Question

(1) A systems study team should understand three levels of corporate goals: general systems goals, top management systems goals, and operating management systems goals. If you had to select one of these categories of systems goals as the most important to the effective operation of an organization’s information system, which one would you choose? Explain the reasons for your choice.

(2) According to the IIA the ‘Internal auditor should develop and record a plan for each engagement, including the scope , objectives, timing and resource allocation." The same can be said about the EA (external auditor). Compare and contrast engagement planning for the IA and EA. How does the control environment relate to engagement planning? Also what role does SOX have on the control environment and audit planning?

Answer 1

1. Although each of the three have significant differences pertinent to the efficiency of an organization, I would venture to say that top management systems goals are the most important. This is my choice specifically because those in this position are the hub of the organization. They are the heart and the foundation of what makes the organization what it is in which both the general systems goals and operating management systems goals would stem. The top management systems goals would be imposed as the guiding force for the instructions that assist the general systems goals to accomplish contributing principles such as, awareness, concern, commitment, and flexibility; while also implementing various decisions pertaining to the company’s long‐range plan and strategies in which the operating managers systems goals are tasked to follow. In other words, it’s the top management systems goals that enact various regulations, guidelines, goals, and objectives that the organization’s employees will abide by. Ultimately, they’re responsible for ensuring that the strategic plans for future product and services are well‐defined and implemented, and that the operating managers are enforcing such.

2. Compare and contrast engagement planning for the IA and EA.

Generally the following planning steps are generally included in the engagement planning for both the IA and EA:

Understand the context and purpose of the engagement.

Gather information to understand the area or process under review.

Conduct a preliminary assessment of relevant risks.

Form engagement objectives.

Establish engagement scope.

Allocate appropriate and sufficient resources.

Document the plan.

Internal auditor engagement planning includes Operational Efficiency while external auditor enagagement planning includes Accuracy and Validity of Financial Statement

How does the control environment relate to engagement planning?

To identify fraud risks in the area or process under review, internal/external auditors should understand the organization and the larger context in which it operates i.e. size of the organization.

As part of evaluating the control environment, the auditor should assess -

• Whether management's philosophy and operating style promote effective internal control over financial reporting;

Process Issues: Duties not segregated, Poor physical security ,Poor access controls

• Whether sound integrity and ethical values, particularly of top management, are developed and understood; and
• Whether the Board or audit committee understands and exercises oversight responsibility over financial reporting and internal control.

Management Issues: Lack of area expertise, Lack of supervision, History of legal violations

For example, personnel may express awareness of performance pressures or concerns of unrealistic goals that individuals could use to justify fraudulent behavior. To gain insight into the potential pressures, internal auditors should identify the performance goals and measurements (i.e., key performance indicators (KPI's)) and related incentives in the area under review

These controls might affect the other controls the auditor selects for testing and the nature, timing, and extent of procedures the auditor performs on other controls.

Also what role does SOX have on the control environment and audit planning?

They include authorizations, verifications, reconciliations, performance reviews, security of assets and segregation of duties. Testing of internal controls ensure that fraudulent activity or false reporting do not find their way into the financial statements of the company.