Chapter 2— Auditing It Governance Controls

In 1995, John Chambers joined Cisco Systems as president and CEO. After six years under the supervision of Chambers, the company went from generating $2.2 billion in annual sales to $22.3 billion. As a result of the market downturn in 2001, the company suffered its first loss and laid off 18% of its workforce. Chambers quickly realized Cisco was in need of significant organizational restructuring if Cisco were to survive and thrive the downtown. This change shifted the company from a decentralized firm that only focused its three work silos of Marketing, Engineering and Sales to segregated and specific customer groups to a centralized firm that focused on collaboration and relevant technologies for given customer groups. This

Due to the high risk to information systems, many organizations do not conduct a periodic risk analysis and are not able to know where they stand. This may seem blatantly obvious, but it is something many of the healthcare organizations continue to wonder about. In order to improve the effectiveness and proficiency of the health care system, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, includes Administrative Simplification requirements for HHS to accept national standards for electronic health care operations and code sets, unique health identifiers, and security (Sullivan, 2014). Enforcement of the Privacy Rule that began on April 14, 2003 for most HIPAA covered objects.

Facilitates the flow of documents/information to and from the unit, and ensures financial integrity and consistency by controlling, in accordance with policy, purchase and payment authorities, receipt of goods and services, requisitions, reconciliation of accounts and travel accounts.

With this first policy an organization with prohibit or allow the usage of equipment and/or accounts depending on the individual’s permitted access.

Information technology (IT) has become increasingly sophisticated and complex, escalating the ongoing change within Kudler Fine Foods. As IT information is adopted within the organization, automation controls many processes within the Kudler’s environment. As Kudler has become more virtualized, a need for increased trust and assurance in the relationships with consumers, partners and suppliers. The swell of e-commerce business has created new ways of conducting an audit. Statement on Auditing Standard 94 (SAS 94) requires that the auditor understands the technological aspect of the organization in order to grasp the internal controls and the assessment of control risks for a proper audit

An important decision for any shareholder is deciding whether or not to do business with that company. When a business is audited, the operations are reviewed to make sure that nothing is being hidden. An auditor will review the company’s financial statement and practices to confirm that each are direct and correct. The financial statements are the business’s way of representing them and showing that they are following the Generally Accepted Accounting Principles. The audit process is an important one because it provides a platform for the auditor’s opinion concerning the financial statements of the company. As part of the audit process the auditor will conduct an audit plan that outlines a number of actions that he or she will be perform while also detailing the reason for those actions. With every audit, the business’s management is in charge of handing over the financial statements that the auditor will review; while the auditor will review the statements for any material or immaterial misstatements.

Ensure that payment documents are processed correctly by having different people involved in the payment process. This principle is called separation of duties.

An accounting system affords companies the luxury to be able to use their financial information whenever they need it, by it being store at a convenient location. There are three divisions within the accounting method; analysis, design, and implementation must be complemented with a system of control. This control is another system within a system that is design to ensure success of the accounting systems. Internal controls keeps business safe, preventing someone from committing fraud or abusing the system; this way the information that is store in the system is kept accurate and reliable. Part of internal controls is who are responsible; physical, mechanical, and electronic controls; there must also be segregation of duties, and independent internal confirmation.

The system/application domain consists of mission-critical systems, applications, and data. Common targeted systems and applications are operating systems (desktop, server, and network), e-mail applications and servers, Enterprise Resource Planning (ERP) applications and systems, and web browsers.

IT governance incorporates ideas and information about the way you execute your business strategy. It is about how you operationalize and capitalize on market opportunity. It is only at the lowest levels of division that IT governance is about decision rights, compliance, regulations, standards, and policies. And while not to minimize the extreme importance of these elements for IT governance, I do declare that if your IT governance solution is primarily about being compliant, etc., and secondarily about business execution, then neither your IT organization nor your business is likely to benefit from your implementation. You will have missed the opportunity that IT governance offers.

In addition to audit controls, access controls are important because they help reduce the risk of internal data breaches by preventing unauthorized work staff to have access to ePHI. “Only individuals with a “need to know” should have access to ePHI” (Brodnik, Finehart-Thompson, & Reynolds, 2012, p. 304). Additionally, Brodnik et al., (2012), states that access controls are used to aid in the authentication, audit and authorization process by implementing unique specifications such as: a unique user identification number, emergency access procedures, having an automatic log offs, and by having unique specifications within the system that allows for encryption and decryption

Facilitates the flow of documents/information to and from the unit, and ensures financial integrity and consistency by controlling receipt of goods and services, requisitions, reconciliation of accounts and travel accounts.

Shared governance is important to compliance in order to keep all staff accountable for compliance measures. Shared governance is an organizational model that gives all management and staff control over their actions and practices and extends the influence of administrative areas (Hess, 2004). Giving all managers a voice can help improve governance compliance and operations by promoting teamwork and accountability among staff throughout the entire organization.

“Internal controls are policies and procedures put in place to ensure the continued reliability of accounting systems” (Ingram 2017). WorldCom’s attempts at maintaining internal controls are less than favorable. Segregation of duties enables the division responsibilities to ensure that no employee completes two similar tasks. The CEO’s monitoring of WorldCom’s financial processes shows that the company has a lax segregation of duties, which makes it easier to commit fraud. Access controls protect financial data from unauthorized access, however, WorldCom’s extent is password-protected computers. No access inventories are taken to monitor employee usage, so there is no trail of when employees are doing during work.

Risk, compliance and governance activities are by nature interconnected and rely on common sets of information, processes, technology and methodology. The traditional approach to governance, risk and compliance relies on working in silos and using separate point solutions to address each assurance group’s requirements. This creates a fragmented approach