ACCT 531 Week 3 Discussion Board Forum Replies 2 Example

Discussion Board Forum Replies 2: Responding to Classmates' Article Critiques

ACCT 531 Accounting Information Systems, Discussion Board Forum Replies 2

Thread by [Student Name]

The classmates are composites; the articles they critiqued and the other sources cited are real.

Reply to Rachel

Rachel, your critique of Klamm and Watson (2009) identified what I think is the article's most important contribution: that IT-related material weaknesses disclosed when SOX 404 reports first appeared tended to travel with failures in the remaining COSO components. You argued, rightly, that this makes IT controls a foundation rather than a separate category, because a failure in access or change management undermines the reliability of everything built on top of it. I would add evidence that the damage reaches inside the company as well. Li et al. (2012) reported that companies disclosing IT control weaknesses issued earnings guidance that missed by wider margins, a sign that the systems feeding unreliable statements to investors were feeding equally unreliable numbers to the managers who run the business. That connects to this week's chapters on databases: if access controls over a shared database are weak, every report drawn from it, external or internal, inherits the weakness. One limitation you might add to your critique is that Klamm and Watson drew on the earliest round of SOX 404 reports, when many companies were documenting controls for the first time, so the strength of the association could differ in later years as IT controls matured. A second limitation is that the study counted disclosed weaknesses, so it captures only the problems management and auditors found and reported, not the ones that went unnoticed. Do you think their framework would apply equally well to companies that have since moved to cloud-based systems, where the vendor now runs many of the general controls?

Reply to Tyler

Tyler, your critique of Koreff (2022) did a good job explaining the experiment's design, in which auditors received conclusions from either an anomaly model or a predictive model applied to either financial or nonfinancial data. I wanted to clarify the finding, because I think it is more interesting than a simple preference for one model. Koreff found that the two inputs worked together: when financial data were analyzed, auditors increased budgeted hours more after predictive models than anomaly models, but when nonfinancial data were analyzed, the opposite occurred. The conclusion is that analytics with different inputs do not move auditors' judgments by the same amount. That matters for practice because, as Appelbaum et al. (2017) argue, big data and analytics are pushing audits toward full-population testing and new kinds of evidence, including nonfinancial data. If auditors respond differently depending on the model and the data, firms need guidance to make sure the response fits the risk rather than the format of the analysis. Your point that the participants were working in an experimental setting is fair; I would add that budgeted hours are a planning judgment, so the study does not tell us whether the eventual audit evidence changed. A follow-up that tracked the procedures auditors actually performed would answer that question.

References

Appelbaum, D., Kogan, A., & Vasarhelyi, M. A. (2017). Big data and analytics in the modern audit engagement: Research needs. Auditing: A Journal of Practice & Theory, 36(4), 1-27. https://doi.org/10.2308/ajpt-51684

Klamm, B. K., & Watson, M. W. (2009). SOX 404 reported internal control weaknesses: A test of COSO framework components and information technology. Journal of Information Systems, 23(2), 1-23. https://doi.org/10.2308/jis.2009.23.2.1

Koreff, J. (2022). Are auditors' reliance on conclusions from data analytics impacted by different data analytic inputs? Journal of Information Systems, 36(1), 19-37. https://doi.org/10.2308/isys-19-051

Li, C., Peters, G. F., Richardson, V. J., & Watson, M. W. (2012). The consequences of information technology control weaknesses on management information systems: The case of Sarbanes-Oxley internal control reports. MIS Quarterly, 36(1), 179-203. https://doi.org/10.2307/41410413