Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7

What is Information Systems Risk?

• Read selected sections of The Current Impact of Information Technology on Internal Audit Departments, a report by Deloitte & Touche LLP for the Institute of Internal Auditors Research Foundation.
  • Executive Summary
  • Section 1 - Organization Use of Technology (skim this section)
  • Section 2 - Auditing New Technology
• Read Marchany, Seven-Step IT Risk Assessment, IT Audit Forum, March 1, 2002
• Read Oliphant, An Introduction to Computer Auditing - Part Deux, No. 2, IT Audit Forum
• Read Hall, New Areas for Your Risk Management Program, IT Audit Forum, March 1, 2001
• Read Hall, Additional Areas for Risk Management to be Concerned About, IT Audit Forum, April 15, 2001
• View the PowerPoint slides on Information System Risk in the COURSE MATERIAL section of Blackboard.


Now let's look at a specific example.  Read the following article (in the COURSE MATERIAL section of Blackboard) about how Ford and GM have implemented technology and think about business-related information system risks that arise as a result. Identify the IS risks that are associated with business or organizational use of these information technology. To get started, imagine how each organization uses information technology in its affairs and think of the consequences of the organization being abruptly without the use of its information systems.

• White, G. L. 1999. "How GM, Ford think Web can make splash on the factory floor." The Wall Street Journal (December 3): A1
• Compare your assessment of the IS risks with the suggested solution (in the COURSE MATERIAL section of Blackboard) from an IS audit class at Georgia State University.  DO THIS AFTER YOUR HAVE GIVEN IT SOME THOUGHT OF YOUR OWN!
  
  
• Here are some other resources you might find interesting:

• Ernst & Young's Annual Information Security Surveys - 2001, 1998 (US), 1998 (Global)
• The AIPCA's Report of the Special Committee on Assurance Services section on Effect of Information Technology on the Assurance Services Marketplace, and Applications and Influences on Organizations.

Jacksonville Jaguars Case

Here are some additional articles that will give you some background on smart cards and their use in business.

• Here are some additional articles that will give you some background on smart cards and their use in business.

  • Wolpoff, Cashing Out: Ravens Might Use Smart Cards, Baltimore Business Journal, June 6, 1997
  • GSA, Smart Card Tutorial (multimedia presentation)
  • O'Sullivan, Smart cards pose tax problem for merchants, ABA Banking Journal, December 1996

The Professional Standards

• Read SAS #80 (You can search Lexis/Nexis from the Baylor Libraries Electronic Resources Home Page. Use the Business Database and find the text in the Journal of Accountancy. Try using "electronic evidence" as the keyword search.)
• Read New SAS Likely to Affect All Auditors, Journal of Accountancy, January 1997
• Read Williamson, The Implications of Electronic Evidence, Journal of Accountancy, February 1997
• Read SAS #94 (You can search Lexis/Nexis from the Baylor Libraries Electronic Resources Home Page. Use the Business Database and find the text in the Journal of Accountancy. Try using "effect of information technology" as the keyword search.)
• Read Tucker, IT and the Audit, Journal of Accountancy, September 2001
• Read Ratcliffe & Munter, Information Technology, Internal Control,and Financial Statement Audits, The CPA Journal, April 2002
• Review SSAE #1 (You can search Lexis/Nexis from the Baylor Libraries Electronic Resources Home Page. Use the Business Database and find the text in the Journal of Accountancy. Try using "Statements on Standards for Attestation Engagements No. 1" as the keyword search and look for an April 1999 date. You may have to scroll down a few pages to get to this statement as it is presented with some others.)
• Review the following ISACA Standards
  • Standards for Information Systems Control Professionals
  • Due Professional Care
  • Audit Evidence Requirement
  • Materiality Concepts for Auditing Information Systems

COBIT - Control Objectives for Information and Related Technology

Read the COBIT Executive Summary
Read Colbert & Bowen, A Comparison of Internal Controls: COBIT™, SAC, COSO and SAS 55/7
Read Lainhart, COBIT®: An International Source For Information Technology Controls
Look at the COBIT Control Objective example in the COURSE MATERIAL section of BLACKBOARD

Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7 | Top

Conducting an Information Systems Audit

• Read Boritz, Chapter 9
• Read the following ISACA Guidelines
  • Planning the IS Audit
  • Audit Documentation
  • Audit Considerations for Irregularities
  • Organisational Relationship and Independence
  • Use of Risk Assessment in Audit Planning
• Read Fennelly, Audits from Hell: Find Out How to Avoid Those Audit Nightmares
• Review the PowerPoint slides for this topic in the COURSE MATERIALS section of Blackboard.

Auditing Systems Development Activities

• Review Boritz, Chapter 4. Concentrate on the "Controls over Systems" and "Role for Auditors in the System Development and Acquisition Process" sections.
• Read the following ISACA guidelines
  • Effect of Non-Audit Role on the IS Auditor's Independence
  • Organisational Relationship and Independence
• Read Oliphant, An Introduction to Computer Auditing - Part Deux, No. 14, Part A, ITAudit Forum, December 1, 2000
• Read Oliphant, An Introduction to Computer Auditing - Part Deux, No. 14, Part B, ITAudit Forum, January 1, 200. Just read the section about auditing the SDLC activities.
  
• Review the following SDLC Audit Programs
  • Blue Cross Blue Shield of North Carolina
  • Gallaudet University
  • Delta Airlines

Controlling Systems Development Projects - Case Studies

• Read Oz, E. 1994. When professional standards are lax: The CONFIRM failure and its lessons. Communications of the ACM 37(10), 29-36.
• Read Stanford, The project from hell, Computerworld, September 4, 1995.
• Skim Keil & Mann, The Nature and Extent of IT Project Escalation: Part I, IS Audit and Control Journal in the COURSE MATERIALS section of Blackboard.
• Skim Keil & Mann, The Nature and Extent of IT Project Escalation: Part II, IS Audit and Control Journal in the COURSE MATERIALS section of Blackboard.

Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7 | Top

Module 4—Internal Controls

Auditing General Controls

• Review the following audit plans
  • General Controls Review - Parker
  • General Controls Review - Siegal
  • General Controls Review - Summerson
  • Access Controls
  • Computer Facility Physical Security
  • Disaster Recovery Plans - Ray
  • Disaster Recovery Plans - Johnson
• Review the Wholesale Widgets Case from Boritz. Look at the narratives of the computer operations (Exhibits I and II). Then look at the Control Evaluation Guide for General Controls (it has several parts). Examine the entries that have been provided to see what type of evidence needs to collected to assess the level of general controls over computer operations.

Auditing Application Controls

• Read Oliphant, An Introduction to Computer Auditing - Part Deux, No. 15A, ITAudit Forum, February 1, 2001
• Read Oliphant, An Introduction to Computer Auditing - Part Deux, No. 15B, ITAudit Forum, March 1, 2001
  
• Read Upper Plains Auto Rentals case in the COURSE MATERIALS section of Blackboard.

Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7 | Top

Module 5—CAATS

Computer Assisted Audit Tools & Techniques (CAATS)

• Review Boritz, Chapter 10.
• Read Kalaba, The Benefits of CAATs
• Read P. J. McFadden, Seven good reasons to test the entire population versus just a sample, IS Audit & Control Journal II: 14-16, in the COURSE MATERIAL section of Blackboard.
• Read Kalaba, The Benefits of CAATs
• Read Le Grand, Use of Computer Assisted Audit Tools and Techniques - Part I
• Read ISACA standard on Use of Computer Assisted Audit Techniques.
• For additional information:
  • Visit AuditTools.com and review their references on CAATs (IDEA is software similar to the ACL package we will be using in this course).

Parallel Simulation

• Read the Wacky Widgets Bonus Calculation Case.
• Go to COURSE MATERIALS in Blackboard and download the data file used by Wacky Widgets to calculate the bonuses.
• Using the data file you obtained, prepare a parallel simulation in EXCEL to calculate the bonuses. If you need help importing the data file into EXCEL, there is a help sheet in COURSE MATERIALS in Blackboard.
• Compare your results to those generated by the client's system found in COURSE MATERIALS in Blackboard .
  

Introduction to ACL

• Read ACL for Windows Workbook, Chapters 1 and 2.
• Read Paul Warner, ACL for Windows, The CPA Journal, November 1998.
• Read Lanza, Take My Manual Audit, Please, Journal of Accountancy, June 1998.
• You may want to view the ACL Demo (6.2 MB) in Blackboard. You can also download a zipped file (1.9 MB) there.
• There are some tips sheets for specific ACL commands that you may find useful in the COURSE MATERIAL section of Blackboard .
  • Getting Started
  • JOIN command

Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7 | Top

Module 6 - Using ACL

Understanding Data with ACL

• Read Paul Warner, ACL for Windows, The CPAJournal, November 1998.
• You may want to view the ACL Demo (6.2 MB) in Blackboard. You can also download a zipped file (1.9 MB) there.
• Read Norwood Office Supplies, Inc. Case.

Manipulating Data with ACL

• Read Norwood Office Supplies, Inc. Case.

Gathering Evidence with ACL

• Read Norwood Office Supplies, Inc. Case.

Module 7—Emerging Topics in IS Auditing

Digital Analysis

• Read The Power of One
• Read Steve Stanek, Applying Benford's Law to Internal Audit
• Read Mark Nigrini, I've Got You Number, Journal of Accountancy. May 1999

CPA WebTrust

• The AICPA has initiated system assurance product called WebTrust. Visit the AICPA site, as well as the WebTrust site, and learn about this product.
• Read Richard J. Koreto, In CPAs We Trust, Journal of Accountancy, December 1997.
• Read Carl Pacini and David Sinason, The Law and CPA WebTrust, Journal of Accountancy, February 1999.
• Read Rand & Adams, CPA WebTrust™: High-Tech Assurance, Frontier Opportunity.

Systrust

• The AICPA has developed a systems reliability assurance service called SysTrust. Visit the site and learn about the product.
• Read Carl Pacini, Stephen E. Ludwig, William Hillison, David Sinason and Leslee Higgins, SysTrust and Third-Party Risk, Journal of Accountancy, August 2000.
• Read Efrim Boritz, Erin Mackler and Doug McPhie, Reporting on Systems Reliability, Journal of Accountancy, November 1999.

Module 2 | Module 3 | Module 4 | Module 5 | Module 6 | Module 7 | Top