Information Technology Control Research Articles

Improving IT Control Compliance using Artificial Intelligence

In an era where digital transformations are not just trends but necessities, the reliability and security of information systems have become paramount. The complexity of modern IT environments, coupled with increasing regulatory demands, poses significant challenges for organizations worldwide. IT control compliance, particularly in the context of Sarbanes-Oxley Act (SOX) IT General Controls (ITGC), requires rigorous and continuous monitoring to ensure that financial reporting and data integrity are maintained. However, traditional compliance efforts are often hampered by manual processes that are both time-consuming and error-prone. These methods struggle to keep pace with the dynamic nature of IT advancements and the evolving landscape of cyber threats. This gap not only increases the risk of non-compliance but also places a heavy burden on the resources of the organization. With the advancement of Artificial Intelligence (AI), there is promising potential to revolutionize these processes. AI technologies, through their capability to analyze large volumes of data and recognize patterns quickly, can automate complex tasks, enhance decision-making, and significantly improve the efficiency and effectiveness of compliance systems. By integrating AI into IT control frameworks, organizations can address the perennial challenges of compliance more effectively. AI-driven systems can reduce human error, streamline control processes, and ensure more robust governance and risk management frameworks. This paper explores the integration of AI technologies into IT control frameworks. It discusses how leveraging AI not only aids in maintaining compliance with existing regulations but also enhances the organization’s ability to adapt to new regulatory changes swiftly, thus safeguarding against compliance risks and fostering a culture of continuous improvement in governance practices.

Toward a Level Playing Field: An Analysis of the Language and Transparency of IT Risk

ABSTRACT We employ both manual and automated content analysis to update an existing dictionary (Boritz, Hayes, and Lim 2013) used to classify types of information technology weakness (ITW). Through analysis of auditors’ reports on internal control filed under Section 404 of the Sarbanes-Oxley Act from 2011 through 2020, we provide a robust tool for textual analytics. Additionally, we apply OpenAI’s large-language model neural networks for classification as a comparison point. We expand identification of ITW categories such as Design, Security, and Outsourcing and identify Governance as a critical new category in auditor reporting. We further expand the dictionary, capturing categories of IT risk found within current IT control frameworks (e.g., COBIT and AICPA TSCs), which we compare with content of auditor reporting. Evidence suggests stakeholders are subject to significant information asymmetry in assessing and reporting IT risk. We provide direction for future IT governance and improve application of advanced textual analysis.

Minor and serious cyberloafing in the workplace: antecedents and effects on job satisfaction

ABSTRACT The duality of cyberloafing is a topic that has always been debated. Considering this, the purpose of this paper is to classify cyberloafing and explore the antecedents of different degrees of cyberloafing and their different effects on job satisfaction. Using the Technology-Organisation-Environment Framework and the conservation of resources theory, this paper proposes a research model to investigate the mediation mechanism of cyberloafing. Using the partial least square method (PLS) SEM method to analyze 294 employees’ data, the results show that: (1) Work-related enterprise social media usage only negatively affects serious cyberloafing, while social-related enterprise social media usage only positively affects minor cyberloafing. (2) The impact of perceived IT control policy on minor cyberloafing was not statistically significant, while negatively affected serious cyberloafing. In terms of environment factors, the study shows that prescriptive norms and work overload have opposite effects on cyberloafing, with work overload having no significant effect on minor cyberloafing. Significantly, policy satisfaction plays a significant moderating role between environment factors and cyberloafing. (3) Minor cyberloafing positively affects job satisfaction, while serious cyberloafing negatively affects job satisfaction. Our findings provide instrumental insights into how enterprise managers manage employees to improve employees’ job satisfaction, control different degrees of cyberloafing.

CONTINUOUSLY CONTROLLABLE ARTIFICIAL DETRUSOR SYSTEM AND ITS CONTROL STRATEGY

In this paper, a new artificial detrusor system is proposed to achieve continuous control over the urination process and realize the normal voiding process of human (NVPH). The system is powered by a wireless power transfer (WPT) module, controlled by a control module and actuated by a shape memory alloy (SMA) spring. The design method of the SMA springs is proposed. Two control strategies are proposed to achieve NVPH. The first strategy is an open-loop control strategy based on the result of finite element analysis (FEM) simulation results and calculation of the derived system governing equations. The second strategy is a closed-loop control strategy based on the collection of feedback data and algorithmic processing. Both strategies are verified by experiments. The results show that the proposed system is feasible and both strategies can achieve NVPH. It can provide reference and guidance for the design of artificial detrusor system and formulation of control strategies.

Moving towards Reliable and Fault-Tolerant Smart Grid Systems

Smart Grid is significantly being initiated in all fields due to their extensive use of IT, monitoring, protection, and automation control. Safety, integrity, privacy and dependability of data with long-term sustainability using green sources of energy. Ensuring perfection in their implementation is a herculean task amidst varying environments. This paper sketches and highlights about the scope of implementing reliable, secure, error-controlled fault-tolerant techniques in Electric Grid-systems. Thus, the paper talks about the sub-units of Smart Grid systems. The discussions on opportunities due to nanotechnology and incorporation of FPGAs are part of this paper. Hence, the design of this paper is well thought-out as the critical focal junction in enhancing the future in design of Smart Grid systems.

IT GOVERNANCE CAPABILITY LEVEL IDENTIFICATION OF COBIT 2019 AT THE RSUP PROF. DR. R.D. KANDOU, MANADO, NORTH SULAWESI

In terms of technology, governance can be implemented effectively and efficiently if it can provide functionality or value that applies to businesses of all sizes and types. IT governance design can help you explore design factors that influence governance and includes a workflow for planning a governance system for your enterprise. Control Objectives for Information and Related Technologies (COBIT) is a framework created by ISACA that contains guidance or guidance documents that may be useful to auditors, users, and management. COBIT is an internationally recognized and applied best practice for information, information technology, and organizational risk which can be used to define information technology to maximize IT control. As it is required to improve IT service, the design of IT governance was conducted at the Central Unit Hospital (RSUP) Prof. Kandou, Manado, North Sulawesi, using the latest version of COBIT, COBIT 2019. The following is an explanation of the priorities of Malayang Hospital. Governance below 25 points is proficiency level 1. The results shows that there are five objectives that becomes main priority (reaching level 4): EDM03, APO12, BAI02, BAI03 and BAI05. These objectives are the ones recommended to be audited. The second tier that may also suggested to be audited are objectives with capability level 3: APO07, APO08, BAI01, BAI07, DSS01, DSS02 and MEA01.Keywords; COBIT 2019, IT Governance, RSUP Prof. Kandou Malalayang

COMPUTATIONAL MODEL OF A FRACTIONAL-ORDER CHEMICAL REACTOR SYSTEM AND ITS CONTROL USING ADAPTIVE SLIDING MODE CONTROL

Dynamics of chemical reactor systems are found with highly nonlinear behavior. Computational modeling of a fractional-order chemical reactor system and investigating nonlinear dynamical changes and its control are the main focus of this research work. Chaos theory is a blooming fertile field in recent years, which is used widely to quantify nonlinear behaviors such as quasi-oscillations, bi-stability and bifurcation. The work starts from deriving state-space model of the system with first-order differential equations. There are six equilibrium points and the Jacobian matrix is derived for investigating the stability of the equilibrium points. Eigenvalues of each equilibrium point are calculated. Based on the sign of the real part of the eigenvalues and the existence of imaginary part, we found two equilibrium points behave as saddle spirals and the remaining four equilibrium points are saddle nodes. The stability of the system for different parameter values is investigated and presented. The influence of parameters in the system dynamics is discussed and significant parameter values are highlighted for further study. We considered Caputo’s definition for formulating the fractional-order (FO) model of the system based on the advantages highlighted in various literatures. The stable and unstable regions are portrayed with parameter variations. The results clarified that the analysis can be refined using fractional-order treatment of chaotic systems. We proceeded with our investigation towards obtaining different oscillations, particularly chaotic oscillations. The challenges lie in finding the proper fractional order to handle the system. We showed the bifurcation diagram for a range of fractional-order values and clarified the transitions from periodic oscillations to chaotic behavior and period-doubling bifurcations. The phase portraits are presented to show the limit cycle oscillations for fractional-order 0.95, period-doubling during 0.98, and chaotic oscillations for higher values. We proceeded with our investigation with fractional-order as 0.99. Bifurcation plots for parameter variation are obtained. Chaotic regions, periodic oscillations, period-halving and period-doubling are observed and the influences are discussed. We emphasize the intricate properties which are not addressed during the integer-order treatment of the system and nail the importance of fractional-order treatment. An adaptive sliding mode (ASM) controller is derived and implemented to control the system precisely. The effectiveness is shown by providing simulation results of the system with parameter estimation and controlled state time history plots. The work can be extended to verify the simulated results with equivalent electronic circuits.

ITS and Traffic Control System

ITS and Traffic Control System

Effects of Internal Control Weaknesses, Financial Independence and Size on Quality of Financial Statements in the Tanzanian Local Government Authorities

This study examines the relationship between internal control weaknesses (ICWs), independence, and size on the quality of financial statements of local government authorities (LGAs) in Tanzania. The analysis is based on data from a large sample of LGAs’ financial statements for four years from FY 2010/11 to FY 2013/14. The study employed logistic regression to examine whether ICWs (fraud prevention plan, risk management, accounting system, and IT controls), financial independence, and size of LGAs determine financial statement errors/restatements in the LGAs. The study shows that large and financially dependent LGAs with accounting system ICWs are more likely to have lower financial statement quality. However, other ICWs (IT controls, fraud prevention, and risk management) results were insignificant. These results may be attributed to the level of compliance and implementation of the parent ministry’s directives among LGAs. Therefore, practitioners and policymakers should ensure that LGAs not only adopt directives/policies but also fully comply and implement with their requirements as well as build financial management capacity to increase LGAs’ financial independence.

How and when does hospitality employees’ core beliefs challenge foster their proactive coping for technostress?: Examining the roles of promotion focus, job insecurity, and technostress

Disruptions to where hospitality work is performed has been caused by the COVID-19 pandemic. The COVID-19 spread urged hospitality organizations to apply digital technologies for undertaking work from home. Nevertheless, little is understood about how hospitality employees cope with stress linked with the use of digital technologies. The aim of this study is to examine how hospitality employees' core beliefs challenge can foster their proactive coping for technostress in the forms of positive reinterpretation and information technology (IT) control. The data were obtained from 427 employees in 28 hotels that applied digital technologies during the COVID-19 pandemic. The data were processed through multilevel structural equation modeling (MSEM). The results revealed that hospitality employees' core beliefs challenge was positively associated with positive reinterpretation and IT control. Promotion focus served as a mediation mechanism for such positive associations. The results provided support for the role of job insecurity as a moderator to attenuate the positive effects of promotion focus on both positive reinterpretation and IT control. While technostress enhanced the positive effect of promotion focus on positive reinterpretation, it demonstrated a non-significant moderating effect on the positive association of promotion focus with IT control. The findings advance the understanding of the roles of core beliefs challenge and promotion focus in leveraging proactive coping for technostress, as well as provide practical implications for hospitality managers to foster employees’ proactive coping for technostress while employees are engaging with digital technologies to work from home during a crisis such as COVID-19 pandemic.

Leveraging COBIT 2019 to Implement IT Governance in SME Context: A Case Study of Higher Education in Campus A

Achieving business and Information Technology (IT) alignment has become the aspiration of most organizations nowadays. Small and Medium Enterprises (SMEs) are not exempt as they also thrive to survive in a competitive market using IT. However, implementing all IT control and management components will be excessive, with a lack of justifiable cost-benefit for SMEs. A tailored governance system based on the specificities of SMEs is necessitated to help the organization to focus on its main objectives and strategies. By leveraging COBIT 2019 design toolkit, the researchers support Campus A in establishing healthy governance and IT management. Both qualitative and quantitative approaches are applied to select relevant governance/ management objectives. The toolkit has been designed with a semi-automated quantitative approach in which users will get scoring for each objective based on the associated value inputted for each design factor. Through a series of discussions with the management team, it concludes the governance design and recommends several improvements to increase its capability level, from the current level of 1.05 (initial stage) to the desired level of 2.33 (repeatable stage). Then, since the toolkit is practical to use, it is also rigid by design with its predefined and protected formula. To some extent, the resulting score or importance level of certain governance/management objectives is questionable and lacks justification. Flags or indicators to ‘should-have’ governance/management objectives, regardless of the organization’s size and type, will be useful to prevent the omission of essential objectives.

Information Technology Control and Fraud Risk Detection in Deposit Money Banks (DMBs) in Nigeria

The banking sector has been considered as a fulcrum for economic growth in any country because of the intermediary role the banks play in collecting funds at interest from the surplus household and giving it out at a markup to the deficit household. The smooth operations of banks however had been faced with the risk of fraud which has led to the loss of a considerable amount of money running into billions of naira annually. This challenge had brought a bigger problem of how to properly manage the risk of fraud and boast customers' confidence in the banking sector in Nigeria and globally. Information Technology Control had been perceived to influence fraud risk management. Therefore, this study reviewed the effect of Information Technology Control on Fraud Risk Detection in Deposit Money Banks (DMBs) in Nigeria. The study employed the survey research design with a study population of 1,030 which comprised staff in the Internal Control, Internal Audit and Information Technology departments of all Deposit Money Banks (DMBs) in Nigeria as contained on the CBN website. The 13 listed banks were used as samples for the study and the Taro Yamane formula was used to obtain a sample size of 288. The purposive sampling technique was subsequently used in administering the questionnaire to the respondents. The reliability of Cronbach-alpha coefficients ranged from 0.864 to 0.952. Descriptive and inferential statistics were used to analyze the data. Similarly, the study showed that IT control has a significant effect on fraud risk detection in Deposit Money Banks (DMBs) in Nigeria with F287=30.690, Df = 3 & 265, adj. R2 =0.209, p-value=0.000< 0.05. The study, therefore, concluded that IT Controls have a significant effect on fraud risk detection in DMBs in Nigeria. The study, therefore, recommended that Banks should give priority to the implementation of information technology controls across all their digital channels or platforms as this will help to promote adequate fraud risk detection on the platforms and boost customers' confidence in the banking sector.

Information Technology Control and Fraud Risk Assessment in Deposit Money Banks (DMBs) in Nigeria

The banking sector has been considered a fulcrum for economic growth in any country because of the intermediary role the banks play in collecting funds from the surplus household and giving it out at a markup to the deficit household. The operations of banks however had been faced with the risk of fraud which has led to the loss of a considerable amount of money running into billions of naira annually. Therefore, this study reviewed the effect of Information Technology Control on Fraud Risk Management in Deposit Money Banks (DMBs) in Nigeria. The study employed the survey research design with a study population of 1,030. The 13 listed banks were used as samples for the study and the Taro Yamane formula was used to obtain a sample size of 288. The purposive sampling technique was subsequently used in administering the questionnaire to the respondents. The Cronbach-alpha reliability test coefficients ranged from 0.864 to 0.952. Descriptive and inferential statistics were used to analyze the data. The results showed that IT control has a significant effect on fraud risk assessment in Deposit Money Banks (DMBs) in Nigeria with F287=51.818, Df = 3 & 264, adj. R2 =0.366, p-value=0.000< 0.05. The study concluded that IT Controls have a significant effect on fraud risk assessment in DMBs in Nigeria. The study, therefore, recommended that Banks should give priority to the implementation of information technology controls across all their digital channels or platforms as this will help to promote adequate fraud risk assessment and prevention on the platforms.

Rethinking IT governance: Designing a framework for mitigating risk and fostering internal control in a DevOps environment

An increasing amount of companies is transforming their IT departments towards cross-functional teams which are responsible for both development and operation of software and use automation to speed up their delivery process. This novel approach, which is commonly known as “DevOps”, promises many benefits such as increased speed and frequency of deployment. However, companies using DevOps are often struggling with demonstrating control of their software delivery processes to IT auditing parties, due to the decentralized decision-making structures and high degree of automation in DevOps teams. The research at hand presents a framework which aims to provide guidance to organizations in mitigating and governing risks in IT teams and departments that make use of the DevOps paradigm. We have adopted a design science research approach, building on a literature review and semi-structured interviews with seventeen employees from nine Dutch companies that are in different stages of their DevOps transition. The results suggest that two main factors which influence how departments design their DevOps environment are risk appetite and the DevOps maturity. We furthermore find that companies in practice often use a mixture of traditional, manual IT controls and the automated controls suggested in literature. Based on these insights, a situational control framework is designed which suggests suitable risk mitigation practices.

Electricity load forecasting in smart grid using web based geographic information systems (web GIS)

India is a developing nation and due to emerging new infrastructure in various sectors, the demand of electricity is always higher than generation. Smart Grid is an automated system which includes automation of existing electrical infrastructure into modern and controlled system with the help of IT control, Internet of Things (IoT) systems that enables real-time monitoring and control of bi-directional power flows and information flows from generation to consumption. Electricity demand is a major issue in India and with the help of these technologies the demand of electricity can be managed in reliable and economic mode. Consumers can monitor real-time energy consumption of their energy use, and this can be reflected in supply, demand and generation of energy. State utilities send their billing data to Electricity Regulatory Commission every year where billing data analysis is carried and new tariff of electricity is decided by the Regulatory Commission to all Consumers of Electricity in the State. Web based Geographical Information System (GIS) can help by mapping all electrical infrastructures on a digital map including their complete details and all consumers can be mapped. Web based GIS can help to state utilities as a tool for plan and manage their all assets by logging into the system from anywhere. Web based GIS can help to manage area wise Load Scheduling by integrating Road, Buildings, Lands, Transmission Stations, Transmission Lines, Generation Stations and consumer's detail. This system can help for Load Forecasting, Decision Making and Electricity Demand Management for State Utilities, Regulatory Body and Policy Makers towards making effective approach in Energy Conservation and Efficiency.

Konsep Pengendalian Intern Untuk Keamanan Sistem Informasi

The purpose of this article is to determine the concepts of good control to be applied in a corporate organizational environment. Based on several concepts offered, the control based on Sarbanes-Oxley and Internal Control (COSO Framwork) is still highly recommended by experts. This is because the control concept of this model has adopted all existing aspects of protection, both physical and non-physical. However, security protection for information systems should ideally be focused on access control and IT control. There are three groups of individuals who differ in their normal ability to access hardware, namely; 1) Personal computer systems, which often pose a potential bottleneck because they often have special access to important data and programs. 2) Users, they have narrower access, but they still have the opportunity to commit embezzlement. 3) The intruders, they do not have access at all, but they are often people who have the ability to interfere with company information systems.

The association between human resource investment in IT controls over financial reporting and investment efficiency

This study investigates the association between human resource investment in information technology (IT) controls over financial reporting and its investment efficiency. To conduct the analysis, it uses novel hand-collected data on the number of IT control personnel. In particular, it uses the ratio of (1) the number of IT control personnel, (2) the number of IT control personnel who are certified public accountants to the total number of employees in a firm, and (3) the natural logarithm of average working experience of IT control personnel in months as a proxy for human resource investment in IT controls. This study finds that such investment is negatively associated with the firm's abnormal investment, suggesting that investing in IT control personnel enhances a firm's investment efficiency. Furthermore, not only quantitative but also qualitative investment in IT control personnel improves investment efficiency. We also find that the association between human resource investment in IT controls and a firm's investment efficiency is more pronounced for firms with lower financial reporting quality and information environment. The results of this study provide useful implications for management, regulators, and market participants, as they demonstrate the positive role of investment in IT control personnel on the firm's internal decision.

Value co-creation in online healthcare communities

The extant research sheds light on the vital role of co-creation in online healthcare communities (OHCs) as nascent peer-to-peer co-creation platforms in public health and wellbeing. However, more investigation of the underlying factors affecting patient value co-creation in OHCs is required. This study relies on the socio-technical theory to identify the social and technical factors that impact healthcare users' intention to co-create value. Analysis of survey data gathered from users of Top 10 healthcare-based pages on Facebook indicated that both social and technical factors are salient in the prediction of value co-creation in OHCs. More specifically, social support and its antecedents (i.e., perceived privacy risk and social media interactivity), as well as government IT infrastructures and perceived control of information, are found to be the critical antecedents of value co-creation intention. However, social support emerged as the most potent predictor of value co-creation relative to government IT infrastructures and control of information. The theoretical and practical contributions of the findings are discussed.

The Value of Auditors’ Cross-Client Learning in Preventing Data Breaches

I examine whether auditors generalize their knowledge across different clients (cross-client learning) to prevent data breaches. I focus on two audit mistakes. One relates directly to data breaches, and the other is severe restatements (indirect experiences strongly related to auditors’ reputational incentives), to gauge the extent to which auditors generalize their mistakes across clients to deter data breaches. I find that cross-client learning is stronger when learning experiences are similar, when these experiences directly relate to monitoring technologies (i.e., when auditors inspect a firm’s internal controls in integrated audits, including IT controls), when mistakes are more severe, and when clients are more receptive (i.e., in the presence of increased reputational risks and good internal controls). I also conduct interviews and an anonymous survey to collect information not captured by the empirical analyses. Collectively, my paper uses cross-client learning to explain whether and how third-party monitors can deter data breaches and quantifies the economic significance of this learning.

Holistic thermal-aware workload management and infrastructure control for heterogeneous data centers using machine learning

Two key contributors to the energy expenditure in data centers are information technology (IT) equipment and cooling infrastructures. The standard practice of data centers lacks a tight correlation between these two entities, resulting in considerable power wastage. Considering the cooling cost of different locations inside a data center (cooling heterogeneity) and various cooling capabilities of servers (server heterogeneity) has significant potential for saving power, yet has not been studied thoroughly in the literature. There is a necessity for state-of-the-art approaches to integrate the control of IT and cooling units. Moreover, the literature still lacks an accurate and fast thermal model for temperature prediction inside a data center. In this paper, innovative approaches to quantify data center thermal heterogeneities are presented. Using data center thermal models the cost of providing cold air at the front of servers can be (indirectly) calculated, and the capability of servers to be cooled is formulated. Our approach assigns jobs to locations that are efficient to cool (from the perspectives of both servers and cooling units) and tunes cooling unit parameters. The method, called holistic data center infrastructure control (HDIC), has the potential to save a considerable amount of power by exploiting synergies between the workload scheduler and operational parameters of cooling units.