Information Technology Control Research Articles

Mitigating risks in managing cloud-based IT controls

Cloud computing (CC) represents a key tool in the race for innovation across industries. However, organisations are facing constraints in implementing and leveraging cloud technology for development purposes due to a lack of skills, knowledge and talent. To address this concern, this study focuses on the impact of CC on IT staff's roles and responsibilities, within cloud user organisations. Accordingly, this study suggests skills required to mitigate the risks in the accountability and responsibility of managing IT controls. The results were empirically verified by senior IT practitioners. The empirical intervention emphasised on people's business skills, in addition to domain knowledge and the mind-set to adapt to the changed environment. The findings of this study offers new insights for scholars and it will help IT decision makers to assess their staff's capabilities to meet their business needs and to plan appropriate selection, training and hiring policies.

Mitigating risks in managing cloud-based IT controls

Mitigating risks in managing cloud-based IT controls

How IT Awareness Impacts IT Control Weaknesses and Firm Performance

How IT Awareness Impacts IT Control Weaknesses and Firm Performance

THE INCREASING ROLE OF IT AUDITORS IN FINANCIAL AUDIT: RISKS AND INTELLIGENT ANSWERS

Financial auditing cannot be imagined without the involvement of IT specialists since business processes are designed to be served by IT components such as ERP systems, online customer-facing applications, databases etc. Financial auditors therefore exposed to IT system and control reliance want to gain reasonable assurance that data and transactions stored in IT systems cannot be modified, access is controlled, and there is no suspicion of any fraud at business organizations. The paper tries to understand the current situation of IT audit involvement in financial auditing, interpret risks that parties face and provide some solutions by use of intelligent applications.

Customs Studies at the Cross Roads

In the current free trade era, Customs is evolving as a professional organization responsible not only for efficient revenue collection but also assigned with twin responsibilities of border protection for enhanced Supply Chain Security and facilitation of Trade by efficient cargo clearance supported by IT enabled systems. This in turn requires a new set of knowledge, skills and behavior requirements for pursuing a career in Customs. Accordingly, the current educational courses in the area of Customs Studies offered by various universities across the world need to be structured and aligned with the latest developments in IT, International Law, Business Management and Border Control. The role of WCO in taking the lead in this initiative is emphasized.

The Impact of Firm Characteristics and IT Governance on IT Material Weaknesses

Accurate and timely reporting of organizational performance is becoming increasingly important and highly regulated. However, organizations face a variety of challenges in seeking to provide accurate and reliable information due to the existence of IT control problems. Hence it is important for end users including auditors and managers to understand how to manage IT material weaknesses (ITMWs). While there is extensive accounting research on general material weaknesses (MWs), ITMWs are under researched. This article identifies key firm characteristics that appear to be related to ITMWs. In addition, the authors suggest that IT governance may help firms mitigate such problems. To gain a deeper understanding of IT governance effects, this article proposes a model which includes an innovative construct, ITGOV, operationalized using secondary data. The authors empirically validate the proposed model based on a data set of 1,112 firms. Their study illustrates the differences between ITMWs and general MWs. These results can also help end users computing by offering insights into better management of ITMWs.

A process model for implementing information systems security governance

Purpose The frequent and increasingly potent cyber-attacks because of lack of an optimal mix of technical as well as non-technical IT controls has led to increased adoption of security governance controls by organizations. The purpose of this paper, thus, is to construct and empirically validate an information security governance (ISG) process model through the plan–do–check–act (PDCA) cycle model of Deming. Design/methodology/approach This descriptive research using an interpretive paradigm follows a qualitative methodology using expert interviews of five respondents working in the ISG domain in United Arab Emirates (UAE) to validate the theoretical model. Findings The findings of this paper suggest the primacy of the PDCA Deming cycle for initiating ISG through a risk-based approach assisted by industry-wide best practices in ISG. Regarding selection of ISG frameworks, respondents preferred to have ISO 27K supported by NIST as the core framework with other relevant ISG frameworks/standards forming the peripheral layer. The implementation focus of the ISG model is on mapping ISO 27K/NIST IT controls relevant IT controls selected from ISG frameworks from a horizontal and vertical perspective. Respondents asserted the automation of measurement and control mechanism through automation to assist in the feedback loop of the PDCA cycle. Originality/value The validated model helps academics and practitioners gain insight into the methodology of the phased implementation of an information systems governance process through the PDCA model, as well as the positioning of ITG and ITG frameworks in ISG. Practitioners can glean valuable insights from the empirical section of the research where experts detail the success factors, the sequential steps and justification of these factors in the ISG implementation process.

The Cost Stickiness of Information Technology Material Weaknesses: An Intertemporal Comparison between IT-Related and Other Material Weaknesses

PCAOB inspections of audit firms help drive audit focus and costs, and with the PCAOB’s emphasis on internal control audit work beginning in 2010, internal control weaknesses (ICW) have become of even greater concern. IT-related material weaknesses have emerged as particularly significant with PCAOB reports in 2008 and 2012 highlighting on-going deficiencies in audit work related to IT controls, and the 2015 brief noting the PCAOB’s intention to maintain focus on audit deficiencies that appear recurring. We explore how the focus on ICW affects audit fees and how the complexity of contemporary enterprise systems results in a persistence of audit fee premiums post-remediation. We conduct a study of audit fee premium differences associated with various categories of material weaknesses in internal controls. Using propensity score matched samples, we provide evidence that the fee premium charged to firms reporting IT-related material weaknesses (ITMW), after remediation, lingers longer than the fee premium imposed on firms reporting non-IT entity-level material weaknesses (NITELMW), or firms reporting account-specific material weaknesses (ASMW). Moreover, we show that the association between audit fee premiums and type of material weakness remediated is strongest for ITMW linked to data processing integrity. Our findings, which are based on more robust contemporary research methods, underscore the importance of distinguishing not only between entity-level material weaknesses and ITMW but also between different types of ITMW as identified in prior data quality research.

Cloud Computing Auditing

Cloud Computing is a new form of IT system and infrastructure outsourcing as an alternative to traditional IT Outsourcing (ITO). Hence, migration to cloud computing is rapidly growing among organizations. Adopting this technology brings numerous positive aspects, although imposing different risks and concerns to organization. An organization which officially deputes its cloud computing services to outside (offshore or inshore) providers and implies that it outsources its functions and process of its IT to external BPO services providers. Therefore, customers of cloud must evaluate and manage the IT infrastructure construction and the organization’s IT control environment of BPO vendors [25]. Since cloud is an internet-based technology, cloud auditing would be very critical and challengeable in such an environment. This paper focuses on practices related to auditing processes, methods, techniques, standards and frameworks in cloud computing environments.

Nonprofessional investor perceptions of the partial remediation of IT and non-IT control weaknesses: An experimental investigation

In this study, we investigate whether nonprofessional investors' judgments about a firm with known and disclosed material weaknesses in internal control as required by the Sarbanes Oxley (SOX) Act of 2002 depend on the remediation strategy used by the firm. Analysis of SOX internal control weakness disclosures reveals that firms (1) often have multiple internal control weaknesses, (2) frequently have a mix of information technology (IT) and non-IT control weaknesses, and (3) invariably fail to remediate all control weaknesses in the period they are identified. We design an experiment to investigate how nonprofessional investors respond to remediation of a subset of disclosed material weaknesses in internal control, when a firm discloses a remediation plan that prioritizes the remediation of an IT (non-IT) internal control weakness leaving a non-IT (IT) weakness unremediated. We apply counterfactual theory to the future oriented remediation setting and find that investors favor a firm remediation strategy that prioritizes the remediation of an IT weakness over a strategy that prioritizes the remediation of a non-IT weakness. We further find that perceived effectiveness of remediation, financial misstatement risk attributed to the unresolved internal control weakness, and management credibility fully mediate the relation between company remediation strategies and investing judgments. These findings should be informative to both auditors and management when confronted with a range of IT and non-IT internal control weaknesses following the initial identification and disclosure of multiple material weaknesses as required by SOX.

Information Technology Audit in Georgia

With the development of information technology to carry out effectively their missions the largest part of a variety of organizations, government agencies and services have become dependent on computer systems. For each of the organization’s activities the IT environment must be properly studied and evaluated in which they perform the basic activities. Therefore, in such environment it is necessary to make the information technology audit of IT systems operating reliability and functionality in order to obtain reasonable assurance. IT governance and information systems audit is imperative for successful governance. This paper with a comprehensive literature review defines information technology audit, investigates how IT audit performs in the public sector of Georgia. Also it provides the thorough explanation of the experiences of the Georgian State Audit Office. The study analyses the challenges of the IT audit and point to future development directions of IT audit in the public sector. Although considerable research exists on IT control and on internal auditing, there is limited study that refers to IT evaluation control activities in the public sector auditing. As such, the findings from this research would generate new conclusion to enrich the existing literature on IT related auditing. The findings also may improve the IT evaluation activities in the Georgian public sector.

EPIDEMIC OF DENGUE IN DEVELOPING COUNTRIES LIKE INDIA AND ITS CONTROL.

17Jul 2017 EPIDEMIC OF DENGUE IN DEVELOPING COUNTRIES LIKE INDIA AND ITS CONTROL. Neena Mishra. Acharya Prafulla Chandra College, New Barrackpore Kolkata-700131.

How IT controls improve the control environment

PurposeThe purpose of this paper is to analyze how Information technology (IT) controls influence the control environment’s components and the internal control system.Design/methodology/approachThis paper aims to highlight how IT controls enable to improve the control environment assessment and implementation.FindingsThe analysis indicates that the implementation of the IT controls (IT organizational controls, IT process controls and IT soft variables controls) provides some indications for managers and auditors, who must implement or assess internal control system. A joint use of the three dimensions of IT control contributes to a better assessment of the individual components of the control environment. IT controls help managers to develop the design of the organizational structure and to identify the key processes to achieve the internal control objectives and to mitigate firm’s risk.Practical implicationsThe examination of three IT control dimensions allows managers to expand their knowledge about these types of controls and change the way they approach technology-based processes and associated risks. This improves the understanding of the key aspects connected to the control environment. The paper provides a list of the relevant activities that affect the three types of IT controls. This is useful for managers to begin to frame the specific controls inside the three dimensions of IT control.Originality/valueThis paper addresses an area of relevance to both practitioners and academics. This analysis focuses on accounting information systems themes and, through the examination of the IT controls, allows a better understanding of the hard and soft elements of the control environment.

Key Issues for the Successful Adoption of Cloud Computing

Cloud Computing constitutes an alternative for organizations who do not intend to invest in in-house IT resources. It offers a service model on the premise that the consumer has at its disposal the means for manipulating information, over the internet, according to its current needs. However, outsourcing IT poses various challenges, such as the effective control of IT, attention to an increasing number of threats posed by the Internet ecosystem and concerns regarding the efficient use of resources. Hence, the uncertainties about the migration to Cloud Computing can have a negative impact on the adoption of this technology. In order to better inform the decision process launched by organizations considering the alternative of Cloud Computing, this study presents a list of key issues compiled from literature that could assist IT managers steering the organization towards the path of adopting Cloud Computing solutions efficiently and securely. In addition, to better understand those issues and rank them in terms of importance, interviews were conducted with IT directors of enterprises that use and provide Cloud services, endowing the list of issues with the views of practitioners that successfully experienced the migration to the Cloud environment.

ITS Control of Highways Capacity

The article describes the potential for capacity increase of a highway section with use of intelligent transport systems. The implementation results in significant reduction of congestion and accident rate decrease on a highway. It is referring to the first linear control project in the Czech Republic implemented on the automobile ring road around Prague.

Control of the Public Health IT Physical Infrastructure: Findings From the 2015 Informatics Capacity and Needs Assessment Survey.

Despite improvements in information technology (IT) infrastructure in public health, there is still much that can be done to improve the adoption of IT in state and local health departments, by better understanding the impact of governance and control structures of physical infrastructure. To report out the current status of the physical infrastructure control of local health departments (LHDs) and to determine whether there is a significant association between an LHD's governance status and control of the physical infrastructure components. Data came from the 2015 Informatics Capacity and Needs Assessment Survey, conducted by Georgia Southern University in collaboration with the National Association of County and City Health Officials. A total of 324 LHDs from all 50 states completed the survey (response rate: 50%). Outcome measures included control of LHD physical infrastructure components. Predictors of interest included LHD governance category. The majority of the control of the physical infrastructure components in LHDs resides in external entities. The type of governance structure of the LHD is significantly associated with the control of infrastructure. Additional research is needed to determine best practices in IT governance and control of physical infrastructure for public health.

IT controls in the public cloud: Success factors for allocation of roles and responsibilities

ABSTRACTThe rapid adoption of cloud computing by organizations has resulted in the transformation of the roles and responsibilities of staff in managing the information technology (IT) resources (via IT governance controls) that have migrated to the cloud. Hence, the objective of this research is to provide a set of success factors that can assist IT managers to allocate the roles and responsibilities of IT controls appropriately to staff to manage the migrated IT resources. Accordingly, we generated a set of success factors from behavioral and information systems (IS) literature. These success factors were verified using in-depth interviews of executives from the United Arab Emirates (UAE). The empirical intervention suggests that the role allocation is driven predominantly by people’s skills, competencies, organizational strategy, structures, and policies. In addition, the research made clear that the most significant competency and skill for a person allocated to IT controls is to be able to evaluate and manage a cloud service provider, especially in terms of risks, compliance, and security issues related to public cloud technology. The findings of this study not only offer new insights for scholars and practitioners involved in assigning responsibilities but also provide extensions for IT governance framework authorities to align their guidelines to the emerging cloud technology.

ICT Factors Influencing Consumer Adoption of E-Commerce Offerings for Education

Background/Objectives: Learning is getting transformed into digital and digital coursework is evidently seen to have increased adoption. Major consumer base for e-commerce companies is India wherein learners and instructors form a major part. So, many e-commerce companies are well positioned to service this need having an eye on education market. The rapidly growing internet and smartphone penetration in the country is expected to further fuel this growth. India's leading e-commerce companies are in a competitive environment offering e-learning material for formal education, certificate courses, E-books, coaching materials for competitive exams, online tests etc. Some e-commerce companies also offer hobby courses. The study investigated the Information Control Technology (ICT) related factors that decide the adoption of various online offerings from e-commerce companies for the purpose of education. Method/Statistical Analytics: Simple random sampling has been applied for the research to collect the required sample. A structured questionnaire was distributed to collect the data from about 100 consumers including learners and instructors. A conceptual framework was developed to analyze the ICT factors impacting adoption of e-commerce offerings for education. Application/Improvements: This study provides valuable guidance to policy makers and providers of e-commerce in education in understanding the ICT factors influencing consumer adoption. Findings: ICT infrastructure has a significant impact on the perceived satisfaction of the stakeholders (Learners and Instructors) followed by ICT skills and then the ICT Support. Also consumers view insufficient ICT skills to take advantage of new technology as a significant challenge. Thereby they see a need for continuous technical training. Other major concerns from respondents on the ICT infrastructure is about the unavailability of up-to-date anti-virus protection in their systems, unavailability high-speed internet connection and multi-media incompatibility issues.

A Study on Drivers and Barriers of Consumer Adoption Towards E-Commerce Offerings for Education

Background/Objectives: Information Control Technology (ICT) keeps undergoing transformational changes. Thereby educational institutions leveraging the e-commerce offerings by various e-commerce companies and those developing in house online learning have to travel along an evolutionary path. For this transformation to be successful in the benefit of all stakeholders, it's important to understand the drivers and barriers as to why the learners and instructors adopt the e-learning or hybrid models. The study investigated the drivers and barriers that influence the adoption of various online offerings from e-commerce companies for the purpose of education. Method/Analytics: Simple random sampling has been applied for the research to collect the required sample. Data were gathered from about 100 respondents circulating a well-structured questionnaire. Application/Improvements: Although e-commerce has a proliferated growth with the explosive growth in ICT, there has not been sufficient research concerning the status of adoption and the factors influencing its adoption. This study provides valuable guidance to policy makers and providers of e-commerce in education in understanding the drivers/barriers of consumer adoption. Findings: Majority of the consumers are pushed towards adoption due to time saving aspect while lack of required technical skills stands out as major barrier.

Losing [IT] Control to Gain It: Exploring Organizational Linkages of Social Media Technology

ABSTRACTAffiliates of parent companies seeking localized control of their social message may adopt easily available social media platforms beyond the control of the parent IT function. A revelatory case identifies several IT control points by which the parent can still exert control over the affiliate. These controls separate the affiliate’s digital identity from the parent resulting in the perception of increased autonomy yet shifting the conception of control to a social form of self-regulation.