Hunton, Bryant, Bagranoff Core Concepts of Information Technology Auditing Solution Manuals

Core Concepts of Information Technology Auditing By Hunton, Bryant, Bagranoff

Email: Richard@qwconsultancy.com

IT Audit Solutions Manual Chapter One Discussion Questions 1-1. Describe the two objectives of IT Governance. Which do you think is more important?

The two objectives of IT governance are to: (1) use IT to promote an organization’s objectives and enable business processes and (2) to manage and control IT-related risks. As with many discussion questions, there is no “right” answer here. Both objectives are important. The answer could vary by industry and organization type as IT-related risks could be greater for some businesses than for others. Similarly, the use of IT for strategic business purposes could mean the difference between business failure and success.

1-2. Describe the various types of transactions that an IS might process in the course of acquiring raw materials for production.

Acquiring raw materials for production involves ordering the materials, receiving the materials, and paying the vendor. The information system would record each of these transactions and the data associated with them. For example, data entered in the system would include the supplier name, the terms of payment, shipping data, the name of the person making the purchase, and so on.

1-3. This chapter described several types of work done by IT auditors. Using the Internet, can you identify any other types of work these auditors might do?

Several Internet sites provide information about the work of IT auditors. Professional organization sites such as www.isaca.org and www.iia.org provide insight. The web sites for various auditing firms, such as www.ey.com or www.kpmg.com are also helpful. Auditing firms typically post services or solutions as a menu item at their web site. Selecting assurance services will provide you with information about the various assurance service lines offered by the company.

1-4. IT auditors often have technical skills related to specific software. One such software specialization area is enterprise resource planning (ERP) applications. Explain how an IT auditor could acquire and maintain knowledge about one of these software packages.

Knowledge about specialized software, including enterprise systems, is most often obtained through work experience. Auditors working for large professional service firms will “apprentice” on job assignments that involve technologies new to them. A company may send the IT auditor

to formal training or provide them with time to take online courses. Still, practical experience is always needed to master these systems. IT auditors wishing to learn how to audit a specialized technology may request working on engagements where clients use these IT systems. Internal IT auditors are limited in their experience to the technologies used by their firms.

1-5. CISA is the most common credential obtained by IT auditors. Discuss how this certification would add value for someone practicing IT auditing.

The CISA credential, like any other widely respected certification provides an IT auditor with credibility. An auditor with this certification will have a competitive advantage in the market place. Professional service firms encourage their employees to acquire certifications as they cite them when proposing work to clients. Someone purchasing services from an IT auditor is assured that if the professional has the CISA certification, they have passed a knowledge test and are upto-date on current practices.

1-6. The AICPA recently created a new credential for CPA's who have specialized training and experience in IT. Discuss whether or not you think the CITP is likely to be a sought after credential by both IT audit practitioners and those contracting with IT audit professionals.

An example of an individual who has the CITP credential is Kevin Martin, of Kevin Martin and Associates, an accounting/consulting firm specializing in implementing mid-level accounting information systems. Kevin is a CPA who has personally obtained many specialized technologyrelated certifications. He felt that the CITP would provide him with a competitive advantage.

The CITP allows a practicing accountant to differentiate him or herself with respect to knowledge of IT. It is difficult to say how widely this will be received but it makes some sense to have a specialized “add on” to the CPA, which remains the most widely recognized and respected professional certification for accounting professionals.

1-7. How do IT audit guidelines, such as those issued by ISACA, help an IT auditor to do their work?

IT auditors need frameworks and guidance in order to make sure that they have reviewed information systems risks and controls sufficiently to have an opinion about them and to offer management suggestions. Risks and controls vary with different technologies. As a result, no one auditor can hope to have sufficient knowledge to recognize all the risks associated with each, nor can the IT auditor be knowledgeable about the controls or sets of controls best able to mitigate risks. Auditing standards help lend structure to IT audits.

1-8. ISACA recently made their standards, guidelines, and procedures "open." This means that they share them at no cost - anyone can download them from the ISACA web site. Discuss the value of such a strategy.

While a professional organization might wish to profit in some way by keeping standards private and charging for them, if the aim of a profession is to help develop and improve the profession,

then open distribution of the standards is imperative. Open distribution will assure that a maximum number of IT audit professionals will have the benefit of these standards and guidance.

It should serve to increase the quality of work that IT auditors do. Enhancing the professionalism of IT auditors in the long run will increase the stature of the professional organization to which they belong.

EXERCISES 1-9. In 2001, the Auditing Standards Board of the AICPA issued Statement on Auditing Standards No. 94 - The Effect of Information Technology on the Auditor's Consideration of Internal Control in a Financial Statement Audit. This standard is likely to increase the involvement of an IT auditor on a financial audit engagement. The standard requires auditors to consider how an organization's use of IT might affect internal controls. The standard explains that auditors may determine that it is more effective and efficient to assess control risk than to perform detailed testing of account balances and transactions (i.e., substantive testing).

Required: Explain how SAS No. 94 is likely to impact the work of both the financial and IT auditor.

Both financial and IT auditors are likely to increase the amount of attention they pay to internal controls as a result of both SAS No. 94 and the Sarbanes Oxley Act of 2002. Since almost all AIS today are computerized, financial auditors are likely to rely more on IT auditors in their evaluation of internal controls, particularly application controls. In talking with some Big Four IT audit practitioners, it appears that IT auditors are increasing the time they spend on financial audit engagements. They're doing internal control evaluations up front in the engagements, and their work is increasing from about 5 to 10% of the engagement time and cost budget, to 20% or more.

1-10. Many large business, government, and not-for-profit organizations have adopted CobiT® as a framework for IT governance, including the U.S. House of Representatives. IT governance has two primary components: (1) acquisition and deployment of IT to promote an organization's objectives and enable business processes and (2) management and control of IT-related risks.

Required:

Assume that you have been asked to consult a Fortune 1000 business enterprise about implementing IT governance. Using the framework shown in Figure 1-1, identify an implementation plan with six or more specific activities you would recommend.

The ISACA web site has several examples and case studies of implementations using CobiT, e.g., implementation at Charles Schwab. The following is an example of how the IT governance framework might be used for a Fortune 1000 company.

1) The process begins with management setting objectives for IT. Specific activities might include, surveying competitive use of IT, analyzing the current organization's use of IT (maps and flowcharts would be useful here), inviting IT vendors to discuss new products on the horizon, and doing a high level IT risk assessment.

2) Management needs to compare where they want to be (strategic objectives) with where they currently are (current performance). This will require several meetings that will include some or all of these groups: IT management, internal audit, external auditors and consultants, the board, and general management.

3) The results of the comparison of objectives with current performance will lead to identification of specific IT activities. These activities might include: implementing an enterprise-wide software solution, adopting customer relationship management or other ebusiness software, creating a data warehouse, implementing a plan for systems reliability assurance, improving the return on investment for IT resources, creating a knowledge management system, or improving automation in business processes, such as manufacturing or procurement.

IT AUDIT SOLUTIONS MANUAL

CHAPTER TWO

ETHICAL AND LEGAL ISSUES FOR IT AUDITORS

DISCUSSION QUESTIONS 2-1 Who is responsible for prevention and detection of irregular and illegal acts?

Management is responsible for the prevention and detection of irregular and illegal acts, not the IT auditor.

2-2 What types of written contracts do auditors typically examine? What are the three elements the auditor must ensure a contract contains?

Auditors typically examine written contracts dealing with purchase and sale of goods and services. Auditors should look to ensure that there at least three elements contained in the contract: offer, consideration and acceptance.

2-3 What cannot be included in an employment contract?

1

An employment contract cannot include that the employee must work for the employer for a stated period of time.

2-4 What stipulation of non-disclosure agreements dealing with trade secrets differ from confidentiality agreements?

The term of non-disclosure agreements may last indefinitely.

2-5 When is the contract element of ‘consideration’ required and not required in a noncompete agreement? Why? If a non-compete agreement is signed before or immediately after employment, consideration is not required because the employment itself is the consideration. If an employer requests an employee to sign a non-compete agreement during or upon termination of employment, additional consideration on the part of the employer may be required since the employment has already been established.

2-6 What does computer or ‘cyber’ crime mean? Give ten examples.

Computer or ‘cyber’ crime is the direct or indirect use of computer and communication technologies to perpetrate a criminal act. Acts include any behaviors determined by states or nations to be illegal. Examples include: ▪

hacking into an entities network

▪

stealing intellectual property

▪

sabotaging a company’s database

▪

denying service to others who wish to use a Web site

▪

harassing or blackmailing someone

▪

violating privacy rights

▪

engaging in industrial espionage

2

▪

pirating computer software

▪

perpetrating fraud

▪

any instrumental use of a computer and/or the Internet to the assist or carry out a crime, such as an illegal narcotics trafficker who uses the Internet to coordinate sales and logistics.

2-7 What are the three requirements of an invention in order to receive a patent?

An invention must be novel, useful, and not of an obvious nature.

2-8 What are four general types of intellectual discoveries covered under patent law?

▪

machines

▪

human made products

▪

compositions of matter

▪

processing methods

2-9. What does a breach of availability mean?

A breach of availability occurs when an authorized user is prevented from timely, reliable access to data or a system, such as a denial of service attack.

2-10 What is the responsibility of a manager in an organization for individual privacy rights?

Mangers are obligated to institute proper internal controls aimed at protecting the confidentiality of personal information that is collected during the normal course of business

3

EXERCISES 2-11 In September 1997, eBay revolutionized the concept of on-line marketplace exchanges by holding auctions over the Internet. Competitor on-line auction sites soon followed, such as Yahoo! and Amazon.com, and a new industry was born. In spring 1999, a related business model emerged—auction aggregators. The auction aggregator model was to search on-line auction sites, and offer listings and price information to users. For example, if a user of an auction aggregator was looking for, say, a particular rare coin, the aggregator would search eBay, Yahoo! and Amazon.com for the coin, and display the description and price to the user. Bidder’s Edge was one of the most notable auction aggregators.

The rise of auction aggregators was sparked by a court case which found that ‘facts’ are public property, even if such facts are collected through the ‘sweat equity’ of another entity (Feist Publications, Inc. versus Rural Telephone Service Co., 499 U.S., 340). eBay decided to sue Bidder’s Edge for intellectual property right violations, even though the Feist decision weighed heavily in favor of Bidder’s edge. Various consumer groups, on both sides of the argument, rallied to the cause. As a result, H.R. 354 and H.R. 1858 were introduced in congress in 1999.

H.R. 354 basically asserts the ‘sweat of brow’ doctrine, which states that ‘facts’ which are collected as a result of substantial investments of time, personnel and effort are protected intellectual property of the collector. HR 1858, on the other hand, argues that it is in the public interest for Internet users to be able to obtain and compare information from various databases; thus, collected facts are public property.

4

Required: Discuss the pros and cons of H.R. 354 and H.R. 1858. In responding to this question, please consider the positions taken by Coalition Against Database Piracy (CADP) and NetCoalition.com in the debate.

Answer: The answer to the question posed above will certainly stir controversy, as there are legitimate arguments on both sides of the debate. You should encourage the students to visit the web sites of CADP and NetCoalition.com, as well as to read H.R. 354 and H.R. 1858. This is a great exercise for getting students involved in public policy issues, and to get them involved with Internet research.

2-12 In 1999, a company called DoubleClick was formed. The business model of DoubleClick was to track click-stream data, stored on cookies, for advertisers. There was little consumer opposition to DoubleClick, as the company did not collect personal information from users or their computers; rather, users were only identified by an ID number. DoubleClick offered an ‘opt out’ policy, although it was difficult to find on its website. In 2000, DoubleClick formed Abacus Online, a click stream database where users’ click-streams were linked to personal information (with an opt-out policy) only when they made catalog purchases, completed on-line surveys or participated in drawings. Then, DoubleClick decided to merge the two databases to provide tailored information to advertisers. This strategy was vehemently opposed by Internet privacy rights groups. After much public outcry, DoubleClick abandoned its merger plans, at a sunk cost of $1.7 billion.

Required: How important is ‘privacy’ to the ultimate survival of the Internet as a viable platform for e-commerce?

5

Answer: While a few students might argue that ‘privacy’ does not and should not exist on the Internet, the vast majority of students will likely support some level of Internet privacy. This question should evoke some stimulating debate.

Required: What have the private sector, U.S. Federal government and the European Union done to protect Internet Privacy Rights?

Answer: This question will require students to research privacy issues over the Internet, where they will find dozens of privacy rights groups. With respect to the private sector, students should at least be aware of the P3P, which means Platform for Privacy Preferences Protection. Regarding the U.S. Federal government, students should refer to the Federal Trade Commission’s (FTC) web site for recent positions on Internet privacy.

Referring to the European Union, students should, at a minimum, note “The Directive on Data Protection,” which was the Union’s attempt to harmonize privacy policies.

6

IT AUDIT SOLUTIONS MANUAL Chapter 3 Discussion Questions 3-1. Why is it important to identify and assess IT risk prior to developing IT internal controls?

Auditors who concentrate on internal controls, rather than risk, might over-control. IT internal controls should serve the purpose of mitigating risk. They do not exist for their own sake. By assessing risk first, IT auditors focus only on those controls that add value by accomplishing this goal.

3-2. This chapter identified four types of IT risks: business, audit, security, and continuity risks. Discuss the similarities and differences among them.

Business risk concerns inability to meet business goals and objectives. Audit risk stems from the failure of the audit to accomplish its goals and objectives. Security risk concerns data access and integrity. Continuity risk concerns the information system's availability and back up process. The risks are similar in that each results in an IT failure that impacts business effectiveness and efficiency. They all result from a failure in IT governance. They are different in the sense that they are each associated with a different aspect of risk and also in the nature of the impact they might have.

3-3. One approach to risk assessment is to identify threats, vulnerabilities, and acceptable risk levels. What vulnerabilities might exist for a business organization’s intranet?

There are several threats and associated vulnerabilities associated with a business organization's intranet. Vulnerabilities include impaired data confidentiality and privacy through remote or on-site access by unauthorized users, increased exposure to programmed threats such as viruses through remote or on-site access by unauthorized users and lack of maintained anti-virus software, and unauthorized access to assets by unauthorized users.

3-4. Describe three risk indicators that might be associated with a company’s intranet.

There are many risk indicators associated with a company's intranet. Network and ebusiness security are discussed in Chapters 6 and 7. Three risk indicators for a company's intranet would be: 1. Failure to maintain firewall security 2. Failure to maintain intrusion detection software 3. Failure to maintain user profile security, which includes multiple access levels and passwords

3-5. Why would an organization accept some level of risk?

It is pretty much impossible to control against every type and level of risk and it is certainly not going to be cost-effective to do so. IT managers will often say that they have trouble sleeping at night because they know that they're vulnerable to risks. The budgets just aren't big enough to control for everything. Organizational entities need to assess risk and analyze it to determine what's acceptable and what isn't. They also need to weigh the costs of controls against various risks and their likelihood of occurrence.

3-6. What is the difference between COSO and ISO 9000?

COSO is an internal control model or framework. ISO9000, on the other hand, is a set of standards of quality control. Both internal controls that protect IT assets and quality controls that improve processes can contribute to organizational effectiveness as they increase confidence. ISO9000 certification provides external organizational stakeholders with some comfort regarding quality. COSO does not entail certification and so, in that sense it may be more difficult to convey to the public that an organization has incorporated their internal control framework.

3-7. Discuss each of the five components of COSO. Which do you think is most important to an effective internal control system?

The control environment is the overall organizational attitude toward control, especially that of top management. Because this attitude is likely to drive internal control emphasis, funding, and compliance in an organization, it is probably the most important component.

Risk assessment is another component, which emphasizes the identification, measurement, and evaluation of risk. Control activities are the specific internal control procedures and policies. Information and communication concern the need to acquire and communicate information necessary to fulfill management strategies and objectives.

Finally, monitoring ensures that an internal control system continues to operate as intended.

3-8. Go to the www.aicpa.org and view the new Trust Services Principles and Criteria.

How does this new model incorporate SysTrustTM? The AICPA combined WebTrust and SysTrust principles and criteria under a new set of Trust Services Principles and Criteria, effective January 1, 2003. The SysTrust and WebTrust services had some commonalities that the AICPA sought to use to create a harmonized trust framework. The primary change is in terms of structure, order, and working of Principles and Criteria in order to obtain harmony. There are no new principles but the old SysTrust Principle of Maintainability is now subsumed under other principles. The new set of Principles are: Security, Availability, Processing Integrity, and Online Privacy and Confidentiality. SysTrust now has a two-month minimum

reporting period. Another change is that the SysTrust logo may now be used as a seal under specified conditions. There are other changes as well, but these are the primary ones.

3-9. How might an auditor use an internal control flowchart? Do you agree that a flowchart is a better documentation for internal control than an internal control narrative?

An auditor may use an internal control flowchart to identify areas where controls are either strong or weak. Sometimes the creation of the flowchart itself will assist the auditor in obtaining an understanding of the system sufficient to identify internal control areas of concern. Flowcharts are superior to narratives if the auditor has some familiarity or training in developing and analyzing flowcharts. At a minimum, the auditor must be knowledgeable about the symbols used in the flowchart. Narratives of more than one paragraph are very difficult to follow.

3-10. Discuss the importance of monitoring risks and controls. What components would exist in a structure for monitoring risks and controls in a large, global public corporation?

Monitoring risks and controls is important because in the absence of monitoring, controls are likely to be circumvented, and/or fall by the wayside. Internal controls frequently impede operational efficiency. For example, required authorizations add an extra step to a process. Monitoring controls ensures that employees continue to observe controls that have been implemented to mitigate risks. Monitoring risks ensures that new risks are identified and risks that no longer pose a threat have their associated controls eliminated.

A large, global public corporation is likely to employ an internal audit staff. The internal audit staff can set up a plan for regular monitoring of risks and controls. This size corporation will also have external auditors to evaluate risks and controls.

Exercises 3-11. Mi Mexico, Inc., a national fast food restaurant chain, recently hired consultants to build a data mart containing its sales data. The company owns and operates 174 stores, with average annual revenue of $650,000 per store. Mi Mexico has an enterprise information system that integrates its accounting, human resource, and distribution subsystems.

Appropriate sales data from the enterprise system is automatically sent to

the data mart. The marketing and sales department queries the data mart to learn about

sales trends and patterns. Jeff Ewing, the CIO recently met with Sylvia Rangel, the CFO, and Juan Hernandez from the Internal Audit department, to discuss risks and controls related to the new data mart.

Required: 1. Describe any business, audit, security, or continuity risks that may be associated with the new data mart.

The primary business risk is that the data mart fails to meet the business objectives for which it was designed. The internal audit staff will want to make sure that the information gleaned from the data mart is actually adding value in terms of improved customer satisfaction and retention, in increased sales from new customers, and perhaps information about sales related to various stores and menu items.

The audit risks include inherent, control, and detection risks. Because a data mart uses secondary data, that is data that has already been used for operational purposes, data errors or misstatements are not likely to have the same impact as operational data.

However, if there are errors in moving the data from operations to the data mart that are systematic, there is a chance that analysis of data mart information will lead to inaccurate conclusions.

Data mart security includes data integrity and access. The data in the data mart has likely been audited at its source but some data will be transformed during the "data scrubbing" process that is necessary prior to its entry in the data mart. The logic associated with this scrubbing is important. Data in the data mart must have integrity in order to provide useful information. Since the data mart will include a lot of historical sales data, the data is sensitive with respect to competitors. Therefore, physical and logical access security is very important.

As for continuity risk, again the fact that the data is not operational reduces the impact of its loss. Certainly there will be a cost to losing the data in the mart, but the loss will not impede operations.

2. How might Mi Mexico go about identifying specific risks and controls introduced by the new data mart?

Mi Mexico can use the techniques described in this chapter to identify the risks and controls associated with the new data mart. They can use the approach described in Figure 3-3 and identify threats, vulnerabilities, and acceptable risk levels. Another approach would be to identify the risk indicators associated with a data mart. There is

likely to be guidance available for this from many sources, including the consultants who helped to create the data mart. Mi Mexico can look to the COSO framework for guidance on developing a system of internal controls over the data mart risk indicators.

3-12. Cyber Com is an Internet start-up company that offers business intelligence software and consulting services to help companies with customer relationship management. The business is quite new and has just recently completed a successful initial public offering (IPO). All of management’s energies have been consumed with growing the business and successfully going public. As a result, there has not been much time devoted to internal control. The company uses state of the art technologies to manage its business. These include an enterprise-wide information system, electronic commerce, an Intranet, and a knowledge management system. The CEO has recently issued a directive to Joy Bridges, the CFO, to work with the company’s auditor to see how they should proceed in developing an internal control system that manages the company’s IT risks.

Required: 1. How might you use COSO, CobiT® , ISO 9000, or Six Sigma to help in constructing such an internal control system?

ISO 9000 and Six Sigma are likely to be more useful in evaluating quality in a company that has been around a bit longer. A new company, such as CyberCom, should be most concerned with IT risks and controls, rather than the efficiency and quality of its processes at this point.

COSO could help in developing an internal control system. The company could apply a risk assessment approach, such as one of the two described in the chapter, to determine risks. The auditor could develop a set of risk indicators for each technology and implement controls to mitigate the risks. Another option is to use CobiT to develop a comprehensive set of internal controls for the company. CobiT would be very useful as a structure to identify controls over the acquisition and deployment of IT, as well as over other specialized IT and IT processes.

2. After developing an internal control system to manage IT risks, Joy thinks it might be a good idea to have the company’s auditor conduct a Systems Reliability Assurance engagement to test the controls. Explain the value this might add.

This is a great idea. By using the structure for Systems Reliability Assurance, the auditor will be approaching risk and control from yet another vantage point. This may highlight some components that were missed in developing the system of internal control initially.

Further, once the system meets the principles and criteria in the AICPA Trust engagement standards, CyberCom will be able to publicize its compliance. This may help to assure customers, suppliers, investors, and creditors that the company has appropriate controls over its IT risks.

3-13. Schneider Manufacturing, Inc. employs 236 salaried and hourly workers. All employees are paid on a weekly basis. The company’s accounting information system includes a payroll module that records payroll expenses, issues checks, and updates the general ledger. The following is an internal control narrative for the payroll system: Hourly employees clock in and out to record their hours worked. Salaried employees do not report time, but they must complete a form available on the company’s Intranet to account for vacation and sick days. Each week, departmental supervisors deliver time cards to the payroll office. The supervisors also deliver the completed and authorized vacation and sick day forms. A payroll clerk checks the cards and forms to see that they are complete and then enters them into the payroll system through a PC. The payroll software checks the entered data against employee files to verify the existence of employees and retrieve pay rates. The software contains several internal controls. For example, it checks to make sure that time worked does not exceed 60 hours a week. The software also makes sure that employees do not exceed allotted vacation and sick days.

The payroll system either issues checks encoded with a digital signature, or makes direct deposits to employee bank accounts for those employees who have chosen this option. The payroll clerk prints the checks and gives them to the appropriate departmental supervisors for distribution to employees. The payroll system also produces a payroll register. The Accounting Department supervisor receives a copy of the payroll register.

Required: 1. Prepare an internal control flowchart for Schneider Manufacturing’s payroll system, identifying internal controls as shown in Figure 3-7.

Employees Hourly employees clock in and out

Supervisors

Payroll Office

Time cards

Time cards

1

1 Authorize vacation and sick day forms and print

Salaried employees enter sick and vacation days online

Printed out sick and vacation day forms

Printed out sick and vacation day forms 2

Payroll clerk checks cards and forms

3 Payroll clerk enters data into payroll system

Payroll software performs control checks

4 Payroll software produces checks or direct deposits

Payroll register Payroll checks

Payroll checks 5

2. Can you identify any internal control weaknesses associated with Schneider Manufacturing’s payroll system?

Control Weaknesses: 1. Supervisors do not appear to check time cards 2. Should not be a need to print out vacation and sick forms.

3. Payroll data should automatically enter the system.

4. The company should consider mandatory direct deposit.

5. Supervisors do not appear to check payroll checks for reasonableness.

IT AUDIT SOLUTIONS MANUAL CHAPTER FOUR

INFORMATION TECHNOLOGY DEPLOYMENT RISKS

DISCUSSION QUESTIONS 4-1 What could be the consequences if the information systems function of a company does not align its strategy with the overall company vision?

If the IS function does not align its strategy with the company’s vision, there is a risk that valuable, scarce IS resources could be misallocated in a way that interferes with the company’s current profitability and future growth.

4-2 Why should the information systems function develop policies?

Policies reflect concrete manifestations of the IS function’s strategy. As such, guidelines are useful in knowing how to carry out the strategy. You should refer students to the “Important

1

Policy Areas for IS Functions” provided in this chapter to illustrate the importance of developing IS policies.

4-3 What is the purpose of the Information Systems Steering Committee?

The steering committee serves as the liaison group that ensures that the proper allocation of IS resources are congruent with the company’s vision, mission, objectives, strategy and policies. The steering committee is made up of high-ranking managers from all functional areas of the organization. This way, each functional area, as well as general management, better understands the company’s priorities and resource constraints. As such, the committee must make tough decisions regarding who gets what IS resources, when and why.

4-4 Why is it important to understand the boundary conditions (scope, time and cost) of any information systems project?

The scope of a project sets the parameters for time and cost. If the scope is too narrow, the applications may not meet the needs of users and information consumers. If the scope is too wide, the applications may include a plethora of ‘bells and whistles’ that might be nice to have, but are not necessary. Setting the scope of a project is very difficult, yet of utmost importance.

Once the scope has been determined, time and cost estimates can be made. At this point, the company has to decide if the project can be accomplished in a timeframe that meets its needs.

Also, the company must decide if the cost considerations are affordable. If either time or cost

2

estimates are problematic, perhaps the scope needs to be readjusted. This type of feedback loop process continues until the scope, time and cost parameters are in balance.

4-5 When contemplating the acquisition of application software, how would the company determine if the software can handle the information-processing load?

The IS function can perform benchmark tests and performance tests. Regarding benchmark tests, the company can establish minimum guidelines that the software must meet.

For instance, the software must be capable of processing X amount of transactions per minute or the software must respond in Y seconds to users during normal daily processing loads.

Performance testing can be accomplished by processing archived company data through the system to determine how fast the system is capable of processing, especially at peak times.

When the software is pushed to its limit, this is called stress testing.

4-6 Why use three libraries (development, test and production) in the information systems function?

The development library can serve as a ‘sand box’ for programmers and developers. In this secured space, they can write programs and conduct preliminary testing. Once an application is built, the object code is moved from the development to the test library. In the test library, system users can ‘play’ with the application, using sample data, to see how it feels and performs. Based on user feedback, the applications may be moved back to the development library for further work. Once the users agree that the applications are working as desired, the

3

final object code is moved to the production library, where it is used for live processing. This approach keeps programmers out of the production library (incompatible functions), users out of the development library (incompatible functions), and live data from being corrupted until the application is ready for use.

4-7 Why should the steering committee form a separate Feasibility Group for each potential project?

Feasibility Group members are typically interested in, involved with and knowledgeable about the proposed development project. At a minimum, the group should be comprised of representatives from affected functional area(s), general management and IS function management. As such, the Feasibility Group is much closer to the project than the steering committee. Besides, the steering committee is comprised of senior level managers who do not have the time or expertise to determine if a proposed project is technically, financially and culturally feasible. Thus, creating a Feasibility Group is an efficient and effective means of delegating responsibility in this regard.

4-8 What is the objective of a Feasibility Study?

The objective of a feasibility study is to determine if the project is technically, financially and culturally feasible. If so, the Feasibility Group would recommend to the steering committee that the project should move forward to the prioritization and development stages.

4

4-9 Why should the company be concerned with developing formal procedures for changing existing software applications?

If formal ‘change’ procedures are not developed and followed, the IS department would be inundated with user requests for all sorts of software changes and have no guidance regarding where to start. Thus, typically the users who complain the most, are most liked by the IS function, yield the most political power and so on will get priority over others, which may be incongruent with the company’s profitability and growth strategy. Additionally, a formal change procedure alerts the company’s accountants, internal auditors and external auditors to on-going and upcoming application changes that may adversely affect the internal control structure.

4-10

What are the alternative implementation strategies and which one is best?

The four implementation strategies discussed in the chapter are 1) parallel, 2) big-bang, 3) partial and 4) focused. The ‘best’ strategy is contingent on the circumstances. This question should bring about some interesting discussions regarding such circumstances. Some things to consider are: ▪

size of the company,

▪

geographic dispersion of the company,

▪

scope of the project,

▪

critical nature of the software,

▪

competency of the implementation team,

▪

resources allocated to the implementation strategy, and

5

▪

user readiness for the implementation.

6

EXERCISES 4-11

Archetype Technologies, Inc. (ATI) has grown at a phenomenal rate of over 45%

per year for the past five years. Presently, the legacy information system at ATI is laboring under the heavy processing load. Additionally, ATI managers are frustrated because it is extremely complicated and time-consuming for them to get the information they need to make decisions, primarily because the applications are not integrated with each other. The current applications are written in the Cobol programming language and the data is stored in flat files. ATI is contemplating several options for dealing with its information systems problems (below). At this point, ATI has formed a Feasibility Group to examine each alternative.

Required: Develop a checklist of issues that the group should consider for each option.

You should look for the following major issues: A. Upgrade the existing applications such that they better integrate with one another. a) Technical Feasibility i) Is the IS function capable of upgrading the existing applications to be more integrative? ii) Is it possible to accomplish the objective of integration using Cobol and flat files? b) Financial Feasibility i) How much will it cost to upgrade the existing systems? ii) Will there be sufficient return on investment to warrant upgrading the current system? c) Cultural Feasibility

7

i) If the existing applications were more integrative, would they meet the needs of decision makers? ii) Would users be happy with upgrading the existing systems? iii) Can the current system be upgraded in sufficient time so as not to harm the company’s profitability and competitive position?

B. Develop (in-house) an integrated suite of applications using a relational database. a) Technical Feasibility i) Is the IS function capable of operating in a relational database environment? ii) Is the IS Function capable of programming in a relational database application language? iii) Will the current information technology infrastructure handle a relational database environment? b) Financial Feasibility i) How much will it cost purchase the database? ii) How much will is cost to develop the application software? iii) Will there be sufficient return on investment to warrant the switchover to a relational database environment? c) Cultural Feasibility i) Would a relational database driven system meet the information needs of managers? ii) Would users willing to learn a brand new system? iii) Can the database system be developed in sufficient time so as not to harm the company’s profitability and competitive position?

C. Purchase an Enterprise Resource Planning (ERP) system from an outside vendor.

8

a) Technical Feasibility i) Does the ERP system fit with the overall company vision and mission? ii) Is the IS Function capable of implementing and operating an ERP system and the associated relational database? iii) Will the current information technology infrastructure handle the ERP system? b) Financial Feasibility i) How much will it cost purchase the database (which must accompany an ERP system)? ii) How much will is cost to purchase the ERP system? iii) Will there be sufficient return on investment to warrant purchase of an ERP system from an outside vendor? c) Cultural Feasibility i) Would an ERP system meet the information needs of managers? ii) Would users willing to learn a brand new system? iii) Can the ERP system be implemented in sufficient time so as not to harm the company’s profitability and competitive position?

9

4-12 Dogwood Manufacturing, Inc. (DMI) just purchased and implemented a popular and widely used Enterprise Resource Planning (ERP) system. The ERP applications run on a relational database, which is purchased separately. The consultants who installed the ERP system and relational database have advised DMI to incorporate security controls (ID/Password) at the network, database and application levels. Because DMI employs only a few people in its information systems function, whose jobs are primarily oriented at helping users and keeping the information technology infrastructure operating on a daily basis, DMI feels that it does not have the expertise to maintain three levels of security once the consultants are gone. Thus, DMI has decided to rely on the security features that are incorporated into the ERP system, which restricts users to authorized applications based on their ID/Password. Furthermore, the person responsible for maintaining the ID/Password security features will be the company controller, since she is the most computer savvy person of all company managers. Required: A. What are the advantages of relying on the ERP security features only?

The ERP system security features are likely quite strong, since the ERP system is in use at many other companies and many ‘holes’ in the system have likely been identified and fixed.

B. What are the disadvantages of relying on the ERP security features only?

Savvy users can figure out ways to get around the applications directly into the database.

Once in the database, such users have complete access to all data and database tools (such as the query engine, data dictionary, manipulation language and so on). Also, since the network is

10

unsecured, offsite users and/or hackers can penetrate into the company’s database, as well as the operating system. While relational databases have many advantages, one major disadvantage is that once an individual is inside the database, all of the company’s information is exposed and vulnerable.

C. What are the risks of assigning the security responsibility to the controller?

The major risk is that the controller could perpetrate a fraud, since she has control over the financial information and the database. This is a classic violation of ‘segregation of incompatible functions’. Another concern is that the controller stays so busy with her normal workload, that the security responsibilities take a back seat. As a result, user permissions may be too liberal, passwords may not get changed on a regular basis, monitoring of security breaches might not be performed on a regular basis, and so on.

11

IT AUDIT SOLUTIONS MANUAL CHAPTER FIVE

MANAGING THE IT FUNCTION

DISCUSSION QUESTIONS 5-1 Discuss the business and audit risks of having the IT function improperly located in the company’s organizational structure.

The business risks are that scarce valuable organizational resources consumed by the IT function will fail to address that company’s strategic initiatives, thereby sub-optimizing the company’s potential efficiency and effectiveness.

The audit risks are that improper segregation of incompatible functions can threaten the integrity and security of enterprise-wide information, as well as the computing infrastructure.

5-2 What are some considerations regarding the organizational level at which the IT manager is placed?

It is optimal for the IT function manager to be located at least at the same organizational level as peer functional/line managers. The internal control structure should consider the possibility of opportunistic (perhaps fraudulent) behaviors stemming from upper management brought about by an overlap of incompatible duties by instituting sound procedures and exercising vigilant oversight in this regard. In this manner, the internal control implications of locating the IT Function at or above the level of other functional/line managers can be effectively managed.

Having the IT function manager report directly to the corporate controller is often considered. However. most corporate controllers perform two of the three incompatible duties: authorize and record certain transactions. If the IT function reported here, the

1

corporate controller would also maintain custody of assets, -- information databases and software applications, thereby giving all three incompatible duties to one person.

Other functional/line managers normally would have insufficient knowledge of computing infrastructures, operating systems, software applications and related matters to offer effective guidance and support to IT managers. There is also the risk that a functional/line manager will prioritize the IT function to serve their own area rather than consider the long-term needs that benefit the entire organization. Also, if the IT manager reports to another functional/line manager, the IT function might receive inadequate attention from upper management and possess relatively weak power when it comes to acquiring necessary resources.

2

5-3 What is the profit center approach to funding IT operations? Discuss the advantages and disadvantages.

With the profit center approach, the IT function charges internal users for IT services.

The IT budget will then show a list of its customers (the company’s departments) and the anticipated intra-company billing to them, and a detailed budget of the total IT department expenses. The goal would be to have all the expenses offset by the intracompany billings to justify the IT department.

Advantages: ▪ The departments would realize a cost associated with services, and would more likely justify the real need for the services before requesting them.

▪ Projects would less likely loose track of the original scope if they know they are being billed for the time involved. (Some managers purposely present a small project intending to creep the scope as the project progresses.)

▪ The IT department would justify its own existence by showing the value of its operation in billable time.

▪ The accountability of the IT function would be maintained by tracking and billing the IT services.

Disadvantages: ▪ The IT department may raise the billing rates until the services will be too expensive for the departments to utilize them.

▪ Without proper controls, the structure could encourage “empire building.”

▪ If the rates become higher than market value, the departments may seek services outside the company, which may undermine the mission of the IT function.

5-4 Discuss controls to prevent damage to hardware and software by a terminated employee.

The IT department must have a formal termination policy as an internal control to prevent separated employees from damaging computer systems, corrupting databases, and stealing hardware.

▪ ▪ ▪ ▪ ▪ ▪

Backup procedures should be in place to ensure recovery of lost or corrupted data.

Checks and balances should be in place. For instance, asset lists and a routine inventory ensure that any shrinkage will be quickly discovered and traced.

Employees should be cross-trained of to ensure that the knowledge of operations and systems can be continuous, and not dependent on a single employee.

Job rotations ensure that a working knowledge of processes are shared and enhanced.

Mandated vacations ensure that employees do not “burn-out.”

Procedures to check out equipment makes employees accountable for moving computer equipment off-site or out of the department.

3

▪

Immediate separation upon termination announcement eliminates the employee’s access to programs or equipment.

5-5 Discuss what the IT auditor should understand and document regarding the workload administration of the IT department.

The auditor should check for a formal capacity plan and workload forecast. This entails mapping the workload peaks and valleys over a year, understand how management handles workload variances, and determine the effectiveness of the performance monitoring process.

5-6 What is a computing infrastructure? What should the IT auditor be looking for with respect to the computing infrastructure?

The computing infrastructure includes computer hardware, network hardware, communication systems, operating systems, and application software and data files.

The IT auditor needs to check and verify the inventory of owned and non-owned items, as well as test the extent to which the company is in compliance with software licenses.

5-7 What business risks are involved with third party service providers who support the IT function? What must the IT manager do to minimize these risks?

The main business risk is business disruption due to a service provider’s failure to perform as expected. Another business risk is the breach of security.

• •

• •

The IT manager should, in concert with upper management, establish policies and procedures regarding the purchase, use and termination of third-party services.

There should be legally binding contracts between the company and service providers articulating the roles and responsibilities of each party, services to be performed, service level agreements, contract duration, service costs, dispute resolution, dissolution arrangements and so on.

The IT function must work with the service provider to ensure the security and confidentiality of company information.

The IT manager must have a backup and recovery plan in place, which should be periodically tested --the compliance monitoring process.

5-8 What is meant by the term ‘concurrency control’?

Concurrency control is the need in a relational database environment to protect the integrity of the information when multiple users are accessing, reading, and changing the same data.

4

5-9 Explain the concepts of RAID, NAS, and SAN. RAID (Redundant Array of Independent Disks), NAS (Network Attached Storage), and SAN (Server Area Network) are ways in which to configure redundant storage devices.

RAID includes many levels of redundancy involving storing data on separate disks. The chapter discussed disk mirroring and disk striping. See Figure 5-6 in text.

NAS integrates storage devices into the local area network (LAN) to handle input-output operations. It can be shared by multiple users. 2320444 SAN is a dedicated network linked to multiple LANs. It is used with wide area networks (WAN), and is capable of handling high volumes for large companies.

5-10 Discuss the considerations of a disaster recovery plan.

Companies must be proactive and plan for disasters. The Plans must be periodically tested. Various disaster scenarios should be planned for what, who, when, where, how, which and why.

• The contingent scenarios describe what can happen and then what to do next.

• The plan should specify who to contact, in what order, and what they are expected to do.

• When to enact or wait and see is a critical decision that requires prior planning.

• The plan must consider where to transfer processing and business operations.

• How is the logistical aspect of the plan, that is, the physical moving of people, computers, software, and data to the recovery site.

• The Planners must consider which applications are essential to continue business operations.

• A prioritized recovery plan considers why some applications are more time sensitive than others.

5

EXERCISES 5-11 The Grand Company averages around 200 employees each pay period. They have departments for manufacturing, administration, sales, marketing, customer service, and information systems.

Currently the company issues a payroll semi-monthly. The company has full-time, part-time, salaried and hourly employees. Sales people earn commissions based on total sales, and bonuses based on meeting budgeted sales goals. For payroll calculations, the company uses 2030 hours as the number of work hours each year.

The payroll is administered by two full-time employees who earn $30,000 per year plus benefits which average 15 percent of their salary. All employees typically receive a three percent (3%) increase in pay on January 1 each year.

The payroll software needs updating. The legacy system has the following problems: • It does not interface with the Human Resources system, so all new hires and employee changes must be entered twice, once into the Human Resources system, and once into the payroll system.

• The PR software does not prorate, so all changes must be made at the beginning of a payroll period, or manually calculated.

• There is no audit trail of changes from one payroll to the next. A change made in error could go undetected unless the employee notifies the company.

• Tax table changes require an upgrade from the software company, and they charge $1,500 each time. The new tax laws indicate there will be changes twice a year for the next five years. The company is expected to increase the upgrade fees by 5% each year.

• Employees have difficulty understanding their pay stubs. The payroll administrators receive an average of 10 inquiries per payroll, mostly from bonus & commission calculations.

• The number of paychecks with errors average 4 per payroll.

• Issuing W-2’s at the end of the year is always a nightmare. They are never finished until the deadline day since the payroll administrators are so busy with their regular duties, this overtime activity requires ten total hours, paid at time and one-half.

• Filing Federal and State reports and reconciling them to the payroll has always been very time consuming, and requires ten hours overtime (total) per quarter.

• Currently the IT department has one person dedicated to the administrative staff, and about 20 percent of this person’s time is devoted to payroll and Human Resources issues.

Response to non-emergency requests often takes four weeks. The IT person responsible for payroll related issues currently earns $40,000 per year.

The IT department is recommending that the company outsource the payroll function. The Payroll Company claims:

6

• • • • • • • • • • • •

The Human Resources system will interface with the Payroll. New hire information and changes will automatically be updated into the Payroll system and salary changes will begin on the effective date.

The cost would be $1.00 per paycheck issued, plus $50.00 per payroll. These fees are expected to increase by 5% each year after the first payroll year.

There is a one-time setup fee of $2,000.

The setup would include a commission and bonus calculator. A special report would be generated to show each sales person’s calculation, and a company summary.

The timesheets for each department will be online everyday for managers to review. A secure report would be issued to them with the payroll with an electronic signature required for approval.

The payroll administrator will receive an audit trail report with all changes since the last payroll. This will be issued in time for a final review before the payroll is issued.

The design of the payroll stub or advice can be customized. They can include nonpayroll information, such as the number of vacation days available, or upcoming company events.

Direct deposit is available.

Tax returns will be generated after the last payroll of the tax period, including W-2’s.

A free training session would be provided.

Customer service support would be available at all times, and employee questions are guaranteed to be answered within 48 hours.

Upgrades and tax table changes would be seamless and invisible. The payroll department would be notified when the changes would take place and what changes and features would be included.

In addition to the advantages offered by the payroll company, the IS department feels that only one employee will be needed to administer the payroll function, eliminating one full time position. The IS person dedicated to payroll will be able to devote all of her time to other projects.

Required: Using the above information, create a project scorecard for this IS proposal.

Include goals for each perspective, and show how each goal can be measured. For the Organizational Contribution perspective, detail the net present value cash flow over the next five years for two scenarios: 1) remaining with the current in-house method of administering payroll and 2) outsourcing payroll. Then, calculate the net present value gain or loss assuming the company was to outsource payroll. Further assume that The Grand Company will continue to calculate payroll as usual for the remainder of the current year, but that if it decides to outsource payroll, it will do so starting with January 1st of the upcoming year.

7

Organizational Contribution Goal: Increase cash flow each year for next five years.

Measure: Compare costs with and without the project for five years showing positive present value.

Year 0

Year 1

Year 2

Year 3

Year 4

Year 5

5-Yr Total

2 @ $30,000

60,000

61,800

63,654

65,564

67,531

69,556

328,105

$60,000 x 15%

9,000

9,270

9,548

9,835

10,130

10,433

49,216

(50/2030 hrs) x $30,000 x 1.5

1,108

1,142

1,176

1,211

1,247

1,285

6,061

5% increase @ yr

3,000

3,150

3,308

3,473

3,647

3,829

17,407

20% x $40,000

8,000

8,240

8,487

8,742

9,004

9,274

43,747

$8,000 x 15%

1,200

1,236

1,273

1,311

1,351

1,391

6,562

82,308

84,838

87,446

90,136

92,910

95,768

Cost of Current System Payroll Adm. Salary Payroll Adm. Benefits Payroll Adm. Overtime Software Upgrades IT Personnel Wages IT Personnel Benefits Total Annual Cost Total Cost for next 5 years

Cost for New System

451,098

Year 0

Year 1

Year 2

Year 3

Year 4

Year 5

Total

Payroll Adm Salary

$30000 @ 3%

30,900

31,827

32,782

33,765

34,778

164,052

Benefits

$4,500 @ 3%

4,635

4,774

4,917

5,065

5,217

24,608

Setup Fees $50 fee per payroll 24 periods x $50 $1.00 fee per paycheck (24 periods x 200 employees) Total Annual Cost

2,000

-

-

-

-

1,200

1,260

1,323

1,389

1,459

6,631

4,800

5,040

5,292

5,557

5,834

26,523

43,535

42,901

44,314

45,776

47,288

Total Cost for next 5 years Annual Cash Savings from Outsourcing Payroll

2,000

223,814

41,303

8

44,545

45,822

47,134

48,480

227,284

User Satisfaction Goal: Have inquiries for payroll questions drop to two or less per payroll.

Measure: Log inquires each payroll.

Goal: Payroll administrator will require no support from the IS department.

Measure: IS support person will eliminate time on Payroll and IS issues. Responses to employee requests from the outsourcing company are guaranteed within 48 hours.

Operational Performance Goal: Error free payrolls at least 75 percent of the time due to audit trail report that is verified for all changes, and each manager’s review and approval of department online timesheets.

Measure: Log the payroll changes made for corrections.

Goal: Payroll related Federal and State tax returns will be filed on time without overtime. This includes issuing W-2’s to employees.

Measure: Log filing dates of payroll related tax returns. Check payroll administrator’s overtime records for time-periods prior to filing dates.

Adaptability and Scalability Goal: The new payroll system will be operational on the date planned.

Measure: First payroll will be issued on target date.

Goal: Interface with Human Resources system will be completed with first payroll.

Measure: A satisfactory operational test will be performed two weeks prior to first live payroll.

Goal: Claims made by The Payroll Company will be evaluated every six months for performance and satisfaction.

Measure: A system audit will indicate if Payroll Company performs as claims and continues to meet the needs of the Grand Company.

9

IT AUDIT SOLUTIONS MANUAL Chapter 6 Discussion Questions 6-1. This chapter discussed a variety of network configurations. How many clients and servers do you think are on the networks of a Fortune 500 company?

It might be interesting to contact a local business and learn about how many clients and servers they have. You can use this number to extrapolate and guess at the numbers for a Fortune 500 company, although to some extent this will vary with the industry. One way to calculate the number is to guess at how many employees such a company has and then think in terms of one client per employee. If the ratio of servers to clients is one to 20, you can use this as a divisor to determine the number of servers. For example, Procter and Gamble has more than 100,000 employees, so they might have 100,000 clients and 5,000 servers.

6-2. Just about every business has been impacted by a programmed threat. What are the costs associated with a threat such as Code Red? The costs are much more than seems evident at first. There are both direct and indirect costs. It appears that most people think only in terms of direct costs, which may be why security doesn't receive more attention. The direct costs of Code Red are likely to be small. These might be the costs of finding and obtaining patches, rebooting or ghosting machines, and/or paying for security consultants. The indirect costs relate primarily to productivity, although they might also concern lost revenues. There have been several attacks that have "slowed" the Internet. One such virus attack occurred January 25, 2003. This attack infected more than 200,000 computers and slowed the Internet. It impacted e-mail, Web browsing, and even ATM access.

6-3. Suppose you work for a company that is the object of a Denial of Service attack?

Describe the steps managers and auditors should take during and immediately following the attack to control it and prevent future attacks.

There is a very good Harvard case about a fictitious e-business that undergoes a Denial of Service attack (iPremier). Management does many things right during and immediately preceding the attack. They try to find the cause, do everything possible to stop the attack, and communicate the attack and its impact to the public. What they do incorrectly immediately following the attack is fail to detect the source and act to make sure that the attack didn't penetrate their databases. As a result, sometime later, their competitor comes under attack from a hoax or worm that appears to

be coming from their site! This case emphasizes that the most important thing to do is to make sure that confidential information is not compromised in such as attack. The management and auditors need to take any steps necessary, including a complete rebuilding of databases and information systems to protect their data.

6-4. Some people think Kevin Mitnick is a hero and others see him as a criminal. What do you think? What is he doing now?

According to Forbes magazine, Kevin "Mitnick is really just your average geek who has

done some bad things in his life, and has paid the price. To this day, he would like nothing more than to dissect some computer program to see how it works."

Kevin was released from prison in January 2000. As part of his release agreement, he was prohibited from using a computer for a number of years. This parole condition ended in January 2003, when Kevin was able to get on the Internet for the first time in eight years. At this time he is interviewing for jobs in computer security.

6-5. Describe five ways a hacker might use social engineering to penetrate a business network system.

A hacker could use social engineering to penetrate a business network system in the following ways: 1) Posing as an employee to physically enter a computer room.

2) Posing as an employee to acquire user or password access information from a computer help desk employee.

3) Posing as an employee to acquire user or password access information from an authorized user.

4) Getting to know an insider and guessing their passwords.

5) Posing as a security consultant conducting a penetration test.

6) Posing as a news reporter writing a story about the company's IT. 6-6. Network and telecommunications systems are even more vulnerable to attack from insiders than from outside hackers. Describe three things an IT auditor can do to verify controls over these systems specifically related to employees.

An auditor should check the current user listing against a list of valid employees provided by Human Resources. The IT auditor can make sure there are no Group ID numbers in use. These allow multiple users to access the system with the same identification code. The IT auditor can check access rights of various levels of users. An IT auditor can also look at the settings for passwords in the system access or operating software.

6-7. Using the Internet, find two examples of software vulnerabilities. Discuss how security administrators and auditors can protect themselves from these types of threats.

The Internet worm attack in January 2003 preyed upon a software vulnerability in a Microsoft database program called SQL Server 2000. Security sites, such as CERT, track these vulnerabilities. The following is an example from www.cert.org (January 27, 2003): CVS is a version control and collaboration system that is widely used by open-source software development projects. CVS is commonly configured to allow public, anonymous, read-only access via the Internet.

The CVS server component contains a "double-free" vulnerability that can be triggered by a set of specially crafted directory requests. While processing these requests, an errorchecking routine may attempt to free() the same memory reference more than once.

Deallocating the already freed memory leads to heap corruption, which an attacker could leverage to execute arbitrary code, alter the logical operation of the CVS server program, or read sensitive information stored in memory. In most cases, heap corruption will result in a segmentation fault, causing a denial of service.

The CVS server process is typically started by the Internet services daemon (inetd) and runs with root privileges. Arbitrary code inserted by an attacker would therefore run with root privileges.

6-8. Discuss the level of security afforded by firewalls. What are some of the protections offered by personal firewalls?

Firewalls both permit and block communications among networks. They are an important component of network security, but they are limited in that they are only as good as the programmers and systems people who install and maintain them, and their role as a screen does not mean that they can afford perfect security.

A personal firewall such as ZoneAlarm can offer many different security features, including: hacker tracking, control over pop-up ads and other ad blocking, control over cookies, and protection against e-mail attachment viruses.

6-9. Discuss the level of security afforded by intrusion detection systems. How do these systems use artificial intelligence techniques such as pattern recognition to detect network intrusions?

Intrusion detection systems (IDS) are frequently incorporated in today's firewall systems.

Specialized IDS such as Tripwire, perform the function of scanning for unauthorized access or manipulation. For example, an IDS can detect when an unauthorized party tries to change your Web page. IDS can also detect hackers who are scanning your ports for access points.

An IDS works by recognizing attack patterns in network traffic. There are two types of approaches to detecting IS attacks. One is to detect intrusions by scanning for activities that correspond with known intrusions or vulnerabilities (misuse detection model) and the other is to detect intrusions by searching for unusual traffic (anomaly detection model). Expert systems can be used in the misuse detection model when they are constructed with a set of

rules describing attacks. Neural networks work for both models. Their ability to learn and retrain allows them to adopt to changing situations.

6-10. Describe the benefits to a company of hiring an IT audit consultant to conduct a penetration test of a network system.

Every network is likely to have vulnerabilities. Penetration testing can identify where those vulnerabilities exist. You then have the option of controlling for them or not. An IT audit consultant is going to be familiar with tools that can help protect the system.

EXERCISES 6-11. Amanda and Chris McDermott own a small business, Plastic Dollars, which produces and maintains stored value cards for retailers. Most of the cards they sell are gift cards, such as those available in various restaurants and stores. They just started their business two years ago, but this year they hope to sell about four million dollars worth of cards. Depending on the arrangement with the business, they may or may not maintain the database that contains the card owner's name and the current value on the card. Their revenue comes from the percentage of retail value they charge businesses for the cards. Therefore, although the business is doing well, money is still tight.

Plastic Dollars employs five people, including Chris and Amanda. Two of the employees are full-time, and the other is a part-time worker who is also a college student. The business has two servers and three client computer workstations. They also have three phone lines that allow them to communicate with various retail and restaurant establishments in real time. The company has been "hit" a few times by various programmed threats. Chris and Amanda use anti-virus software, but they aren't always careful about keeping it up to date. They know they should do more but they don't think the cost is worth it. Although they have no disaster recovery plan, they do back up their files every three hours, by encrypting and compressing their data and uploading it to a remote location.

Required: 1. Evaluate the risks to Plastic Dollars of programmed threats. What are the potential

direct and indirect costs associated with these risks?

Plastic Dollars has a lot to fear from programmed threats. They could have their web site taken over, which would result in lost revenues. They could also have the database compromised, either in terms of data integrity, or their customers' privacy could be violated. In a worst-case scenario, an attacker could plant a virus that would provide access to credit card numbers. Since they engage in transactions with retail and restaurant establishments in real time, an outage of their system will create a disruption in service to their customers.

2. Develop a security plan for Plastic Dollars that will protect them against blended and other programmed threats.

A security plan for Plastic Dollars would include the following: • firewall software • intrusion detection software • a regular review of firewall, anti-virus, and IDS systems • a manual backup plan • a regular scan of virus and security alerts 6-12. Figure 6-11 describes the components of an IT audit program to evaluate network security. The first step an IT auditor must take in conducting a review of this security area is to obtain an understanding of network configuration and network security administration.

Required: 1. Describe in some detail the specific steps you would take to obtain such an understanding.

The IT auditor would first obtain last year's audit papers and review them. The next action would be to interview the CIO and the network services director. Next the auditor should ask for a detailed organization chart (showing the network security administration function) and a map of the network system. If no map exists, the IT auditor will need to interview personnel regarding the configuration and create such a map. If there is a map, the IT auditor will need to physically inspect at least a portion of it to verify that it is up to date. The IT auditor may want to spend time with the network administrator and the network security administrator - both in an interview format and also, time permitting, observing some of their activities. There is no substitute for physical inspection! Finally, the IT auditor will need to inspect hardware and software contracts to obtain assurance that there are no outdated versions that may no longer be maintained by vendors.

To further obtain an understanding of network security administration, the IT auditor should obtain copies of documents and procedures used to control logical access and change control. In addition, the auditor should obtain a listing of all controls, including firewalls, etc. The auditor

will need to evaluate firewall and IDS security, which includes evaluating the specific firewall rules and defaults set. The IT auditor also needs to learn about procedures for scanning security alerts and updating security-related software such as anti-virus programs and procedures for patching holes in application software. Some of these steps entail more than an overview and might be done later in the IT audit.

2. What is the purpose of this portion of the audit?

The purpose of this portion of the IT audit is to obtain an understanding of the system sufficient to determine the scope of work that will be necessary to obtain assurance regarding IT risks.

IT AUDIT SOLUTIONS MANUAL Chapter 7 Discussion Questions 7-1. What would be the differences in risks faced by an organization that used the Internet primarily to display content versus a business that conducted collaborative ebusiness?

A company that primarily uses the Internet to publish information is much less at risk than one that engages in collaborative e-business. A web site with content and no exchange of data really has little risk. A site that allows the exchange of data back and forth among servers may allow unauthorized users to obtain access to internal networks.

7-2. What are the differences between the OSI protocol described in Chapter 6 and the TCP/IP protocol described in this chapter?

OSI is the general network protocol and TCP/IP is the protocol for the Internet. OSI, consisting of seven layers, supports network interoperability, which allows disparate computers to communicate and share data. TCP/IP has a four-layered architecture. It allows communication and data sharing among computers across the Internet. The layers in OSI and TCP/IP map to each other and serve the same functions.

7-3. XML is developing as a language to facilitate the extraction and manipulation of data on the Internet. Discuss some of the obstacles likely in the development of a common language for communicating and manipulating e-business data.

XML lets various groups of individuals or entities develop their own set of custom mark-up applications for their particular area of interest (e.g., accounting). An obstacle to its development is that each group must agree on standards for their mark-up domain, otherwise the ability to communicate is lost. There is also the issue that software developers must incorporate support for XML in their appropriate software. XML and its industry-specific derivatives will only be successful if it gains wide usage and acceptance. As of this writing, Microsoft plans to release MS Office 11 in mid-2003 - and it will include XML support. This development should have a dynamic impact on the future of XML. 7-4. Privacy is considered to be one of the biggest concerns in conducting consumer-to-

business transactions across the Internet. Find the privacy policy for a popular online retailer and compare it with that of GE. Almost every web site has a privacy policy.

7-5. Discuss the difference between privacy and confidentiality issues for two businesses engaged in e-commerce.

The AICPA/CICA Trust Services principles and criteria refer to online privacy as concerning personal information obtained from e-business transactions. Confidentiality, on the other hand, is considered to be information that has been agreed to be kept secret. Interestingly, confidential information does not have some of the rights of access that personal information does. It is also more difficult to define confidential information so it is important that parties conducting ebusiness clearly designate that which they consider to be confidential. Many of the controls that protect privacy are the same controls that ensure confidentiality. For example, encryption would be a control over both.

7-6. Discuss the advantages and disadvantages of cookie files from an end consumer standpoint.

We may hate cookies for their privacy infringement, but they do save time in transacting ebusiness. When your browser visits the web site for an e-tailer like Amazon, you may be greeted personally. This is an advantage because Amazon can customize the information you receive according to your expressed past preferences. Further, when you "check out" at an e-tailer, the process can be streamlined because of the cookie.

7-7. SSL is the most common encryption form used for e-business. Discuss its shortcomings and explain how it compares with SET. SSL offers less protection than SET because it doesn't include authentication features because it doesn't produce digital signatures. On the other hand, SSL is quite easy to adapt and for this reason, it's the encryption of choice for most online businesses. SET hasn't caught on like other encryption protocols, in part because it relies on a complex infrastructure that includes digital signatures. SSL can be used in conjunction with other protocols, such as S-HTTP, in order to achieve similar security levels and authentication provided by SET. 7-8. Discuss the advantages to both an end consumer and to banks and billing companies of EBPP systems.

EBPP systems are good for everyone! Paying bills online will save end consumers time and money. Repeat bills can be paid at the click of a mouse. This is certainly better than writing checks, addressing envelopes, and buying stamps. It's also cost-effective for the end consumer because there is no postage - although the cost savings could be offset by a banking fee. At this time, some vendors are considering charging extra for making payments offline, which is another

incentive for the consumer to use EBPP. As for banks, they have an opportunity to engage in this business. The big banks are starting to offer EBPP to their customers, competing with pure EBPP companies like CheckFree. Vendors are going to be very happy also because they are likely to collect their accounts payable faster and more reliably.

7-9. Why is the issue of repudiation so important in e-business?

Repudiation is especially important when transactions do not take place face-to-face. In ebusiness, it is easy for a party to assume a false identity. E-business also often involves transactions among parties who are strangers to each other and aren't engaged in recurring business. This makes it easier for someone to deny all or part of a transaction. The "proof" that a transaction actually took place is harder to acquire.

7-10. Explain how you would go about obtaining a digital signature. Also explain why a digital signature might carry less risk than a paper signature.

Digital signatures are available from certificate authorities (e.g., Thawte). Paper signatures are actually relatively easy to forge, whereas digital signatures are not. A digital signature is created with a cryptographic algorithm that constitutes the signer's private key. The signature can't be forged unless someone has access to the private key. A user can sign documents with the private key and also use it to unlock encrypted documents received that have been encoded with the corresponding public key. You need a public key to check someone's digital signature - they typically send it to you. You can verify it then with the signer or with a certificate authority.

7-11. Describe at least four implications of electronic versus paper evidence for IT auditors.

Because of the many implications of electronic evidence for auditors of all types, the Auditing Standards Board of the AICPA issued SAS No. 80. One implication of this evidence is that it may be easier to alter or change. Changes to paper documents are easy to spot, whereas a change to an electronic document is not likely to be detectable. Another implication concerns time.

Electronic evidence may be discarded more readily, such as when users empty their e-mail trash.

Another implication concerns access. Electronic evidence may be easier to protect in terms of physical access, but not necessarily logically. Hackers have been able to penetrate all kinds of information systems, which puts electronic evidence at more risk. One other implication of electronic evidence is that it may be more difficult for auditors to obtain or to put together coherently. For example, a physical transaction voucher is a set of documents that is typically stapled together or bound in some fashion. An electronic voucher may have data links instead of a paper clip.

7-12. E-business conducted over the Internet may supplant traditional EDI systems.

Why would a company choose to continue using EDI for exchange of business documents versus the Internet?

The primary reason that a company will continue to do so is that they have already made the investment as have their vendors. If all are EDI-ready, then there is not so much reason to change. The ongoing cost of the VAN may be outweighed by the tasks that the VAN performs e.g., error-checking.

7-13. If you were an IT auditor who learned that the company for which you work is planning to engage in collaborative commerce over the Internet, what would be your concerns regarding risk?

I'd be very worried! An IT auditor once commented that he wished we would just stick to mainframes! It's much easier to protect one computer in a room than a distributed network. And c-commerce opens up your systems to many parties. Of course, there are controls available to partition off access, but the fact that customers, suppliers, and other partners are now able to access parts of your system increases risks with respect to security threats such as denial of service attacks.

7-14. Describe four specific topics that should be included in an organization's e-mail policy.

The chapter discussed many of these. One topic is the policy toward use of the e-mail system for personal mail. Another is that the company owns all of the e-mail and can audit and monitor the system. Another part might explain that e-mail is not confidential. The e-mail policy should also note the enterprise's e-mail retention policy. Finally, the policy should address sending or receiving e-mail that might contain offensive material, such as sexually explicit images.

7-15. Businesses have long been using the services of third parties. Why does the Internet make management of third party providers an increasingly important issue?

In many cases the Internet service itself is provided by a third party. The Internet creates many opportunities for third parties to specialize and offer needed services to users. These include hosted software, bill payment, supplier auctions, and security services.

7-16. The AICPA introduced its WebTrustTM assurance service several years ago. To date, it has been slow to catch on and its seal is on only a few Internet sites. Why do you think this service has not been more popular?

WebTrustTM is popular in that many CPA practices offer a form of it to their clients. However, the seal itself has been slow to catch on. One reason may be that the CPA brand was not recognized out of context - or online. Another reason is that while consumers may be hesitant to buy from an online e-tailer that they don't know, the more successful online merchants actually have brands with which they are already familiar (e.g., Staples, Gap). Another reason the WebTrustTM seal did not catch on is likely its cost. Originally, the assurance service was sold as a complete package that included transaction processing, security, and so on. This made it quite pricy, particularly if a merchant wanted only a piece of it, such as privacy protection. Finally,

there proved to be quite a bit of competition from other brands, such as Better Business Bureau and large accounting firms (e.g., PC BetterWeb).

EXERCISES 7-17. Equip-Your-Office, Inc. is a Chicago-based company that sells office equipment to end consumers and retail stores, primarily throughout the Midwestern United States. Pierce Bennett, the CIO, is currently directing a project to develop an online sales operation. He has many concerns about security and privacy. The CFO, Halle Banks, is recommending that the company obtain third party assurance at the web site. She feels that it will be important to customers to see a seal or other form of guarantee that will give them some comfort about doing business with Equip-Your-Office online.

Required: 1. Discuss the advantages and need for third-party assurance in this scenario.

The advantages of third-party assurance in this scenario are twofold. First, the use of a web seal can help online consumers to feel more comfortable in placing orders. Second, this assurance would allow Equip-Your-Office to have an independent party provide them with feedback on their performance with respect to issues such as privacy, security, maintainability, and availability.

Staples, a known brand in the off-line retail office supply industry has no third party seal at its web site. They do have a link to a privacy policy and security site that includes a privacy statement and information about the company's business policies. Nor do Office Depot or Office Max have a third party web seal. Viking Office Supplies, however, a less well-known company, carries the VeriSign security seal and the bizrate.com seal, which reports customer satisfaction with the site. This data suggests that third-party assurance is most needed for companies that do not have national brand recognition. Equip-Your-Office may need to invest in third party assurance and obtain seals that will make online consumers feel safer when placing their orders.

2. Which third-party assurance type would you recommend?

The most important concerns for online consumers are likely to be security, privacy, and business policies. I would recommend a possible combination of seals and assurance to cover these issues.

Given that CPA WebTrust has not achieved much name recognition, it is likely that Better Business Bureau's BBBonline service, perhaps combined with TRUSTe, would offer the best value.

7-18 eXtensible Business Reporting Language (XBRL) is an XML-based standard for business reporting on the Internet, being developed by a consortium of more than 170 organizations.

Ideally, XBRL will allow easy comparison, exchange, and analysis of financial reports. More than 80% of US-based companies publish some financial information on the Internet, however this data is a variety of formats that makes it difficult to use the information.

Required: 1. Explain the likely benefits of XBRL to each of the following groups: • Investors •

Accountants

•

Reporting entities

•

Lenders

A series of articles that appeared in Strategic Finance (June 2001) discussed the advantages of XBRL to these groups in some depth. These are terrific but should be considered cautiously as we can't really know the benefits of any new technology until it is used. Some of the potential advantages to each group are: • Investors. XBRL is likely to improve the ability of investors to compare data among multiple businesses that publish their financial performance data online. Currently, the use of disparate formats by companies publishing their financial statements on the Internet makes such comparisons impossible, except through a service such as EdgarScan, which puts SEC EDGAR data in a common form.

• Accountants. Accountants preparing financial statements should be able to create financial reports at reduced cost, primarily because they will need to prepare them just once, in a common format. Software programs will publish in the XBRL format and will also be able to take that common format and translate it into other views such as for credit applications. Accountants will also be able to collect data from multiple sources for comparison purposes. It's possible that the XBRL standard will also help in tax return preparation and reporting, compliance with regulatory agencies, and even contribute to improved budgeting.

• Reporting entities. These entities will enjoy the same cost advantages as accountants who are preparing reports.

• Lenders. Lenders will be able to translate XBRL data into a variety of formats, without needing to undertake a lot of data entry. They are likely to also have an easier time manipulating the data and presenting it in a variety of formats.

2. While XBRL holds a lot of promise, there are many impediments to its development

and usage. Discuss the problems in creating this standard.

A primary problem in creating any standard is the need for consensus. While some might say that XBRL will help unify accounting standards, the reality is that the same issues that make it difficult to reconcile US GAAP and IAS standards, the reality is that the same underlying differences still exist and will, even with XBRL. There can be different sets of tags for different industries and different accounting standards. These all need to be developed and there needs to be consensus around each set. This is perhaps the biggest impediment to development and usage.

There is also a need for a critical mass to agree to publish with the standard and for software developers to use it. Microsoft will be releasing an XBRL-ready version of Office products soon (sometime in 2003) and it is likely that this action will speed the process.

IT AUDIT SOLUTIONS MANUAL Chapter 8 Discussion Questions 8-1

The disadvantages of using electronic working papers (which include electronic audit programs and questionnaires) deal primarily with over-reliance and failure to fully understand the underlying mechanics of the process. Inexperienced auditors may simply enter information without understanding the full implications of the information. There is also the danger of entering information in the wrong place, which can lead to incorrect audit conclusions. Finally, the omission of information in the working papers can also lead to incorrect audit conclusions.

8-2

Audit expert systems are especially good for structured, routine tasks for which expertise can be adequately captured and represented in the knowledge base of the system. Some successful expert system applications include internal control systems, bankruptcy decisions, and going concern decisions. The expert system must be able to render a decision such as bankrupt or not, going concern or not, rely on internal controls or not.

Thus, this kind of structured decision is a good candidate for an expert system.

8-3

The liability of an auditor relying on an expert system is an issue in its infancy with respect to the law. There have been a few cases but the issue is still open. You may wish to have students read: “An Analysis of Potential Legal Liability Incurred through Audit Expert Systems,” S. Sutton, R. Young and P. McKenzie, Journal of Intelligent Systems in Accounting, Finance, and Management, Volume 4, Number 3 (Special Issue on Accounting), September 1995.

8-4

A client’s data may be obtained on tape, CD, direct OBDC connection, or disk. Tape is the least expensive media, but direct OBDC connection is the most efficient, since the data can be directly imported into the audit software.

8-5

In using test desks, the auditor’s biggest concern is that (s)he must try to cover all possible exceptions and deviations from the normal output. If a possible deviation is omitted from testing, this may be the very thing that is in fact problematic. In an integrated test facility, the auditor must be careful to reverse any test transactions that have been introduced in the client’s live system. Failure to do so will corrupt the client’s financial data and resulting statements.

8-6

An input file definition in ACL is the structure that ACL attaches to a file being imported into ACL. Client data that is imported into ACL must have an input file definition (IFD) so that ACL can properly identify the data and data types within each field. For example, is a field numeric or alphanumeric? Is it a data field? The IFD identifies the character of data in each field being imported into ACL. Once the data are imported into ACL, the data can be manipulated in many different ways. One can look at various columns and rows, filtering the data for various criteria of particular interest to the auditor. Each of these filtered files is called a “view” in ACL. An auditor can establish as many “views” as (s)he wants. Views are temporary but can be saved if the auditor wishes. A view does not change the underlying data in the imported file or the IFD.

8-7

The Statistics command can analyze data or numeric data elements within a file. For example, this command will give you the maximum and minimum values for a selected field, the number of records with a value of 0 in that field, the number of negative records, and the average for the field. The Statistics command cannot be run on a character or alphanumeric field.

8-8

Digital analysis is a technique for detecting anomalies in a dataset. The technique helps to identify any fields where the first digit of the data in that field is outside the expected

frequency of occurrence that that particular first digit should appear. For example, in a large data file of invoice numbers, the number one should appear as a first digit approximately 30% of the time, while the number nine should appear approximately 4.6% of the time (see Figure 8-17, p. 198). If, for a sufficiently large sample of invoices, the 15% of them started with the number nine, this would indicate possible fraud within that file. The auditor would then investigate the reason for the deviation from the expected frequency for that digit. Digital analysis is based on Benford’s Law, which says that the first digits of a set of naturally occurring numbers will follow an exponential distribution. Numbers that occur in a set pattern or sequence will not follow Benford’s Law. For example, telephone numbers, zip codes, and social security numbers follow a set pattern, and thus would not follow Benford’s Law. 8-9

A data query model is using an entire set of facts or circumstances to determine if fraud is present. For example, in examining travel vouchers submitted for payment, one might examine the entire circumstances of the trip. When did the trip occur? Does the data of business coincide with the dates submitted for reimbursement. It means looking at more than just the travel voucher, but going further to see if all of the facts fit to establish the business nature of the reimbursement being claimed by the employee.

8-10

An embedded audit module is a batch routine inserted into the audit client’s information system to monitor transactions to determine exceptions as they occur, as opposed to waiting until the annual audit is conducted. The auditor embeds the audit module, with the full knowledge and consent of the auditee.

Exercises 8-11 8-11.1 There are 772 records (Analyze, Count).

8-11.2 161 of 772 records have negative amounts (Analyze, Count, If amount<0). The negative amounts mean credit balances in accounts receivable for that customer/record.

8-11.3 190 of 772 met the test: amount>1000. The total of Amount is: $318,379.09.

8-11.4 The average of total accounts receivable is $607.36 (Analyze, Statistics, Statistics On Amount). Note that the average of the 609 positive accounts receivable records is $865.81, while the average of the 161 negative accounts receivable is -$362.71.

8-11.5 The two strata in the middle have the highest amount of receivables.

8-11.6 A rule of thumb to determine if further investigation might be necessary is a z-statistic larger than one. In the accounts receivable file, there are several first digits that appear suspect. In particular, the receivables that begin with 2, 5, and 6 bear some further investigations. The auditor may also look at receivables that begin with 8 or 9 also. An auditor should view all of these receivables to investigate if fraud is present.

8-11.7 Click on the + next to Input file definition for Ap_trans.

8-11.8 There are 102 transactions in this file (Analyze, Count).

8-11.9 There are 37 vendors represented in the Ap_trans file. (Highlight the Vendor number column and select Analyze, Classify. This will show the number of records associated with each vendor.) Note that there are 50 vendors in the Vendor file; however, the question asks how many vendors are represented in the Ap_trans file.

8-11.10 Yes. There are 101 gaps in invoice numbers. (Highlight the invoice number column, then select Analyze, Gaps) The auditor would examine this further to determine if this situation is reasonable or not.

8-11.11 There are no duplicate invoice numbers (Highlight the invoice number column, then select Analyze, Duplicates).

8-11.12 3 vendors sell inventory items that cost more than $100 (Set filter to Unit_Cost>100.)

The command log looks like this: 11475 8752512

10/21/2000

7,125.80

090584072

41

173

11837 2213337

10/21/2000

3,996.20

090585322

29

137

10134 70075

4/09/2000

467.40 090081001

3

155

8-11.13 The log of the aged A/P file looks like this: @ AGE ON Invoice_Date CUTOFF 20001231 INTERVAL 0,30,60,90,120,10000 TO SCREEN <<< Graphable Data >>> Page ... 1 06/01/2003 15:40:01 Produced with ACL by: ACL for Windows Workbook <<< AGE over 0-> 10,000 >>> >>> Minimum encountered was 21 >>> Maximum encountered was 355 Invoice_Date 0 -> 29 30 -> 59 60 -> 89 90 -> 119 120 -> 10,000

COUNT <-- % 4 3.92% 22 21.57% 19 18.63% 20 19.61% 37 36.27% 102 100.00%

Clicking on “Graphable Data” yield the following graph:

This yields a very high amount of old accounts payable. In fact, more than half of the accounts payable are 90 days or older. The auditor would be very concerned as to why this company is apparently not paying its bills on time and would investigate accordingly.

8-11.14 You must open the “Vendor” file to obtain the street addresses of the company’s vendors.

No vendors have P.O. Boxes for addresses. This is important because a P. O. Box is sometimes (but of course not always) indicative of a suspect address. You can visually scan the address file, or in a bigger file, you would use the “Sounds Like” expression to make this determination.

8-11.15 Highlight the Invoice Amount column and choose Analyze, Benford. The command log looks like this: @ BENFORD ON Invoice_Amount LEADING 1 TO SCREEN <<< Graphable Data >>> Page ... 1

06/01/2003 15:53:02

Produced with ACL by: ACL for Windows Workbook Leading Digits

Actual Count

Expected Count

1

29

31

0.260

Zstat Ratio

2 3 4 5 6 7 8 9

18 9 12 12 6 8 4 4

18 13 10 8 7 6 5 5

0.010 0.971 0.541 1.255 0.130 0.671 0.322 0.079

Clicking on “Graphable Data” yields the following graph:

The digit “5” is the only one that appears to be slightly above normal in terms of how many times you would expect it to appear as the first digit. The auditor may do some investigation here, but would likely not be overly concerned with this results, as they appear fairly in line with expectation.

8-12

Open the “Inventory” file.

8-12.1 152 inventory items are maintained by this company. (Analyze, Count) 8-12.2 There are 37 inventory items sold at Location 3. There are two ways to determine this.

One way is to select Analyze, Count and under “If” type: Location=’03’ A second (similar) way is to set the filter to: Location=’03’ and then select Analyze, Count. Either way accomplishes the same end result.

8-12.3 Highlight the Unit Cost column, then select Analyze, Statistics. The average cost of an inventory item is $17.73. The most expensive and least expensive inventory items are

381.20 and –6.87 (which, of course, bears looking into). The command log looks like this:

@ STATISTICS ON UnCst TO SCREEN NUMBER 5 Field : UnCst Number Total Average Positive : 149 2,642.35 17.73 Zeros : 0 Negative : 3 -16.88 -5.63 Totals : 152 2,625.47 17.27 Abs Value: 2,659.23 Range : 388.07 Highest : 381.20 173.80 155.80 137.80 87.40 Lowest : -6.87 -6.80 -3.21 0.01 0.03 8-12.4 The profit on item #034255003 is $6.58. Set the filter to: ProdNo='034255003' Use the expression builder to calculate the profit (SalePr-UnCst). If you wanted, you could create a new column for the profit by right clicking and choosing “add column,” enter the expression for the contents and change the title to “Profit.”

8-12.5 There are 4 inventory items that have a product status of “U.” (Set filter to U: ProdStat='U')

8-12.6 Yes, there are 3 items for which the sales prices are less than the unit cost. (Set filter to: SalePr-UnCst<0) As an auditor, I would investigate why there are three items for which we apparently intend to lose money on.

8-12.7 Yes, there are 6 items for which we should have an order placed but we won’t. (Set filter to: QtyOH<MinQty AND QtyOO=0). This might indicate a problem in our ordering system if the system is automated, and even if the system is a manual reordering system.

Obviously these items should be on order. The auditor would investigate why they are not on order.

8-12.8 The total market value of the inventory is $ 1,029,061.61. (Highlight the Market Value column and click the sum key).

8-13

Open the Empmast file. (Click the default view for this file.)

8-13.1 There are 42 employee records. (Analyze, Count) 8-13.2 There are 23 male employees (Analyze, Count, If Sex=’M’) and 19 female employees (Analyze, Count, If Sex=’F’). Note that the characters within the single quotes are case sensitive. Thus, If Sex=’m’ will return 0 records that match.

8-13.3 Thirty employees have college degrees (Set filter to: EdLevel>=16).

8-13.4 The average salary is $27,441 (Highlight the Salary column and then select Analyze, Statistics); the max salary is $52,750; the min salary is $15,340. The command log looks like this: @ STATISTICS ON Salary TO SCREEN NUMBER 5 Field : Salary Number Total Average Positive : 42 1,152,525.00 27,441.07 Zeros : 0 Negative : 0 0.00 0.00 Totals : 42 1,152,525.00 27,441.07 Abs Value: 1,152,525.00 Range : 37,410.00 Highest : 52,750.00 46,500.00 46,500.00 41,250.00 40,175.00 Lowest : 15,340.00 15,900.00 15,900.00 17,250.00 17,750.00 8-13.5 There don’t appear to be any employees who are “grossly” over- or underpaid, though this is a matter of judgment. Highlighting the Salary field and selecting Analyze, Statistics, will yield the following command log: STRATIFY ON Salary ACCUMULATE Salary INTERVALS 10 TO SCREEN <<< Graphable Data >>> Page ... 1 06/01/2003 17:43:20 Produced with ACL by: ACL for Windows Workbook <<< STRATIFY over 15,340.00-> 52,750.00 >>>

>>> Minimum encountered was 15,340.00 >>> Maximum encountered was 52,750.00 Salary

COUNT <-- % % -->

15,340.00 -> 19,080.99 19,081.00 -> 22,821.99 22,822.00 -> 26,562.99 26,563.00 -> 30,303.99 30,304.00 -> 34,044.99 34,045.00 -> 37,785.99 37,786.00 -> 41,526.99 41,527.00 -> 45,267.99 45,268.00 -> 49,008.99 49,009.00 -> 52,750.00

Salary

6 14.29% 8.71% 100,410.00 6 14.29% 10.88% 125,350.00 11 26.19% 23.90% 275,510.00 11 26.19% 27.54% 317,410.00 1 2.38% 2.80% 32,250.00 1 2.38% 3.14% 36,170.00 3 7.14% 10.38% 119,675.00 0 0.00% 0.00% 0.00 2 4.76% 8.07% 93,000.00 1 2.38% 4.58% 52,750.00

42 100.00% 100.00% 1,152,525.00

Clicking on Graphable Data yield the following graph:

From an analysis of this data, six people make in the lowest strata (between 15,340.00 -> 19,080.99), while one individual earns in the top strata (49,009.00 -> 52,750.00). If the auditor wishes, (s)he can verify the salary of this individual by checking with the paymaster

8-13.6 Bonuses are between $300 and $1000 (Analyze, Statistics). Stratifying the bonus column will yield a distribution of the bonuses as follows: Produced with ACL by: ACL for Windows Workbook <<< STRATIFY over 300.00-> 1,000.00 >>>

>>> Minimum encountered was 300.00 >>> Maximum encountered was 1,000.00 Bonus COUNT <-- % % --> Bonus 300.00 -> 369.99 4 9.52% 5.19% 1,200.00 370.00 -> 439.99 7 16.67% 12.12% 2,800.00 440.00 -> 509.99 13 30.95% 28.14% 6,500.00 510.00 -> 579.99 0 0.00% 0.00% 0.00 580.00 -> 649.99 11 26.19% 28.57% 6,600.00 650.00 -> 719.99 1 2.38% 3.03% 700.00 720.00 -> 789.99 0 0.00% 0.00% 0.00 790.00 -> 859.99 3 7.14% 10.39% 2,400.00 860.00 -> 929.99 1 2.38% 3.90% 900.00 930.00 -> 1,000.00 2 4.76% 8.66% 2,000.00 42 100.00% 100.00% 23,100.00 8-13.7 There are no employees that have the same address. (Analyze, Duplicates, to Screen). If there were, the auditor would investigate these are possible nepotism.

8-13.8 There don’t appear to be any related employees. This was partly tested by the previous question and the duplicate address test. You can further test this by testing for duplicates on last name, which will show no employees with the last name.

8-14

Open the “Payroll” file.

8-14.1 There are no duplicate check numbers. (Highlight “Cheque Number” field, Analyze, Duplicates) 8-14.2 There is one gap. (Highlight “Cheque Number” field, Analyze, Gaps) The command log shows the following gap: @ GAPS ON Cheque_No ERRORLIMIT 10 TO SCREEN PRESORT Presorting data Page ... 1 06/01/2003 18:05:15 Produced with ACL by: ACL for Windows Workbook *** Gap detected between 12388 and 12393 0 data sequence errors detected 1 gaps and/or duplicates detected

8-14.3 Yes, gross pay less taxes equals net pay in all cases. You can verify this by calculating and inserting a new field, Calculated_tax, which will be equal to Gross_Pay - Net_Pay. (Right

click where you want the new column to appear, add new column, then use the expression builder to create the expression.). Then, in the filter box, enter “Gross_Pay - Net_Pay<>Tax_amount.”

This expression will yield no matching records, which means that the two fields are equal.

IT Audit Solutions Manual Chapter 9 Discussion Questions 9-1

There are four categories of IT audit: attestation, findings and recommendations, SAS 70, and SAS 94. The first three are separate and distinct types of IT audits. The fourth category, a SAS 94 audit is an integrated audit where the client’s IT is specifically evaluated. A regular financial statement audit typically has a SAS 94 component to it.

9-2

Individuals who possess the CISA designation are bound by ISACA standards, guidelines, and interpretations. If an individual holding the CISA designation is found to have violated ISACA standards in the conduct of an IT audit, (s)he could lose his/her CISA license and certification.

IFAC is the International Federation of Accountants. The following information is from www.ifac.org. “IFAC is the global organization for the accountancy profession. It works with its 155 member organizations in 113 countries to protect the public interest by encouraging high quality practices by the world's accountants. IFAC members represent 2.4 million accountants employed in public practice, industry and commerce, government, and academe. Its structure and governance provide for the representation of its diverse constituencies and interaction with external groups that rely on or influence the work of accountants.”

9-3 IFAC promulgates international standards on auditing for which IFAC members are required to observe.

http://www.ifac.org/Guidance/ states regarding international standards:

“International Standards on Auditing (ISAs) National standards on auditing and related services published in many countries differ in form and content. The International Auditing and Assurance Standards Board (IAASB) takes cognizance of such documents and differences, and, in the light of such knowledge, issues ISAs, which are intended for international acceptance.

ISAs are to be applied in the audit of financial statements. ISAs are also to be applied, adapted as necessary, to the audit of other information and to related services.

International Auditing Practice Statements (IAPSs)

IAPSs are issued to provide practical assistance to auditors in implementing the ISAs or to promote good practice. These statements are not intended to have the authority of standards.

ISAs and IAPSs are compiled in the 2003 Handbook of International Auditing, Assurance, and Ethics Pronouncements.

Discussion Papers Discussion papers are issued on timely matters of concern to auditors.

IFAC’s primary activities are (http://www.ifac.org/About/): “Serving the Public Interest IFAC strives to serve the public interest through the development of standards in the areas of auditing, education, ethics, and public sector financial reporting; by advocating

transparency and convergence in financial reporting; by providing best practice guidance for professional accountants employed in business; and by implementing a membership compliance program.

Facilitating Collaboration and Cooperation Among Member Bodies IFAC works closely with its member organizations in to ensure the competence and integrity of accountants worldwide and to support accountants in their efforts to provide high quality services.

Speaking Out on Behalf of the International Profession IFAC is the primary spokesperson for the international profession and speaks out on a wide range of public policy issues. This is accomplished in part through outreach to

numerous organizations that rely on or have an interest in the activities of the international accountancy profession.”

9-4

During planning, the IT auditor should perform the following tasks: •

Establish the scope and control objectives of the work the auditor will perform;

•

Perform a preliminary assessment of controls relevant to the process that the auditor will audit;

•

Gain an understanding of the organization and its business, financial, and inherent risks, as well as environmental issues germane to the industry or client;

•

Identify the extent to which the client relies on outsourcing;

•

Develop the audit program containing specific audit procedures the auditor will conduct during the audit fieldwork;

•

Develop the audit plan for the conduct of the overall audit; and

•

Document the audit workpapers with the audit plan and audit program and other documentation necessary to substantiate an understanding of the client’s business operations and operating environment.

9-5

Materiality in a financial statement audit is often a quantitative assessment such as percent of total assets or total sales. In an IT audit, materiality is determined in a qualitative manner as relates to controls around the information system. A control is deemed material if its absence prevents control objectives from being met; the auditor determines materiality for an information system or operation that processes financial transactions by assessing the value of the assets controlled by the system or the volume of transactions processed through the system. (ISACA Guideline 50)

9-6 A risk-based approach to auditing means the auditor gains an understanding of the client’s environment and information system and determines which areas are high-risk, or material.

These areas are then the focus of the audit. The alternative to a risk-based approach is to evaluate the client’s entire environment and operating system. This is often referred to as the “old model” of auditing, with the risk-based approach being considered the new model of auditing.

9-7 The audit program consists of the audit scope, the audit objectives, the audit procedures, and administrative details such as planning and reporting. Because the IT audit environment is highly specialized, the audit program is typically a generic template that is then customized to reflect the client’s operating system, platform, and other details relevant to the client.

9-8 According to ISACA Standard 60, the auditor is required to gather “sufficient, reliable, relevant and useful evidence to achieve the audit objectives efficiently.” Evidence is gathered during fieldwork, and includes: •

direct observations of operations or procedures as conducted by the client;

•

documentary evidence gathered such as program change logs, system access logs, and authorization tables;

•

flowcharts, narratives, written policies and procedures; and

•

data analysis such as computer assisted audit techniques run on client data files.

Evidence that is provided independently from outside sources (such as a bank) is considered more reliable than evidence obtained from inside the client company. Also, evidence that is objectively obtained (such as raw data) is considered more reliable than interpretations of such evidence (i.e., interpretation of the data).

9-9 Attribute sampling is most often used in IT audit. This sampling approach involves counting the number of deviations from a control. For example, if an auditor wishes to verify proper maintenance of program change logs, (s)he will obtain the log and determine how many times program changes were made but were not logged in. Variable sampling, on the other hand, involves substantive testing of population characteristics that vary, such as invoice amounts.

The auditor in a financial statement audit may wish to obtain a sample of accounts payable invoices. (S)he will do so usually based on a random sample.

9-10

The four types of IT audits are: (1) attestation, where the auditor provides assurance on

something for which the client is responsible; (2) findings and recommendations, or a “consulting” or “advisory” engagement, where the auditor performs a less structured type of engagement such as a systems implementation engagement; (3) a SAS 70 audit, where a service organization wishes to provide assurance on a service it provides to others, such as a payroll service; (4) a SAS 94 audit, which is also referred to as an “integrated audit.” This is part of a regular financial statement audit, where the auditor must evaluate controls around a client’s information system, as well as the entries that are processed through a client’s information system.

9-11

Typically, auditors do not communicate with each other. However, in the case of a SAS

70 report, an auditor may request a SAS 70 report from a client with respect to a material process that is outsourced.

9-12

A Type I SAS 70 report describes a company’s internal controls, but does not perform

detailed testing of these controls. Instead, the auditor performs a “walkthrough” of controls, where the auditor validates his understanding of the controls in place. A Type II SAS 70 report covers controls actually tested and validated. Both a Type I and Type II SAS 70 report can reduce substantive testing, but a Type II report reduces substantive testing more.

9-13

An audit performed using CobiT differs only in the audit program. If there is an existing

audit program, the IT auditor can map CobiT audit procedures back to the audit objectives and audit procedures already in place. The auditor can also use CobiT’s Audit Guidelines to identify any areas not covered sufficiently in the existing audit program. If there is no audit program with which to start, the Audit Guidelines can be used to build an audit program.

Exercises 9-14

The student should prepare some variation of Figure 9-9.

9-14a Attestation 9-14b Attestation 9-14c SAS 70 9-14d Findings and recommendations 9-14e Findings and recommendations

9-15

CobiT’s Executive Summary can be found at http://www.isaca.org/exec1b.htm Student responses will vary.

IT Audit Solutions Manual Chapter 10 Discussion Questions 10-1

The Fraud Triangle is a model of why fraud occurs. It includes opportunity, pressure, and rationalization. Opportunity exists when internal controls are not sufficient or not followed. Pressure typically comes from personal circumstances, such as sickness, gambling debts or other internal crises. Rationalization occurs when an individual finds a way within his/her conscience to justify the theft.

10-2

According to the 2002 Wells Report, 58% of occupational fraud was committed by employees, which 36% was committed by managers. Those who commit fraud tend to be male (53.3%), middle-aged or older individuals with college degrees who have never been charged or convicted before. Private and public companies are about equally likely to be victims of fraud, with not-for-profits slightly less likely.

10-3

The three categories of fraud are asset misappropriation (85.7%), financial statement fraud (5.1%), and corruption (12.8%). While asset misappropriation is the majority of the fraud detected, financial statement fraud reflects higher dollar losses.

10-4

A company has a responsibility to maintain a positive (that is, proactive, forwardlooking) security model. This includes fostering an ethical atmosphere,

1

maintaining corporate policies on computer use and misuse, including a corporate fraud policy, maintaining a network security program, and maintaining a corporate security incident response plan.

10-5

SAS 99 requires auditors to assess management’s “tone at the top” with respect to ethics.

•

The auditor must also:

Evaluate the client’s industry, including an internal or external pressures that might exist;

•

Evaluate operating characteristics and financial stability of the client;

•

Ask management and employees whether they are aware of any fraud within the company;

•

Exercise professional skepticism;

•

Assign adequately trained and knowledgeable personnel to the engagement;

•

Engage in team discussions regarding the possibility of fraud

•

Consider the possibility of revenue misstatement;

•

Consider management’s programs and controls in place to prevent, deter, or detect fraud.

10-6

Sarbanes-Oxley (SO) establishes a Public Oversight Board to regulate the accounting profession. Corporate governance is also greatly changed under SO. Audit committees now directly oversee the auditor’s work as opposed to the auditor reporting to management. Audit committees must preapprove all audit and nonaudit services provided by the auditor, and the auditor must report disagreements between the auditor and management and other relevant communications to the audit committee. SO also provides for greater

2

independence between the auditor and auditee, establishing a list of 8 specifically prohibited activities that auditors cannot provide concurrently with the audit.

Lead auditors are required to rotate every 5 years. Management is also now required to assess the company’s system of internal controls prior to the conduct of the audit. SO also provides mandatory criminal sanctions, as well as whistleblower protection for corporate fraud.

10-7

Computer forensics is the science of determining if fraud has occurred and the extent of any possible fraud, using computer technology. Typically, the auditor is also evaluating crimes performed with computers.

10-8

Freezing the audit logs means the logs are immediately copied, as is, at that moment in time. This is done by an IT or forensic auditor as soon as fraud is suspected or known. This is important to establish the benchmark for the computer logs.

10-9

Interviewing suspected fraudsters is an art. It requires the use of psychology on the part of the investigator. The goal is to get the interviewee to relax so as to let his or her guard down. The investigator may use an icebreaker to establish a relaxed atmosphere and/or trust with the individual. The investigator will also use a list of preplanned question, tailored to the individual being interviewed. The interviewer looks for verbal and nonverbal cues. Cues that indicate an interviewee may not be answering truthfully include: changes in speech pattern, using oaths, swearing, sudden selective memory, feigned unconcern, breaking eye contact, shifting body positions, crossing and recrossing arms and legs, and removing eyeglasses.

3

10-10 According to common law, the following four elements must be present for a fraud conviction to occur: 1) omission; 2) of a material fact; 3) with intent to deceive; 4) quantifiable injury or loss must have been suffered by the victim.

10-11 Figure 10-13 on page 255 shows various tools that would be commonly used by the forensic auditor.

Exercises 10-12 Sherron Watkins was the whistleblower at Enron; Cynthia Cooper was the whistleblower at WorldCom; and Coleen Rowley was the whistleblower at the FBI. Students should summarize how the individuals exposed fraud at their respective organizations. Under Sarbanes-Oxley, their companies cannot legally retaliate against them.

10-13 Student responses will vary.

4

Page 1of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

ANSWER KEY

You are in charge of the Payroll Audit for People State University (PSU). The audit consists of four steps: A) ACL Administration; B.) Analytical Review Procedures; C) Fraud Tests; and D) Other Procedures. As you progress through the audit outline, there are questions about the procedures and outcomes. Include your answers the questions, as well as relevant output from the ACL tests, as support in your workpapers.

SCOPE AND OBJECTIVES SCOPE: Conduct an audit of the Peoplesoft payroll module for payroll period ending 10-26-2000.

OBJECTIVES: 1. Ensure that payroll information is accurate and reliable 2. Assess the extent to which the People State University (PSU) complies with policies and procedures, plans, laws and regulations.

ACL ADMINISTRATION 1. Identify and obtain access to all database records necessary to conduct the following computer-assisted audit procedures.

1.1. Download the following databases from Wiley Press, Inc. and import the databases into ACL: 1.1.1. EMPLOYEE_FILE.DBF (www.wiley.com/college/hunton) 1.1.2. EMPLOYEE_PAY.DBF (www.wiley.com/college/hunton) 2. Save your ACL project as “PSU”.

3. Refer to the dictionary of codes used by these databases when appropriate (see Attachments One and Two).

4. Be sure to include documentation of each of the following tests in your workpapers.

5. Open EMPLOYEE_PAY 5.1.1. How many records are there in the database? [147] 5.1.2. How many data validity errors are there in the database? [0 data validity errors] 5.1.3. What are the following totals?

Page 2of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

5.1.3.1.Gross Pay (TOTAL_GROS) [$178,831] 5.1.3.2.Taxes withheld (TOTAL_TAXE) [$36,584] 5.1.3.3.Deductions withheld (TOTAL_DEDU) [$24,947] 5.1.3.4.Net Pay (NET_PAY) [$117,292] 6. Open EMPLOYEE_FILE 6.1.1. How many records are there in the database? [101 records] 6.1.2. How many data validity errors are there in the non-date fields? [Analyze, Verify.

There should be no errors. If you get errors you have probably included the date fields, which are denoted by category D].

6.1.3. What are the total annual salaries? (ANNUAL_RT) [$1,963,945] ANALYTICAL REVIEW PROCEDURES: 1. Be sure to include documentation of each of the following tests and related questions in your workpapers.

2. Using the EMPLOYEE_FILE database, Classify on PAY GROUP and accumulate on ANNUAL_RATE. [Analyze, Classify, Click on “Classify on”, Select “Pay Group”, press “OK.” Click on “Accumulate Fields”; select “Annual Rate”, Press “OK.” The results should look as follows:]

PAYGROUP PEU POP PS3 PS9 PSA PSF PSU

COUNT

%

%

Annual Rate

10 52 8 24 2 4 1

9.90% 51.49% 7.92% 23.76% 1.98% 3.96% 0.99%

13.70% 17.80% 1.74% 48.87% 2.94% 12.43% 2.52%

$269,032 $349,645 $34,102 $959,846 $57,725 $244,071 $49,524

101

100.00% 100.00% $1,963,945

2.1. QUESTION: Review this report. What are you verifying? Explain by giving an example. [Verifying the reasonableness of the salaries by pay group. For instance, group PS9 has 23.76 percent of the employees, but 48.87 percent of the salaries. The

Page 3of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

code dictionary says that PS9 is the paygroup for 9-month salaried faculty. It is reasonable in a University that this group has a higher pay average than the other groups since this reflects the professional group of employees with the most education.]

3. Using the EMPLOYEE_PAY database, confirm that total gross pay amount less total taxes withheld less total deductions withheld equals the net pay amount by re-calculating another net pay field. Call your new field “Computed_Net.” [Create a new field (edit, input file definition, add a new expression). Call the new expression/field Computed_Net. Click on the F(x) button and enter the correct mathematical expression. Click on green check and close the window. Add the column to your project view for Computed_Net.] 3.1. What are the totals of Computed_Net [117,300] and Net_pay [117,292]?

3.2. QUESTION: When you tested that total gross, less total taxes, less total deductions equals net pay, were there differences between the Computed_Net and Net_Pay fields?

If so, obtain a report of all records where differences exist and explain what is probably causing the differences? [To answer this, display the records in which Net_Pay is not equal to Computed_Net. To determine the records that don’t agree use the filter (f(x) ) and enter Net_Pay <> Computed_Net. The total records should be 36. It appears that the cause of the difference is rounding.]

FRAUD TESTS 1. Be sure to include documentation of each of the following tests and related questions in your workpapers.

2. Invalid Employees Test: (Use EMPLOYEE_PAY database) 2.1. Determine if there are duplicate Social Security Numbers in the EMPLOYEE_PAY database. [Analyze, Duplicates, Sequence SS#, List Fields (Paycheck_N), Output FileSSN_DUP, then retrieve with Data, Select. There are two instances of duplicate SSN, as follows:] 360341898 360341898

Summer,Day Edwards, Marie

696503393 696503393

Gore, Stacy Lynch,William L

Page 4of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

2.2. QUESTION: What could be the possible reasons for the duplicate Social Security numbers? [Keying errors, new hire provided wrong number, fictitious employees, or change of name by marriage or divorce.]

2.3. QUESTION: What would you do to find out the actual reason for these duplicates?

[Verify SS#’s to hard copies in employee files, contact employees and have them show their social security card.]

3. Address Test: Review addresses for the following unusual items: 3.1. How many blank addresses are in the database? [Use the ISBLANKfunction to create list. Count and list records. (ISBLANK(Address1) in the filter window,Ffx. The number of records should be three.]

3.1.1. Why might these blank addresses exist?

3.2. How many instances are there of multiple employees using the same address? [Use the duplicate function and list the address, paycheck name, employee ID, and Department ID. Use the Duplicate function on the address, list ADDRESS1, PAYCHECK_N< EMPLID< DEPTID. There are 24 records including the three blanks.]

3.2.1. QUESTION: Describe the probable causes for the duplicate addresses. [Work address is given instead of home address, employees live together, default address is input for new hires when none is available.]

3.3. How many P.O. Box numbers are listed as addresses? [Use the Soundslike function.

(Edit, Filters, New Expression, Soundslike Address1, “‘PObox”). Should by 4 records] 3.4. How many out of state addresses are listed? [(Edit,Filters,New Expression, State<>”FL”) Should be 5 out of state addresses, plus 2 addresses with blanks for State] 3.4.1. QUESTION: Assuming PSU operates only in Florida, why would there be nonFlorida addresses? (Address field updated for terminated employees that moved, new employees that are relocating to Florida still have out of state address, temporary employees from a different state maintain permanent out-of-state address, and fictitious employees.)

4. Duplicate Appointments Test in Employee Master File. (Use EMPLOYEE_FILE)

Page 5of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

4.1. Determine if there are duplicate employee numbers (EMPLID), and save the results to a separate file. Call this file “Duplicates”. Count the records and duplicates. List: Employee ID, Name, Department ID, Fulltime or Part-time, pay group, employee status, effective date, action reason, and annual rate on the report. [First analyze duplicates and sequence on EMPLID. List the fields: Name, DEPTID,FULL_PART_, PAYGROUP, EMPL_STATU, EFFDT, ACTION_REA, ANNUAL_RT. On the output tab, File, Name Duplicates, save, OK. Open the duplicates file (Data, Select, Duplicates) and count the file, 28 records and 15 duplicates.]

4.1.1. QUESTION: What were some of the causes of the duplicate numbers? Do not list actual employees just describe the general causes. (You will need to use the code list here. Duplicates include changes of status and terminated employees.)

5. Inactive Employee Test: 5.1. Test to verify that all employees who received paychecks were also in the current EMPLOYEE MASTER FILE. Count the number of records that do not. (Hint: You will need to join the files to identify unmatched records. Call the joined file “UNMATCHED’.

5.1.1. First, we must ensure that the primary key used to match (EMPLID) is a character field of the same length in both files (EMPLOYEE_FILE and EMPLOYEE_PAY) 5.1.1.1.Open EMPLOYEE_FILE. Using edit input file definition, open the field named EMPLID by double clicking on the field name. Change the type to ASCII and verify the length is 12.

5.1.1.2.Open EMPLOYEE_PAY. Using edit input file definition, open the field named EMPLID by double clicking on the field name. Change the type to ASCII and verify the length is 12.

5.1.2. With the EMPLOYEE_PAY file open; join the two files using DATA, JOIN. 5.1.2.1.The Primary key is EMPLID. Click on Primary fields, and select add all.

5.1.2.2.The Secondary file is EMPLOYEE_FILE. The Secondary Key is EMPLID. Since we are looking for unmatched records, there are no secondary fields.

5.1.2.3.In the TO box enter file name UNMATCHED.

Page 6of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

5.1.2.4.Click on the MORE tab, and click the box marked UNMATCHED Primary RECORDS. 5.1.2.5.Click on OK. 5.2. Open the file called UNMATCHED 5.3. How many unmatched records are there? [77] 5.3.1. Question: Why would these employees receive paychecks when they are no longer active per the Master File? [Final paycheck to terminated employee, Fraud scheme where paycheck is issued to terminated employee, but supervisor keeps it.]

5.3.2. Question: What would you do to verify the reasons? [Compare time records with pay records, verify termination date with employee, compare endorsements on back of checks from prior payrolls.]

OTHER PROCEDURES 1. Be sure to include documentation of each of the following tests in your workpapers.

2. Identify three additional audit tests to be performed using ACL and the two data files (EMPLOYEE_FILE & EMPLOYEE_PAY).

3. What is the audit objective of each test?

4. Perform each of the three tests identified above.

5. Describe and analyze your findings.

Page 7of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

Attachment One Dictionary of Database Codes for EMPLOYEE_FILE Field Codes EMPLID – Employee ID number NAME – Employee name DEPTID – Department ID JOBCODE – Job code U STUDENT – Student union employee (All-Times, Graduation-Periods, HolidayOnly) REG TEMP – Regular or Temporary employee PAYGROUP – Pay group PEU Exceptional Hourly USPS POP Salaried and Hourly OPS PS3 3 month Salaried Faculty PS9 9 month Salaried Faculty PSA Salaried A&P PSF Salaried Faculty PSU Salaried USPS ACTION – Payroll action EMPL STATU – Employee status (Active or Terminated) FULL PART – Full (F) or Part-time (P) STD HOURS – Standard Hours ACTION DT – Payroll action date EFFDT – Payroll action effective date EFFSQ – Effective payroll sequence number ACTION REA – Payroll action reason EMPL TYPE – Employee type COMP FREQ – Compensation frequency (Biweekly or Hourly) HOURLY RT – Hourly rate MONTHLY RT – Monthly rate COMPRATE – Compensatory time rate ANNL BENEF – Annual benefits ANNUAL RT – Annual benefit rate CHANGE AMT – Change amount CHANGE PCT – Change percentage CMPNY SENI – Company seniority date EE06CODE – Equal Employment Opportunity Code 1 Executive 2 Faculty 3 Prof Non Faculty 4 Secretarial/Clerical 5 Technical/Paraprofessional

Page 8of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

6 Skilled Craft 7 Service Maintenance EMPL RCD – Employment record FICA STATU – FICA Status (Exempt, Non-Exempt) HIRE DT – Hire date JOB ENTRY – Job entry date LAST INCRE – Last increase date REHIRE DT – Rehire date SAL ADMIN – Salary administrative code SERVICE DT – Service date TERMINATIO – Termination date U DUAL COM – Union dual compensation U OVERLAP – Union Overlap

Page 9of 9 APPENDIX B PEOPLE STATE UNIVERSITY PAYROLL AUDIT

Attachment Two Dictionary of Database Codes for EMPLOYEE_PAY Field Codes EMPLID – Employee ID number SSN – Social security number PAYCHECK N – Paycheck name BENEFIT RC – Benefits reclassification code ADDRESS1 – Check address CITY – Check City STATE – Check State ZIP – Check zip code COUNTRY – Check country CHECK DT – Check date PAY END DT – Payroll ending date EMPL TYPE – Employee type (Exempt, Salary, Hourly) DEPTID – Department ID number NET PAY – Net pay amount PAY GROUP – Pay group PEU Exceptional Hourly USPS POP Salaried and Hourly OPS PS3 3 month Salaried Faculty PS9 9 month Salaried Faculty PSA Salaried A&P PSF Salaried Faculty PSU Salaried USPS TOTAL DEDU – Total deductions amount TOTAL GROS – Total gross pay amount TOTAL TAXE – Total taxes amount