Case Study: Information Systems Audit and Assurance (ACCG358)

This assignment presents a case study on information systems audit and assurance, analyzing a major cybercrime bank raid where hackers stole a significant amount of money. The case study delves into the main and subsidiary objectives of audit procedures, including the examination of internal control systems, verification of financial statement accuracy, and the detection and prevention of errors like principle errors, errors of omission, commission, and compensation. It also explores audit procedures related to authenticity, transaction value, revenue, expense, and capital expenditure. Furthermore, the assignment discusses the risks associated with outsourcing data center functions, such as less control, security concerns, compatibility issues, and lack of coordination. It then outlines the audit objectives for IT outsourcing reviews, focusing on independent assessment, evaluation of internal controls, and audit reliance on supplier performance. The assignment also details audit procedures for IT outsourcing, including outcome review, disaster recovery planning, and governance processes. The analysis covers various aspects related to the cybercrime, including the bank's internal computer systems and the hackers' methods. The case study emphasizes the importance of robust audit procedures to prevent financial misstatements and ensure the security of financial institutions.

Running head: INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Name of the student
Name of the university
Authors note

1INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Table of Contents
Section A........................................................................................................................3
Case study 1...............................................................................................................3
Answer to question 1..............................................................................................3
Section B:...................................................................................................................7
Answer to question 2..................................................................................................7
Answer to question 3................................................................................................10
Case study 2.................................................................................................................11
Section B..................................................................................................................11
Answer to question no 4:..........................................................................................13
Reference:....................................................................................................................14

2INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Section A
Case study 1
Answer to question 1
The main objectives of the audit procedure is only to express an opinion over the
financial statements. Hence in order to implement the opinion over the financial statements, it
is important to examine perfectly all the financial statements and also to make them satisfied
and ensure truth and fairness of the financial position and also to analyse the operating results
of the enterprise. Hence there are certain process which have some limitations to the extent.
Since it is not possible to find out all the errors by the auditors and try to sort out all of them,
thus the main audit objectives has been divided into two parts namely-
The primary audit objectives are as follows-
1. Examining the internal system check.
2. Checking and determining the accuracy to the company book of financial statements
as well as checking, verifying and posting casting and balancing the financial value.
3. Verify the authenticity and transactional value.

3INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
4. Checking the proper distinction between the actual and revenue capital in the nature
of the transactions,
5. Confirming the existence to the value of the assets and liabilities.
Thus it is important to verify all the statutory requirements and whether they are been
properly fulfilled or not. Hence providing true and fairness of operating results presented
by the income statement and to check the financial position provided to the balance sheet.
Subsidiary objective of the balance sheet:
There are some objectives which has been set up to attain only the primary objective.
Hence these are as follows –
1. Detection and error prevention:
While doing the company auditing it is important to check the all possible errors and
to ensure prevention and detection of the same. Thus the errors are considered as those
mistakes which have been committed due to carelessness and negligence or knowledge
lacking. Hence it could provide and vest interest. Hence it may commit with or without t
vesting interest. Thus all the errors are to be checked carefully and ensure error free
process. Some of those process are –
2. Principle errors:
At the time of recording the transactional items which are not been covered in the books
of accounts, thus it is known as error of principal. Hence these errors are not been
traceable from the trail balance and these maybe committed in order to manipulate the
accounting rules and regulations to the process. Here some kind of those errors could be
like-
3. Provide excessive and adequate depreciation.
4. Where the outstanding audit expense are wrong.

4INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Error of omission:
There are two types of omission seen in auditing where the main focus is on the
transactions recording in the books of accounts.
Here the transaction is totally omitted from the groups of accounts and it will not have
any kind of effect in the books of the trail balance and detection of such error in the books of
accounts. However there are some examples of these kind of errors like
Omission of the purchase or sales from the purchase day book the sales day book
respectively. ( Beck, & Mauldin, 2014).
Omission of outstanding or unpaid expenses.
Other than that there are certain transactions which are been partially omitted from the
books of account. These are as follows –
The total of the purchase or the sales account are to be omitted from the net purchase or the
sales day book respectively.
The payment and receipt transaction omitted to be recorded into the company books of
accounts.
Error of commission:
It occurs when the entry made in the company books of the accounts and hence an original
entry is been made stating that the ledger posting is wrong. Considering some examples of
this case are as follows –
Purchase of goods worth of Rs 15000 which has been wrongly entered in the purchase day
book as Rs 1500.
Credit purchase from b company has been wrongly entered into the A companies account.

5INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
The purchase day book total is counted at Rs 250000 instead of Rs 2230000.
Compensation errors
It is an effect of the errors which had been compensated by another error, hence it is
known as the compensating errors. Thus such kind of errors do not fully effect the companies
balance and thus there is a chance of showing error of compensations. Considering an
example in this case would be like the total in the companies debit and credit balance is
shown at short of Rs 5000 in both the sides. Hence this kind of errors are known as
compensating errors.
Audit procedure for authenticity and transaction value:
An auditor who is conducting an audit responsible in accordance with GAAS model is
responsible for obtaining the audit assurance and levied the financial misstatement caused by
the fraud error. Thus due to the inherence of the audit report there are some unavoidable risks
which are been associated with the risk factors in transactional audit.
As per the audit section it is seen that the GAAP principle are very much significant
to this process. Thus here the company auditor could identify the basic root causes in this
cases. Thus the British bank could also look to implement these audit rules and regulations to
prevent future money hacking.
Audit procedure for revenue expense and capital expenditure:
The capital and revenue expenditure are important aspects to prepare correct financial
statement and the absence of all these aspects will lead to mislead in result and as per the
principles the capital account and the profit and loss statement have been considered in the
company balance sheet of the firm. Thus it is important for British bank to always cross

6INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
check the capital and revenue expenses to the company thoroughly in order to stop money
laundering from occurring.
Section B:
Explain four (4) risks of outsourcing data centre functions
Some of the key risks to outsource the IT data centre functions are as follows –
1. Less control: at the time of outsourcing the information technology to the pricing and
third party heavily relying the expertise along with the resources and services, the
transactional process will do well. On the other hand if the company is not satisfied to
the third party vendor, then the company could not go for outsourcing the data and
thus the company needs to think for new IT plans.
2. Security: the cloud computing services share the resources with the company tenants
and it makes the process easy to operate. However it does not mean that all the companies
will be using the same data and process all the time. Especially if the company have some
other requirements.
3. Compatible: it is another issue with the IT and cloud computing process where the
data process and outsourcing is just the another part in this process.
4. Lack of coordination: here the outsourcing process of the vendor does not go for a
day to day understanding to the company business and they understand the goals as well
as the rules and regulations of the IT business. And they do not directly work with the
employees or for the customers. Thus the lack of ordinance should be discussed.
Answer to question 2
The main audit objectives to the IT outsourcing review is as follows-

7INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
To provide the management with an independent assessment of the IT outsourcing
process which is related to the attainment of objectives and goals, complying with the
company term and conditions of the outsourcing contracts. Hence this process calls for
successful remediation of the issues identified during the execution of the business
process .
Providing the management with an opportunity to evaluate the internal control
affecting the business procedure relating to the business activities outsourced and internal
process affecting to the outsourcing.
Permit the audit and assurance professional to place out the audit reliance of the data
gathered and the operational performed by the supplier on the behalf of the customer. Thus
the IT audit and assurance professionals could customise the document to the company
environment over the audit and assurance process. Hence the document could be used in the
checklist and questionnaire. Hence it is assumed that the whole procedure is necessary
subjected to the expertise required to conduct the whole process and also to design the same
where they are adequately been performed.
Audit procedures for IT outsourcing:
1. Review and evaluate the audit outcome of the company:
Since the companies have high audit expectations hence it is important to constantly
review and check the detailed audit procedure of IT audit sourcing and monitor the same.
Hence if those expectations are not meet then the audit operation and system will call for
a change. Thus the steps need to follow in this regard are-
Availability of the data.
Performance of the company auditor.

8INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Check the response time of the audit report.
Security and compliance requirements.
Ensuring the adequate disaster recovery process:
The organization needs to prepare for recovery from the disaster from the outsourcing
process and operations. Hence the failure to this process will likely result in extended cases
will cause disruption in the business and will cause disaster for the business also. Hence the
same step could also be considered for the IT outsourcing and service outsourcing. Thus it is
important that the vendor could follow proper and actual disaster managing policy and here
the steps are been added to the process in the business. Thus the business could be rightly
sold out to the audit vendor of the company. The British bank could also indulge in the same
technique to get the most of this business and ensure profitability.
Issue of appropriate governance process: the cloud computing techniques makes the
whole process a much easier and ensures proper engagement in the corporate IT. Since most
of the IT enabled service companies can access the data via internet and thus the business
could engage a cloud vendor service and this process will help the company to effectively
audit all the financial statement which had been prepared by the company in the financial
year. Hence this step is proven to most useful in the case of the cloud computing techniques.
Here the company reviews all the financial statements where the topic has been addressed.
Thus the policies should be considered in making specific procedures for the vendors over the
service. Now the implementation of this auditing process will only exist if there are certain
audit policies over cloud computing are made of. Thus if the company have centralised
procurement issue then the organisation must be used to sign the contracts and the gatekeeper
could ensure proper procurement which have been followed by engagement process. Thus the

9INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Same technique could be used by the British bank in order to ensure implementation of the
cloud computing technique within the system.
Evaluating the company’s technique as per plan:
The company could look to terminate the outstanding relationship in the future of the
business for many reasons and the provider could go out of the business and could also look
to discontinue the business as well as look to switch over to new service providers. However
the company could try to bring the business to normal by changing the cost valuation or
performance and thus the vendor could win the hearts of the clients. Hence this form of
technique will be useful to all forms of outsourcing business and hence it will prove to be a
very useful process for the vendors to survive as well as increase the valuation of the
business. Thus if the British bank wants to improve the business profitability of the company
as well as look to outsource all the values and aspects of the banks business then they could
look to imply this process .
Answer to question 3
Cloud computing related questions:
a) Questions related to cloud-based IT service delivery and support
In order to formulate proper and accurate cloud computing and to know about the risk, the
main important aspect is to know about the cloud computing process. Thus there are some
questions related to the cloud computing services –
1. Does the bank follows proper cloud computing techniques?
2. Have the company secured any benefits out of the cloud computing process?
3. Does the company had followed all the cloud computing models?

10INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
4. Whether the cloud computing system is totally reliable to the company and whether it
is available to the company at the same time?
5. What the security management service process does the company have in terms of
cloud computing? ( Vovcheno et al.,2017)
b. Questions related to protection and privacy of information assets in the cloud
There are also some important questions to be followed in cloud computing in case of
data breeching. These are as follows-
1. Does the company are ready to cope up with data breech?
2. Does the company incorporate privacy to design into the IT services?
3. Have the cloud computing system conducted a privacy impact assessment?
4. Does the cloud computing system measure and demonstrate in compliance with the
global data privacy regulation?
Case study 2
Section B
Audit procedures for each objectives:
The main audit objectives of the company are as follows-
 Examining the internal checking system:
These are the methods of organizing proper accounting and auditing system and the
business concern have the duties and some responsibilities to concern to the persons who
are automatically checked by another people and there are possibility if fraud and
irregularly s minimised unless it is used in clerks. The essential elements are as follows –
1. Instituting the day to day transactions.
2. These checks operate continuously as a part of the routine system.

11INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
3. There are continuously complementary work valuation to one another.
 Detection and prevention of errors :
The auditors could be very careful about the detection of errors because manipulation
in accounting may also appear as an error or carelessness may occur into the case.
Hence the major aspects of this process are –
Error of principle.
Error of omission.
Error of duplication.
Error of commission.
Compensation of errors.
 Detection and prevention of frauds:
The frauds and mistakes made are been committed knowingly some vested interest to the
direction of the top level management. Hence the audit procedure for this aspect will be to
judge the financial ability of the organization by considering that fraud is an incidental object.
Hence independent option and judgement will form proper auditing techniques and accounts.
These process are-
Misappropriation of cash.
Misappropriation of goods.
Manipulation of accounts
 Stock valuation:

12INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
If the company considers inventory as an assets and undergoes annual audit then the
company auditors will conduct the audit inventory. Hence for the inventory size there are a
quite large number of inventories which could encourage and make valuation more
comfortable and make the inventory asset reliable.
Answer to question no 4:
Audit evidence and testing:
1. Identify and assessment of audit risk over a significant deviation.
Issue of unqualified audit report where there is reasonable justified qualification.
Issue of qualified audit option where there is no qualification is necessary.

13INFORMATION SYSTEMS AUDIT AND ASSURANCE (ACCG358)
Reference:
Beck, M. J., & Mauldin, E. G. (2014). Who's really in charge? Audit committee versus
CFO power and audit fees. The Accounting Review, 89(6), 2057-2085.
Vovchenko, N. G., Holina, M. G., Orobinskiy, A. S., & Sichev, R. A. (2017). Ensuring
financial stability of companies on the basis of international experience in construction of
risks maps, internal control and audit. European Research Studies Journal, 20(1), 350-
368.