A CASE STUDY OF : IT COMPLIANCE IMPLEMENTATION AT PT AVRIST ASSURANCE

Transcription

1 A CASE STUDY OF : IT COMPLIANCE IMPLEMENTATION AT PT AVRIST ASSURANCE CASE STUDY LINDA WIJAYA BINUS BUSINESS SCHOOL MAGISTER MANAGEMENT IN BUSINESS MANAGEMENT BINUS UNIVERSITY JAKARTA 2010

2 A CASE STUDY OF : IT COMPLIANCE IMPLEMENTATION AT PT AVRIST ASSURANCE CASE STUDY LINDA WIJAYA A Thesis Submitted to the graduate Faculty In Partial Fulfillment of the Requirements For Master of Management Degree Major : Business Management i

3 A CASE STUDY OF : IT COMPLIANCE IMPLEMENTATION AT PT AVRIST ASSURANCE CASE STUDY LINDA WIJAYA Supervisor : Richard Kartawijaya March 12th, 2010 ii

4 PREFACE First of all, I d like to say my biggest thanks to my God Jesus and His mother Maria who already gave me the opportunity to finish the thesis and finish my education in Binus as a Master of Business Management. I d also like to give my gratitude to Binus, that already facilitates my with all of the facilities. My special thanks for Binus lecturer, Mr. Richard Kartawijaya who always challenge me to do my best and give me the useful suggestions. I d also like to give an infinite gratitude to the company I ve worked for, PT Avrist Assurance and Mr. Denni Hidayat that gave me the work experiences as an IT Security and Compliance and make me able to write the thesis. For Mr. Altos Pebrianto, I sincerely thank you for the permission to use all the data and for the support and reviews on my thesis. Last but not least, I d like to thank to my mom, my bro and sis, that keep supporting me during my education. Sorry that I ve missed all of the family time during my study. And also thank you for all of my friends and colleagues who had supported me with encouragements, prayers during the thesis writing. In writing the thesis, I personally like to share my experiences and knowledge through this thesis and hope that it would be useful for people who work in a profession like me. Thank you. Linda Wijaya iii

5 TABLE OF CONTENT CHAPTER I. INTRODUCTION Background Company Profile PT Avrist Assurance Overview Avrist s Organization Structure Company s Information Systems history Problem Definition Objective Scope CHAPTER II. COMPLIANCE REVIEW Compliance Definition IT Compliance category Information Security Content Management Policies and Procedures The IT Compliance challenges Growing complexity of managing compliance with multiple regulations Increasing Cost of Compliance Sarbanes-Oxley Sarbanes-Oxley Section 404 Overview SOX 404 Internal Control Framework Assessment and Improvement of Internal Controls Development of risk management programs Reporting processes CHAPTER III. RESEARCH v

6 3.1. Research Time and Place Defining IT Control area IT Compliance Self Assessment Remediation Process CHAPTER IV. ANALYSIS Before IT Compliance Implementation After IT Compliance Implementation Analysis Benefit for infrastructure Benefit in Financial IT Compliance Benefit for Management IT Compliance Benefit for Company Partners IT Compliance Benefit for Customers CHAPTER V. CONCLUSION AND RECOMMENDATION LIST OF REFERENCE CURRICULUM VITAE vi

7 TABLE OF FIGURES Figure 1.1 Avrist's Organization Structure 8 Figure 1.2. MIS-DC Organization Chart 11 Figure 2.1. Key Components of IT Compliance 16 Figure 2.2. SOA Key Principles 24 Figure 2.3. Processes to Achieve SOA Compliance 27 Figure 2.4. COSO Framework Table 3.1. IT General Control Checklist 37 Table 3.2. Preliminary Findings Report 40 APPENDIX A. TO NEW YORK RESPONSE YEAR APPENDIX B. Internal Audit Finding, Year APPENDIX C. EXTERNAL AUDIT FINDING REPORT, YEAR APPENDIX D. EXTERNAL AUDIT FINDING REPORT, YEAR APPENDIX E. Internal Audit Finding Report APPENDIX F. What Could Go Wrong Checklist 88 vii

8 CHAPTER I. INTRODUCTION 1.1. Background Data intrusion and fraudulent access is a huge global problem. IT systems managers are charged with protecting privacy and personally identifying financial information, and are responsible for building access controls capable of protecting the integrity of financial statements and safeguarding intellectual property in a strong and growing regulatory environment against a world-wide threat force that never sleeps. Protecting privacy and information issues is very important for the financial business, such as bank and insurance industries. Industries have to complete the security issues in order to comply with the government regulation. This is also to complete the business ethics and good corporate government issues. Any company could not gain customers and public trust if they were not running the business ethics and good corporate governance to manage their business. Systems designers are challenged to create authentication strategies and application development systems needed to secure the customer s data. Data center have to manage their data safe, create backup and servers management procedures. Users and employees should be made aware about having a secure computer activity at the office. To improve the IT system security, IT Compliance is no doubt needed. Any good IT system security wouldn t run well without any good compliance act

9 2 In the business, compliance often considered as wasting company budget. In a company who apply compliance, often the business process is getting more difficult for users because there is some compliance standards added in the operation procedures. But considering keeping the security of IT system is getting more and more important, thus nowadays more company implement compliance standard in their IT business system process. This thesis will give you information about the importance of IT compliance implementation to your company business. It will gives you a picture that running a compliance in your company is not just a waste of budget, but also accelerate the business process thus maximize the company s profit. From there we can see what factors important to support the implementation of compliance in a company Company Profile PT Avrist Assurance Overview PT Avrist Assurance (Avrist) is a life insurance company. Avrist was named PT Asuransi AIA Indonesia (AIAI) and was joined venture with American International Assurance Company, Limited (AIA) an AIG life assurance group company. Since the separation from AIA, The company changed its name and the whole company identity to Avrist. The company was first established in 1975 under the name of PT Asuransi Jiwa Ikrar Abadi. It changed its name to PT Asuransi AIA Indonesia in 1984, and

10 3 changed its name again to PT Avrist Assurance on Oct 22 nd, From the beginning of its establishment, Avrist has already been in life insurance industry for almost 35 years. In January 27 th, 2010, PT Avrist Assurance taking a financial partner with a German investment bank, DEG (Deutsche Investitions-und Entwicklungsgesellschaft mbh). DEG has a AAA rating the highest credit rating of the agencies Fitch Ratings, Moody s and Standard & Poor s. DEG takes a 23-per cent participation in PT Avrist Assurance (Avrist). With its new autonomy, Avrist is able to both position itself as an independent life assurance company and implement new strategies. With a strong financial fundamental and capital and also a great long history in Insurance business in Indonesia, Avrist is strengthen its commitment to focus on fulfilling the customers needs and growing its business partner with high professionalism and positive solutions of wealth accumulation and wealth protection services. As a life insurance company, Avrist is strongly committed to provide innovative products and quality services to meet the changing needs of its customers. The company is becoming more agile in providing life assurance needs for the customers and to meet the company goals: to have one Avrist policy in each Indonesian household. Avrist had a wide range of products in Accident and Health, Credit Life and life insurance category. The products are marketed to both individual and corporate market. In 2008, Avrist also had pay for more than 1500 claims with a total

11 4 118billion rupiahs 1.With the competitive price offered, Avrist then awarded Best Insurer award from Euromoney 2 in year The Best Insurer award from Euromoney criteria are: Best innovation, products range, claims resolution and price Avrist s Organization Structure Based on the company s goal, PT Avrist assurance provides a wide range of products to satisfy all range of Indonesian customers. The wide ranges of products are reflected in the company s organization structure, showed below in figure 1.1. Figure 1.1 Avrist's Organization Structure Departments on the company are divided into 2 big sections, the Sales and the Business Support sections. 1 Oct 28 th, 2009, Bisnis Indonesia, Pembayaran klaim Padang. 2 AIA Indonesia Raih Euromoney Insurance Awards, Thursday, April 16 th 2009, nce.awards 3

12 5 The Business Support section contains departments to support the business operation such as Operation Department and IT or usually known as MIS and DC. The departments are determined by the company s products and the services it gives to the customers; it is further separated by Individual Services and Group Services. Individual services manage only products for individual customers and Group services manage products for group or corporate customers. The company sales section is usually called the Distribution Channel section. Distribution Channel sections are Agency, Bancassurance, Employee benefit and Pension Departments. Agency department contains agency forces (assurance agents), inside the department are people to manage the agency forces such as recruitment and development (training), operation support, agency for employee benefit (EBS Agency) and event organizers. Bancassurance is a department that manages businesses related to bank partners. Corporate Relationship department manages departments who are related to corporate partners. The department manages Employee Benefits and Pension. The Marketing section contains Marketing and Profit Center Department. The departments function is to make sure that the company (Avrist) is known by all Indonesian citizens. Marketing department also research on who is the company s current and future customers. The Profit Center department manages on how the company earn its revenue, including designing the company s products. Strategic, Financial, Admin and Marketing are separated section to maintain the company s business strategy and operation. Strategic section manages the