Binu Anna Eapen

Also not knowing the technology would mean he or she might need to rely on someone else for expertise or have to spend more time to learn and understand the processes involved.

Yes, I believe SOX changed the way a public company worked. It made it more alert and cautious. SOX caused companies to have a greater internal control of financial reporting, independence among more-focused management team and increased expertise. SOX imposed new ethic requirement, disclosure requirements, new reporting and audit practices,…[Read more]

Regarding the differences you mentioned that Compliance driven control has short term benefits. I quiet disagree with that. Compliance driven control may have long term benefits as well. As in if the company is complaint to all its policies then they might not have to waste money with lawyers or with government to get things right after a control…[Read more]

I agree with you Yu Ming that Adobe may be a better software in itself. But we need to consider what the objective of the business is. If it does not care about the additional functionalities and is not really concerned about the availability and only need few of the features which are also available in Nitro Pro 9 and if it is still compliant to…[Read more]

I Agree with Alexandra that SOX just forms the basic platform for providing control and is not sufficient in itself to prevent fraud. But without it, it would be a open field for more fraudulence. It always helps to learn from the past and to prevent it, instead of regretting later.

How does the control environment affect IT?

Control environment is the foundation on which internal audit is built. That is it represents the ethical value, corporate culture, operating style, management style, structure of the organization, policies and procedures in place. It influences the control consciousness of the people and shows the…[Read more]

What are some current system-related risks that you have experienced in your organization?

One of the issues that I had seen was that IT technician and AD team had the access to reset the password of any user under them. But there was no way of knowing who had reset the password. Off course no would reset someone else’s password without the u…[Read more]

What issues did you identify from this video?

The video illustrates the following IT controls
1. All employees must be properly trained of the security policies.
2. Protecting password- a strong password policy should be in place, should not be shared with co workers or written down or stored in places that are easily…[Read more]

What is the purpose of all auditors having some understanding of technology?

All auditors should have some understanding of technology as this can show credibility of the auditor. Else he can be fooled by the client into believing that the control he was suggesting was impossible to achieve and might not be able to refute or justify his course…[Read more]

2. Is information security a technical problem, a business problem that the entire organization must frame and solve, or both? Explain the nature of the problem in the context(s) you chose.

Information security is not solely a technical problem as it involves not just technical glitches but also the intention of the intruder. More that…[Read more]

Yes. SOX was more like the right thing to do approach. And keeping a standard helps who are coming up in the market or the ones already existing to keep a check on the policies so as not to cheat others and to keep it fair.

4. Describe a real life example of a company’s profitability-driven controls. What are the differences between a compliance-driven vs. a profitability driven control?

Profitability controls can be achieved by meeting customer demand, achieving high sales, controlling costs by reducing or limiting excessive spending. So for example, if a p…[Read more]

Question: Describe a business process you have experienced (either as an external or internal participant) and what your role was.
Role: End of Lease portfolio owner. Managing the laptop replacement for entire Hyderabad region with over 2000 laptop changes per quarter. Assigning the technicians in respective block (walk up) and making sure the…[Read more]