Information System Assurance for Enterprise Resource Planning Systems: Unique Risk Considerations

Abstract

Enterprise Resource Planning (ERP) systems inherently present unique risks due to tightly linked interdependencies of business processes, relational databases, and process reengineering. Knowledge of such risks is important in planning and conducting assurance engagements of the reliability of these complex computer systems. Yet, there is little empirical evidence on this issue. To examine this topic, a semi-structured interview study was conducted with 30 experienced information systems auditors (from 3 of the Big 5 firms) who specialize in assessing risks for ERP systems. This approach allowed us to obtain detailed information about participants' views and client experiences. The results indicate that the implementation process of ERP systems has an important impact on system reliability. Further, interviewees identified a number of common implementation problems (e.g., improperly trained personnel and inadequate process reengineering efforts) that result in heightened risks. Interviewees also reported that ongoing risks differ across applications and across vendor packages. Finally, in providing assurance on ERP systems participants overwhelmingly indicate a focus on testing the process rather than system output.

An Approach to Identify Failure Factors of Enterprise Application Implementation in Indian Micro Enterprises

“…Some researchers also proposed that the concept of risk pertaining to Enterprise application may be the reason (Wright and Wright, 2001). …”

“…On the basis of interview with the senior management involved in implementation process of ERP system identified some risk factors for ERP implementation which are: inadequate training, shortage of expert, lack of information flow within organization, failure of synergizing inside and outside expertise, business plan and vision not aligning with the ERP function, and separation from certain ready systems (Wright and Wright, 2001). Huang et al (2004) on the basis of research study proposed some risk factors for ERP projects which are: insufficient support from top management, no proper client communication, no proper training facilities for end -users, shortage of user's support, lacking project management, intention to integrate fully with existing system, conflict in business, improper structure of ERP team, failure in proper Business process reengineering, misunderstanding the demand for change.…”

The Effect of ERP System Implementations on the Management of Earnings and Earnings Release Dates

“…Also, there are concerns in practice with respect to the competency of IT auditors assigned to test the ERP system (e.g., Bagranoff and Vendrzyk 2000;Janvrin et al 2004). With respect to internal controls, Wright and Wright (2002), through semi-structured interviews with IT audit specialists, find that 31.8 percent of their participants had experiences in practice where their client's ERP system lacked adequate controls. These systems often remove traditional internal controls such as segregation of duties and supervisory review and require bolt-on internal control systems (Moore and Warrick 1998;Weinberg 1998).…”

“…In addition, these integrated systems eliminate barriers between firm functions, allowing managers unprecedented access to accounting information (O'Leary 2000). However, recent research indicates that there may be reductions in internal control effectiveness and audit quality in ERP system settings (Wright and Wright 2002;Hunton et al 2004;Brazel and Agoglia 2007). This combination of increased manager access and greater discretion over accounting information with a weaker system of checks and balances could lead to enhanced opportunities to manage earnings in ways that meet managers' objectives (e.g., beat earnings expectations).…”

Cousins Separated by a Common Language: Perceptions of Information Technology Risk

“…The emergence of e-business partnerships and outsourcing/co-sourcing arrangements, combined with the ubiquitous nature of computerized accounting systems, have increased the attention given to IT risk (Abu-Musa, 2006;Sutton and Hampton, 2003). IT risk investigated in the accounting information systems (AIS)literature include business interruption (Abu-Musa, 2006;Hermanson et al, 2000;Hunton et al, 2004), process interdependency (Hermanson et al, 2000;Hunton et al, 2004), logical security over networks and applications (Ettredge and Richardson, 2003;Hermanson et al, 2000;Hunton et al, 2004), and data integrity (Abu-Musa, 2006;Mock et al, 2008;Wright and Wright, 2002).…”