Special Integrators Information Systems Audit

Republic of Turkey Ministry of Treasury and Finance has been published “e-Document Special Integrators Information Systems Audit Guide” on 19 November 2019 (https://ebelge.gib.gov.tr/duyurular.html). The guide has been prepared for determining the procedures and principles regarding the realization of the information systems audit regarding whether the information systems related to the special integrator’s activities and processes related to the e-Document applications of the Special Integrators, which will be permitted by the Turkish Revenue Administration (GIB).

In accordance with this guide, those who have been authorized by a private integrator institution and the institutions whose evaluation processes continue will be audited by the independent audit institutions authorized until 31 December 2020. The necessary permissions of the integrators who do not perform audit will be cancelled and sanctions can be applied according to the results of the audit report. The audit will be valid in two years and will be repeated every 2 years in accordance with the guide. As disclosed in the guide, the authority to perform information systems audit has been given to independent audit institutions the framework of the Banking Regulation and Capital Markets Legislation. “GÜRELİ Yeminli Mali Müşavirlik ve Bağımsız Denetim Hizmetleri A.Ş.” is one of the audit institution authorized to perform information systems audit under the legislation and regulation of Capital Markets Board and Banking Regulation and Supervision Agency. Our professionals are be able to provide the necessary support required to ensure compliance with “e-Document Special Integrators Information Systems Audit Guide” and regarding information systems audit.

“e-Document Special Integrators Information Systems Audit Guide”

Critical information systems assets and actors

In scope of SIISA, the guide has been disclosed definitions and explanations regarding critical assets and actors.

Critical Information Systems Assets

Those critical assets existing within the system which can be concealed the fraud by falsifying the records or fraudulent activities which will severely affect the confidentiality, integrity, source or accessibility of the system:

Primary Assets: Those assets include information for services provided regarding “Taxpayer/Users Profiles, Transactions, Secure Communications Paramaters, e-Invoice, Archive, e-Delivery, e-Document Management
Secondary Assets: Those assets are aiming to protect primary assets which include cryptographic keys used by special integrators, usernames, access code, hardware security module, specialized equipment, active network equipment, servers, personal computers and other software etc.
Actors

The threats have been identified under authorized and non-authorized users (Hackers, Cyber Terrorists, etc.).

Information Systems Management

In addition, the necessary control mechanisms must be ensured and operated in information systems management are disclosed under following headlines:

SIISA Process and Results

The responsibilities of the special integrator regarding the SIISA, the content and creation of the SIISA report and the law enforcement procedures on special integrator can be applied by the GIB depending on the SIISA report which are clearly defined in the SIISA Guide.

GIB may also apply different law enforcement procedures in accordance with the result of the SIISA report. Accordingly;

Unqualified Opinion: If the auditor expressed an unqualified opinion as a result of the audit, the special integrator notifies GIB within 15 days with presenting its action plan which includes specific measurement of considering defects or improvements and completion date regulation and presenting its action plan would receive a letter for warning. GIB has authority to make changes regarding the completion date of the action plan.

Qualified Opinion or Disclaimer of Opinion: If the auditor expressed a qualified opinion or disclaimer of opinion as a result of the audit, the special integrator has received a letter for immediate repeat of audit within 90 days. If the auditor expressed a qualified opinion or disclaimer of opinion again, the activity of the special integrator has been suspended until the new audit result in which the special integrator must have unqualified opinion. If the suspension of the operating activities has been determined due to expressing disclaimer of opinion in 2 times, the suspension period of activity cannot be determined as less than 3 months.

Adverse Opinion: If the auditor expressed an adverse opinion as a result of the audit, the operating activity of the special integrator has been suspended immediately in a temporary period of time. The special integrator must submit a new audit report which expresses unqualified opinion to GIB within 6 months otherwise, the authority of the special integrator is cancelled. The special integrator is obliged to provide information about new auditing before and after the audit process including necessary documentation to GIB within 6 months.

Subjects and Headlines of SIISA (ÖEBSD)

ÖEBSD_SER: International Certifications, Penetration Testing Services and IT (BİS) Report

In this evaluation, main perception of this certification is aim to control the existence and compliance of international certifications that special integrators must enhance suitable formation of penetration tests.

· ÖEBSD_SER.1 International Certifications, Penetration Testing Services and IT (BİS) Report: The existence of certificates of the special integrator such as ISO/IEC 20000 Information Technology Service Management System, ISO/IEC 27001 Information Security Management, ISO 22301 Business Continuity Management, Penetration Test Report and BİS Report shall be controlled accordingly.

· ÖEBSD_SER.2: Internal Control and Control Mechanisms: The existence of internal control and audit processes of the special integrator and the results of these mechanisms shall be controlled in compliance with the necessary certifications.

ÖEBSD_PER: Nature of Personnel

The classification aims for controlling whether special integrator employs the appropriate quality and number of personnel in accordance with the services provided by the special integrators.

ÖEBSD_SIS: Evaluation of System and Security

The classification aims for controlling the infrastructure that special integrators must comply with their information systems, their architectural system analysis and all kinds of physical elements with ensuring business continuity, the creation and operation of the necessary security and risk assessment processes, change management, the creation of audit trails and the requirements in case of outsourcing.

Merkez Adres:	Spine Tower Büyükdere Cad.No:243 Kat: 25 34398 Sarıyer / İstanbul – Merkez Ofis
Telefon:	444 9 475 – (0212) 285 01 50
İnternet Sitesi:	www.gureli.com.tr
Eposta Adresi:	KVK@gureli.com.tr

Merkez Adres:	Spine Tower Büyükdere Cad.No:243 Kat: 25 34398 Sarıyer / İstanbul – Merkez Ofis
Telefon:	444 9 475 – (0212) 285 01 50
İnternet Sitesi:	www.gureli.com.tr
Eposta Adresi:	KVK@gureli.com.tr

Special Integrators Information Systems Audit

Special Integrators Information Systems Audit

Services

Çerezleri Kabul Edin