Syllabus

This course introduces students to the methods used as organizations builds an enterprise information system architecture within an environment of internal control. Topics include information system planning, management and usage, the development, acquisition and maintenance of these technologies and their impact on the organization’s business processes.

Course Objectives

1. Evaluate the business case for the proposed investments in information systems acquisition, development, maintenance and subsequent retirement to determine whether it meets business objectives.
2. Evaluate IT supplier selection and contract management processes service levels and requisite controls are met.
3. Evaluate the project management framework and controls to determine whether business requirements are achieved in a cost-effective manner while managing risks to the organization.
4. Conduct reviews to determine whether a project is progressing in accordance with project plans, is adequately supported by documentation, and has timely and accurate status reporting.
5. Evaluate controls for information systems during the requirements, acquisition, development and testing standards, procedures and applicable external requirements.
6. Evaluate the readiness of information systems for implementation and migration into production to determine whether project deliverables, controls and the requirements are met.
7. Conduct post-implementation reviews of systems to determine whether project deliverables, controls and the requirements are met.

 

 Textbook and Readings and Reference Material

Textbooks	Valacich J.S. and George J.F., 2017, Modern Systems Analysis and Design, Eighth Edition, Pearson Education, Inc., ISBN-13: 978-0-13-420492-5
ISACA	CISA Review Manual 26th Edition, 2015, ISACA, ISBN 978-1-60420-367-7
	“COBIT 2019: Framework Introduction and Methodology”, ISACA, ISBN 978-1-60420-763-7
	“COBIT 5: Enabling Processes”, 2012, ISACA, ISBN 978-1-60420-241-0
	Chaudhuri, A., von Solms, SH, Chaudhuri, D. (2011), “Auditing Risks in Virtual IT Systems”
	Gelbstein, E. (2015) “Auditors and Large Software Projects, Part 1”
	Gelbstein, E. (2015) “Auditors and Large Software Projects, Part 2”
	Gelbstein, E. (2015) “Auditors and Large Software Projects, Part 3”
	Helskanen, A.LJK (2012) “Project Portfolio Management”
	Kancharia, M. and Bhattacharjee, S. (2010) “Realizing Benefits of IT Investments: Overcoming the Silver-bullet View”
	Raval, V. and Sharma, R. (2017) “Mitigating the Risk Factors of IT Project Failure”
	Singleton, T. (2014) “The Logical Reason for Consideration of IT”
	Singleton, T. (2014) “The Core of IT Auditing”
	Singleton, T. (2012) “Auditing Applications, Part 1”
	Singleton, T. (2012) “Auditing Applications, Part 2”
	Singleton, T. (2011) “Understanding the New SOC Reports”
	Singleton, T. (2010) “IT Audits of Cloud and SaaS”
FedRAMP	“CSP Authorization Playbook – Getting Started with FedRAMP”
FIPS	PUB 199 “Standards for Security Categorization of Federal information System and Information Systems”
NIST	Special Publication 800-34 Revision 1 “Contingency Planning Guide for Federal Information Systems”
	Special Publication 800-53A Revision 4 “Assessing Security and Privacy Controls in Federal Information Systems and Organizations”
	Special Publication 800-53 Revision 4 “Security and Privacy Controls for Federal information Systems and Organizations”
	Special Publication 800-64 Revision 2 “Security Considerations in the System Development Life Cycle” (SDLC)
SANS	Hein, R. (2004) “The Application Audit Process – A Guide for Information Security Professionals”
Misc.	INTOSAI (2008) “Why IT Projects fail, Best Practices Guide”
	Peppard, J. (2016) “A Tool to Map Your Next Digital Initiative”, Harvard Business Review

 

Schedule of class topics:

 

Assignments

The readings, questions, and case study assignments will bring the real world into class discussion while illustrating fundamental concepts. 

1. Readings: Below is the reading schedule you are responsible for completing. Check the class website for updates and changes to the readings.  Complete each reading and answer reading discussion questions posted to the class website before each class:

Unit #	Readings
1	·       MSAD Ch. 1, Ch. 2 “Systems Development Environment” ·       CISA Ch. 3 “Systems Development Methodologies” ·       CISA Ch. 3 “SDLC Models” ·       CISA Ch. 3 “SDLC Phases”
2	·       MSAD Ch.1 “Project Management” ·       CISA Ch. 3 “Project Management and Governance”
3	·       MSAD Ch. 4 “Identifying and Selecting Projects” ·       MSAD Ch. 5 “Initiating and Planning Information Systems Projects” ·       CISA Ch. 3 “Business Case and Feasibility Analysis”
4	·       MSAD Ch. 6 “Determining Systems Requirements” ·       CISA Ch. 3 “Requirements Definition”
5	·       MSAD Ch. 7 “Structured System Process Requirements” ·       CISA Ch. 3 “Structured Techniques”
6	·       MSAD Ch. 8 “Structured System Data Requirements” ·       CISA Ch. 3 “Entity Relationship Diagrams”
8	·       MSAD Ch. 9 “Database Design” ·       CISA Ch. 3 “Control Identification and Design” ·       CISA Ch. 3 “Relational and Embedded Databases”
9	·       CISA Ch. 3 “Software Development Methods” ·       CISA Ch. 3 “System Development Tools and Productivity Aids” ·       CISA Ch. 3 “Control Identification and Design”
10	·       MSAD Ch. 10 “Designing Forms and Reports” ·       MSAD Ch. 11 “Designing Interfaces and Dialogues”
12	·       MSAD Ch. 12 “Designing Distributed and Internet Systems” ·       CISA Ch. 3 “Infrastructure Development and Acquisition Practices” ·       CISA Ch. 3 “Hardware and Software Acquisition”
13	·       MSAD Ch. 13 “Systems Implementation” ·       CISA Ch. 3 “IS Auditors Role in Project Management” ·       CISA Ch. 3 “Software Development Methodologies” ·       CISA Ch. 3 “Software Testing”
14	·       MSAD Ch. 14 “Maintaining Information Systems”

Participation

Much of your learning will occur as you prepare for and participate in discussions about the course material.  The assignments, analysis, and readings have been carefully chosen to bring the real world into class discussion while also illustrating fundamental concepts.

To encourage participation, 10% of the course grade is earned by preparing before class and discussing the topics between and in class. Evaluation is based on you consistently demonstrating your engagement with the material. Assessment is based on what you contribute, not simply what you know.

1. Preparation before class – To facilitate active participation in the class I request that you do the following before noon on the day of the class:

Briefly address and summarize:

1. One key point you took from each assigned reading. (One or two sentences per reading)
2. One question that you would ask your fellow classmates that facilitates discussion.

I will also require that you identify, and are prepared to discuss, an article about a current event in the IT, Security, or Project Management arena each week.  Each student is expected to contribute a link to an article to the online class discussion each week.  An ideal article would be tied thematically to the topic of the week.

However, any article you find interesting and would like to share is welcome. The deadline for posting is noon on the day of class.

2. Participation during class – We will typically start each session with “opening” questions about the assigned readings and analyses. I may ask for volunteers, or I may call on you.  Students called on to answer should be able to summarize the key issues, opportunities, and challenges in the analyses.  All students should be prepared to answer these questions.

Another important aspect of in-class participation is completion of in-class assignments and contribution to any break out activities.

3. Participation between classes – To facilitate ongoing learning of the course material, we will also discuss course material on the class blog in between class.

Each topical week, a discussion primer will be posted on the class website. Students should actively engage in meaningful discussion of the weekly topic.  Full credit for discussions is not predicated on “answering the question”, but rather on meaningful contribution to the conversations.  As a general guideline, students are expected to review and post comments three times during each topical unit.

Any submissions to the discussion board after the topical week concludes will not be considered during grading.  Overall, discussion participation will be weighted 20% of the final course grade.

Exams

There will be twoe exams given during the semester.  Together these exams are weighted 30% of each student’s final grade. 

Below is the exam schedule:

These exams will consist of multiple-choice questions.  You will have a fixed time (e.g. 50 minutes) to complete the exam.  Test one will occur in week 7 and will cover the systems analysis and planning; test two will occur in week 14 and will cover the remaining material.

A missed exam can only be made up in the case of documented and verifiable extreme emergency situation.  No make-up is possible for test three.

Projects

There will be 5 projects during the course.  Each project is weighted 12% of your final grade (60% in total).  Details on each project will be provided in class, with the due dates noted on the syllabus.  While these projects are graded individually, students may work collaboratively to complete their individual project submissions.  Students will be randomly chosen to present their project to the class.

Weekly Cycle

As outlined above in the Assignments and Participation sections, much of your learning will occur as you prepare for and participate in discussions about course content. To facilitate learning course material, we will discuss course material on the class discussion board between classes.  Each week this discussion will follow this cycle:

Evaluation and Grading

Item Weight Assignments 60% Participation 10% Exams 30%   100%

Grading Scale 94 – 100 A 73 – 76 C 90 – 93 A- 70 – 72 C- 87 – 89 B+ 67 – 69 D+ 83 – 86 B 63 – 66 D 80 – 82 B- 60 – 62 D- 77 – 79 C+ Below 60 F

Grading Criteria

The following criteria are used for evaluating assignments. You can roughly translate a letter grade as the midpoint in the scale (for example, an A- equates to a 91.5).

Criteria	Grade
The assignment consistently exceeds expectations. It demonstrates originality of thought and creativity throughout. Beyond completing all of the required elements, new concepts and ideas are detailed that transcend general discussions along similar topic areas. There are no mechanical, grammatical, or organization issues that detract from the ideas.	A- or A
The assignment consistently meets expectations. It contains all the information prescribed for the assignment and demonstrates a command of the subject matter. There is sufficient detail to cover the subject completely but not too much as to be distracting. There may be some procedural issues, such as grammar or organizational challenges, but these do not significantly detract from the intended assignment goals.	B-, B, B+
The assignment fails to consistently meet expectations. That is, the assignment is complete but contains problems that detract from the intended goals. These issues may be relating to content detail, be grammatical, or be a general lack of clarity. Other problems might include not fully following assignment directions.	C-, C, C+
The assignment constantly fails to meet expectations. It is incomplete or in some other way consistently fails to demonstrate a firm grasp of the assigned material.	Below C-

Late Assignment Policy

An assignment is considered late if it is turned in after the assignment deadlines stated above.  No late assignments will be accepted without penalty unless arrangements for validated unusual or unforeseen situations have been made.

• The exercise assignments will be assessed a 20% penalty each day they are late. No credit is given for assignments turned in over five calendar days past the due date.
• You must submit all assignments, even if no credit is given. If you skip an assignment, an additional 10 points will be subtracted from your final grade in the course.
• Plan ahead and backup your work. Equipment failure is not an acceptable reason for turning in an assignment late.

Citation Guidelines

If you use text, figures, and data in reports that were created by others you must identify the source and clearly differentiate your work from the material that you are referencing. If you fail to do so you are plagiarizing. There are many different acceptable formats that you can use to cite the work of others (see some of the resources below). The formats are not as important as the intent. You must clearly show the reader what is your work and what is a reference to someone else’s work.

Plagiarism and Academic Dishonesty

All work done for this course:  examinations, homework exercises, blog posts, oral and written presentations — is expected to be the individual effort of the student presenting the work.

Plagiarism and academic dishonesty can take many forms.  The most obvious is copying from another student’s exam, but the following are also forms of this:

• Copying material directly, word-for-word, from a source (including the Internet)
• Using material from a source without a proper citation
• Turning in an assignment from a previous semester as if it were your own
• Having someone else complete your homework or project and submitting it as if it were your own
• Using material from another student’s assignment in your own assignment

Plagiarism and cheating are serious offenses, and behavior like this will not be tolerated. In cases of cheating, both parties will be held equally responsible, i.e. both the student who shares the work and the student who copies the work. Penalties for such actions are given at my discretion, and can range from a failing grade for the individual assignment, to a failing grade for the entire course, to expulsion from the program.

Student and Faculty Academic Rights and Responsibilities

The University has adopted a policy on Student and Faculty Academic Rights and Responsibilities (Policy # 03.70.02).

Additional Information

Availability of Instructor	§  Please feel free to contact me via e-mail with any issues related to this class.  I will also be available at the end of each session.  Please note that these discussions are to address questions/concerns but are NOT for helping students catch up on content they missed because they were absent. Note: I will respond promptly when contacted during the week §  I am available to meet personally with you: ü  Immediately before or after class ü  During class breaks
Attendance Policy	§  Class discussion is intended to be an integral part of the course.  Therefore, full attendance is expected by every student. §  If you are absent from class, speak with your classmates to catch up on what you have missed.
Class Etiquette	§  Please be respectful of the class environment.  §  Class starts promptly at the start time.  Arrive on time and stay until the end of class. §  Turn off and put away cell phones, pagers and alarms during class. §  Limit the use of electronic devices (e.g., laptop, tablet computer) to class-related usage such as looking up terms and taking notes.  Restrict the use of an Internet connection (e.g., checking email, Internet browsing, sending instant messages) to before class, during class breaks, or after class. §  Refrain from personal discussions during class.  Please leave the room if you need to speak to another student for more than a few words.  If a student cannot refrain from engaging in private conversation and this becomes a pattern, the students will be asked to leave the classroom to allow the remainder of the students to work. §  During class time speak to the entire class (or breakout group) and let each person “take their turn.” §  Be fully present and remain present for the entirety of each class meeting.