Wen Ting Lu

What is an information risk profile?
-An information risk profile is a quantitative analysis that documents the types, amounts and priority of information risk that an organization finds acceptable and unacceptable. This profile is developed collaboratively with numerous stakeholders throughout the organization.

How is it used?
– An…[Read more]

Some common controls to reduce the risks of theft and fraud are segregation of duties, use three ways match wherever possible, have purchasing policies, implement procurement Independence with suppliers, and monitor vendor/source/price decisions, etc.

3. Which portion / step of the Procure to Pay process do they see as the most vulnerable to theft, fraud or failure of some kind? Explain

The most vulnerable portion of the Procure to Pay process is the first three steps:
1. Determination of requirements
2. Source determination
3. Vendor Selection

The reason why these steps are most…[Read more]

I agree with you Priya.
Nowadays, technology growing rapidly. People tend to use their mobile devices more than PCs. I don’t think it’s the matter of what device we use for online shopping, it’s more of the effort to download security software and make sure you are connecting to websites using encrypted HTTPS connections. However, it’s always a…[Read more]

In class we discussed several dimensions of Management Assertions. Which do you believe is the most important? Why?

I believe among several dimensions, “Accuracy” is the most important dimension. “Accuracy” means amounts and other data relating to recorded transactions and events have been recorded appropriately. In my opinion, I think w…[Read more]

Yulun,
you are right that completeness is important, In my opinion, I think accuracy is more important than completeness because without record accurate information, even all the business events are recorded they do not reflect much value because they are inaccurate.

1. The concept of ‘Assertions’ is important to accountants. Who else is it important to? Why?

Assertions are management’s claims about the recognition, measurement, presentation, as well as disclosure of information presented in the financial statements. The concept of “Assertions” is not only important to accountants, it is also important…[Read more]

Yes, you are right. From my past experience working at Greyhound Bus Lines, we used to have the card to swipe in and out from work. In addition, we had to clock out for half hour lunch when we work a shift for more than six hours. I have seen some of my co-workers didn’t swipe out for lunch, so they can get an extra half hour pay. However, before…[Read more]

3. Have you ever:
– Been victim of Fraud?
– Had evidence of, suspicions of fraud occurring?
– Been pressured (e.g. by an employer) to commit an act that was morally or legally questionable?
Explain

Fortunately, I have never been a victim of fraud. I have a habit of keep all the receipts and reconcile the receipts with the bank state…[Read more]

I agree with you, it’s not a good idea to use business account for both business and personally use, or use personal account for business use. The owner of the construction company did not comply with the economic entity principle, in which the transactions associated with a business must be recorded separately from those of its owners or other…[Read more]

Add on to my answer to Paul’s question, I think in the case of employee committing time theft touched on two parts of the fraud triangle. Employees must perceive an opportunity to commit and conceal their fraud (which in this case I assume the interns report their own time sheet). In addition, employees are able to rationalize their offenses as…[Read more]

Paul, you raised some interesting questions.
I don’t think they realized they were committing fraud, I guess most of them were thinking it’s okay or not a big deal for them to report some extra time. I think their motive for committing time theft is very simple, which is to gain more money.

I have seen one of my co-worker in the past sat…[Read more]

Hi, Fred

You made a great point. The current credit payment system definitely need to be strengthen to prevent fraud, you are absolutely right that leave the tip open for merchants to enter after customers left leaves a lots room for fraud. Back in high school, I worked as a server in restaurants, I have seen customers just signed their names…[Read more]

Uber reportedly invested $500 million to build a better mapping system

The article I read is about Uber reported its plan to invest $500 million to build a better mapping system. In addition, Uber hired Microsoft engineers to support its map work. I was glad to hear about this news because I take Uber very often, especially when Uber launched…[Read more]

Question: What are the key activities within each phase?

1. Planning
– Developing the scope of audit
-Determine the exist internal controls
-Preliminary survey
-Research
-Communicate/schedule with customers to set up where and time the audit will taking place

2. Fieldwork and Documentation
– Gather information
– Test evidence and i…[Read more]

Q:Why do we need control framework to guide IT auditing?

A: We need control framework to guide IT auditing because it serves as guidelines for IT audtiors to follow. By following these guidelines will ensure the IT infrastructure of the company maintain a strong governance.

Hi, Paul

Thanks for sharing the pizza analogy, it is very interesting and easy to understand. I totally agree with you that the control framework is a set of guidelines for auditors to follow. By following these guidelines will ensure the IT infrastructure of the company maintain a strong governance.

Hi, Fangzhou

It’s interesting that you listed requesting documents as the first step of IT aduit phase, and preparing the audit plan as second step. However, I think it is the other way around, I believe it is important to determine the objectives and scope of the audit first and then request the information needed.

Hi, Daniel

I think it is also necessary to follow up and track the issue after the audit is completed. The audit is not considered as truly complete until the issues found in the audit are resolved, or being accepted by the management.

Source: IT Auditing by Chris Davis and Mike Schiller

Hi, Abhay

I agree with you that customer input is important. Auditors should discuss potential issues with the customers immediately. Also, they should work together to come up with action plans to resolve potential issues.