internal control framework of a compliant erp system · internal control framework of a compliant...
TRANSCRIPT
Accepted Manuscript
Title: Internal Control Framework of a Compliant ERP System
Author: Jing Fan Pengzhu Zhang David C. Yen
PII: S0378-7206(13)00115-8DOI: http://dx.doi.org/doi:10.1016/j.im.2013.11.002Reference: INFMAN 2675
To appear in: INFMAN
Received date: 1-2-2012Revised date: 17-10-2013Accepted date: 4-11-2013
Please cite this article as: J. Fan, P. Zhang, D.C. Yen, Internal ControlFramework of a Compliant ERP System, Information & Management (2013),http://dx.doi.org/10.1016/j.im.2013.11.002
This is a PDF file of an unedited manuscript that has been accepted for publication.As a service to our customers we are providing this early version of the manuscript.The manuscript will undergo copyediting, typesetting, and review of the resulting proofbefore it is published in its final form. Please note that during the production processerrors may be discovered which could affect the content, and all legal disclaimers thatapply to the journal pertain.
Page 1 of 44
Accep
ted
Man
uscr
ipt
Internal Control Framework of a Compliant ERP System
Abstract
After the occurrence of numerous worldwide financial scandals, the importance of related
issues such as internal control and information security has greatly increased. An internal
control framework that can be applied within an enterprise resource planning (ERP) system is
developed in this study. A literature review is first conducted to examine the necessary forms
of internal control in information technology (IT) systems. The control criteria for the
establishment of the internal control framework are then constructed. A case study is
conducted to verify the feasibility of the established framework. This study proposes a 12-
dimensional framework with 37 control items aimed at helping auditors perform effective
audits by inspecting essential internal control points in ERP systems. The proposed
framework allows companies to enhance IT audit efficiency and mitigates control risk.
Moreover, companies that refer to this framework and consider the limitations of their own IT
management can establish a more robust IT management mechanism.
Keywords: internal control framework, enterprise resource planning, IT control
Page 2 of 44
Accep
ted
Man
uscr
ipt
1. Introduction
The popularity of information technology (IT) applications has increased reliance on
computers in processing business transactions. Companies adopt IT systems to improve their
operations. The surveys on the collaborative operations of IT systems conducted by the
Market Intelligence and Consulting Institute [42] indicate that enterprise resource planning
(ERP) system is the most adopted IT system among large companies.
Given that ERP is a popular and all-encompassing information system utilized by many
organizations and owing to the increased consideration of the risks associated with IT,
information system security and internal control related to information systems have greatly
increased [17, 45, 63, 75]. The Committee of Sponsoring Organizations of the Treadway
Commission (COSO) defines internal control as “a process, effected by an entity’s board,
management, and other personnel, designed to provide reasonable assurance regarding the
achievement of objectives such as effectiveness and efficiency of operation, reliability of
financial reporting, and compliance with regulation” [15]. The internal control related to
information systems is commonly referred to as IT control, which is composed of controls
(i.e. policies and procedures) over organizational IT infrastructure and systems [47, 63]. IT
control consists of general and application controls. General controls refer to these relevant
controls designed to ensure an entity’s control environment is well managed, and applied to
all sizes of systems ranging from large mainframe systems to client/server systems and to
desktop and/or laptop computer systems. Whereas application controls include input,
processing, and output control based on the flow of data processing. In other words,
application controls focused on the accuracy, completeness, validity, and authorization of the
data captured, entered in the system, processed, stored, transmitted to other systems, and
reported [54]. Further, general controls can be used to support the application controls and
hence, allow information system be smoothly operated [22]. Given that financial reporting in
many entities is based on information systems such as ERP systems, IT controls help entities
achieve the objective of internal control. Similar to information security, IT controls can also
Page 3 of 44
Accep
ted
Man
uscr
ipt
manage and protect information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction [68].
An attack on information generally leads to theft of confidential data, financial fraud,
incapacitated web server, and corrupted operation data [27], which all influence the accuracy
and reliability of financial data derived from the information system [75]. If entities fail to
establish proper information security, they cannot guarantee the accuracy and reliability of
financial data [51]. ERP built-in control features may prove to create a positive impact on the
effectiveness of internal controls over financial reporting. However, ERP does not necessarily
safeguard against some deliberated systems’ manipulations, for example, a few of the control
features might not be activated in a timely manner on the implementation stage [45]. Further,
in order to manipulate the date for performing the earning management, top managers may
attempt to override some control features [6]. Following a number of reported business
scandals, investors are beginning to question the accuracy of financial reports, including those
generated by major companies in the world. In fact, the confidence of investors in the
accuracy of financial reports and the shared holding positions of large companies has
collapsed over the recent years [56]. Durfee [18] emphasizes that the announcement of
material weakness in the internal control system may result in a drop in stock prices, increase
in share volume, and loss of chief financial positions. Goel and Shawky [26] also indicate that
announcements of security breaches would decrease the market share of firms. Conversely,
effective internal control can help firms achieve their expected financial goals, maintain
precise records of daily transactions, and produce accurate financial statements [20]. The
accuracy and reliability of data within the ERP system are critical to ensure the transparency
of the company’s situation at all times, help rebuild investor confidence, and ensure low cost
of capital [3].
Software vendors establish “built-in” control in ERP systems [45]. Companies also have
an internal control framework in their ERP systems. Management is required to establish the
framework, especially when a company is publicly listed. Companies constantly audit the
Page 4 of 44
Accep
ted
Man
uscr
ipt
effectiveness of the ERP system’s internal control. Thus, an increasing number of companies
have started to focus on the implementation of effective controls in their ERP systems while
simultaneously providing the management and external auditor a suitable framework to assess
the ERP system’s internal control. COSO released a report entitled “Internal Control-
Integrated Framework” [15] in 1992 in an attempt to illustrate a systematic framework for
internal control. However, the report failed to list supplemental criteria in the implementation
and assessment of IT controls [49]. Referring to specific control items would allow the
management and auditor to execute IT control procedures [29]. However, IT control
procedures not only consider the environment within the entity but also the control related to
the external environment [66]. In addition, given the minimal compliance guidance in the use
of IT sets by the government, the interpretation of the scope and nature of the IT environment
is inconsistent [8]. These limitations increase the difficulty of compliance. Despite the
importance of deploying proper internal control frameworks to fully develop the effectiveness
of the ERP system, only a few academic studies have assessed this issue. Accordingly, this
study derived the main research question, that is, what are the types of internal control that
must be considered when auditing an ERP system? The primary objective of this study is to
develop a preliminary internal control framework for application in an ERP system.
2. Research Background
The growing awareness of IT’s role in managing knowledge derived from information
systems has caused the production of accurate and relevant information to become the focus
of studies on information systems such as accounting information systems (AIS) and
management information systems (MIS) [76]. IT governance has been discussed recently and
has gained attention; IT governance is “used to describe how those persons entrusted with
governance of an entity will consider IT in this supervision, monitoring, control, and direction
of the entity” [32]. Well-defined controls are considered an imperative and necessary part of
IT governance. This study attempts to establish good internal control standards for ERP
systems by proposing an internal control framework for such systems. Three subtopics are
discussed in this section. The first subsection describes the system security and internal
Page 5 of 44
Accep
ted
Man
uscr
ipt
controls in the ERP system. The second subsection introduces the audit and inspection
challenges associated with the ERP system. The third subsection presents and discusses the
internal control framework.
2.1 System security and internal controls in the ERP system
An increasing number of firms depend on ERP to address operational transactions.
Therefore, information system security must be emphasized, especially in financial
transactions [70, 73]. Walters [75] states that many information system threats, such as
unauthorized access and system vulnerability attacks, influence the accuracy and reliability of
financial data derived from information systems. Information security protects and controls IT
resources and ensures the accuracy and reliability of information [1]. Van de Riet et al. [69]
noted a number of security aspects associated with an ERP system; these aspects include
security policy, user authentication, authorization, time restriction, log and trace, and database
security.
Information security control maintains the reliability of the information system resource
and the availability and integrity of financial data. Thus, information security control is
closely linked with information security and internal controls. After the occurrence of
numerous worldwide financial scandals, company management teams and auditors are now
required to take responsibility for their respective financial reports. The effectiveness of
internal control has been emphasized in this decade [52]. If firms lack the proper level and
type of information security, they cannot ensure the effectiveness of their internal controls and
the integrity of their financial data [51]. Thus, identifying the necessary control-related
considerations in an ERP system is an important initial task for management and auditors.
2.2 Audit and inspection challenges in the ERP system
The introduction of a new information system in a company may generate a risk different
from that initially associated with the legacy framework. The risks that accompany new
framework operations may not be similar to those of the original system [50]. Reengineering
of the business process and organizational changes brought about by the introduction of a new
system may also lead to the changes in the control requirements of a company in terms of
Page 6 of 44
Accep
ted
Man
uscr
ipt
ERP [11]. Problems frequently associated with the ERP system are generally contained. Such
issues include business interruption, process interdependency, network security, database
security, application security, and overall internal controls [31]. Therefore, many key aspects
in the risk control environment must be considered [56]. Glover et al. [25] suggest that
internal auditors consider the relevant risks and controls required for system planning based
on knowledge of risk management and the internal risks present in the company during the
introduction of the ERP system. Auditors and inspectors should first understand the basic
architecture of the ERP system to effectively exert internal control over the ERP system [2,
9]. In the comprehensive application of the IT environment, “owning” the control framework
can help auditors evaluate the effectiveness of IT control and decide on an auditing strategy
and program. The control framework can also enhance the efficiency of IT control evaluation
and mitigate the audit risk for auditors [29].
2.3 Internal control framework
The management and auditors must follow a suitable and holistic internal control
framework to ensure the effectiveness of internal control in a firm. COSO released a report
entitled “Internal Control-Integrated Framework” and recommended that this report be
utilized by companies, auditors, regulating agencies, and educational institutions [15]. The
conceptual model of the report indicates that internal control objectives require five
components of control, namely, the control environment, risk assessment, control activities,
information and communication, and monitoring.
However, the framework provided by COSO focuses on high-level guidance of internal
controls and does not provide the detailed control objectives that auditors require in the
design of audit tests [49]. Moreover, the framework does not address the specific risks and
complexities of IT [14]. An organization and its auditor require a comprehensive framework
to adapt properly to the current IT auditing environment and to comply with regulations [66].
Transactions involving information systems require particular control standards and
criteria because IT utilization presents difficulties in inspecting the audit trails of business
operations. The computerization of business transactions leads to the digitization of audit
Page 7 of 44
Accep
ted
Man
uscr
ipt
evidence, resulting in difficulties in following audit trails [41]. Thus, IT internal control
usually includes the following procedures: (1) general controls, which refers to the relevant
control measures associated with EDP; and (2) application controls or the division of input,
processing, and output controls based on the flow of data processing.
In this digital age, the absence of information security in a certain company implies that
the entire company is built on a fragile foundation such that it cannot survive any related
internal control tests [4]. Information systems in enterprises require many internal controls
owing to the pervasive implementation of IT and the need to minimize problems. The
complexity of modern systems can overwhelm auditors and the management if no appropriate
guidance is provided [66]. Hence, auditors and the management should increase their
understanding of the IT environment and related IT processes and controls because they must
perform control procedures periodically [44, 47]. Given that the two control types utilized at
present cannot effectively or completely regulate the robustness of an internal control
framework especially when incorporated in present information systems, numerous
institutions have established their own sets of criteria for information security. A series of
standards and criteria such as the British Standard (BS7799) and the Control Objectives for
Information and Related Technology (COBIT) is employed by organizations. COBIT
complements the COSO enterprise framework in terms of assessing internal control and
balanced risks in IT-intensive environments [33, 53]. Huang et al. [29] established an IT
control evaluation model that includes control objectives. Referring to specific control items
would allow the management and auditor to execute control procedures. However, despite the
importance of deploying proper internal control frameworks, only a few academic studies
have been conducted to fully develop the effectiveness of the ERP system. The present study
aims to develop a preliminary internal control framework for application in ERP systems to
bridge such gap.
3. Research methodology and design
The research flow presented in this study utilized a theoretical strategy based on the V
structure developed by Gowin [48] (Figure 1). The interactions between the two sides of the
Page 8 of 44
Accep
ted
Man
uscr
ipt
structure (i.e. theoretical and methodological) merge relevant concepts and methods to
achieve the proposed research goals [48]. Following the procedures listed on the “theoretical”
side, the items related to IT control were summarized by studying the previous research. A
literature review is thus conducted prior to the development of an internal control framework
for ERP systems. To this end, two steps were performed in the literature review and they are
collecting literature from the related sources and conducting coding procedures. In specific,
relevant literature was gathered from the following sources.
(1) IT controls for the internal use of companies. The data gathered are expected to be these
within the scope of the internal use of companies and can be compiled with the current
internal control bylaws of corporate information systems;
(2) Information security organization bylaw. This study refers to the regulations and criteria
of COBIT and BS7799 in particular and includes all information systems. Both
references are important as they have been adopted by many companies worldwide [66];
and
(3) Academic literature
-----------------------------------------------
Insert Figure 1 here
-----------------------------------------------
Upon the completion of the initially constructed theoretical model and prior to
conducting the case study, the control items were established to meet the requirements needed
in the application of the model to the ERP system. In fact, expert questionnaires were
administered in this process. The main purpose of utilizing the expert questionnaires is to
ensure and enhance the content validity of each of the measurement constructs and to bridge
the gap between the presented literature for application and these in actual practice. The
measurement constructs and item indicators were screened separately to determine the
internal control issues prevalent in the ERP system as well as to enhance the quality of the
Page 9 of 44
Accep
ted
Man
uscr
ipt
examination process and gain deeper insights.
Following the procedures outlined on the “practical” side, an empirical case study was
then conducted to investigate the feasibility of the proposed framework derived from
literature review and the questionnaires. The case study included “how” and “why” questions
[79] and a pre-identified company was selected for the case study. In addition, the case study
included the steps related to design, preparation, collection, analysis, and sharing [79]. Not
only the case design was identified in the design step, but also the unit of case study was
described in detail in this step.
4. Construction of the preliminary framework for the internal controls of the ERP
system
The Science Direct database was utilized to search for academic literature. The main
criteria for this search may include the following items.
(1) Keywords or abstract sections must have the words “information security” or “internal
control”;
(2) Literature must be related to information field; and
(3) Studies should be published within 2003 to 2007 since numerous financial scandals
emerged worldwide were mainly occurred after 2002 and the issue of internal control
was happened during this aforementioned period. Consequently, several regulations
which requested the management to assess their own enterprise internal control were
proposed, and auditors were also asked to determine whether their client’s internal
control assessment report was adequate. Form the above discussion, the studies collected
in this research are limited to this aforementioned period to investigate what have been
discussed or explored during this specific time window.
Conceptualized results from 30 relevant publications were collected based on the
abovementioned criteria. The collected results are shown in Table 1. A detailed analysis was
also performed to present a complete and consistent list of internal control items for ERP. The
preliminary model was constructed based on the literature review. The entire process was
roughly divided into three steps as follows: (1) open coding, (2) axial coding, and (3)
Page 10 of 44
Accep
ted
Man
uscr
ipt
selective coding.
-----------------------------------------------
Insert Table 1 here
-----------------------------------------------
4.1 Open coding
Open coding was performed for the literature contents that satisfied the criteria
mentioned above. Section extraction was performed, and the sections identified as relevant to
the internal controls of the information operations or those that obviously indicate the
components of the IT control of the information operations are coded. Coding was conducted
to classify the studies from A to C. The codes derived from IT control for the internal use of
companies, information security organization bylaws, and academic literature were classified
as A, B, and C, respectively. For example, “C Company—Computerized Information System
ICE” includes a section that addresses internal regulations. More specifically, this section
states, “going online requires test reports or passing of tests.” This description can thus be
conceptualized and coded into three factors (i.e., A216 whether test documents exist, A217
whether independent test environments exist, or A218 whether they have been verified by
users). A total of 670 concepts were derived by this process.
Accurate and complex interpretations were established as certain phenomena. For
instance, codes A78, A108, A114, A115, A177, A192, A252, B15, B16, B17, B31, B46, B104,
B154, B162, C40, C61, C87, C114, C158, C170, and C219 describe anomalies in the
information system, how the information department is contacted and informed, how the
information department rules out anomalies, and how information security incidents are
addressed. Thus, these codes (concepts) were grouped in the domain of “whether procedures
exist to report disasters.” The other concepts were translated into domains according to the
same rule; 66 domains were established as internal control key issues based on the 670
concepts determined in the open coding process.
4.2 Axial coding
Axial coding is usually conducted after open coding. This stage aims to recompose the
Page 11 of 44
Accep
ted
Man
uscr
ipt
distributed data into new methods such that the classifications and sub-classifications become
related to one another.
The 66 domains of the coded entries were further classified into dimensions. For example,
the domains “whether relevant control procedures exist regarding system outsourcing” and
“whether contracts are signed for system outsourcing” are related to the outsourcing operation
control and are imperative in managing system outsourcing for an organization. Therefore,
these domains were classified into the dimension of “control of outsourced operations.” The
results of axial coding are summarized in Table 2.
-----------------------------------------------
Insert Table 2 here
-----------------------------------------------
4.3 Selective coding
Axial coding consolidates complex data and is the foundation of selective coding.
Selective coding is conducted to explain a selected core category systematically, verify the
relationship of the main and other classifications, and fill the gap for supplements or
developments required for individual classifications [64].
Based on the internal controls and the analysis of relevant literature, 66 key domains that
influence the internal control of information systems were identified. The domains integrated
through axial coding were re-classified as single key domains in selective coding. For
example, the domains “whether anti-virus measures are used” and “whether firewalls are
used,” were merged into “whether information equipment is protected with security
measures” given that both are related to the security measures of the information equipment.
Subsequently, 51 key domains were established. These domains function as internal control
items.
4.4 Expert Questionnaires
Upon the construction of the preliminary internal control items based on literature, the
methodology and validation process developed by Lawshe [37] was adopted. The adoption of
this methodology and validation process enabled the collection of opinions from experts with
Page 12 of 44
Accep
ted
Man
uscr
ipt
extensive experience in the establishment, maintenance, and auditing processes of the ERP
system. Questionnaires were distributed to gather the opinions from experts who are
responsible for the corporate functions (including internal audit and information), handle
external audits (accounting firms), and work in some partner companies regarding the
introduction of an ERP system. The backgrounds of the participating experts are shown in
Table 3. The control dimensions and items were screened to determine those suitable for the
ERP system. Both theoretical and actual application are expected to increase the validity,
extent, and practicality of this study, thereby achieving the research purpose of constructing
internal control in an ERP system.
-----------------------------------------------
Insert Table 3 here
-----------------------------------------------
The questionnaires utilized in this study measures the opinions of the respondents based
on an ordinal scale of 5 as follows: “very important (5),” “important (4),” “ordinary (3),”
“unimportant (2),” and “very unimportant (1).” Each dimension is semi-open so that the
respondents can provide relevant feedback on the key items related to internal control in the
ERP system.
A total of 18 experts responded to the questionnaires. Following the methodology and
validation process proposed by Lawshe [37], content validity ratio (CVR) can be calculated as
CVR = (n-N/2)/(N/2) where n represents the number of times that experts categorized the
items as either “very important” or “important” and N represents the total number of experts.
The value of CVR should be greater than 0.43 to meet the targeted requirement. However,
this study requires that CVR ratio be greater than 0.60 before a control item is adopted to
ensure that the control items constructed in this study remain important and feasible for most
companies. Table 4 provides a summary of the questionnaire results, including the statistics
from the questionnaires and the calculation of CVR.
As described previously, a literature review was conducted and 51 key items were
Page 13 of 44
Accep
ted
Man
uscr
ipt
identified for the internal control of ERP systems. Fourteen items were considered
unimportant and were deleted after calculating and comparing the CVR values derived from
the questionnaires. The remaining 37 control items were generalized and consolidated. The
preliminary internal control items were further modified by referring to the suggestions
provided by the expert respondents. Table 5 shows the modified internal control framework.
-----------------------------------------------
Insert Table 4 here
-----------------------------------------------
-----------------------------------------------
Insert Table 5 here
-----------------------------------------------
5. Empirical findings on internal control for the ERP system
This section provides a brief description of the practices employed by the case company.
The selected company was established in 1996 and is dedicated to the development and
manufacturing of wireless telecommunication products. The company aspires to become the
world leader in the area of wireless telecommunications by exerting efforts in research and
development (R&D) which is aimed at improving technology. Its products are divided into
three lines; and they are namely, satellite telecommunications, mobile telecommunications,
and wireless network equipment.
The managers in the company can keep abreast of the key technologies associated with
their product lines in accordance with the changes occurred in the marketplace through their
extensive experience and background in technology. The company is thus capable of
developing the relevant niche products to meet the market demands by quickly integrating
telecommunication technologies into their product lines.
This company provides the comprehensive wireless and telecommunication products and
timely after-sale services to its customers. With its focus on the R&D of new technologies and
extensive in-house development of accompanied software and hardware, the company designs
Page 14 of 44
Accep
ted
Man
uscr
ipt
and develops its own products effectively. In fact, the company has achieved their best
economies of scale by establishing an increasingly comprehensive product line. As a result,
the company is capable of maintaining its competitive advantage in the wireless
telecommunications industry.
The computer auditors working for the accountant were invited to participate in this
study. Interviews were also conducted to study the actual company’s operations with
collecting the current internal control information as primary data. The company was asked to
provide secondary data (i.e., relevant operation documents and files) for the analysis and
synthesis of the research findings. Table 6 summarizes the background of all the interviewees.
-----------------------------------------------
Insert Table 6 here
-----------------------------------------------
A select group of public companies that introduced ERP systems was filtered for the case
study. The company targeted for interview is the one engaged in the tasks of R&D and
manufacturing of wireless telecommunication products. The company actually replaced its
Baan computer system with the Oracle ERP system in 2006. The interviewees comprised an
internal auditing supervisor who facilitates two different ERP systems, an assistant manager
in the MIS Department who maintains and deploys these two different systems, and a
computer auditing manager who works for the accounting firm to audit the information
system of this company. In other words, these three individuals are responsible for the ERP
audit. All the three interviewees have relevant experience and background in the auditing and
maintenance of ERP systems.
A case study on a public company with the obtained audited financial reports was
conducted. A manufacturing firm similar to this telecommunications company can be
regarded as a representative case of companies in other industries. For this reason, this case
result can be employed and justified as a rationale for the use of a single case [79]. In specific,
the case study protocol was developed in the preparation step. Primary data about the actual
operations of the company were gathered on-site in the collection step, while secondary data
Page 15 of 44
Accep
ted
Man
uscr
ipt
were utilized to address the main objectives of this research. Further, data were gathered,
analyzed, and collated prior to conducting the interviews with personnel who are experts in IT
control and have worked with the independent accounting firm maintaining a relationship
with the company selected in the case study. The feasibility of the internal control items that
were applied in the planning of the ERP system was evaluated in the analysis and sharing
steps. Finally, the results and findings were presented.
The control items and information auditing of the ERP system in the case company were
reviewed. The feasibility of the control items constructed for the company were also
evaluated.
(1) Practices within the case company
Two auditors are employed in the audit department of the case company. Their tasks
include inspecting domestic and overseas affiliates in the same group. In addition to adjusting
the internal control framework originally based on the “eight major cycles,” the two auditors
also perform internal audits and execute special projects assigned by their supervisors because
these tasks are part of their job description. In auditing ERP systems, the focus is on soft
control. The company’s MIS department has established a division called “ERP System
Services.” All seven employees in this division are responsible for the maintenance of the
ERP system. Their major responsibilities include maintaining the normal operations of the
system, solving all problems raised by users, and meeting the operational demands of users.
These employees perform ordinary control tests and passive checks on requests from the
auditing department as ERP system audits.
(2) Control items within the case company
The current audit checklist for ERP systems was originally based on the control items
listed by the company headquarters. The checklist was later modified in accordance with the
actual situations experienced by the company. The key control items comply with the criteria
set by the authority. However, these control items are not fixed and are regularly reviewed for
appropriateness.
Director Chen said, “After the introduction of the new Oracle ERP system in 2006, the
Page 16 of 44
Accep
ted
Man
uscr
ipt
company conducted timely adjustments to ascertain control items.”
(3) Information auditing of the ERP system
The internal auditors of the case company focus their audit on soft control items in the
ERP system such as accounts, passwords, authorization, and remote access. The auditors are
equipped to perform only soft audits. Other forms of audits are delegated to the MIS
department as the internal auditors perform these tasks through collaborative procedures. The
definition of the items pertaining to overall control is modified by referring to previous audit
records. For example, each audit is performed on a regular basis (i.e., once a year) to
minimize risk. However, the items with poor records have a high-risk profile and are therefore
analyzed under strict standards (i.e., conducted quarterly or every semester).
Given that financial reports are generated by the company’s ERP system, the reporting
accounts must be spot-checked as a form of internal control to reduce confirmatory audit
risks. The computer audit personnel of the accounting firm check the system setups and the
ordinary control measures of the company.
Manager Li said, “Basically, auditing for the ERP system within the company is mainly
focused on general and basic checking of the Oracle ERP architecture in the UNIX operating
system, Oracle database, and network. These are the critical points of our audit.”
If audit results indicate that the internal control of a company is proper, then the
accountants may reduce the required number of spot-checking procedures. Auditing
procedures should be modified on a timely basis in accordance with the actual demands of
companies. The company under study was able to amend system faults and failures pointed
out by its external auditors. This review process should be performed continuously to
establish a robust internal control structure.
The difficulties encountered by the company’s ERP system auditors are caused by lack of
IT training. Consequently, the company can focus only on software controls. With regard to
the other forms of audits, the auditors remain dependent on the MIS department for
effectiveness. However, despite the sufficient IT knowledge of the personnel in the MIS
department, these personnel cannot perform audits effectively owing to control issues posed
Page 17 of 44
Accep
ted
Man
uscr
ipt
by individuals, control measure requirements, and related auditing concepts. External auditors
continue to believe that most companies do not have any personnel dedicated to computer
audits.
Manager Li said, “Currently, the competent authority or relevant institutions are not
certified with regard to computer audits. In addition, most auditors claim they lack sufficient
IT training. Given the limited computer audit talents, very few companies have established a
stable computer audit department.”
In sum, the challenges involving ERP systems include whether auditors can clearly
understand the operational flows of the company and its overall information system
environment to effectively manage both the behavioral risks caused by human factors and the
technical risks integrated in a system. For auditors who do not have expertise in both audit
(accounting) and IT, the auditing processes in an ERP environment pose imminent obstacles
and challenges.
(4) Understanding the feasibility of the control items
Both interviewees concurred that the control items constructed in this study meet most of
the requirements. However, a suitable list of control items should consider the infrastructure
of the company, including the company scale and number of MIS employees. These
considerations are important because individual control points have important roles in legacy
information architecture. Accordingly, a number of control items cannot completely meet the
specifications of the company under study owing to limitations in identifying infrastructure
concepts such as whether the responsibilities of MIS personnel are clearly defined.
Assistant Manager Lin said, “This proposed framework seems suitable for my company,
but the premise must consider the company's structure. For example, the company did not do
well in distinguishing the responsibilities of IT personnel. The main reason is due to the lack
of manpower and information unit personnel. Therefore, some control items within this
proposed framework may be excluded. Nevertheless, the framework is still useful for my
company.”
The case company suggested that several control items be transformed to attainable
Page 18 of 44
Accep
ted
Man
uscr
ipt
targets in the future.
The interviewees were requested to state their opinions regarding the appropriateness and
importance of the control items to understand the feasibility of the proposed framework. Table
7 provides a summary of the company’s evaluation of the control items constructed in this
study. The list shows that the MIS department is particularly focused on “system development
and control over program modifications” and “access control of programs and data,” further
proving that the list is applicable and can thus serve as future reference. With respect to the
dimension “system development and control over program modifications,” Assistant Manager
Lin said, “If the MIS department could manage developed or modified system programs
effectively, it could help improve the credibility of information and preciseness of data.”
Two interviewees presented their views on the dimension “access control of programs
and data.”
Director Chen said, “Because of the critical nature of the data and program within the
company, appropriate control strategies and controls should be set for IT systems through
access control policies. Only authorized users should be provided access to information
system assets.”
Assistant Manager Lin said, “The current system login in the company is appropriately
controlled by access control procedures such as passwords. This form of logical access
control over information is primarily required within the company to protect information
against acts such as unauthorized creation and modification as well as inadvertent errors.”
With respect to the audit of control items, auditors believe that in principle, general audits
should be conducted annually. However, several dimensions such as “access control of
programs and data” require timely system auditing procedures. Jointly auditing these
dimensions and those for the eight-cycle operations is sometimes necessary. Auditing in such
situations is conducted not only annually but also rather promptly in conjunction with other
procedures. External auditors believe that the current self-control mechanisms of the
company’s internal IT department involve two dimensions (i.e., “system development and
control over program modifications” and “access control of programs and data”), which
Page 19 of 44
Accep
ted
Man
uscr
ipt
should be audited internally at least on a quarterly basis. As for the other dimensions, auditing
may be conducted every semester depending on the impact on the company processes.
The interviewees in the case study agreed that the constructed control items could
effectively assist the company in the audit and control of its ERP system.
Director Chen said, “This proposed framework is great and comprehensive. A few
control items are not available in the company at the moment, and this framework can be
utilized to adjust the present version of the company.”
-----------------------------------------------
Insert Table 7 here
-----------------------------------------------
(5) Discussion of Findings
As per earlier discussion, several findings are rather interesting. In general, internal
control framework for ERP existed in this case company could help related personnel to
perform an effective management and track the outcomes of IT control. This proposed
framework is relatively rigorous, complete and more easily acceptable logic-wise. Although
some control items are not suitable in the case company, this proposed framework can be used
repeatedly to adjust/improve the present version.
According to the results of case study, IT general control has reasonably been
emphasized since it supports the resulting application processing. However, different
industries and company size may provide different perspectives about determining the priority
of control items. For instance, small-sized companies often use Office software package to
handle business processing, and in this case, some of control items within this proposed
framework may need to be amended. Nonetheless, this proposed framework still can be
employed to greatly assist the entity to execute IT control and perform IT governance in the
case company.
6. Conclusions
Given that the ERP system is widely utilized in many organizations, relevant information
on security and internal controls must be continuously prioritized. Stakeholders wish to feel
Page 20 of 44
Accep
ted
Man
uscr
ipt
confident that internal control within the organization is executed effectively to reduce the
possibility of business failure or fraudulent financial reporting [38]. However, improper
management of control procedures in the computer environment of a company may result in
significant financial reporting errors and financial losses for the same company. Thus, this
study developed an ERP internal control framework to assist stakeholders in verifying the
effectiveness of their respective companies’ internal control mechanisms.
Literature related to IT controls for the internal use of companies, various information
security organization bylaws, and academic literature were reviewed. Open, axial, and
selective coding were performed to finalize the 51 key items associated with ERP internal
control. Questionnaires were administered to confirm whether the abovementioned items are
suitable for and essential to the ERP system. Out of the 51 control items, only 37 were
utilized in the preliminary model. A case study was then conducted to verify the feasibility of
the proposed framework.
Our findings have provided some implications on/to future research. The internal control
matrix could be regarded as a common method to represent internal controls for specific
business processes within the SOX audit environment, which includes the internal control
objectives [24]. Only a few studies have developed a structured, systematic approach that
stakeholders can utilize. The proposed framework was derived from several rigorous methods
and contained necessary control dimensions and items that can be utilized for ERP control
and improvement of IT governance. Comparing with the previous studies on internal control
frameworks including Jo et al. [34] and Lin et al. [40], case study approach has been
recommended for this stream of studies and this is simply because of the need for detailed and
contextual information from the entity stakeholders. Further, more extant researches utilized
experts from CPA firms as a research subject, this study yet recruited several participants
from the case company to disseminate their thoughts. Since this study embraced the
application controls to broaden the IT control domain, the obtained outcome may complete
Huang’s [29] work because of its only focus is placed on the IT general controls.
A previous study indicated that existing internal control frameworks do not consider
Page 21 of 44
Accep
ted
Man
uscr
ipt
important control aspects such as the environment outside the organization [66]. The
dimension “control of outsourced operations” in the proposed framework strengthens the ERP
internal control points. A few empirical studies examined IT control weakness and IT
operation risk [5, 36, 39]. The study of Li et al. [39] provided empirical evidence regarding
IT-related material weakness based on internal and external governance. Further, Klamm and
Watson [36] examined IT material weakness based on the internal control-integrated
framework proposed by COSO. In summary, this proposed framework may be utilized to
assess ERP control.
The proposed framework can also be applied to the external auditing profession. External
auditors can communicate logically with their clients through this framework. The
responsibility of the certified public accountants in attesting to the effectiveness of their
clients’ internal control system has been clearly regulated. An auditor in an IT environment
must have a good understanding of internal control. If an auditor does not have a proper
understanding of such concept, auditing work may incur many uncertainties and risks.
From the perspective of a business entity, acquiring effective internal control is a
complex task. However, internal control can be facilitated and maintained if a proper
framework is adopted. The proposed framework is a supplement to the COSO framework [15]
and provides a comprehensive framework to facilitate the construction of detailed controls for
ERP systems. Among the 12 dimensions constructed in this study, only the dimension “access
control of program and data” was unanimously recognized by all interviewees as an important
criterion in information risk management. This finding is similar to that of Wallace et al. [73],
thereby proving that access control is the most common and prioritized control in practice.
When an entity establishes proper access control, the probability of an attacker obtaining
unauthorized system access decreases [59]. However, most of the items in the proposed
framework were regarded as moderately important. The listed company under study should
therefore exercise compliance, and its stakeholders should assume more responsibility to
protect the information system. This result confirms the results of Wallace et al. [73].
With the proposed framework, which includes comprehensive control dimensions or
Page 22 of 44
Accep
ted
Man
uscr
ipt
items, internal auditors and MIS department chiefs can verify the effectiveness of internal
control through a complete mechanism to comply with government regulations. In other
words, internal auditors and MIS department chiefs can develop their relationship and
communicate the effectiveness of internal control by referring to the proposed framework.
According to Wallace et al. [73], a good relationship between an organization’s internal
auditors and MIS department chiefs helps the organization comply with IT-related internal
control requirements.
Several control items are considered high-priority items. Perhaps stakeholders should
prioritize high-risk control points. This process not only enhances audit efficiency also easily
identifies the weakness of internal control. Companies must consider the limitations inherent
in their infrastructures in terms of internal control management to determine the most
important control points [58]. These recommended improvements can enable companies to
build robust auditing structures.
Small and medium-sized enterprises (SMEs) need to implement information systems in
their operations to cooperate with large firms. Most large firms request to review and audit
downstream SMEs to ensure system security. SMEs may therefore consider the proposed
framework and adjust several control items following their own characteristics to determine
their IT control weaknesses in advance.
The present study has limitations. Thirty relevant studies were selected and reviewed to
construct the ERP system internal control framework. This study did not prove that the coding
process reached saturation; other control items might have been missed. Furthermore, despite
recruiting 18 qualified experts to confirm the control items derived from the literature review,
other experts might have concluded otherwise. Another limitation of this study is external
validity. The explanatory power of this study may be limited because single case method is
adopted herein. This proposed framework with control items developed in this study is
generic in nature. In other words, it could be applied to the majority of entities regardless of
the size or industry. A few industries with a higher security consideration of IT environment
(i.e., banking sector) will be able to expand this framework and add other new control
Page 23 of 44
Accep
ted
Man
uscr
ipt
dimensions and items to provide additional insights to this subject area.
Several future research avenues are discussed as follows. First, given the increasing
number of published studies on ERP internal control, follow-up research may analyze these
streamed studies to add control items and refine the proposed framework. Second, several
control items in the proposed framework may be extended to other systems, organizations
(i.e., government agencies), and industries. Future studies could examine the usefulness and
feasibility of the proposed framework.
Page 24 of 44
Accep
ted
Man
uscr
ipt
References [1] American Institute of Certified Public Accountants (AICPA), Audit Risk and Materiality
in Considering an Audit, SAS No.94, AICPA, New York, 1983. [2] American Institute of Certified Public Accountants (AICPA), the Effect of Information
Technology on the Auditors’ Consideration of Internal Control in a Financial Statement Audit. SAS No. 94. AICPA, New York, 2001.
[3] H. Ashbaugh-Skaife, The effect of SOX internal control deficiencies on firm risk and cost of equity, Journal of Accounting Research 47(1), 2009, pp. 1–43.
[4] J. C. Bedard, L. E. Graham, The effects of decision aid orientation on risk factor identification and audit test planning, Auditing 21 (2), 2002, pp. 39-65.
[5] M. Benaroch, A. Chernobai, J. Goldstein, An internal control perspective on the market value consequences of IT operational risk events. International Journal of Accounting Information Systems 13 (4), 2012, pp. 357–381.
[6] J. Brazel, L. Dang, The effect of ERP system implementations on the management of earnings and earnings release dates, Journal of Information Systems 22 (2), 2008, pp. 1–21.
[7] British Standards Institution (BSI), Information Security Management- Part 2: Specification for Information Security Management Systems, British Standards Institution, London, 2002.
[8] W. Brown, F. Nasuti, Sarbanes-Oxley and enterprise security: IT governance—What it takes to get the job done, Security Management Practices 14(5), 2002, pp. 15–28.
[9] L. Calabro, Looking under the hood, CFO, 20 (6), 2004, pp. 97-98. [10] V. Cerullo, M. J. Cerullo, Business continuity planning: A comprehensive approach,
Information Systems Management 21(3), 2004, pp.70-78. [11] S. I. Chang, G. G. Gable, A comparative analysis of major ERP lifecycle
implementation, management and support issues in Queensland government, Journal of Global Information Management 10 (3), 2002, pp. 36-54.
[12] J. Chau, Application security – it all starts from here, Computer Fraud & Security 2006 (6), 2006, pp. 7-9.
[13] M. Coe, Trust services: A better way to evaluate IT controls, Journal of Accountancy 199 (3), 2005, pp. 69-75.
[14] J. L. Colbert, P. L. Bowen. A comparison of internal controls: COBIT, SAC, COSO, and SAS 55/78, IS Audit and Control Journal 4, 1996, pp. 26-35.
[15] Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control - Integrated Framework. AICPA, New York, 1992.
[16] A. Daveiga, J. H. P. Eloff, An information security governance framework, Information Systems Management 24 (4), 2007, pp. 361-372.
[17] G. Dhillon, Principles of Information System Security: Text and cases, John Wiley and Sons, New Jersey, 2007.
[18] D. Durfee, The 411 on 404: Reporting a material weakness in controls can cost shareholders millions and some CFOs their jobs. CFO Magazine, 2005.
[19] J. H. P. Eloff, M. M. Eloff, Information security architecture, Computer Fraud & Security 2005 (11), 2005, pp.10-16.
[20] Ernst & Young, Preparing for internal control reporting: A guide for management’s assessment under section 404 of the Sarbanes-Oxley Act, Ernst, Young LLP, 2002.
[21] S. Flowerday, R. Von Solms, Continuous auditing: Verifying information integrity and providing assurances for financial reports, Computer Fraud & Security 2005 (7), 2005, pp. 12-16.
[22] S. Flowerday, R. Von Solms, Real-time information integrity= system integrity+ data integrity+ continuous assurance, Computers and Security 24 (8), 2005, pp. 604-613.
[23] C. Fox, P. C. Zonneveld, IT Control Objectives for Sarbanes-Oxley: The Importance of IT in the Design, Implementation and Sustainability of Internal Control over Disclosure and Financial Reporting, IT Governance Institute, Illinois, 2003.
Page 25 of 44
Accep
ted
Man
uscr
ipt
[24] U. J., Jr. Gelinas, R. B. Dull, Accounting Information Systems, 7th edition, Mason, OH: Thomson South-Western, 2008.
[25] S. Glover, D. Prawitt, M. Rommy. Implementing ERP, Internal Auditor 56 (1), 1999, pp. 40-47.
[26] S. Goel, H.A. Shawky, Estimating the market impact of security breach announcements on firm values, Information & Management 46 (7), 2009, pp. 404-410.
[27] L. A. Gordon, M. P. Leob, W. Lucyshyn, R. Richardson, CSI/FBI Computer Crime and Security Survey. Computer Security Institute, Available at: www.gocsi.com, 2005.
[28] M. Gorge, USB and other portable storage device usage: Be aware of the risks to your corporate data in order to take pre-emptive and/or corrective action, Computer Fraud & Security 2005 (8), 2005, pp.15-17.
[29] S. M. Huang, W. H. Hung, D. C. Yen, I. C. Chang, D. Chiang, Building the evaluation model of the IT general control for CPAs under enterprise risk management, Decision Support Systems 50 (4), 2011, pp. 692-701.
[30] P. Hunter, Card systems: Four million Hack – under the spotlight, Computer Fraud & Security 2005 (11), 2005, pp. 8-9.
[31] J. E. Hunton, A. M. Wright, S. Wright, Are financial auditors overconfident in their ability to assess risks associated with enterprise resource planning systems?, Journal of Information Systems 18 (2), 2004, pp.7-28.
[32] IT Governance Institute (ITGI). Board briefing on IT governance. Available at: http:// www.itgi.org. 2003.
[33] IT Governance Institute (ITGI), Control Objectives, Management Guidelines, Maturity Models in CobiT 4.0., IT Governance Institute, Illinois, 2005.
[34] Y. Jo, J. Lee, J. Kim, Influential factors for COBIT adoption intention: An empirical analysis. International Journal of Contents 6(4), 2010, pp.79-89.
[35] A. Jones, The convergence of physical and electronic security, Computer Fraud & Security 2006 (3), 2006, pp.12-14.
[36] B.K. Klamm, M.W. Watson, SOX 404 reported internal control weakness: A test of COSO framework components and information technology, Journal of Information Systems 23(2), 2009, pp.1-23.
[37] C. H. Lawshe, A quantitative approach to content validity, Personnel Psychology 28 (4), 1975, pp. 563-575.
[38] C. M. Lehmann, Internal controls: A compendium of short cases, Issues in Accounting Education 25 (4), 2010, pp. 741-754.
[39] C. Li, J. H. Lim, Q. Wang, Internal and external influences on IT control governance, International Journal of Accounting Information Systems 8 (4), 2007, pp.225-239.
[40] F. Lin, L. Guan, W. Fang, Critical factors affecting the evaluation of information control systems with the COBIT framework: A study of CPA firms in Taiwan. Emerging Markets Finance & Trade 46(1), 2010, pp.42-55.
[41] A. Mancuso, Auditing standard board issues SAS No. 80, The CPA Journal 66, 1997, pp. 74-74.
[42] Market Intelligence and Consulting Institute (MIC), Analysis of IT Applications for Large Companies in Taiwan, Institute for Information Industry, Taipei, 2009.
[43] N. Marks, The more things change, Internal Auditor 61 (4), 2004, pp.60-64. [44] T. J. Mock, L. Sun, R. P. Srivastava, M. Vasarhelyi, An evidential reasoning approach to
Sarbanes-Oxley mandated internal control risk assessment. International Journal of Accounting Information Systems 10(2), 2009, pp. 65-78.
[45] J. J. Morris, The impact of enterprise resource planning (ERP) systems on the effectiveness of internal controls over financial reporting, Journal of Information Systems 25 (1), 2011, pp.129-157.
[46] E. Myler, G. Broadbent, ISO 17799: Standard for security. Information Management Journal 40 (6), 2006, pp. 43-52.
[47] C. S. Norman, M. D. Payne, V. P. Vendrzyk, Assessing information technology general control risk: An instructional case, Issues in Accounting Education 24 (1), 2009, pp. 63-76.
Page 26 of 44
Accep
ted
Man
uscr
ipt
[48] J. D. Novak, D. B. Gowin, Learning how to learn. Cambridge University Press, NY, 1989.
[49] J. B. O’Donnell, Y. Rechtman, Navigating the standards for information technology controls, The CPA Journal 75 (7), 2005, pp. 64-69.
[50] D. O’Leary, Enterprise Resource Planning Systems: Systems, Life Cycle, Electronic Commerce, and Risk, Cambridge University Press, Cambridge, 2000.
[51] P. Proctor, J. Viganly, The security implications of Sarbanes-Oxley, Symantec Enterprise Solutions Webcast, Available at: www.symantec.com/press/2004/ n040218c.html, 2004.
[52] Public Company Accounting Oversight Board (PCAOB), An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statement, Auditing Standard No. 2, PCAOB, Washington, 2004.
[53] M. Ramos, Evaluate the control environment, Journal of Accountancy 197 (5), 2004, pp. 75-78.
[54] M. B. Romney, P. J. Steinbart, Accounting Information Systems, Pearson, Upper Saddle River, New Jersey, 2009.
[55] R. Saint-Germain, Information security management best practice based on ISO/IEC 17799, Information Management Journal 39 (4), 2005, pp. 60-66.
[56] W. Sally, M. W. Arnold, Information system assurance for enterprise resource planning system: Unique risk considerations, Journal of Information Systems 16 (1), 2002, pp. 99-113.
[57] W. She, B. Thurasingham, Security for enterprise resource planning systems, Information Systems Security 16 (3), 2007, pp. 152-163.
[58] M. Siponen, R.Willison, Information security management standards: Problems and solutions, Information & Management 46 (5), 2009, pp. 267-270.
[59] P. J. Steinbart, R. L. Raschke, G. Gal, W. N. Dilla, The relationship between internal audit and information security: An exploratory investigation, International Journal of Accounting Information Systems 13(3), 2012, pp. 228-243.
[60] P. Stephenson, Incident analysis and recovery, Computer Fraud & Security 2005 (3), 2005, pp. 17-19.
[61] P. Stephenson, Ensuring consistent security implementation within a distributed and federated environment, Computer Fraud & Security 2006 (11), 2006, pp. 12-14.
[62] A. Stewart, On Risk: Perception and direction, Computers and Security 23 (5), 2004, pp. 362-370.
[63] M. D. Stoel, W. A. Muhanna, IT internal control weaknesses and firm performance: An organizational liability lens, International Journal of Accounting Information Systems 12 (4), 2011, pp.208-304.
[64] A. Strauss, Qualitative Analysis for Social Scientists, Cambridge University Press, Cambridge, 1987.
[65] K. L. Thomson, R. Von Solms, Towards an information security competence maturity model, Computer Fraud & Security 2006 (5), 2006, pp. 11-15.
[66] B. Tuttle, S. D. Vandervelde, An empirical examination of CobiT as an internal control framework for information technology, International Journal of Accounting Information Systems 8 (4), 2007, pp. 240-263.
[67] S. Tyson, L. Bean, System access hotspots: Are auditors ignoring danger, Journal of Corporation Accounting and Finance 16 (4), 2005, pp. 3-9.
[68] United States Code, Public Printing and Documents: Definitions. Title 44, Section 3552, United States Code, Washington, D.C., 2008.
[69] R. Van De Riet, W. Janssen, P. De Gruijter, Security moving from database systems, Database and Expert System Applications Proceedings, 1998.
[70] A. Vance, M. Siponen, S. Pahnila, Motivating IS security compliance: Insights from habit and protection motivation theory, Information & Management 49 (3-4), 2012, pp. 190-198.
[71] L. Volonino, G. H. Gessner, Holistic compliance with Sarbanes- Oxley, Communication of AIS 14 (1), 2004, pp. 219-233.
Page 27 of 44
Accep
ted
Man
uscr
ipt
[72] S. H. Von Solms, Information security governance – compliance management vs. operational management, Computers and Security 24 (6), 2005, pp. 443-447.
[73] L. Wallace, H. Lin, M. A. Cefaratti, Information security and Sarbanes-Oxley compliance: An exploratory study, Journal of Information Systems 25 (1), 2011, pp. 185-211.
[74] L. Wallace, M. Keil, A. Rai, Understanding software project risk: A cluster analysis, Information & Management 42 (1), 2004, pp. 115-125.
[75] L. M. Walters, A draft of an information systems security and control course, Journal of Information Systems 21 (1), 2007, pp. 123-148.
[76] C. L. Wilkin, R. H. Chenhall, A review of IT governance: A taxonomy to inform accounting information systems, Journal of Information Systems 24 (2), 2010, pp. 107-146.
[77] R. Williams, Performing a successful UNIX audit, Computer Fraud & Security 2003 (8), 2003, pp. 11-12.
[78] P. Wilson, Risk control: A technical view, Computer Fraud & Security 2005 (5), 2005, pp. 8-11.
[79] R. K. Yin, Case study research- Design and methods, Sage, California, 2009.
Page 28 of 44
Accep
ted
Man
uscr
ipt
Table 1. Related literature on IT internal control No. Author Literature Title Literature Source 1 A company Computerized Process: Internal Control A company 2 B company Computerized Process: Operation B company 3 C company Computerized Process: Internal Control C company 4 British Standards Institution
[7] Information Security Management Part 2: Specification for Information Security Management Systems; British Standards Institution.
British Standards Institution (BSI)
5 IT Governance Institute [33] Control Objectives for Information and Related Technology (COBIT 4.0) Information Systems Audit and Control Association 6 Cerullo and Cerullo [10] Business Continuity Planning: A Comprehensive Approach Information Systems Management 7 Chau [12] Application Security: It All Starts from Here Computer Fraud and Security 8 Coe [13] Trust Services: A Better Way to Evaluate IT Controls Journal of Accountancy 9 Daveiga and Eloff [16] An Information Security Governance Framework Information Systems Management 10 Eloff and Eloff [19] Information Security Architecture Computer Fraud and Security 11 Flowerday and Von Solms
[21] Continuous Auditing: Verifying Information Integrity and Providing Assurances for Financial Reports Computer Fraud and Security
12 Gorge [28] USB and Other Portable Storage Device Usage: Be Aware of the Risks to Your Corporate Data Take Pre-emptive and/or Corrective Action
Computer Fraud and Security
13 Hunter [30] Card Systems: Four Million Hacked – Under the Spotlight Computer Fraud and Security 14 Jones [35] The Convergence of Physical and Electronic Security Computer Fraud and Security 15 Marks [43] The More Things Change… Internal Auditor 16 Myler and Broadbent [46] ISO 17799: Standard for Security Information Management Journal 17 Saint-Germain [55] Information Security Management Best Practice Based on ISO/IEC 17799 Information Management Journal
18 Stephenson [60] Incident Analysis and Recovery Computer Fraud and Security 19 Stephenson [61] Ensuring Consistent Security Implementation within a Distributed and Federated Environment Computer Fraud and Security 20 Stewart [62] On risk: perception and direction Computers and Security 21 Thomson and Von Solms
[65] Toward an Information Security Competence Maturity Model Computer Fraud and Security
22 Tyson and Bean [67] System Access Hotspots: Are Auditors Ignoring Danger? Journal of Corporation Accounting & Finance 23 Volonino and Gessner [71] Holistic Compliance with Sarbanes: Oxley Communication of AIS 24 Von Solms [72] Information Security Governance: Compliance Management vs. Operational Management Computers and Security 25 Wallace et al. [74] Understanding software project risk: a cluster analysis Information and Management 26 Williams [77] Performing a Successful Unix Audit Computer Fraud & Security 27 Flowerday and Von Solms
[22] Real Time Information Integrity = System Integrity + Data Integrity + Continuous Assurances
Computers and Security
28 Walters [75] A Draft of an Information System Security and Control Course Journal of Information Systems 29 She and Thuraisingham [57] Security for Enterprise Resource Planning Systems Information System Security 30 Wilson [78] Risk Control: A Technical View Computer Fraud and Security Nos. 1 to 3 are classified as A (IT control for the internal use of companies)
Page 29 of 44
Accep
ted
Man
uscr
ipt
Nos. 4 to 5 are classified as B (information security organization bylaws) Nos. 6 to 30 are classified as C (academic literature)
Page 30 of 44
Accep
ted
Man
uscr
ipt
Table 2. Results of axial coding Category Domain Codes (From open coding) References
Whether clear definitions of the responsibilities of maintenance personnel in the MIS department exist
A1, A30, A121, A193, B12, B32, B112, C17, C33, C49, C81, C94, C151, C179
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], Eloff and Eloff [19], IT Governance Institute [33], Jones [35], She and Thuraisingham [57], Stephenson [61], Volonino and Gessner [71], Von Solms [72], Walters [75]
Whether application procedures exist for the system accounts (authorization)
A43, A45, A124, A152, A155, A209, A224, A232, A236, B65, C42, C72, C106, C109, C194, C196
A company, B company, C company, British Standards Institution [7], Cerullo and Cerullo [10], Gorge [28], Stephenson [60], Volonino and Gessner [71], Walters [75]
Whether system accounts (authorization) should be approved by related unit heads
A47, A210, A223, A237, C18, C48, C147 A company, C company, Cerullo and Cerullo [10], Jones [35], Von Solms [72]
Whether accounts are cancelled after employees leave
A46, A63, A153, A195, A225, B66, B117, C150, C197
A company, B company, C company, British Standards Institution [7], IT Governance Institute [33], Jones [35], Walters [75]
Whether accounts are modified simultaneously when employees change job responsibilities
A64, A196, A226, A228, B118, C47 A company, B company, C company, Cerullo and Cerullo [10], IT Governance Institute [33]
Whether user authorization is constantly reviewed
A62, A102, A126, A156, B69, B113, C34, C149, C199
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], IT Governance Institute [33], Jones [35], Walters [75]
Definition of functions and responsibilities of data processing department
Whether a dedicated team is responsible for the maintenance of the hardware and software of the system
A51, A73, A97, A107, A125, A200 A company, B company, C company
Whether application procedures exist for requests to modify system programs
A4, A23, A71, A127, A142, A212, B98 A company, B company, C company, British Standards Institution [7]
Whether modification specifications are confirmed by the MIS department and the department that submits such requests
A5, A8, A22, A24, A140, A143, B120, B127, B132, B142, C13 A company, B company, IT Governance Institute [33], Von Solms [72]
Whether system program modification documents are approved by related unit heads
A7, A21, A213, C50, C176 A company, C company, Marks [43], Walters [75]
Whether SA and SD program documents relevant to the modifications are available
A16, A42, A129, A137, B60, B64, B99, B123, B133, B143
A company, B company, British Standards Institution [7], IT Governance Institute [33]
Whether independent environments exist for development A15, A141, A217, C121, C180 A company, B company, C company, Chau [12], Walters [75]
Whether independent environments exist for tests B35, B40, B58, B93, B147, C181 British Standards Institution [7], IT Governance Institute [33], Walters [75]
System development and control over program modifications
Whether relevant test documents and records on program developments exist
A10, A18, A26, A38, A128, A135, A138, A216, A221, B41, B61, B92, B124, B134, B144, C22, C122, C182, C209
A company, B company, C company, British Standards Institution [7], Chau [12], Flowerday and Von Solms [22], IT Governance Institute [33], Stewart [62], Walters [75]
Page 31 of 44
Accep
ted
Man
uscr
ipt
Category Domain Codes (From open coding) References
Whether updated (newly added) programs are assessed by users
A13, A14, A25, A134, A139, A218, B59, B97, B100, B122, B130, B136, B146, C21, C123, C130, C186
A company, B company, C company, British Standards Institution [7], Chau [12], IT Governance Institute [33], Stewart [62], Walters [75]
Whether relevant control measures exist for changes in system flows A29, A122, C58 A company, B company, British Standards Institution [7]
Whether coding management is executed on the documents in relation to program modifications (updates)
A6, A32, A144, A214 A company, B company, C company
Whether documents are updated and modified by version after the modifications (additions) of programs
A11, A20, A27, A31, A36, A41, A53, A54, A132, A145, A190, A219, A222, B84, B101, B126, B137, B145, C23, C187
A company, B company, C company. British Standards Institution [7], Flowerday and Von Solms [22], IT Governance Institute [33], She and Thuraisingham [57], Stewart [62], Walters [75]
Whether review documents are improved after the programs have been developed
A17, B83, B88, B125, C105, C124, C183 A company, British Standards Institution [7], Chau [12], IT Governance Institute [33], Stephenson [61], Walters [75]
Whether dedicated personnel safeguard the documents in relation to the systems
A28, A33, A34, A35, A39, A149, A215, A220, B24, B173, C54
A company, B company, C company, British Standards Institution [7], Coe [13], IT Governance Institute [33]
Control over the compilation of system documents
Whether only certain personnel can access (modify) the documents in relation to the system programs or the original library
A37, A40, A194, B94, B164, C55, C192, C210
A company, B company, British Standards Institution [7], Coe [13], IT Governance Institute [33], Walters [75]
Whether authority controls exist
A61, A83, A159, A165, B33, B74, B76, B91, B155, B174, C26, C31, C39, C43, C56, C69, C77, C95, C108, C125, C131, C148, C195
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], Chau [12], Coe [13], Daveiga and Eloff [16], Eloff and Eloff [19], IT Governance Institute [33], Jones [35], She and Thuraisingham [57], Stephenson [60], Stephenson [61], Volonino and Gessner [71], Walters [75]
Whether password controls exist B68, B70, B78, B89, C64, C100, C136, C138, C144, C145, C198, C202, C225
British Standards Institution [7], Daveiga and Eloff [16], Flowerday and Von Solms [21], Myler and Broadbent [46], Stephenson [61], Walters [75], Williams [77]
Whether different access authorizations exist pursuant to the nature of users
A49, A55, A207, A227, A231, B52, B54, B63, B67, B70, B75, B79, B156, B169, C2, C5, C27, C46, C71, C146, C203, C224, C226
A company, C company, British Standards Institution [7], Cerullo and Cerullo [10], Flowerday and Von Solms [21], Gorge [28], IT Governance Institute [33], Myler and Broadbent [46], Saint-Germain [55], Von Solms [72], Walters [75]
Whether the transfer of external data into the system has undergone verification by relevant programs
A56, B55, C193 A company, British Standards Institution [7], Walters [75]
Whether control over remote access to the system mainframes exists
A257, B72, B175, C25, C29, C96, C134, C135, C137, C200, C201
C company, British Standards Institution [7], Cerullo and Cerullo [10], IT Governance Institute [33], Stewart [62], Stephenson [61], Walters [75], Williams [77]
Access control of programs and data
Whether dedicated personnel are responsible for the maintenance of the system databases
A2, A50, A130, A151, A154, A157, A234, C3, C44, C65, C66, C73
A company, B company, C company, Cerullo and Cerullo [10], Daveiga and Eloff [16], Gorge [28], Von Solms [72]
Page 32 of 44
Accep
ted
Man
uscr
ipt
Category Domain Codes (From open coding) References Whether application files exist for system data filing A60 A company
Whether original documents exist for input data A65, A158, A205, C36 A company, B company, C company, Cerullo and Cerullo [10]
Whether numbering of the documents is generated by the system
A67, A208 A company, C company
Whether verification procedures exist for the data input/output interface
A66, A77, A146, A162, A206, A235, B53, B85, B86, B87, B135, B165, C103, C126, C207, C227
A company, B company, C company, British Standards Institution [7], Chau [12], IT Governance Institute [33], Myler and Broadbent [46], Stephenson [61], Walters [75]
Whether appropriate control measures are present for output confidential data
A68, A147, A160, A163, B49, B51, B62, B90, B166, C37, C53, C70, C104, C229
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], Coe [13], Gorge [28], IT Governance Institute [33], Myler and Broadbent [46], Stephenson [61]
Control of data inputs and outputs
Whether records exist for any changes in data additions (modifications)
A48, A161, B77, B157, C80, C208 A company, B company, British Standards Institution [7], Eloff and Eloff [19], IT Governance Institute [33], Walters [75]
Whether relevant flows exist to manage the changes in data modification
A3, A52, A59, A69, A70, A81, A166, A233, B34, C4, C127
A company, B company, C company, British Standards Institution [7], Chau [12], Von Solms [72]
Whether data are regularly backed up
A86, A101, A111, A112, A131, A164, A167, A178, A186, A244, A247, A251, B44, B81, B151, B167, C11, C92, C156, C189, C205, C228
A company, B company, C company, British Standards Institution [7], IT Governance Institute [33], Myler and Broadbent [46], Stephenson [60], Von Solms [72], Tyson and Bean [67], Walters [75]
Control of data processing
Whether backup data are supported by another location
A88, A168, A245, B152, B170, C93, C159
A company, B company, C company, IT Governance Institute [33], Stephenson [60], Tyson and Bean [67]
Whether information equipment is listed and managed
A95, A106, A148, A183, B4, B11, B28, C35, C84, C168
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], Eloff and Eloff [19], Walters [75]
Whether information equipment is protected with security measures
A57, A58, A90, A185, A204, A241, A256, A258, C24, C30, C32, C41, C57, C97, C188, C214
A company, B company, C company, Cerullo and Cerullo [10], Coe [13], Flowerday and Von Solms [22], Saint-Germain [55], Stephenson [61], Stewart [62], Walters [75]
Whether anti-virus measures are present B102, C7, C112, C116, C212 British Standards Institution [7], Hunter [30], Saint-Germain [55], Von Solms
[72]
Whether firewalls are present B48, B73, B159, C6, C67, C74, C78, C90, C99, C111, C213, C230
British Standards Institution [7], Daveiga and Eloff [16], Eloff and Eloff [19], Hunter [30], IT Governance Institute [33], Myler and Broadbent [46], Saint-Germain [55], Stephenson [60], Stephenson [61], Thomson and Von Solms [65], Von Solms [72]
Whether the system mainframe is placed in facility rooms B18, B20, C85, C132, C171, C221 British Standards Institution [7], Eloff and Eloff [19], Saint-Germain [55],
Williams [77], Walters [75]
Security control of files and equipment
Whether access control over facility rooms is present
A94, A150, A173, A184, A201, A230, B19, B21, B171, C86, C133, C154, C172, C223
A company, B company, C company, British Standards Institution [7], Eloff and Eloff [19], IT Governance Institute [33], Saint-Germain [55], Tyson and Bean [67], Walters [75], Williams [77]
Page 33 of 44
Accep
ted
Man
uscr
ipt
Category Domain Codes (From open coding) References Whether fire, water, and temperature control facilities are present in facility rooms
A87, A91, A92, A93, A174, A175, A239, A246, C153, C155, C222 A company, B company, C company, Saint-Germain [55], Tyson and Bean [67]
Whether UPS facilities are present B22, B23, B172, C10, C152, C173 British Standards Institution [7], IT Governance Institute [33], Tyson and Bean [67], Von Solms [72], Walters [75]
Whether control procedures exist to destroy the backup data A169, A229, B26, B50, C175, C191 B company, C company, British Standards Institution [7], Walters [75]
Whether the “prevent abnormal invasion” measure exists
A44, A187, B43, B158, C28, C38, C91, C141, C215, C231
A company, B company, British Standards Institution [7], Cerullo and Cerullo [10], IT Governance Institute [33], Myler and Broadbent [46], Saint-Germain [55], Stephenson [60], Wilson [78]
Whether dedicated personnel responsible for the maintenance of software updates are present
A74, A80, A188, A238, B96, B139 A company, B company, C company, British Standards Institution [7], IT Governance Institute [33], Wallace et al. [74]
Whether regular inspections of hardware daily logs are conducted
A75, B39, B80, B141, C20, C101, C139, C140, C177, C190, C204, C232
A company, British Standards Institution [7], IT Governance Institute [33] , Myler and Broadbent [46], Stephenson [61], Von Solms [72], Wilson [78], Walters [75]
Whether the software and hardware are regularly maintained
A82, A98, A133, A171, A203, A242, A248, B38, B82, B109, B138, C9, C15, C60, C113, C174
A company, B company, C company, British Standards Institution [7], Coe [13] , Flowerday and Von Solms [22], IT Governance Institute [33], Hunter [30] Volonino and Gessner [71], Von Solms [72], Walters [75]
Whether records exist to note the maintenance of and changes in hardware
A76, A99, A172, A191, A202, A243, A249, B30, B42, B140
A company, B company, C company, British Standards Institution [7], IT Governance Institute [33]
Whether the system software/program update is approved by the MIS department chief
A136 B company
Whether records exist to note the maintenance of and changes in software
A100, B95, B148, C59, C102 A company, British Standards Institution [7], Coe [13], IT Governance Institute [33], Stephenson [61]
Control over the procurement, use, and maintenance of hardware and system software
Whether the system software is legal A121, A189, A211, A250, A259, B108, B129, B161, C8, C16
A company, B company, C company, British Standards Institution [7], IT Governance Institute [33], Von Solms [72]
Whether regular tests are conducted for system recovery procedures in the face of disaster
A89, A113, A116, A180, A253, B105, B106, B153, B168, C12, C88, C157
A company, B company, C company, British Standards Institution [7], IT Governance Institute [33], Stephenson [60], Tyson and Bean [67], Von Solms [72]
Whether procedures exist to report disasters
A78, A108, A114, A115, A177, A192, A252, B15, B16, B17, B31, B46, B104, B154, B162, C40, C61, C87, C114, C158, C170, C219
A company, B company, C company, British Standards Institution [7], Cerullo and Cerullo [10], Coe [13], Hunter [30], IT Governance Institute [33], Saint-Germain [55], She and Thuraisingham [57], Stephenson [60], Tyson and Bean [67], Walters [75]
System recovery plans/systems and control of testing programs
Whether relevant maintenance records and documents exist in case of abnormal situations
A79, A109, A179, B45, B47, B107, B163, C89, C117, C178, C206
A company, B company, British Standards Institution [7], IT Governance Institute [33], Hunter [30], Stephenson [60], Walters [75]
Control over the processes of information
Whether dedicated personnel responsible for reporting procedures are present
A118, A119, A197, A company, B company
Page 34 of 44
Accep
ted
Man
uscr
ipt
Category Domain Codes (From open coding) References Whether the reports are pursuant to the regulations
A117, A120, A198, A261, A262, B6, C163
A company, B company, C company, British Standards Institution [7], Walters [75]
disclosure on the websites assigned Whether backups of the reporting
data exist A199 B company
Whether system security planning is present
A123, A181, A255, B2, B5, B7, B29, B57, B110, B114, B131, C1, C52, C76, C79, C82, C98, C115, C120, C142, C160, C216, C218
B company, C company, British Standards Institution [7], Coe [13], Eloff and Eloff [19], Hunter [30], IT Governance Institute [33], Saint-Germain [55], Stephenson [61], Thomson and Von Solms [65], Von Solms [72], Wilson [78], Walters [75]
Whether dedicated personnel responsible for the regular audits on information security exist
B3, B111, B115, B176, C19, C45, C107, C119, C143, C162, C164, C217
British Standards Institution [7], Cerullo and Cerullo [10], Hunter [30], IT Governance Institute [33], Saint-Germain [55], Stephenson [60], Von Solms [72], Walters [75], Wilson [78]
Independent information audit units
Whether promotions and training programs targeted at internal staff on information security exist
A85, A182, A254, A260, B1, B13, B14, B27, B56, B116, B160, C14, C68, C75, C83, C110, C118, C161, C169, C220
A company, B company, C company, British Standards Institution [7], Daveiga and Eloff [16], Eloff and Eloff [19], Hunter [30], IT Governance Institute [33], Stephenson [60], Thomson and Von Solms [65], Von Solms [72], Walters [75], Saint-Germain [55]
Whether control procedures on hardware outsourcing exist
A96, A103, A105, A110, A170, A240, B10, B25, B37, C63 A company, B company, C company, British Standards Institution [7], Coe [13]
Whether evaluations of system outsourcing are conducted
B8, B119, B121, B150, C128, C165, C184
British Standards Institution [7], Chau [12], IT Governance Institute [33], Walters [75]
Whether the contracts are signed for system outsourcing B9, B36, B149, C129, C166, C177, C185 British Standards Institution [7], Chau [12], IT Governance Institute [33], Walters
[75]
Control of outsourced operations
Whether relevant control procedures regarding system outsourcing exist
A9, A12, A19, A72, A84, A104, A176, B103, B128, C51, C62, C211
A company, B company, British Standards Institution [7], Coe [13], IT Governance Institute [33], Marks [43], Walters [75]
Page 35 of 44
Accep
ted
Man
uscr
ipt
Table 3. Backgrounds of participating experts
Group Type No. of people Positions
Average years of service
Senior Auditors * 4 Audit 6 Audit Specialists * 2 14
Manager, MIS * 1 Assistant Manager, MIS * 3
Experts within companies IT 5
Deputy Project Manager, MIS * 1 11
Computer Audit, Manager * 1 Computer Audit, Assistant Manager * 1 Computer Audit, Assistant VP * 1 Audit, Manager * 1
Professional firms 5
Audit, Director * 1
6 Experts outside companies
ERP consultants 2 Consultants * 2 7
Page 36 of 44
Accep
ted
Man
uscr
ipt
Table 4. Questionnaire analysis Types Groups
Dimension No. Control items
CVR, CPA firm
CVR, MIS
CVR, Audit
CVR, ERP
consultant
CVR, all
experts
Screen results
CVR, external experts
CVR, internal experts
Perception difference between groups
1 Whether clear definitions of the responsibilities of maintenance personnel in the MIS department exist 1.00 0.60 1.00 1.00 0.89 Yes 1.00 0.82 No
2 Whether application procedures for the system accounts (authorization) exist 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
3 Whether accounts are cancelled after employees leave 0.60 0.60 1.00 1.00 0.78 Yes 0.71 0.82 No 4 Whether user authorization is constantly reviewed 1.00 0.20 1.00 0.00 0.67 Yes 0.71 0.64 No
Definition of functions and responsibilities of
data processing department
5 Whether a dedicated team responsible for the maintenance of the hardware and software of the system exists -0.20 1.00 0.67 1.00 0.56 No 0.14 0.82 Yes
1 Whether application procedures are present for requests to modify system programs 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
2 Whether modification specifications are confirmed by the MIS department and the department that submits such requests 1.00 1.00 0.67 1.00 0.89 Yes 1.00 0.82 No
3 Whether SA and SD program documents relevant to the modifications exist 0.60 1.00 1.00 0.00 0.78 Yes 0.43 1.00 Yes
4 Whether independent environments for development and tests exist 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
5 Whether relevant test documents and records on program developments are present 0.20 0.60 0.67 0.00 0.44 No 0.14 0.64 Yes
6 Whether updated (newly added) programs are assessed by users 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
System development and control over
program modifications
7 Whether relevant control measures for changes in system flows are present 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
1 Whether coding management is executed on the documents in relation to program modifications (updates) 0.60 0.60 0.00 0.00 0.33 No 0.43 0.27 No
2 Whether documents are updated and modified by version after the modifications (additions) of programs 1.00 1.00 1.00 0.00 0.89 Yes 0.71 1.00 No
3 Whether dedicated personnel safeguarding the documents in relation to the systems are present -0.20 1.00 0.67 -1.00 0.33 No -0.43 0.82 Yes
Control over the compilation of system
documents
4 Whether only certain personnel can access (modify) the documents in relation to the system programs or the original library 0.20 0.60 1.00 0.00 0.56 No 0.14 0.82 Yes
1 Whether password controls exist 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
2 Whether different access authorizations pursuant to the nature of users exist 1.00 1.00 1.00 1.00 1.00 Yes 1.00 1.00 No
Access control of programs and data
3 Whether the transfer of external data into the system has undergone verification by relevant programs 1.00 1.00 1.00 0.00 0.89 Yes 0.71 1.00 No
Page 37 of 44
Accep
ted
Man
uscr
ipt
Types Groups
Dimension No. Control items
CVR, CPA firm
CVR, MIS
CVR, Audit
CVR, ERP
consultant
CVR, all
experts
Screen results
CVR, external experts
CVR, internal experts
Perception difference between groups
4 Whether control over the remote access to the system mainframes exists 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
5 Whether dedicated personnel responsible for the maintenance of the system databases are present 1.00 1.00 0.67 1.00 0.89 Yes 1.00 0.82 No
1 Whether original documents for input data exist 1.00 0.60 1.00 0.00 0.78 Yes 0.71 0.82 No
2 Whether numbering of the documents generated by the system is present 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
3 Whether verification procedures for the data input/output interface exist 0.60 0.60 1.00 0.00 0.67 Yes 0.43 0.82 Yes
4 Whether appropriate control measures for confidential output data exist -0.20 1.00 1.00 1.00 0.67 Yes 0.14 1.00 Yes
Control of data inputs and outputs
5 Whether records on any changes in data additions (modifications) exist 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
1 Whether relevant flows exist to manage the changes in data modification 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
2 Whether data are regularly backed up 0.20 1.00 1.00 1.00 0.78 Yes 0.43 1.00 Yes Control of data
processing 3 Whether backup data are supported by another location 0.20 0.60 1.00 1.00 0.67 Yes 0.43 0.82 Yes 1 Whether information equipment is listed and managed -0.60 0.60 0.67 0.00 0.22 No -0.43 0.64 Yes 2 Whether information equipment is protected with security measures 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No 3 Whether access control over facility rooms exists 0.20 1.00 1.00 1.00 0.78 Yes 0.43 1.00 Yes 4 Whether facility rooms are protected with security measures -0.20 1.00 1.00 1.00 0.67 Yes 0.14 1.00 Yes
Security control of files and equipment
5 Whether control procedures exist to destroy backup data -0.20 0.60 1.00 1.00 0.56 Yes 0.14 0.82 Yes
1 Whether dedicated personnel responsible for the maintenance of software updates are present 0.20 1.00 0.33 0.00 0.44 No 0.14 0.64 Yes
2 Whether regular inspections of hardware daily logs are conducted -0.20 1.00 0.67 1.00 0.56 No 0.14 0.82 Yes 3 Whether the software and hardware are regularly maintained -0.20 1.00 0.33 1.00 0.44 No 0.14 0.64 Yes
4 Whether records to note the maintenance of and changes in hardware and software are present -0.60 1.00 0.67 1.00 0.44 No -0.14 0.82 Yes
Control over the procurement, use, and
maintenance of hardware and system
software 5 Whether the system software is legal 0.20 1.00 1.00 1.00 0.78 Yes 0.43 1.00 Yes
1 Whether regular tests on system recovery procedures in the face of disaster are conducted 0.20 1.00 0.67 1.00 0.67 Yes 0.43 0.82 Yes
2 Whether procedures to report disasters exist -0.60 1.00 0.67 1.00 0.44 No -0.14 0.82 Yes
System recovery plans/systems and control of testing
programs 3 Whether relevant maintenance records and documents exist in case of abnormal situations 0.20 1.00 1.00 0.00 0.67 Yes 0.14 1.00 Yes
Page 38 of 44
Accep
ted
Man
uscr
ipt
Types Groups
Dimension No. Control items
CVR, CPA firm
CVR, MIS
CVR, Audit
CVR, ERP
consultant
CVR, all
experts
Screen results
CVR, external experts
CVR, internal experts
Perception difference between groups
1 Whether dedicated personnel responsible for reporting procedures exist 0.20 1.00 1.00 1.00 0.78 Yes 0.43 1.00 Yes
2 Whether reports are pursuant to the regulations 0.60 1.00 1.00 1.00 0.89 Yes 0.71 1.00 No
Control over the processes of
information disclosure on the assigned
websites 3 Whether backups of the reporting data exist 0.20 1.00 0.67 1.00 0.67 Yes 0.43 0.82 Yes
1 Whether system security planning exists 0.20 1.00 0.67 0.00 0.56 No 0.14 0.82 Yes
2 Whether dedicated personnel responsible for regular audits on information security are present 0.60 0.60 1.00 1.00 0.78 Yes 0.71 0.82 No Independent
information audit units 3 Whether promotions and training programs targeted at internal staff
on information security exist -0.20 0.60 0.67 0.00 0.33 No -0.14 0.64 Yes
1 Whether relevant control procedures regarding system outsourcing exist 0.60 0.60 0.67 1.00 0.67 Yes 0.71 0.64 No
2 Whether evaluations of system outsourcing are present 0.20 0.60 0.67 1.00 0.56 No 0.43 0.64 Yes Control of outsourced
operations 3 Whether contracts are signed for system outsourcing 0.60 0.60 1.00 1.00 0.78 Yes 0.71 0.82 No
Page 39 of 44
Accep
ted
Man
uscr
ipt
Table 5. Modified internal control framework Dimension Control Items
Whether clear definitions of the responsibilities of maintenance personnel in the MIS department exist Whether application procedures exist for system accounts (authorization) Whether accounts are cancelled after employees leave
Definition of functions and responsibilities of data processing department
Whether user authorization is constantly reviewed Whether application procedures exist for requests to modify system programs Whether modification specifications are confirmed by the MIS department and the department that submits such requests Whether SA and SD program documents relevant to the modifications exist Whether independent environments for development and tests exist Whether updated (newly added) programs are assessed by users
System development and control over program modifications
Whether relevant control measures for changes in system flows exist Control over the compilation of system documents
Whether the documents are updated and modified by version after the modifications (additions) of programs
Whether password controls exist Whether different access authorizations pursuant to the nature of users exist Whether the transfer of external data into the system has undergone verification by relevant programs Whether control over the remote access to the system mainframes exists
Access control of programs and data
Whether dedicated personnel responsible for the maintenance of the system databases exist Whether original documents for input data are present Whether numbering of the documents generated by the system is present Whether verification procedures for the data input/output interface exist Whether appropriate control measures for confidential output data exist
Control of data inputs and outputs
Whether records for any changes in data additions (modifications) exist Whether relevant flows exist to manage the changes in data modification Whether data are regularly backed up Control of data
processing Whether backup data are supported by another location Whether information equipment is protected with security measures Whether access control over facility rooms is present Whether facility rooms are protected with security measures
Security control of files and equipment
Whether control procedures to destroy backup data exist
Control over the procurement, use, and maintenance of hardware and system software
Whether the system software is legal
Whether regular tests on system recovery procedures in the face of disaster are conducted System recovery plans/systems and control of testing programs Whether relevant maintenance records and documents exist in case of abnormal situations
Whether dedicated personnel responsible for reporting procedures are present Whether reports are pursuant to the regulations
Control over the processes of information disclosure on the assigned websites
Whether backups of the reporting data exist
Independent information audit units Whether dedicated personnel responsible for regular audits on information security exist
Whether relevant control procedures regarding system outsourcing exist Control of outsourced operations Whether contracts are signed for system outsourcing
Page 40 of 44
Accep
ted
Man
uscr
ipt
Table 6. Background of the interviewees Case Study
Function
Title
Interviewee
Experience
Audit room Audit supervisor Director Chen Six years in the audit department of the company; eight
years of audit experience Company MIS Assistant
manager Assistant Manager Lin
More than four years of experience in the maintenance and introduction of the ERP system utilized by the company
Reporting accounting
firm
Information risk management and services
Manager Manager Li More than six years of experience in computer audit; served more than 200 companies
Page 41 of 44
Accep
ted
Man
uscr
ipt
Table 7. Appropriateness and importance of control items Appropriateness Importance Audit dimensions Control items Yes No High Medium Low
Whether clear definitions of the responsibilities of maintenance personnel in the MIS department exist
☆◎ ☆◎
Whether application procedures for system accounts (authorization) exist ☆◎ ☆◎
Whether accounts are cancelled after employees leave ☆◎ ☆◎
Definition of functions and
responsibilities of data processing
department
Whether user authorization is constantly reviewed ☆◎ ☆◎ Whether application procedures for requests to modify system programs exist ☆◎ ☆◎
Whether modification specifications are confirmed by the MIS department and the department that submits such requests
☆◎ ☆◎
Whether SA and SD program documents relevant to the modifications exist ☆◎ ◎ ☆
Whether independent environments for development and tests exist ☆◎ ◎ ☆
Whether updated (newly added) programs are assessed by users ☆◎ ☆◎
System development and
control over program
modifications
Whether independent environments for development and tests exist ☆◎ ☆ ◎
Control over the compilation of
system documents
Whether the documents are updated and modified by version after the modifications (additions) of programs
☆◎ ☆◎
Whether password controls exist ☆◎ ☆◎ Whether different access authorizations pursuant to the nature of users are present ☆◎ ☆◎
Whether the transfer of external data into the system has undergone verification by relevant programs
☆◎ ☆◎
Whether control over the remote access to the system mainframes exists ☆◎ ☆ ◎
Access control of programs and data
Whether dedicated personnel responsible for the maintenance of the system databases exist ☆◎ ◎ ☆
Whether original documents for input data are available ☆◎ ☆ ◎
Whether numbering of the documents generated by the system is available ☆◎ ☆◎ Control of data
inputs and outputs Whether records for changes in data additions (modifications) are available ☆◎ ☆◎
Whether relevant flows to manage the changes in data modification exist ☆◎ ☆◎
Whether data are regularly backed up ☆◎ ☆◎ Control of data processing
Whether backup data are supported by another location ☆◎ ☆ ◎
Whether information equipment is protected with security measures ☆◎ ☆◎
Whether access control over facility rooms exists ☆◎ ☆◎ Whether the facility rooms are protected with security measures ☆◎ ☆ ◎
Security control of files and equipment
Whether control procedures are available to destroy backup data ☆◎ ☆ ◎
Control over the procurement, use,
and maintenance of hardware and
software systems
Whether the system software is legal ☆◎ ☆◎
Page 42 of 44
Accep
ted
Man
uscr
ipt
Appropriateness Importance Audit dimensions Control items Yes No High Medium LowWhether regular tests are conducted for system recovery procedures in the face of disaster ☆◎ ◎ ☆ System recovery
plans/systems and control of testing
programs
Whether relevant maintenance records and documents are available in case of abnormal situations
☆◎ ☆◎
Whether dedicated personnel responsible for reporting procedures exist ☆◎ ☆◎
Whether reports are pursuant to the regulations ☆◎ ☆◎
Control over the processes of information
disclosure on the assigned websites Whether backups of the reporting data exist ☆◎ ☆◎
Independent information audit
units
Whether dedicated personnel responsible for regular audits on information security exist ☆◎ ☆◎
Whether relevant control procedures regarding system outsourcing are available ☆◎ ☆◎ Control of
outsourced operations Whether contracts are signed for system
outsourcing ☆◎ ◎ ☆
☆Director Chen; ◎Assistant Manager Lin
Page 43 of 44
Accep
ted
Man
uscr
ipt
Prototype Construction
Research Question and Purpose
Theoretical
Philosophies
Theories
Principles
Concepts
Methodological
Knowledge Claims
Interpretations
Transformations
Data Gathering
Comparison and
Revision
Case StudyLiterature ReviewExpert Questionnaire
Figure 1. Research flow
Page 44 of 44
Accep
ted
Man
uscr
ipt
Authors
Jing Fan
Management School, Shanghai Jiaotong University, China International Business School, Beijing Foreign Studies University, China [email protected]
Pengzhu Zhang
Management School, Shanghai Jiaotong University, China [email protected]
David C. Yen
School of Economics and Business, SUNY College at Oneonta, USA [email protected]