corporate governance and entity-level controls. escalating role of board members corporate fraud...
TRANSCRIPT
Escalating Role of Board Members
• Corporate Fraud
• Qualifications of directors and management
Governance-2
Board Member Sample Tasks and Expertise
Sample Task Expected Expertise
Approve hiring of chief executive officer Human resources, personnel evaluation
Approve risk assessment framework and monitor risk evaluation
Industry expertise, strategic planning, awareness of potential risks, risk assessment methodologies
Review and approve organizational and business strategies and changes thereto
Long-term planning, strategic planning, industry-specific expertise
Review and approve information systems strategy and changes thereto
Ability to link information systems strategy to business strategy; understand information systems terminology, impact, and alternatives; industry-specific expertise
Approve information systems acquisitions, business acquisitions, or contracts over specified dollar limits
Understand information systems terminology, impact, and alternatives; industry-specific expertise
Approve auditors and financial statements Financial or accounting competence; understand complex accounting terminology and be able to ask the right questions
Oversee the work of internal auditors Understand risks that the organization is exposed to and alternative ways of addressing those risks
Governance-3
Organizational Structure and Corporate Governance
• What has an effect on corporate governance?
• For example, an entrepreneurial structure
• What type of structure would a public company probably have?
Governance-4
Auditor Evaluation of Corporate Governance
• What is the auditor’s goal?
• Typical tools used to understand the components of corporate governance
Governance-6
IT Governance
• IT governance is crucial to the evaluation of corporate governance
• Definition of IT governance
• IT governance is a crucial subset of
Governance-7
Evaluation of IT Governance by the Auditor
• Evaluation of IT governance
• What does the auditor look at next?
Governance-8
Impact of General Information Systems Controls on the Audit
There are three general control categories:
1. organization and management controls
2. systems acquisition, development, and maintenance controls
3. operations and information systems support.
Governance-10
Organization and Management Controls
• Auditors consider
• Key question - Who are the super-users?
Governance-11
Systems Acquisition, Development, and Maintenance Controls
• Auditors focus
• Typical types of software • Providing user interfaces
• Providing security
• Managing hardware and software
• Information communication
Governance-12
Operations and Information Systems Support
• A number of things canb affect the types of controls
1. Hardware confirguration
• Auditor needs to determine
2. Operating system
Governance-13
Advanced Information Systems• Advanced IS results in high complexity.
• Such systems have one or more of the following characteristics:1. Strategic information systems2. Custom software3. Multiple information processing locations4. Database management systems5. Paperless systems6. Integrated computing
Governance-15
1. Strategic Information Systems
• Such systems provide a competitive advantage or improve efficiency within an entity.
• The problems?
• Such systems can be extremely strategic
Governance-16
2. Custom Software
• Custom software is unique software designed for the entity.
• How can it be developed?
• The key reasons why such software is chosen by entities
Governance-17
Risks Associated with Custom Software
• Such systems are usually very costly
• Rigorous testing is required
Governance-18
Audit Impact of Custom Software
• Systems development process
• Risk of errors or unauthorized programs
Governance-19
3. Multiple Information Processing Locations
• Problems with data processed in multiple locations
• Programs could be inaccurate or unauthorized
• Access to programs and data
• Data sent from one location to another
Governance-20
4. Databases and Database Management Systems (DBMS)
• Many software packages use a database as an underlying file structure.
• Key concept of a DBMS
• The DBMS
Governance-21
Effects of a DBMS on Internal Controls
• Existence of a DBMS
• Typical general controls that are affecteda) Organization and management controls
b) Systems acquisition, development, and maintenance controls
c) Operations and information systems support
Governance-22
a) Organization and Management Controls
• The database administrator
• Auditor documentation
Governance-23
b) Systems Acquisition, Development and Maintenance
Added controls should exist to ensure that:
• Database development
• Programs
Governance-24
c) Operations and Information Systems Support
• Data security
• Each application cycle needs to be examined for controls over:
Governance-25
5. Paperless Systems
• A wide variety of paperless systems exist.
• Typical business data communications– EDI (electronic data interchange)
– EFT (electronic funds transfer)
Governance-26
Impact of Paperless Systems on the Audit Engagement
• Where there is no paper trail
• Without a paper trail
Governance-27
6. Integrated Computing
• Increased leve of complexity
• Typical examples– Enterprise Resource Planning (ERP)
– Relational databases
– The objective of such systems
Governance-28
Some Common Entity-Level Controls
• Controls related to the control environment• Controls over management override• The company's risk assessment process• Controls to monitor other controls, including activities of the internal audit function, the audit committee, and self-assessment
programs• Controls over the period-end financial reporting process• Policies that address significant business control and risk management practices• Whistle-blower hotline• Code of conduct• IT environment and organizations• Self-assessment• Oversight by the Board of Senior Management• Policies & procedures manual• Variance analysis reporting• Management triggers embedded within IT systems• Internal communication and performance reporting• Tone setting• Board/audit committee reporting• External communication• Segregation of duties• Accounts reconciliations• System balancing and exception reporting• Governance• Assignment of authority and responsibility• Hiring and retention practices• Fraud prevention/detection controls and analytical procedures
Governance-29
The Effects of Entity-Level Controls
• What can be affected?
• Any one of the control levels being absent or not properly implemented
Governance-30
Relationship between Entity-Level Controls and Specific Audit Objectives
• Entity-level controls can affect
Governance-31
Problem 10-21, Canadian 11th. Edition, Page 342
Friggle Corp. is a leasing and property management company located in Alberta. It provides financing to organizations wishing to purchase equipment or property and manages apartments and condominium properties. The company decided that it was time to upgrade its local area network. It decided to also purchase new accounting software but wanted to retain its old unit maintenance software, which, although 10 years old, had an easy-to-use interface that allowed maintenance personnel to track the maintenance work that they did in each unit. The controller, Joe, decided that the company should purchase the software from Midland Computers, which was owned by his brother-in-law, Tom. The prices were comparable with those of other computer networks that he priced, and Midland happened to be close by. Using materials from industry magazines, Joe decided that the best property management software to buy would be from Quebec; the software had received rave reviews about being easy to use.
The implementation was scheduled for the weekend after the June month-end close so that systems could be up and running by the following Monday. To Joe’s horror, when he arrived at work on Monday, computers were still being unpacked and installed. Tom had difficulty following the installation instructions for the accounting software, which was not up and running until the end of the week. General ledger details had to be manually entered, since the software could not handle the structure of the old accounts. At the end of two weeks, Joe had the old system put back up so that Friggle could catch up on transactions and get some work out the door. It took three months of 12-hour days for all accounting staff to get the new system operational. Unfortunately, the old maintenance systems would not work with the new operating system, and a new maintenance system had to be evaluated and purchased.
Required
Assess the IT governance at Friggle Corp. For weaknesses that you identify, provide recommendations for improvement.
Governance-32
Problem 10-22, Canadian 11th. Edition. Page 342
Turner Valley Hospital plans to install a database management system, Hosp Info, that will maintain patient histories, including tests performed and their results , vital statistics, and medical diagnoses. The system will also manage personnel and payroll, medical and non-medical supplies, and patient and provincial health-care billings. The decision was taken by the board of the hospital on the advice of a consultant who was a former employee of Medical Data Services Inc., the developer of Hosp Info.
Turner Valley Hospital’s chief information officer has come to your accounting firm to ask for advice on what general controls she should ask Medical Data Services Inc. to install to preserve the integrity of the information in the system and to deal with privacy issues.
The system would permit data about patients to be entered by doctors, nurses, and medical technologists.
Required
a)Describe in general terms the controls you would suggest for the system as a whole.
b)Considering the nature of Turner Valley Hospital, describe the potential risks the hospital should be concerned about with respect to Hosp Info.
c)What are the advantages of such a database management system?
d)How would the quality of general controls at the hospital affect your audit?
Governance-33