Controls for Information Technology, Reporting and Evaluation

Scoping and Evaluation Judgments in the Audit of Internal Control over Financial Reporting 12.1 EyeMax Corporation . . Evaluation of Audit Differences

The design and implementation and objectives of company controls are not adequate to meet the control objectives. The control environment control objective is ineffective. This control objective lacks a written policy on ethical conduct, is lacking oversight from the board of directors and audit committee, lacks a consistent style and philosophy from management, and lacks a strong commitment to competence. The risk assessment control objective is effective but lacks any antifraud program and controls. The information and communication control is ineffective. A virus has been detected and is affecting the files of the company. This control is lacking a strong IT department. The general controls financial reporting control objective is effective but is weak in detecting or preventing material misstatement. The monitoring control objective is ineffective; this control has need of an internal auditor.

| “Security controls are the management, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the system and its information” (NIST SP 800, 2009). The control allows the organization to efficiently mitigate the risk coming from the use of information System (IS) to conduct business operations and processes.

The chances of failures can be decreased by executing the checks on the systems. These keep an eye on the systems preventing risks from occurring, and these checks are avoided as the interior controls. The motivation behind the inner controls is to keep the organization safe from risks associated with the modernized accounting-system risks. Organizations change their manual accounting systems to computerized accounting systems for different reasons, this incorporates the points of interest, and the explanation behind utilizing electronic accounting information is instinct. The organizations embrace the policies of their

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate (Louwers & Reynolds, 2007). We believe that the audit evidence obtained is sufficient and appropriate to provide a reasonable basis for our opinions.

Auditors have the responsibilities as well as management to report internal controls. The auditors must examine closely management’s claim of effectiveness and also physically test the controls. After the examination, the auditors should express their opinion and any recommendations to fix any internal control weaknesses.

Another aspect relevant to the information technology is the system-generated data and reports. If auditors choose a control that uses some information generated from the company’s internal IT system, the effectiveness of the control requires obtaining audit evidence of the accuracy and completeness of the internal information. In the ZOU’s case, when testing of the controls over risk #2, auditors use reports, which are automatically generated by the Warehouse K system. Auditors decide to further test the controls over accuracy and completeness. When testing the controls over risk #3, both monthly reporting package and budget information are somewhat generated internally by ZOU’s internal system. Depending on different systems, auditors decide to further test controls for accuracy and completeness with respect to the monthly reporting package, which is generated from PeopleSoft.

Internal controls represent an organization’s processes and procedures used to meet its goals and objectives and serve as a defense in safeguarding assets and preventing and detecting errors, fraud, and abuse. Effective internal controls provide reasonable assurance that an organization’s objectives are achieved through (1) reliable financial reporting, (2) compliance with laws and regulations, and (3) effective and efficient operations. The passing of the Sarbanes-Oxley Act of 2002, as well as the numerous corporate frauds and bankruptcies over the past decade—including some

General Controls include software, hardware, computer operations controls data security, implementation, administrative controls and basically dictate all aspects of the organizations information technology infrastructure. Software controls monitor systems and prevent access from authorized users. Hardware controls make sure that the actual hardware is safe and is always checking to make sure that the equipment doesn’t malfunction. This also covers the backup systems. Computer operations controls keep the data in check by correctly storing it. Data security does just as it suggests keep the data safe in whatever form so that it is not destroyed or altered. Implementation is basically the systems checker and makes sure that at each point the controls are working. Lastly administrative controls are used to create rules and procedures that need to be carried out in order to keep the system running in proper order.

The final responsibility for the integrity of an SEC registrant’s internal controls lies on the management team. U.S. companies need to refer to a comprehensive framework of internal control when assessing the quality of financial reporting to determine that financial statements are being presented under General Accepted Accounting Principles, GAAP. The widely used framework is referred as COSO, Committee of Sponsoring Organizations of the Treadway Commission, sponsored by the following organizations American Accounting Association, the American Institute of CPA’s, Financial Executives International, the Institute of Internal Auditors, and the Institute of Management Accountants. COSO’s defines internal control as:

This portfolio focus on what I have learned during the whole IT Strategy and Control paper, a critical reflection of this paper would be provided. This reflection includes the key points, support reference and the demonstration of my own understanding about the paper itself and all of my personal understandings are based on the learning outcome of this paper. In the first part of this portfolio, I would discuss all the key IT Operations Management framework which have been introduced in the paper, the analysis of the processes based on my own understanding would be given. In the second part, analyze processes required for aligning IT infrastructure and operations with the business goals of an organization would be talked about, and I would focus a business organization which has been mentioned in the caselets as a sample. In the third part, some critical evaluate operational IT organizations and their processes against the studied models would be listed and analyzed. In the last part, the recommendations and analysis of my own would be given against those organizations (caselets) which have some problems and current issues arising from the implementation of the IT framework.

The purpose of this project is to identify measures of internal control that ensures compliance with Sarbanes Oxley Act Section 404 and how the costs of compliance may be used to add business value for shareholders. The key requirements of SOX include definition, documentation, implementation, and assessment of effective controls to ensure the integrity of corporate financial information and the prompt reporting of material events that may affect the financial performance of the firm (Moeller, 2007). A survey conducted by Audit Analytics showed that internal control over financial reporting weaknesses from 2004 to 2005 improved, but still had companies with material weaknesses in both years (Bedard, 2007). This shows there is a need for more identification for continuous improvement. Threats to accounting systems come from various sources and can destroy the relevance and reliability of financial information, if ignored (Beard, 2007). Because IT governance defines the IT structuring measures, and monitoring framework, it should include business value (Robinson, 2005) and, since corporate governance drives and sets IT governance (Lainhart IV, 2000) the corporate governance is required for compliance with SOX Section 404. According to (Peterson, 2004), IT governance is the key to realizing IT business value. With the high costs of compliance that include the possible needing additional software and hardware, consultant engagements, additional

ABSTRACT: Information Technology General Controls (ITGCs), a fundamental category of internal controls, provide an overall foundation for reliance on any information produced by a system. Since the relation between ITGCs and the information produced by an organization’s various application programs is indirect, understanding how ITGCs interact and affect an auditor’s risk assessment is often challenging for students. This case helps students assess overall ITGC risk within an organization’s information systems. Students identify

The Information Systems Audit and Control Foundation, IT Governance Institute and the sponsors make no claim that use of any of the Works will assure a successful outcome. The Works should not be considered inclusive of any proper procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific procedure or test, the controls professional should apply his or her own professional judgment to the specific control circumstances presented by the particular systems or IT environment. Disclosure and Copyright Notice Copyright © 1996, 1998, 2000 by the Information Systems Audit and Control Foundation (ISACF). Reproduction for commercial purpose is not permitted without ISACF’s prior written permission. Permission is hereby granted to use and copy the Executive Summary, Framework, Control Objectives, Management Guidelines and Implementation Tool Set for non-commercial, internal use, including storage in

Control activities. COSO requires the organization to consider general control activities over technology, wherefore activities related to the understanding of technology dependencies are viewed relevant, the IT infrastructure are configured to support restricted access and segregation of duties, and define clear access rights for financial applications and processes. The important elements for the control activities are the development and documentation of policies and procedures, their reassessment, and the establishment of responsibility and accountability. Nevertheless, effective control activities in themselves do not ensure that the organization has implemented an effective system of internal controls; therefore all five COSO components must be existent to make certain that control activities function correctly and consistently overtime (Edelstein, 2004).