1 / 42

Auditor Responsibility?

Karen Evans, national director of the U.S. Cyber Challenge and former Office of Management and Budget administrator. Auditor Responsibility?. Audit Committee Power.

cherokee-solis
Download Presentation

Auditor Responsibility?

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Karen Evans, national director of the U.S. Cyber Challenge and former Office of Management and Budget administrator Auditor Responsibility?

  2. Audit Committee Power "The things that senior leadership does respond to are GAO reports [and] IG reports, and in private industry the audit committee is the most powerful on any board,” Cybersecurity is "now being brought into the audit committee because that's what leadership looks at – they look at the results of an audit," (http://fcw.com/Articles/2013/10/10/cybersecurity-audits-secret-ingredient.aspx?Page=1)

  3. Sarbanes Oxley Information Technology Weaknesses

  4. Background Questions • What is SOX? • How/Why did it come about? • What are SOX requirements? • Which if any rely on or are related to IT controls?

  5. The effect of IT controls on financial reportingGrant, Miller & Alali (2008)

  6. What Standards does paper use for support? • How are these standards used? What do they say (not say) about IT controls? • SAS 94 • “The nature and character of an entity’s use of technology in its information system affects the entity’s overall internal control structure” • SOX • PCAOB AS #5

  7. SOX 302 • What are the requirements? • The signing officers have reviewed the report • The report does not contain any material untrue statements or material omission or be considered misleading • The financial statements and related information fairly present the financial condition and the results in all material respects • The signing officers are responsible for internal controls and have evaluated these internal controls within the previous ninety days and have reported on their findings • A list of all deficiencies in the internal controls and information on any fraud that involves employees who are involved with internal activities • Any significant changes in internal controls or related factors that could have a negative impact on the internal controls

  8. SOX 404 • 404 (a) • Management statement of responsibility over Internal Controls & • Assessment of Internal Controls • 404 (b) • Auditors must attest and report on managements assessment • Report Material Weaknesses in Internal Control and Remediation Plan • What are/define MW’s? • Most Companies use COSO as Internal Control Framework

  9. Section 409 • Issuers are required to disclose to the public, on an urgent basis, information on material changes in their financial condition or operations.

  10. Section 802 • all audit or review papers must be maintained for a period of 5 years • How are audit/review papers maintained in 2012?

  11. What IT deficiencies did the paper look at? • IT deficiencies include controls related to • software programs • program implementations • segregation of duties associated with access to computer accounting or financial reporting records • problems with access to electronic data and programs • What other controls might be important for accounting/auditing? • Why weren’t they investigated?

  12. COSO & IT • General IT Controls • Ensure proper operations • Application IT Controls • Ensure proper functioning of software • Processing of transactions • Storage of Data

  13. Findings • IT Deficiency ranked 6th among all MWs (20% so 1 in 5) • IT Deficiency -> Internal Control deficiency • IT Deficiency -> accounting errors (Why?) • revenue recognition • receivables, investments, and cash issues • inventory, vendor, and cost of sales issues • financial statement, footnote, US GAAP, and segment disclosures issues • IT Deficiency -> Higher Audit Fees

  14. SOX 404 Reported Internal Control Weaknesses: A Test of COSO Framework Components and Information TechnologyKlamm and Watson (2009)

  15. Overview • Examined IT and non-IT Controls Material Weaknesses with respect to COSO Components • Material Weaknesses were mapped to a specific COSO component • IT Vs. non-IT MWs • What is your assessment of the IT MW’s?

  16. COSO Components • Control environment • Foundation • Sets tone of the firm • integrity, ethical values, competence, philosophy, and operating style of the firm’s managers and employees • Risk assessment • identification, analysis, and management of (operating, economic, industry, regulatory) risks that may prevent a firm from achieving its objectives • Management implements control activities • segregation of duties, approvals, reviews, reconciliations, and authorizations • Information & Communication • timely capture and dissemination of pertinent information on internal and external events • communication among and between management, employees, suppliers, and customers • Monitoring • continual evaluation of the other components’ effectiveness.

  17. Findings • Weak Control Environment is related to other weaknesses in COSO components • Weak Monitoring is related to weak risk assessment and control activities • Financial Statement reliability is affected by the number of weak COSO components • IT related MW’s are associated with a greater amount of non-IT related MW’s • IT related MW’s are related with: • More misstatements • Greater overall number of MWs

  18. Information Security and Sarbanes-Oxley Compliance: An Exploratory StudyWallace, Lin, and Cefaratti (2011)

  19. Frameworks • COSO • Model for controlling and managing Internal Control • COBIT • IT Governance / NOT IT Security Specifically • What needs Controls • ISO • Specific IT Security Controls • How To

  20. ISO • Security Policy • Organizational Security • Asset Classification and Control • Personnel Security • Physical and Environmental Security • Communications and Operations Management • Access Control • Systems Development and Maintenance • Business Continuity Management • Compliance • In all there are 124 recommended IT controls

  21. What did the research find?

  22. Findings • What is the Extent that ISO controls are in place? • Most Common: • Controls such as deploying antivirus software and authenticating remote users accessing the network • Least Common • Protecting equipment from unauthorized access and tracking the location of removable computer media

  23. “Not Sure” Responses • CPA’s selected “not sure” more frequently than non-CPA’s • CISA’s selected “not sure” less frequently than non-CISA’s • Certified Information Systems Auditor • What Is ISO Category 8? 9?

  24. Training • Auditors with IT Training • 35 more controls were likely to be implemented • IT employees participate in SOX Compliance • 55 more controls were likely to be implemented • IT personnel received SOX compliance training • 65 more controls were likely to be implemented

  25. IT internal control weaknesses and firm performance: An organizational liability lensStoel & Muhanna (2011)

  26. Internal Control • SEC definition: • policies and procedures for the recording of transactions and maintenance of financial records • Since modern enterprises are heavily dependent on integrated computer- based systems • “internal control over financial reporting” process regulated by the SEC must include controls over the accounting and management process as well as over the organizational IT infrastructure and systems. • Statement of Auditing Standards No. 94 (SAS 94) affirmed that the nature and characteristics of a company's use of information technology affect the company's internal control over financial reporting and requiring auditors to consider information technology as an integral part of overall internal controls (AICPA 2001). • Therefore, SOX requires review of Accounting Internal Control as well as IT controls

  27. IT Controls • Pertain specifically to IT systems, processes and infrastructure • used to capture, process and record raw transactional data corresponding to economic events • as well as support the preparation of financial reports • Encompass the management, operational, and technical safeguards or countermeasures prescribed for the firm's information systems to protect the • Confidentiality • Integrity • Availability • of those systems and their information • What framework does this definition come from? • When examining a companies IC – which framework do companies use? Which are prescribed? • What does PCAOB AS #2 say about IT controls?

  28. Overview • What is the business value of IT Controls? • What is the relationship between IT Quality and ROA? • IT Control MW’s -> Lower ROA (Why?) • What were the ROA for the 3 segments examined in this study?

  29. The consequences of Internal Control Weaknesses on Management Information Systems: The Case of SOX Internal Control Reports Li, Peters, Richardson, Watson, 2012

  30. What do the researchers assert? • Quality of financial reporting system output. • In what form? • What can impact quality?

  31. IT Controls • How are these determined? • How are they coded? • How did the authors categorize them? • Data Processing Integrity • Systems Access and Security • System Structure and Usage

  32. Findings What did they find?

  33. A content Analysis of auditors reports on IT internal control weaknesses... (Boritz, Hayes, and Lim, 2013)

  34. What is this about? Why did they do it?

  35. What did they find? • Are any of these categories correlated with each other? • If so what might be an explanation?

  36. What didn’t they find? Or what keywords might you expect that didn’t turn up or turned up infrequently? What might this mean? Can it be fixed?

More Related