Information Technology Control Research Articles

Communication and control in outsourced IS development projects: Mapping to COBIT domains

Internal control over information technology (IT control) in complex outsourced information system development (ISD) projects is an ambiguous and sensitive issue. In this study we bring together Information Systems and Accounting perspectives to investigate how internal controls are incorporated into existing communication practices in outsourced ISD projects. The paper proposes that tools used for client-vendor communication are capable of supporting some of the IT control functions governed by the COBIT framework. In addition, it analyzes the influence of project complexity on the performance of communication tools as informal IT controls. Perceptual field data for the analysis were collected from project managers through an online survey instrument.The findings suggest that control objectives and types of project complexity are each supported by different communication tools. The level of support varies across communication tools categories and control objectives. Early analysis of a project's complexity can help with selection of communication tools which reinforce project support of control objectives while improving communication between client and vendor.

The future of information security incident management training: A case study of electrical power companies

Recent attacks and threat reports indicate that industrial control organizations are attractive targets for attacks. Emerging threats create the need for a well-established capacity for responding to unwanted incidents. Such a capacity is influenced by organizational, human, and technological factors. We have conducted extensive fieldwork for 2.5 years in Norwegian electric power companies with the aim of identifying challenges for improving information security incident management practices. Semi-structured interviews, document analysis, a survey and participant observations have been performed as part of this case study.We describe how training for responding to information security incidents is given low priority and that different types of personnel, such as business managers and technical personnel, have different perspectives and priorities in regard to information security. Moreover, there is a gap in how IT staff and control system staff understand information security. Furthermore, cross-functional teams need to be created to ensure a holistic view during the incident response process.To improve the capacity for responding to incidents, organizations need regular training sessions and systematic evaluations after such sessions. There is also the potential for improvement in evaluating minor incidents. A transition from an ad hoc approach to a systematic approach in training and learning requires a reorientation not only by the electric power companies but also by management. We found that learning to learn will enable the organizations to improve their incident response practices.

Why do information system controls fail to prevent unethical behavior?

Purpose The purpose of this paper is to examine the ability of enterprise systems and embedded controls to prevent unethical behavior within organizations. Design/methodology/approach The authors use a case study to explore how the configuration of information technology (IT) controls within enterprise systems and their effectiveness in preventing unethical behavior is compromised by the tone at the top. Findings The study highlights the decisive role of cultural values and leadership in moderating the relationship between IT controls and unethical behavior and the realization that ethical environments are socially constructed not enforced. Research limitations/implications The limitation of this research is that the authors conducted one case study in an institution of higher education to refute the theory that IT controls embedded within enterprise systems can prevent unethical, and thus, the results may not be generalizable to other industries. Practical implications An important implication of the research is that the configuration of information system controls is affected by the organizational culture and the ethical values embraced by top management. When the tone at the top does not emphasize the ethical code of conduct, the configuration of IT controls will be compromised leaving organizations vulnerable at all levels. Originality/value Although the authors have a wealth of knowledge on ethics and theories that explain why unethical decision-making continue to surface to the headlines, they have little explanation as to why enterprise systems fail to stop unethical behavior in organizations. This study explores technical, organizational and individual factors that contribute to unethical decision-making.

Sox Compliance: Eleven Essential Controls for Sme

Sarbanes-Oxley (SOX) act, was enacted in 2002, in the wake of large accounting scandals ENRON and WORLDCOM .Especially for SMEs (small to mid-sized enterprises) that can benefit from implementing the control objectives, for governance, compliance and improved security. SOX compliance did not gave detailed requirements for IT compliance, therefore many auditors adopted COBIT and COBIT guidelines to comply with SOX. This research discusses the latest sox developments in the SME, key findings from ISACA study and COBIT control objectives to satisfy internal IT controls .This compliance escalates and maps out internal it controls that protect information assets.

Information Technology Controls Quality and Audit Fees: Evidence From Italy

This study analyzes the impact of Information Technology (IT) Controls quality on control risk and audit fees. The impact is expected to occur when regulation increases sensitiveness to audit risk assessment. The research focuses on IT Controls as part of Internal Control over Financial Reporting, particularly on scoping quality, segregation of duties, and Controls framework compliance. The research was conducted with a questionnaire on a population of Italian listed companies. We find that audit fees are lower for higher IT scoping quality, IT Controls segregation of duties, and IT Controls framework compliance. The overall conclusion is that IT Controls quality is related to lower control risk, audit fees, and audit effort.

Compliance Issues in Higher Education

Abstract Efficiency in the 1980’s, quality in the 1990’s, compliance in the 2010’s - private sector management techniques and mechanisms find their way to public services. This paper facilitates the understanding of how compliance management controls can improve operations and prevent or detect failure or wrongdoing. The last few years’ empirical research and benchmark studies demonstrate how organizations are confused about the use of compliance controls. In brief, better organized and integrated IT controls generally lead to better compliance all over the business.

Innovative IT firms and the internal control environment

Internal control over financial reporting is mandated by the Sarbanes-Oxley Act of 2002. Given the integral role of information technology (IT) in financial processing and reporting, IT is hypothesised to be a contributor to the strength of a firm's internal controls. This study explores the relationship between innovative use of IT and internal control weaknesses. The analysis indicates that firms that are ranked in the Information Week 500 as innovative users of IT are less likely to be cited by their auditors for internal control weaknesses. Implications include the importance of solid IT governance practices and a strong focus on IT controls in today's heavily IT-enabled business environments.

The Compliance of IT Control and Governance

This study used a multiple-case study methodology in exploring the status of IT control in the casino gaming industry. The observations of this research should very much represent the overall status of the concerned issues regarding the casino gaming industry of Macao. Having attained a more complete level of IT control not only helps the company in satisfying the concerned regulatory compliance requirements, but also makes IT works more effectively for the companies in helping them to gain the competitive advantage in the fierce competitive environment in the gaming industry. The findings of this research can help the gaming companies to identify the potential enhancement areas of IT control. This study has captured the IT control status of the gaming industry at an initial stage of development in Macao. Further, the results can serve as a solid foundation for future research on the casino gaming industry and extending similar research to be conducted on other industries and government agencies, which are promoting the awareness of the importance of IT control.

Research on the Computer Music Production Technology System under the Digital Background

Computer music, as an important product of the information and digital age, belongs to the systems engineering combining the musical discipline with computer information control technology science. Through the applied research on digitalized acoustical signals, characteristic analysis of computer music, computer MIDI production technology, digital audio technology and computer music production software, this paper builds up a set of computer music production technology system based on a digital, informational and modernized background, and proves by experiments that this system makes the computer music production technology represent effects of simple and convenient usage, high-degree simulation and efficient extraction.

Automated tuning of ITS management and control systems: Results from real-life experiments

The design and deployment of the majority of Management and Control Systems (MCS) for ITS involves a tedious, effort- and time-consuming manual tuning and calibration procedure not only during the initial design and deployment of the ITS but, in most cases, during its whole lifetime. Recently, we have developed and evaluated, both by means of theoretical analysis and extensive simulation experiments, a new methodology which fully automatically takes over the manual tuning and calibration procedure. Most importantly, this new methodology, called Adaptive Fine-Tuning (AFT), achieves to improve the performance of the system and compensate the effect of the continuous changes of its behavior that may be due to either internal or external factors. In this paper, we report results of implementing AFT to a real-life ITS MCS. More precisely, this paper reports and analyzes the results from implementing AFT to an urban traffic signal control application. The results from AFT real-life application demonstrate that it is capable of significantly improving the performance of the system in a safe and robust manner. Moreover, the real-life results exhibit the capability of AFT to efficiently adapt and compensate in cases of changes in the system behavior, even if these changes are significant.

Making Cybersecurity Effective: The Five Governing Principles for Implementing Practical IT Governance and Control

With any complex project deployment, a clearly understood and reliable infrastructure can only be substantiated through a rational and explicit planning process. This planning process is often described as information technology (IT) governance. Governance-based control infrastructures are valuable and can provide the basis for control over every form of organizational resource. Given the level of sophistication of malicious agents, an information and communication technology management control system with even one hole in it is a business catastrophe waiting to happen. Strong executive sponsorship is the prerequisite for effective IT governance and the proper way to establish information security is to engineer an array of interlocking best practices, from a commonly accepted model of best practice. Organizations must define substantive policies, assign roles and responsibilities, educate employees and describe and enforce accountability. This paper presents an understanding and mastery of five strategic principles of cybersecurity best practices based on the Framework for Improving Critical Infrastructure Cybersecurity (CSF).

Multi-Agent Control System for the Movement of Uniaxial Objects

Multi-agent systems are used mainly in IT solutions and control groups of robots. From the point of view of classical control architectures, they are a kind of distributed systems in which nodes perform advanced algorithms, usually associated with the technology of artificial intelligence, and they can be considered as agents. The article describes the multi-agents control system of objects of uniaxial movements. An example of such a system to control a repository with movable racks with electric motors is presented. Each rack acts as an agent through the implemented control of the resources of embedded microcontrollers. Such a system provides high quality control, guaranteeing long-lasting, trouble-free operation while maintaining the safety of both service and stored items.

A Role Allocation Model For IT Controls In A Cloud Environment

The rapid adoption of cloud computing by organizations, along with the need to comply with relevant IT governance (ITG) controls, has increased the complexity of governance in the cloud. This transition from a classical data center to a virtualized data center has resulted in the reallocation of roles and responsibilities of IT personnel for managing and accounting for the relevant IT controls. With a lack of guidelines or model for practitioners to choose from, with regard to the allocation of roles and responsibilities, there is a lack of clarity on the responsibilities and accountability for these IT controls. The purpose of this paper is to propose a theoretical model for assigning roles and responsibilities for IT controls for an organization operating in a cloud environment. The proposed model is based on a strong theoretical grounding and can be used to inform good practice.

Hyperglycaemia in criticaly ill patients

The review highlights the problem of stress-induced hyperglycaemia (IT). The study of this condition is in demand because there is an association between IT and increasing number of complications and mortality among patients in critical state. In the review pathological and physiological mechanisms of stress-induced IT syndrome and its components are shown. These are acute IT, insulin resistance and hyperinsulinemia. The range of critical states, in which development of stress-induced IT is more probable and the IT negative impact on different organs and systems are described in the article. Clinical significance, influence on treatment and complications development of stress-induced IT are considered. It has been shown that adequate control and correction of IT are leading to improvement in critically ill patients state. Much attention in the review is paid to early diagnostics of any carbohydrate abnormalities in critical care medicine, as well as to prevention and optimal correction of IT. The variety of IT correction methods, target glucose levels and various therapeutic methods of hyperglycaemia correction are discussed. Dealing with hyperglycaemia in intensive care units is described in details.

Components of a multi-perspective modeling method for designing and managing IT security systems

Information technology (IT) security design and management are a major concern and substantial challenge for IT management. Today's highly complex business and technological environments and the need to effectively communicate and justify IT security requirements and controls demand methodical support. The modeling method presented in this paper addresses this demand. The method is based on the assumption that enriched enterprise models integrating technological, business, organizational and strategic aspects provide an effective foundation for developing and managing IT security systems and facilitating communication and understanding between stakeholders. The proposed modeling method for designing and managing IT security in organizations accounts for different perspectives and is based on multi-perspective enterprise modeling. The core components of the method, based on analysis of requirements at different levels of abstraction, are: modeling language concepts specifically designed to address security issues, process models that guide the use of the resulting language, and a modeling environment. The method facilitates elaborate representations of the various aspects of IT security at different levels of abstraction and covers the entire lifecycle of IT security systems. It not only supports multi-perspective requirement analysis and design but also enables monitoring and analysis of IT security at runtime. The presented artifact is evaluated with recourse to a research method that enables the configuration of multi-criteria justification procedures.

Essential IT Controls for Preventing Cash Fraud

Cyber‐thieves know the exact location of your organization's cash. What is not certain is whether you are working harder than the thieves to protect your organization's most vulnerable asset. This article encourages organizations to assess the controls they have in place around their cash operations. It describes in detail a variety of general controls over cash, including adequate segregation of duties, explicit authorization approval requirements, and physical access controls. The article then describes several information technology (IT) application controls (including lockboxes, positive pay, ACF Fraud Blocker, and zero balance accounts) that can help you protect your organization's cash against fraud and cyber‐attack. © 2015 Wiley Periodicals, Inc.

Intratympanic steroid injection for Bell's palsy: preliminary randomized controlled study.

To investigate adjuvant effect and safety of intratympanic steroid for the treatment of Bell's palsy. Prospective, investigator blinded, randomized study. Tertiary referral center. Patients who received treatment for Bell's palsy from December 2007 to March 2011 were randomly divided into two groups. The control group (n = 17) was treated with systemic steroid plus antiviral agent, and intratympanic steroid injection group (IT group, n = 14) received intratympanic steroid injection combined with medications. Facial functions were evaluated on a regular basis up to 6 months. Intratympanic steroid injection. Facial nerve functions of initial presentation and follow-up were evaluated with House-Brackmann (H-B) system. Primary outcome was complete recovery rate of 6 months. Secondary outcomes included improvement of H-B grade within 3 weeks, time of first improvement in facial function, and cumulative recovery rate. In addition, subgroup analysis of H-B grade over than IV was performed. Complete recovery rate was not different between groups. Time of first improvement was shorter in IT group (p = 0.043). And IT group had a better cumulative recovery rate (p = 0.041) and showed the significant improvement in H-B grade within 3 weeks compared with control group (p = 0.045). In severe facial palsy, complete recovery rate of IT group and control group were 80% and 50% (p = 0.16), and IT groups showed the significant facial improvement within 3 weeks (p = 0.025). And there were no major adverse effects of intratympanic injection. Intratympanic steroid injection might be a safe and useful adjuvant treatment modality for Bell's palsy.

Audit quality of outsourced information technology controls

Purpose – This paper aims to test the positive relationship between audit quality (AQ) of outsourced information technology controls (ITC) and information technology audit quality (ITAQ). Design/methodology/approach – Factor analysis, ordinary least squares (OLS) regressions and simulations. Findings – Scoping and planning phases of the audit cycle account for about 69 per cent of ITAQ. The AQ of outsourced ITC is strongly and directly related to ITAQ. Improvement of AQ of outsourced ITC may be achieved through evaluation of control design and operating effectiveness by service auditor as well as direct evaluation by the client in service provider location. Research limitations/implications – Sample size and input items in factor analysis. Practical implications – Companies and auditors could improve ITAQ through a better organization of the scoping and planning activities; they could also improve the AQ of outsourced ITC using direct evaluation in the service provider location supplemented with service auditor reports. Regulators could refine or change laws and frameworks to take into account the factors of ITAQ and the methodology of evaluation of outsourced ITC. Originality/value – Private data collected by questionnaire. The measures of ITAQ and the OLS model could be tested in future research, in countries with different frameworks and regulations related to AQ, different weight of outsourced information technology and other characteristics related to clients, service providers and service auditors.

Internal control over financial reporting: opportunities using the COBIT framework

Purpose – The purpose of this paper is to analyze how the COBIT framework, integrated within the internal control framework, enables improvement in the quality of financial reporting while helping to reduce or eliminate the material weaknesses (MWs) of internal control over financial reporting (ICFR). The Control Objectives for Information and Related Technology (COBIT) model is a framework for information technology (IT) management and IT governance. It is a supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks. Preliminarily, the analysis in this paper illustrates how the Committee of Sponsoring Organizations (COSO) framework impacts on the MWs, highlighting strengths and weaknesses. This paper shows how these limits can be overcome with the use of the COBIT framework. Design/methodology/approach – This is a conceptual paper that aims to highlight the relationship between COBIT and COSO, by illustrating how the IT processes reduce or eliminate the main MW categories. Findings – The analysis indicates that the implementation of the COBIT framework, or more generally the adoption of effective IT controls, provides important benefits to the entire company or organization. IT control objectives have a direct impact on the IT control weaknesses and indirectly on the other categories of material weaknesses. Practical implications – The adoption of the framework allows managers to implement effective ICFR. In particular, the COBIT approach provides managers with a more evolved tool in terms of compliance with the Sarbanes–Oxley Act requirements. This framework also improves the reliability of financial reporting in relation to the requirements of Public Company Accounting Oversight Board’s Auditing Standards No. 2 and 5. Originality/value – The analysis provides an interdisciplinary approach, connecting accounting and information systems themes, and suggest solutions and tools than can help managers to address the internal control weaknesses. This paper addresses an area of relevance to both practitioners and academics and expands existing accounting literature.

User liaisons’ perspective on behavior and outcome control in IT projects

Purpose– The purpose of this paper is to examine the extent to which user liaison behavior and outcome control influence the process performance of information technology (IT) projects and how the IT experience, behavior observability, and outcome measurability of user liaisons affect behavior and outcome control.Design/methodology/approach– A research model that integrates the IT experience, behavior observability, outcome measurability, behavior and outcome control, and performance from the perspective of user liaisons is developed. Quantitative data are obtained from 63 completed IT projects. Partial least squares technique is used to evaluate the measurement model. Hypotheses are tested through hierarchical regression analysis.Findings– User liaisons with high IT experience exhibit decreased behavior control but increased outcome control. The outcome control of user liaisons is effective in the process performance of IT projects, whereas their behavior control insignificantly affects performance. However, the behavior observability and outcome measurability of user liaisons strengthen the effectiveness of behavior and outcome control. The behavior and outcome control of user liaisons also vary across different industries and project types.Originality/value– The results of this study highlight the joint effects of the IT experience, abilities, and control decisions of user liaisons. Although the outcome control of user liaisons is an appropriate control mechanism in IT projects in consideration of the strengths of these liaisons in business knowledge and their control expenditures, the behavior control of user liaisons may also be effective in process performance if these liaisons possess high levels of behavior observability and outcome measurability.