Reference no: EM133236620

QUESTIONS:

1. List ALL the frameworks and regulations that would apply to iBank Financials? Why do they apply?
2. Which framework(s) and/or regulation(s) would you select to audit iBank Financials? Why did you select this framework(s) and/or regulation(s)? Be thorough in your response.

CASE STUDY: 

iBank Financials is a publicly-traded financial company in New York City. They have small remote offices in all of the major cities in the US. Their products and services include insurance, annuities, and investing. They have recently added investing in cryptocurrency as a new service.

Technical Information:

1. There are thirty computers in the main office in NYC.
   1. Twenty computers are used to manage all client accounts.
   2. Five laptops are used to manage clients and to work remotely.
   3. The remaining five computers are used to manage all vendor applications, servers, cloud applications, and support.
   4. iBank and a small insurance agency on the same floor share the same wireless. The insurance agency does a lot of work with iBank and the bank's customers. Since they have a great partnership, the insurance agency uses iBank's wireless for internet access.
2. In each of the remote offices, each agent has been issued a laptop.
   1. The computers are used in the office and remotely when meeting with clients or working from home.
   2. The laptops need to connect via VPN to the main office to use the client management applications and purchase financial products.
   3. A few agents have learned to set up their personal tablets to access the client management system over VPN, making it convenient for them to get more work done.
3. There are six servers (on-premise and on AWS) for access management, storage, a client management applications, and vendor applications.
4. Service fees are typically paid using a bank transfer, credit card, check or withdrawn from the customer's account. Some customer credit cards are stored on the company server. The server processes any outstanding fees once per day. 

Since iBank has been growing, they recently hired five new customer support personnel and ten sales and marketing personnel, who were due to start in a day. Background checks were completed for all, and they all came back without any issues. The president of the company wanted them up and working as soon as they arrived.

Since this request came from the president, the following occurred:

1. A system administrator was directed by the president to give all new employees access to all the server data and applications. The system administrator happily agreed to the request and got a pat on the back for setting up the access in less than five minutes. The president didn't realize what he had directed the system administrator to accomplish, being new, the system administrator did not ask enough questions to ensure that proper access management was in place.
2. Since all of the new employees had security clearances, the Human Resources department issued employee ID badges to be used for a card reader to gain access to all company-owned areas.
3. The IT department issued brand new computers configured to access servers and business applications. The computers were all in a non-sensitive location. Since it was a busy time of the year, the sales and marketing team told IT to plan to circle back around in a month to address all of the system-related and security items.