MARCO METODOLÓGICO PARA LA SUPERVISIÓN DEL ÁREA DE TECNOLOGÍA, APLICABLE A LAS INSTITUCIONES FINANCIERAS DEL SEGMENTO 3, 4 Y 5 DE LA ECONOMÍA POPULAR Y SOLIDARIA.

Abstract

There are several studies on the frameworks and methodologies for performing IT audits, however there is little information about its application in financial institutions of the Popular and Solidarity Economy with limited resources. This research study raises the IT audit with a focus on operational risk. The proposal is based on a literary review of the main risk concepts, as well as models applicable to IT auditing, including: COBIT 5, COSO 2013 and ISA-315. The research presents an audit model for IT, through a graphic scheme which is based on international auditing standards such as ISA-315 International Standard on Auditing in reference Identifying and assessing the risks, this scheme establishes as main tasks the identification of risks and the recognition of controls implemented as a measure to prevent economic losses. In addition, as a complement to the methodology, an audit matrix is proposed which serves as a tool for the identification of controls in the IT area, through the following categories: validity of information, data center, access security, changes in applications and system acquisitions. The validation of the proposed methodological framework is done using the technique of focus groups, in