| Study programme competencies |
| Code | Study programme competences |
| A7 | Capacidade para deseñar, desenvolver, seleccionar e avaliar aplicacións e sistemas informáticos que aseguren a súa fiabilidade, seguranza e calidade, conforme a principios éticos e á lexislación e normativa vixente. |
| A9 | Capacidade para comprender a importancia da negociación, os hábitos de traballo efectivos, o liderado e as habilidades de comunicación en todos os contornos de desenvolvemento de sóftware |
| A22 | Coñecemento e aplicación dos principios, metodoloxías e ciclos de vida da enxeñaría do sóftware. |
| A24 | Coñecemento da normativa e a regulación da informática nos ámbitos nacional, europeo e internacional. |
| A25 | Capacidade para desenvolver, manter e avaliar servizos e sistemas sóftware que satisfagan todos os requisitos do usuario e se comporten de forma fiable e eficiente, sexan accesibles de desenvolver e manter, e cumpran normas de calidade, aplicando as teorías, principios, métodos e prácticas da enxeñaría do sóftware. |
| A29 | Capacidade de identificar, avaliar e xestionar os riscos potencias asociados que se puideren presentar. |
| A36 | Capacidade para comprender, aplicar e xestionar a garantía e a seguridade dos sistemas informáticos. |
| A47 | Capacidade para determinar os requisitos dos sistemas de información e comunicación dunha organización de acordo cos aspectos de seguridade e cumprimento da normativa e a lexislación vixente. |
| A49 | Capacidade para comprender e aplicar os principios e as prácticas das organizacións, de forma que poidan exercer como enlace entre as comunidades técnica e de xestión dunha organización, e participar activamente na formación dos usuarios. |
| A50 | Capacidade para comprender e aplicar os principios da avaliación de riscos e aplicalos correctamente na elaboración e execución de plans de actuación. |
| A51 | Capacidade para comprender e aplicar os principios e as técnicas de xestión da calidade e da innovación tecnolóxica nas organizacións. |
| A56 | Capacidade para seleccionar, despregar, integrar e xestionar sistemas de información que satisfagan as necesidades da organización, cos criterios de custo e calidade identificados. |
| B2 | Traballo en equipo |
| B3 | Capacidade de análise e síntese |
| B4 | Capacidade para organizar e planificar |
| B5 | Habilidades de xestión da información |
| B6 | Toma de decisións |
| B7 | Preocupación pola calidade |
| B8 | Capacidade de traballar nun equipo interdisciplinar |
| C6 | Valorar criticamente o coñecemento, a tecnoloxía e a información dispoñible para resolver os problemas cos que deben enfrontarse. |
| Learning aims | |||
| Subject competencies (Learning outcomes) | Study programme competences | ||
| Information Systems Audit | A22 A24 A25 A29 A36 A49 A50 A51 |
B3 B4 B5 B7 B8 |
C6 |
| Information Systems Quality Assurance | A7 A9 A51 A56 |
B6 B7 |
C6 |
| Information Systems Control | A36 A47 |
B2 B3 B6 |
|
| Contents |
| Topic | Sub-topic |
| Unit 1: Introduction to the Quality Assurance Concept in Information Systems. | Concept, needs, requirements. QA Levels and tasks. Quality Management Systems. QA planning and quality reviews |
| Unit 2: IS Auditing process | Concept, needs, functions Risk assessment Internal Controls Audit planning and audit evidences Performing an IS Audit |
| Unit 3: IT Governance | Concept and needs IS strategies vs corporative strategies. Frameworks: COBIT. Auditing IT governance structures. Risk management |
| Unit 4: Protection of Information Assets | Concept and needs IS Protection Logical and applied protection of IS Physical protection of IS infrastructure. Security frameworks auditing. |
| Unit 5: Business continuity plans and recovering after disasters. | General concepts. Business continuity planning and components. Auditing the BCP |
| Unit 6: Legal aspect in IS | Spanish regulatory framework. Data protection regulation. |
| Planning | |||
| Methodologies / tests | Ordinary class hours | Student’s personal work hours | Total hours |
| Workbook | 2 | 7 | 9 |
| Case study | 10 | 25 | 35 |
| Mixed objective/subjective test | 2 | 0 | 2 |
| Supervised projects | 7 | 21 | 28 |
| Guest lecture / keynote speech | 19 | 57 | 76 |
| Personalized attention | 0 | 0 | 0 |
| (*)The information in the planning table is for guidance only and does not take into account the heterogeneity of the students. | |||
| Methodologies |
| Methodologies | Description |
| Workbook | Readings for consolidating and complement the knowledge acquired by the student during the lessons. Topics: techniques, applications and information systems. |
| Case study | Case studies with problem analysis and achieved solutions. |
| Mixed objective/subjective test | In this test the knowledge acquired by the student about the theoretical and operative topics covered during the course will be evaluated. |
| Supervised projects | A set of guided works proposed by the professor will be developed by the students individually or in groups. |
| Guest lecture / keynote speech | Lectures for the exposition of the theoretical aspects of the course using different resources such as blackboard, slides, beamer, demonstrations, and online teaching tools. |
| Personalized attention |
|
|
| Assessment | ||
| Methodologies | Description | Qualification |
| Case study | Case studies for the independent working of the students and student participation in the lectures. It is mandatory to achieve at least the 40% of the marks in order to pass the course | 40 |
| Mixed objective/subjective test | Questions about the acquired knowledge. Questions involving critical reasoning for solving practical problems of the real world. It is mandatory to achieve at least the 40% of the marks in order to pass the course | 40 |
| Supervised projects | Tracking of the working process and evaluation of the final output from the students. It is mandatory to achieve at least the 40% of the marks in order to pass the course | 20 |
| Assessment comments | ||
|
Para a segunda oportunidade, tanto as prácticas e traballos como a teorías avaliaranse no exame mixto |
||
| Sources of information |
| Basic |
Chris Davis, Mike Schiller, Kevin Wheeler (2006). IT Auditing: Using Controls to Protect Information Assets. McGraw-Hill
ISACA (2012). Cobit 5: A Business Framework for the Governance and Management of Enterprise IT..
ISACA (). http://www.isaca.org.
Sandra Senft y Frederick Gallegos (2008). Information Technology Control and Audit. Auerbach Publishers Inc |
|
|
|
| Complementary | |
|
|
| Recommendations | |
| Subjects that it is recommended to have taken before |
| Subjects that are recommended to be taken simultaneously |
| Subjects that continue the syllabus |
| Other comments | |