Type:
Solution Manual
Resource:
Core Concepts of Information Technology Auditing
Edition:
1st Edition
Author(s):
James E. Hunton Stephanie M. Bryant Nancy A. Bagranoff
IT Audit Solutions Manual Chapter One Discussion Questions 1-1. Describe the two objectives of IT Governance. Which do you think is more important? The two objectives of IT governance are to: (1) use IT to promote an organization’s objectives and enable business processes and (2) to manage and control IT-related risks. As with many discussion questions, there is no “right” answer here. Both objectives are important. The answer could vary by industry and organization type as IT-related risks could be greater for some businesses than for others. Similarly, the use of IT for strategic business purposes could mean the difference between business failure and success. 1-2. Describe the various types of transactions that an IS might process in the course of acquiring raw materials for production. Acquiring raw materials for production involves ordering the materials, receiving the materials, and paying the vendor. The information system would record each of these transactions and the data associated with them. For example, data entered in the system would include the supplier name, the terms of payment, shipping data, the name of the person making the purchase, and so on. 1-3. This chapter described several types of work done by IT auditors. Using the Internet, can you identify any other types of work these auditors might do? Several Internet sites provide information about the work of IT auditors. Professional organization sites such as www.isaca.org and www.iia.org provide insight. The web sites for various auditing firms, such as www.ey.com or www.kpmg.com are also helpful. Auditing firms typically post services or solutions as a menu item at their web site. Selecting assurance services will provide you with information about the various assurance service lines offered by the company. 1-4. IT auditors often have technical skills related to specific software. One such software specialization area is enterprise resource planning (ERP) applications. Explain how an IT auditor could acquire and maintain knowledge about one of these software packages. Knowledge about specialized software, including enterprise systems, is most often obtained through work experience. Auditors working for large professional service firms will “apprentice” on job assignments that involve technologies new to them. A company may send the IT auditor
to formal training or provide them with time to take online courses. Still, practical experience is always needed to master these systems. IT auditors wishing to learn how to audit a specialized technology may request working on engagements where clients use these IT systems. Internal IT auditors are limited in their experience to the technologies used by their firms. 1-5. CISA is the most common credential obtained by IT auditors. Discuss how this certification would add value for someone practicing IT auditing. The CISA credential, like any other widely respected certification provides an IT auditor with credibility. An auditor with this certification will have a competitive advantage in the market place. Professional service firms encourage their employees to acquire certifications as they cite them when proposing work to clients. Someone purchasing services from an IT auditor is assured that if the professional has the CISA certification, they have passed a knowledge test and are upto-date on current practices. 1-6. The AICPA recently created a new credential for CPA's who have specialized training and experience in IT. Discuss whether or not you think the CITP is likely to be a sought after credential by both IT audit practitioners and those contracting with IT audit professionals. An example of an individual who has the CITP credential is Kevin Martin, of Kevin Martin and Associates, an accounting/consulting firm specializing in implementing mid-level accounting information systems. Kevin is a CPA who has personally obtained many specialized technologyrelated certifications. He felt that the CITP would provide him with a competitive advantage. The CITP allows a practicing accountant to differentiate him or herself with respect to knowledge of IT. It is difficult to say how widely this will be received but it makes some sense to have a specialized “add on” to the CPA, which remains the most widely recognized and respected professional certification for accounting professionals. 1-7. How do IT audit guidelines, such as those issued by ISACA, help an IT auditor to do their work? IT auditors need frameworks and guidance in order to make sure that they have reviewed information systems risks and controls sufficiently to have an opinion about them and to offer management suggestions. Risks and controls vary with different technologies. As a result, no one auditor can hope to have sufficient knowledge to recognize all the risks associated with each, nor can the IT auditor be knowledgeable about the controls or sets of controls best able to mitigate risks. Auditing standards help lend structure to IT audits. 1-8. ISACA recently made their standards, guidelines, and procedures "open." This means that they share them at no cost - anyone can download them from the ISACA web site. Discuss the value of such a strategy. While a professional organization might wish to profit in some way by keeping standards private and charging for them, if the aim of a profession is to help develop and improve the profession,
then open distribution of the standards is imperative. Open distribution will assure that a maximum number of IT audit professionals will have the benefit of these standards and guidance. It should serve to increase the quality of work that IT auditors do. Enhancing the professionalism of IT auditors in the long run will increase the stature of the professional organization to which they belong.
EXERCISES 1-9. In 2001, the Auditing Standards Board of the AICPA issued Statement on Auditing Standards No. 94 - The Effect of Information Technology on the Auditor's Consideration of Internal Control in a Financial Statement Audit. This standard is likely to increase the involvement of an IT auditor on a financial audit engagement. The standard requires auditors to consider how an organization's use of IT might affect internal controls. The standard explains that auditors may determine that it is more effective and efficient to assess control risk than to perform detailed testing of account balances and transactions (i.e., substantive testing). Required: Explain how SAS No. 94 is likely to impact the work of both the financial and IT auditor. Both financial and IT auditors are likely to increase the amount of attention they pay to internal controls as a result of both SAS No. 94 and the Sarbanes Oxley Act of 2002. Since almost all AIS today are computerized, financial auditors are likely to rely more on IT auditors in their evaluation of internal controls, particularly application controls. In talking with some Big Four IT audit practitioners, it appears that IT auditors are increasing the time they spend on financial audit engagements. They're doing internal control evaluations up front in the engagements, and their work is increasing from about 5 to 10% of the engagement time and cost budget, to 20% or more. 1-10. Many large business, government, and not-for-profit organizations have adopted CobiT® as a framework for IT governance, including the U.S. House of Representatives. IT governance has two primary components: (1) acquisition and deployment of IT to promote an organization's objectives and enable business processes and (2) management and control of IT-related risks. Required:
Assume that you have been asked to consult a Fortune 1000 business enterprise about implementing IT governance. Using the framework shown in Figure 1-1, identify an implementation plan with six or more specific activities you would recommend. The ISACA web site has several examples and case studies of implementations using CobiT, e.g., implementation at Charles Schwab. The following is an example of how the IT governance framework might be used for a Fortune 1000 company. 1) The process begins with management setting objectives for IT. Specific activities might include, surveying competitive use of IT, analyzing the current organization's use of IT (maps and flowcharts would be useful here), inviting IT vendors to discuss new products on the horizon, and doing a high level IT risk assessment. 2) Management needs to compare where they want to be (strategic objectives) with where they currently are (current performance). This will require several meetings that will include some or all of these groups: IT management, internal audit, external auditors and consultants, the board, and general management. 3) The results of the comparison of objectives with current performance will lead to identification of specific IT activities. These activities might include: implementing an enterprise-wide software solution, adopting customer relationship management or other ebusiness software, creating a data warehouse, implementing a plan for systems reliability assurance, improving the return on investment for IT resources, creating a knowledge management system, or improving automation in business processes, such as manufacturing or procurement.
IT AUDIT SOLUTIONS MANUAL
CHAPTER TWO
ETHICAL AND LEGAL ISSUES FOR IT AUDITORS
DISCUSSION QUESTIONS 2-1 Who is responsible for prevention and detection of irregular and illegal acts? Management is responsible for the prevention and detection of irregular and illegal acts, not the IT auditor. 2-2 What types of written contracts do auditors typically examine? What are the three elements the auditor must ensure a contract contains? Auditors typically examine written contracts dealing with purchase and sale of goods and services. Auditors should look to ensure that there at least three elements contained in the contract: offer, consideration and acceptance. 2-3 What cannot be included in an employment contract?
1
An employment contract cannot include that the employee must work for the employer for a stated period of time. 2-4 What stipulation of non-disclosure agreements dealing with trade secrets differ from confidentiality agreements? The term of non-disclosure agreements may last indefinitely. 2-5 When is the contract element of ‘consideration’ required and not required in a noncompete agreement? Why? If a non-compete agreement is signed before or immediately after employment, consideration is not required because the employment itself is the consideration. If an employer requests an employee to sign a non-compete agreement during or upon termination of employment, additional consideration on the part of the employer may be required since the employment has already been established. 2-6 What does computer or ‘cyber’ crime mean? Give ten examples. Computer or ‘cyber’ crime is the direct or indirect use of computer and communication technologies to perpetrate a criminal act. Acts include any behaviors determined by states or nations to be illegal. Examples include: ▪
hacking into an entities network
▪
stealing intellectual property
▪
sabotaging a company’s database
▪
denying service to others who wish to use a Web site
▪
harassing or blackmailing someone
▪
violating privacy rights
▪
engaging in industrial espionage
2
▪
pirating computer software
▪
perpetrating fraud
▪
any instrumental use of a computer and/or the Internet to the assist or carry out a crime, such as an illegal narcotics trafficker who uses the Internet to coordinate sales and logistics.
2-7 What are the three requirements of an invention in order to receive a patent? An invention must be novel, useful, and not of an obvious nature. 2-8 What are four general types of intellectual discoveries covered under patent law? ▪
machines
▪
human made products
▪
compositions of matter
▪
processing methods
2-9. What does a breach of availability mean? A breach of availability occurs when an authorized user is prevented from timely, reliable access to data or a system, such as a denial of service attack. 2-10 What is the responsibility of a manager in an organization for individual privacy rights? Mangers are obligated to institute proper internal controls aimed at protecting the confidentiality of personal information that is collected during the normal course of business
3
EXERCISES 2-11 In September 1997, eBay revolutionized the concept of on-line marketplace exchanges by holding auctions over the Internet. Competitor on-line auction sites soon followed, such as Yahoo! and Amazon.com, and a new industry was born. In spring 1999, a related business model emerged—auction aggregators. The auction aggregator model was to search on-line auction sites, and offer listings and price information to users. For example, if a user of an auction aggregator was looking for, say, a particular rare coin, the aggregator would search eBay, Yahoo! and Amazon.com for the coin, and display the description and price to the user. Bidder’s Edge was one of the most notable auction aggregators. The rise of auction aggregators was sparked by a court case which found that ‘facts’ are public property, even if such facts are collected through the ‘sweat equity’ of another entity (Feist Publications, Inc. versus Rural Telephone Service Co., 499 U.S., 340). eBay decided to sue Bidder’s Edge for intellectual property right violations, even though the Feist decision weighed heavily in favor of Bidder’s edge. Various consumer groups, on both sides of the argument, rallied to the cause. As a result, H.R. 354 and H.R. 1858 were introduced in congress in 1999. H.R. 354 basically asserts the ‘sweat of brow’ doctrine, which states that ‘facts’ which are collected as a result of substantial investments of time, personnel and effort are protected intellectual property of the collector. HR 1858, on the other hand, argues that it is in the public interest for Internet users to be able to obtain and compare information from various databases; thus, collected facts are public property.
4
Required: Discuss the pros and cons of H.R. 354 and H.R. 1858. In responding to this question, please consider the positions taken by Coalition Against Database Piracy (CADP) and NetCoalition.com in the debate. Answer: The answer to the question posed above will certainly stir controversy, as there are legitimate arguments on both sides of the debate. You should encourage the students to visit the web sites of CADP and NetCoalition.com, as well as to read H.R. 354 and H.R. 1858. This is a great exercise for getting students involved in public policy issues, and to get them involved with Internet research.
2-12 In 1999, a company called DoubleClick was formed. The business model of DoubleClick was to track click-stream data, stored on cookies, for advertisers. There was little consumer opposition to DoubleClick, as the company did not collect personal information from users or their computers; rather, users were only identified by an ID number. DoubleClick offered an ‘opt out’ policy, although it was difficult to find on its website. In 2000, DoubleClick formed Abacus Online, a click stream database where users’ click-streams were linked to personal information (with an opt-out policy) only when they made catalog purchases, completed on-line surveys or participated in drawings. Then, DoubleClick decided to merge the two databases to provide tailored information to advertisers. This strategy was vehemently opposed by Internet privacy rights groups. After much public outcry, DoubleClick abandoned its merger plans, at a sunk cost of $1.7 billion. Required: How important is ‘privacy’ to the ultimate survival of the Internet as a viable platform for e-commerce?
5
Answer: While a few students might argue that ‘privacy’ does not and should not exist on the Internet, the vast majority of students will likely support some level of Internet privacy. This question should evoke some stimulating debate. Required: What have the private sector, U.S. Federal government and the European Union done to protect Internet Privacy Rights? Answer: This question will require students to research privacy issues over the Internet, where they will find dozens of privacy rights groups. With respect to the private sector, students should at least be aware of the P3P, which means Platform for Privacy Preferences Protection. Regarding the U.S. Federal government, students should refer to the Federal Trade Commission’s (FTC) web site for recent positions on Internet privacy. Referring to the European Union, students should, at a minimum, note “The Directive on Data Protection,” which was the Union’s attempt to harmonize privacy policies.
6
IT AUDIT SOLUTIONS MANUAL Chapter 3 Discussion Questions 3-1. Why is it important to identify and assess IT risk prior to developing IT internal controls? Auditors who concentrate on internal controls, rather than risk, might over-control. IT internal controls should serve the purpose of mitigating risk. They do not exist for their own sake. By assessing risk first, IT auditors focus only on those controls that add value by accomplishing this goal. 3-2. This chapter identified four types of IT risks: business, audit, security, and continuity risks. Discuss the similarities and differences among them. Business risk concerns inability to meet business goals and objectives. Audit risk stems from the failure of the audit to accomplish its goals and objectives. Security risk concerns data access and integrity. Continuity risk concerns the information system's availability and back up process. The risks are similar in that each results in an IT failure that impacts business effectiveness and efficiency. They all result from a failure in IT governance. They are different in the sense that they are each associated with a different aspect of risk and also in the nature of the impact they might have. 3-3. One approach to risk assessment is to identify threats, vulnerabilities, and acceptable risk levels. What vulnerabilities might exist for a business organization’s intranet? There are several threats and associated vulnerabilities associated with a business organization's intranet. Vulnerabilities include impaired data confidentiality and privacy through remote or on-site access by unauthorized users, increased exposure to programmed threats such as viruses through remote or on-site access by unauthorized users and lack of maintained anti-virus software, and unauthorized access to assets by unauthorized users. 3-4. Describe three risk indicators that might be associated with a company’s intranet. There are many risk indicators associated with a company's intranet. Network and ebusiness security are discussed in Chapters 6 and 7. Three risk indicators for a company's intranet would be: 1. Failure to maintain firewall security 2. Failure to maintain intrusion detection software 3. Failure to maintain user profile security, which includes multiple access levels and passwords
3-5. Why would an organization accept some level of risk? It is pretty much impossible to control against every type and level of risk and it is certainly not going to be cost-effective to do so. IT managers will often say that they have trouble sleeping at night because they know that they're vulnerable to risks. The budgets just aren't big enough to control for everything. Organizational entities need to assess risk and analyze it to determine what's acceptable and what isn't. They also need to weigh the costs of controls against various risks and their likelihood of occurrence. 3-6. What is the difference between COSO and ISO 9000? COSO is an internal control model or framework. ISO9000, on the other hand, is a set of standards of quality control. Both internal controls that protect IT assets and quality controls that improve processes can contribute to organizational effectiveness as they increase confidence. ISO9000 certification provides external organizational stakeholders with some comfort regarding quality. COSO does not entail certification and so, in that sense it may be more difficult to convey to the public that an organization has incorporated their internal control framework. 3-7. Discuss each of the five components of COSO. Which do you think is most important to an effective internal control system? The control environment is the overall organizational attitude toward control, especially that of top management. Because this attitude is likely to drive internal control emphasis, funding, and compliance in an organization, it is probably the most important component. Risk assessment is another component, which emphasizes the identification, measurement, and evaluation of risk. Control activities are the specific internal control procedures and policies. Information and communication concern the need to acquire and communicate information necessary to fulfill management strategies and objectives. Finally, monitoring ensures that an internal control system continues to operate as intended. 3-8. Go to the www.aicpa.org and view the new Trust Services Principles and Criteria. How does this new model incorporate SysTrustTM? The AICPA combined WebTrust and SysTrust principles and criteria under a new set of Trust Services Principles and Criteria, effective January 1, 2003. The SysTrust and WebTrust services had some commonalities that the AICPA sought to use to create a harmonized trust framework. The primary change is in terms of structure, order, and working of Principles and Criteria in order to obtain harmony. There are no new principles but the old SysTrust Principle of Maintainability is now subsumed under other principles. The new set of Principles are: Security, Availability, Processing Integrity, and Online Privacy and Confidentiality. SysTrust now has a two-month minimum