Problems on IT Controls Part I,Sarbanes-Oxley and IT Governance.

Problems

1. PHYSICAL SECURITY

Avatar Financials, Inc., located on Madison Avenue, New York City, is a company that provides financial advice to individuals and small to mid-sized businesses. Its primary operations are in wealth management and financial advice. Each client has an account where basic personal information is stored on a server within the main office in New York City. The company also keeps the information about the amount of investment of each client on a separate server at their data center in Bethlehem, Pennsylvania. This information includes the total value of the portfolio, type of investments made, the income structure of each client, and associated tax liabilities.

In the last few years, larger commercial banks have started providing such services and are competing for the same set of customers. Avatar, which prides itself in personal consumer relations, is now trying to set up additional services to keep its current customers. It has recently upgraded its Web site, which formerly only allowed clients to update their personal information. Now clients can access information about their invest- ments, income, and tax liabilities that is stored at the data center in Pennsylvania.

As a result of previous dealings, Avatar has been given free access to use the computer room of an older production plant. The company believes that this location is secure enough and would keep the data intact from physical intruders. The servers are housed in a room that the production plant used to house its legacy system. The room has detectors for smoke and associated sprinklers. It is enclosed, with no windows, and has specialized temperature-controlled air ducts.

Management has recently started looking at other alternatives to house the server as the plant is going to be shut down. Management has major concerns about the secrecy of the location and the associated measures. They want to incorporate newer methods of physical data pro- tection. The company’s auditors have also expressed a concern that some of the measures at the current location are inadequate and newer alternatives should be found.

Required

1. Why are the auditors of Avatar stressing the need to have better physical environment for the server? If Avatar has proper software controls in place, would that not be enough to secure the information?

2. Name the six essential control features that contribute directly to the security of the computer server environment.

2. INTERNAL CONTROL

In reviewing the process procedures and internal controls of one of your audit clients, Steeplechase Enterprises, you notice the following practices in place. Steeplechase has recently installed a new computer sys- tem that affects the accounts receivable, billing, and shipping records. A specifically identified computer operator has been permanently assigned to each of the functions of accounts receivable, billing, and shipping. Each of these computer operators is assigned the responsibility of running the program for transaction processing, making program changes, and reconciling the computer log. To prevent any single operator from having exclusive access to the tapes and documentation, these three computer operators randomly rotate the custody and control tasks every 2 weeks over the magnetic

tapes and the system documentation. Access controls to the computer room consist of magnetic cards and a digital code for each operator. Access to the computer room is not allowed to either the systems analyst or the computer operations supervisor.

The documentation for the system consists of the following: record layouts, program listings, logs, and error listings.

Once goods are shipped from one of Steeplechase’s

three warehouses, warehouse personnel forward ship- ping notices to the accounting department. The billing clerk receives the shipping notice and accounts for the manual sequence of the shipping notices. Any missing notices are investigated. The billing clerk also manually enters the price of the item and prepares daily totals (supported by adding machine tapes) of the units shipped and the amount of sales. The shipping notices and adding machine tapes are sent to the computer department for data entry.

The computer output generated consists of a two-copy invoice and remittance advice and a daily sales register. The invoices and remittance advice are forwarded to the billing clerk, who mails one copy of the invoice and remittance advice to the customer and files the other copy in an open invoice file, which serves as an accounts receivable document. The daily sales register contains the total of units shipped and sales amounts. The computer operator compares the computer-generated totals to the adding machine tapes.

Required

Identify the control weaknesses present and make a spe- cific recommendation for correcting each of the control weaknesses.

3. DISTRIBUTED PROCESSING SYSTEM

The internal audit department of a manufacturing com- pany conducted a routine examination of the company’s distributed computer facilities. The auditor’s report was critical of the lack of coordination in the purchase of PC systems and software that individual departments use. Several different hardware platforms, operating systems, spreadsheet packages, database systems, and net- working applications were in use.

In response to the internal audit report, and without

consulting with department users regarding their current and future systems needs, Marten, the Vice President of Information Services, issued a memorandum to all employees stating the following new policies:

1. The Micromanager Spreadsheet package was selected to be the standard for the company, and all employees must immediately switch to it within the month.

2. All future PC purchases must be Megasoft compatible.

3. All departments must convert to the Megasoft Entre´e database package.

4. The office of the Vice President of Information Services must approve all new hardware and soft- ware purchases.

Several managers of other operating departments have complained about Marten’s memorandum. Apparently, before issuing this memo, Marten had not consulted with any of the users regarding their current and future software needs.

Required

a. When setting systems standards in a distributed processing environment, discuss the pertinent factors about:

1. Computer hardware and software considera- tions.

2. Controls considerations.

b. Discuss the benefits of having standardized hard- ware and software across distributed departments in the firm.

c. Discuss the concerns that the memorandum is likely to create for distributed users in the company.

4. INTERNAL CONTROL

Gustave, CPA, during its preliminary review of the fi- nancial statements of Comet, Inc., found a lack of proper segregation of duties between the programming and operating functions. Comet owns its own comput- ing facilities. Gustave diligently intensified the internal control study and assessment tasks relating to the com- puter facilities. Gustave concluded in its final report that sufficient compensating general controls provided reasonable assurance that the internal control objectives were being met.

Required

What compensating controls are most likely in place?

5. DISASTER RECOVERY PLAN

The headquarters of Hill Crest Corporation, a private company with $15.5 million in annual sales, is located in California. Hill Crest provides for its 150 clients an online legal software service that includes data storage and administrative activities for law offices. The company has grown rapidly since its inception 3 years ago, and its data processing department has expanded to accommodate this growth. Because Hill Crest’s president and sales personnel spend a great deal of time out of the office soliciting new clients, the planning of the IT facilities has been left to the data processing professionals.

Hill Crest recently moved its headquarters into a re- modeled warehouse on the outskirts of the city. While remodeling the warehouse, the architects retained much of the original structure, including the wooden-shingled exterior and exposed wooden beams throughout the interior. The minicomputer distributive processing hard- ware is situated in a large open area with high ceilings and skylights. The openness makes the data processing area accessible to the rest of the staff and encourages a team approach to problem solving. Before occupying the new facility, city inspectors declared the building safe; that is, it had adequate fire extinguishers, sufficient exits, and so on.

In an effort to provide further protection for its large database of client information, Hill Crest instituted a tape backup procedure that automatically backs up the database every Sunday evening, avoiding interruption in the daily operations and procedures. All tapes are then labeled and carefully stored on shelves reserved for this purpose in the data processing department. The departmental operator’s manual has instructions on how to use these tapes to restore the database, should the need arise. A list of home phone numbers of the individuals in the data processing department is available in case of an emergency. Hill Crest has recently increased its liability insurance for data loss from $50,000 to $100,000.

This past Saturday, the Hill Crest headquarters building was completely ruined by fire, and the company must now inform its clients that all of their information has been destroyed.

Required

a. Describe the computer security weaknesses present at Hill Crest Corporation that made it possible for a disastrous data loss.

b. List the components that should have been included in the disaster recovery plan at Hill Crest Corpora- tion to ensure computer recovery within 72 hours.

c. What factors, other than those included in the plan itself, should a company consider when formulating a disaster recovery plan?

6. SEPARATION OF DUTIES

Transferring people from job to job within the organization is the philosophy at Arcadia Plastics. Management believes that job rotation deters employees from feeling that they are stagnating in their jobs and promotes a better understanding of the company. The computer services personnel typically work for 6 months as an operator, 1 year as a systems developer, 6 months as a database administrator, and 1 year in systems maintenance. At that point, they are assigned to a permanent position.

Required

Discuss the importance of separation of duties within the information systems department. How can Arcadia Plastics have both job rotation and well-separated duties?

7. DISASTER RECOVER SERVICE PROVIDERS

Visit SunGard’s Web site, http://www.sungard.com, and research its recovery services offered for the following classes: High Availability, System Recovery, and End-User Recover. Write a report of your findings.

8. AUDIT COMMITTEE

Micro Systems, a developer of database software pack- ages, is a publicly held company and listed with the SEC. The company has no internal audit function. In complying with SOX, Micro Systems has agreed to establish an internal audit function and strengthen its audit committee to include all outside directors. Micro Systems has held its initial planning meeting to discuss the roles of the various participants in the internal control and financial reporting process. Participants at the meeting included the company president, the chief financial officer, a member of the audit committee, a partner from Micro Dynamics’ external audit firm, and the newly appointed manager of the internal audit department. Comments from the various meeting partic- ipants are presented below.

President: We want to ensure that Micro Systems com- plies with SOX. The internal audit department should help to strengthen our internal control system by correcting problems. I would like your thoughts on the proper reporting relationship for the manager of the in- ternal audit department.

CFO: I think the manager of the internal audit department should report to me because much of the department’s work is related to financial issues. The audit committee should have oversight responsibilities.

Audit committee member: I believe we should think through our roles more carefully. The Tread way Com- mission has recommended that the audit committee play

a more important role in the financial reporting process; the duties of today’s audit committee have expanded beyond mere rubber-stamp approval. We need to have greater assurance that controls are in place and being followed.

External audit firm partner: We need a close working relationship among all of our roles. The internal audit department can play a significant role in monitoring the control systems on a continuing basis and should have strong ties to your external audit firm.

Internal audit department manager: The internal audit department should be more involved in operational auditing, but it also should play a significant monitoring role in the financial reporting area.

Required

a. Describe the role of each of the following in the establishment, maintenance, and evaluation of Micro Systems’ internal control.

Management Audit committee External auditor

Internal audit department

b. Describe the responsibilities that Micro Systems’ audit committee has in the financial reporting process.

9. CMA 1290 4-Y8

Role of Internal Auditor

Leigh Industries has an internal audit department con- sisting of a director and four staff auditors. The director of internal audit, Diane Bauer, reports to the corporate controller, who receives copies of all internal audit reports. In addition, copies of all internal audit reports are sent to the audit committee of the board of directors and the individual responsible for the area of activity being audited.

In the past, the company’s external auditors have relied on the work of the internal audit department to a substantial degree. However, in recent months, Bauer has become concerned that the objectivity of the nonaudit work that the department has per- formed is affecting the internal audit function. This possible loss of objectivity could result in external auditors performing more extensive testing and analysis. The percentage of nonaudit work that the internal auditors perform has steadily increased to about 25 percent of the total hours worked. A sample of five recent nonaudit activities is presented in the following section.

• One of the internal auditors assisted in the preparation of policy statements on internal control. These statements included such things as policies regarding sensitive payments and the safeguarding of assets.

• Reconciling the bank statements of the corporation each month is a regular assignment of one of the internal auditors. The corporate controller believes this strengthens the internal control function because the internal auditor is not involved in either the receipt or the disbursement of cash.

• The internal auditors are asked to review the annual budget each year for relevance and reasonableness before the budget is approved. At the end of each month, the corporate controller’s staff analyzes the variances from budget and prepares explanations of these variances. The internal

audit staff then reviews these variances and explanations.

• One of the internal auditors has been involved in the design, installation, and initial operation of a new computerized inventory system. The auditor was primarily concerned with the design and implementation of internal accounting controls and conducted the evaluation of these controls during the test runs.

• The internal auditors are sometimes asked to make the accounting entries for complex transactions as the employees in the accounting department are not adequately trained to handle such transactions. The corporate controller believes this gives an added measure of assurance to the accurate recording of these transactions.

Required

a. Define objectivity as it relates to the internal audit function.

b. For each of the five nonaudit activities presented, explain whether the objectivity of Leigh Industries’ Internal Audit Department has been materially impaired. Consider each situation independently.

c. The director of internal audit reports directly to the corporate controller.

1. Does this reporting relationship affect the objectivity of the internal audit department? Explain your answer.

2. Would your evaluation of the five situations in question b. change if the director of internal audit reported to the audit committee of the board of directors? Explain your answer.

10. INTERNAL CONTROL AND DISTRIBUTED SYSTEM

Until a year ago, Dagwood Printing Company had always operated in a centralized computer environment. Now, 75 percent of the office employees have a PC. Users have been able to choose their own software packages, and no documentation of end-user-developed applications has been required. Next month, each PC will be linked into a local area network and to the company’s mainframe.

Required

a. Outline a plan of action for Dagwood Printing Company to ensure that the proper controls over hard- ware, software, data, people, procedures, and documentation are in place.

b. Discuss any exposures the company may face if the devised plan is not implemented.

11. INTERNAL CONTROL RESPONSIBILITY FOR OUTSOURCED IT

Explain why managers who outsource their IT function may or may not also outsource responsibility for IT controls. What options are open to auditors regarding expressing an opinion on the adequacy of internal controls?

12. COMPETING SCHOOLS OF THOUGHT REGARDING OUTSOURCING

Explain the core competency argument for outsourcing and compare/contrast it with TCE theory. Why does one theory tend to prevail over the other in making out- sourcing decisions?