ACCT 432 Week 1 Group Discussion Board Forum 1 Example

Group Discussion Board Forum 1: IT Governance and General Controls

ACCT 432 IT Audit, Group Discussion Board Forum 1

Thread by [Student Name]

The company and the classmates are composites; the textbook and the scholarly research cited are real.

The problem I selected asks why segregation of duties within the IT function matters to the financial statement audit. Consider Ridgeline Distribution, a composite regional wholesaler with a six-person IT department. Its senior developer, Kyle, writes changes to the order-entry and billing programs, tests them himself, moves them into production and also serves as database administrator with unrestricted access to the live tables. The arrangement grew up because Kyle is the most experienced person on staff, and it has never caused a known problem.

Hall (2016) explains that IT governance controls include organizational structure controls that separate systems development from operations and separate database administration from development. Kyle holds all of these roles. He could change the pricing logic in billing, approve his own change and move it into production, and no one would review the code. As database administrator, he could alter invoice records directly, outside any application control. Even if Kyle is honest, an error in his untested change could misstate revenue for months. An auditor testing the billing application in March would have no assurance that the same logic was running in November. When one person controls the code and the data, every application control downstream rests on that person alone.

Research supports treating this as a financial reporting issue. Klamm and Watson (2009) examined 490 firms reporting material weaknesses in the first year of SOX 404 and found that IT-related weaknesses were associated with weaknesses in other components of the COSO framework, suggesting that a weak IT foundation undermines controls throughout the organization. Li et al. (2012) found that management forecasts were less accurate at firms reporting IT control weaknesses, which means the information managers rely on internally is degraded too. Ridgeline should move production releases to an operations staff member, require independent approval of every change and restrict Kyle's direct database access to logged, approved emergencies. Those changes cost little and give both management and the auditors a reason to trust the system's output.

Reply to Jenna

Jenna, you pointed out that a six-person IT department like Ridgeline's may not have enough staff to separate every incompatible duty, and that is a real constraint in small organizations. Hall (2016) acknowledges that when full segregation is not feasible, compensating controls can reduce the risk. For Ridgeline, three would matter most. Each depends on someone other than Kyle seeing what he did. First, every program change could be logged automatically by the change management system and reviewed weekly by the IT manager, who would compare the log to approved change requests. Second, database activity monitoring could record every direct change to live tables and send a daily report to the controller, someone outside IT. Third, an independent party, such as the internal auditor or an outside consultant, could review a sample of changes each quarter. Together, the three create a trail an auditor can test. None of these prevents Kyle from making an unauthorized change, but each makes it likely to be detected quickly, which is the purpose of a detective control. The cost of these controls is mostly management time, which a company of Ridgeline's size can afford. Klamm and Watson (2009) found that IT weaknesses tend to spread into other parts of the control system, so compensating controls need to be documented and tested, not just described. I would add that the review must actually happen; a weekly log that no one reads gives a false sense of security, and auditors will test evidence of the review rather than the policy that requires it.

Reply to Marcus

Marcus, your thread explained the risks created by a programmer with production access, and I want to add how an external auditor would respond when finding this weakness at a client like Ridgeline. Hall (2016) explains that auditors rely on IT general controls to support reliance on application controls, such as automated pricing and three-way matching. If general controls over program changes are weak, the auditor cannot assume that the application controls tested at one point in time operated the same way all year, because the programs could have been changed. The response is to reduce reliance on those automated controls and increase substantive testing, for example by recalculating a sample of invoices across the year or using data analytics to recompute every invoice price against the approved price list. Were Ridgeline public, the auditor would also have to decide whether the problem rose to a material weakness in internal control. For a private company like Ridgeline, the auditor would still communicate it in writing to those charged with governance. Li et al. (2012) found that IT control weaknesses reduced the accuracy of information that management relies on, which suggests the auditor should also be skeptical of management's analyses and estimates built from the same systems. Communicating the weakness to the audit committee early gives management a chance to remediate before year-end, which may let the auditor rely on controls for at least part of the next period. Remediation also needs to be tested before the auditor can rely on it.

References

Hall, J. A. (2016). Information technology auditing (4th ed.). Cengage Learning.

Klamm, B. K., & Watson, M. W. (2009). SOX 404 reported internal control weaknesses: A test of COSO framework components and information technology. Journal of Information Systems, 23(2), 1-23. https://doi.org/10.2308/jis.2009.23.2.1

Li, C., Peters, G. F., Richardson, V. J., & Watson, M. W. (2012). The consequences of information technology control weaknesses on management information systems: The case of Sarbanes-Oxley internal control reports. MIS Quarterly, 36(1), 179-203. https://doi.org/10.2307/41410413