText:
Neither system generated data reconciliation && exception report nor transaction audit trail


OptionText:
Version controlled specifications && data dictionary && test scripts


OptionText:
Out of date specifications no test scripts


OptionText:
Non-sensitive - application functions may be interrupted for an extended period of time, at little or no cost to the company and require little or no catching up when restored


OptionText:
Sensitive - application functions can be performed manually at tolerable cost and for extended period of time. However, manual execution is a difficult and laborious process that requires additional staff to perform laborious


OptionText:
Vital - application unavailability will result in some loss of revenue and/or goodwill to the company. System functions can be performed manually but at great financial and recourse costs to the company and therefore for only a brief period of time


OptionText:
Critical - application unavailability will incur significant loss of revenue and goodwill to the company


OptionText:
Low complexity: minimal data manipulation/formatting - static data mapping - simple transaction summarisation - few data sources


OptionText:
Medium complexity: intermediate complexity of data manipulation - data mapping based on multiple criteria - several data sources


OptionText:
High complexity: multiple data sources - complex data manipulation - dynamic data mapping


OptionText:
System event triggered or automatic cyclic batch update


OptionText:
Data from source system manually transposed to destination system


OptionText:
Good exception processing - pre-processing data validation step - system generated exception processing && data reconciliation automated error alert - all in or none in record processing


OptionText:
Medium exception processing - no pre-processing data validation step - system generated record processing reconciliation, no automated error alert, rejected records must be managed by end-users


OptionText:
Low or no exception processing - manual reconciliation required, no automated error alert


OptionText:
Comprehensive documentation - version controlled specifications && test scripts available


OptionText:
Average documentation - original specifications no test scripts available


OptionText:
Poor documentation - no specifications no tests scripts available


OptionText:
Developed by external party (not original vendor) && in house maintained


OptionText:
Developed by external party (not original vendor) && maintained by contractors


OptionText:
Version controlled specifications, data dictionary and test scripts


OptionText:
Out of date specifications and no test scripts


OptionText:
No or minimal process re-engineering - no or minimal application configuration changes


OptionText:
Moderate process re-engineering - moderate application configuration changes


OptionText:
Extensive process re-engineering - extensive/fundamental application configuration changes


OptionText:
Dedicated internal staff only - average experience level > 5 years


OptionText:
Internal staff (mixed level of experience/dedication) dedicated highly experienced long term it providers


OptionText:
Dedicated internal staff only - average experience level < 2 years


OptionText:
Non dedicated internal staff only - average experience level < 2 years


OptionText:
Proven methodology, documented standards and procedures, clear milestones


OptionText:
New methodology, uneven documentation, clear milestones


OptionText:
No/poor methodology, poor documentation, unclear/changing milestones


OptionText:
Senior management and user community engaged


OptionText:
Senior management engaged - user community disengaged


OptionText:
Senior management and user community disengaged


OptionText:
Conducted - ROI on track, no major issues found


OptionText:
Conducted - ROI compromised, some issues found


OptionText:
Conducted - ROI seriously compromised, many issues found


OptionText:
Long && short term IT strategy is documented, published and regularly updated with clear synergy with long && short term business strategy. Regular updates


OptionText:
Long && short term IT strategy is documented and published with clear synergy with long && short term business strategy. No regular updates


OptionText:
Mostly employees with medium turnover or mostly long term outsourcing arrangements


OptionText:
Mostly employees with high turnover or mostly contractors


OptionText:
Transparency && accountability, roles && responsibilities clearly established, documented && up to date; appropriate segregation of duties; accountabilities translated to staff performance development agreements and tie into it strategy


OptionText:
Transparency && accountability, roles && responsibilities clearly established && documented. Deficiencies in segregation of duties and/or no clear link to staff performance development agreements and/or IT strategy


OptionText:
Proven methodology - documented standards && procedures - clear milestones


OptionText:
New methodology - uneven documentation - clear milestones


OptionText:
No/poor methodology - poor documentation - unclear/changing milestones


OptionText:
Good access control over logical assets - comprehensive access policy && formal user administration procedures enforced biometric and/or strong passwords control access to all systems, user access to systems is regularly checked, automated monitoring etc.


OptionText:
Medium access control to logical assets - some deficiencies identified in some systems or some circumstances (e.g. terminated employees etc...)


OptionText:
Poor access control over logical assets, many deficiencies identified, systemic lack of control, inadequate/absence of access control procedures


OptionText:
Good access control over cloud assets - comprehensive access policy && formal user administration procedures enforced and/or strong passwords control access to all systems, administrator && user access to systems is regularly checked, automated monitoring


OptionText:
Medium access control to cloud assets - some deficiencies identified in some systems or some circumstances (e.g. terminated services etc.)


OptionText:
Poor cloud control - many deficiencies identified, or inadequate/absence of cloud computing control procedures


OptionText:
Good access control over physical assets - comprehensive facilities access policy && formal access administration procedures enforced biometric and/or strong access control to all facilities, access to facilities is regularly checked, automated monitoring


OptionText:
Medium access control over physical assets - some deficiencies identified in some systems or some circumstances (e.g. terminated employees, contractor etc.)


OptionText:
Poor access control over physical assets - many deficiencies identified, systemic lack of control, inadequate/absence of access control procedures


OptionText:
Documented BCP, regular BCP training for identified staff, BCP key measures have been tested


OptionText:
Documented BCP but no specific BCP training, BCP key measures have never been tested


OptionText:
Documented DRP, alternate operations sites identified, emergency communication channels identified, redundancy inbuilt in systems and data centres, regular scheduled backups, regular DRP training/briefing


OptionText:
Documented DRP but deficiencies identified in some aspects, DRP key measures have never been tested


OptionText:
Roles && responsibilities not clearly established or documented


OptionText:
Over 10 years - not supported or maintained


OptionText:
Mitigated
(clearly outline reason why in comments box below)


OptionText:
Vendor developed and no ongoing maintenance, product at end of life cycle for example, no maintenance done


# tQuestions

QuestionText:
What is the nature of the information system used by the business to record, store and report tax and superannuation obligations?


QuestionText:
How many staff have access to the system?


QuestionText:
Is the audit functionality turned on so you can monitor access, date and time of transactions?


QuestionText:
How is your software delivered to end users?


QuestionText:
Who develops and maintains your software infrastructure?


QuestionText:
Has this system or systems recently been audited by the ATO or your external or internal auditors?


TitleText:
Data reconciliation, exception reporting && audit trail

QuestionText:
How is data reconciliation and exception reporting handled?


QuestionText:
What documentation do you have for this information system?


QuestionText:
How critical is the system to your daily business functions?


QuestionText:
How complex is the interfacing between your systems?


QuestionText:
How do you know if the interfacing and flow of data does not work?


QuestionText:
Do you have any documentation on the interfacing method and flow of data between your systems?


QuestionText:
How extensive are the changes made by this customisation?


QuestionText:
How long has your customisation been in place?


QuestionText:
Who developed your customised system and how is it supported?


QuestionText:
Do you have any documentation that sets out the specific design of your customisation?


QuestionText:
What is the project cost as a percentage of your administration costs?


QuestionText:
Did or will your project require any business process changes?


QuestionText:
Did or will the project introduce new technology?


QuestionText:
What project methodology was applied for the management of the project?


QuestionText:
Who was engaged from business to provide input into the project?


QuestionText:
How do you know the project delivered the required business outcomes?


QuestionText:
How do you know your IT systems will support the future direction of the business?


QuestionText:
How long have your IT staff been with the business?


QuestionText:
How are IT staff roles and responsibilities managed?


QuestionText:
To what extent do you outsource IT functions?


TitleText:
Application development && support methodologies

QuestionText:
When developing new applications what methodologies do you apply?


QuestionText:
How do you monitor and manage access to your logical assets?


QuestionText:
How do you manage access and use of your cloud assets?


QuestionText:
How do you manage and monitor access to your physical assets?


QuestionText:
Do you have a business continuity plan that sets out what is required to support your operations in the event of a disaster?


QuestionText:
Do you have a document that sets out what and who is responsible to get your systems back online in the event of a failure?


