The Development of a Computer Auditing System Sufficient for Sarbanes-Oxley Section 404— A Study on the Purchasing and Expenditure Cycle of the ERP System

Abstract

After Section 404 of the Sarbanes-Oxley Act (SOX 404) was released, developing a computer auditing system became more important for management and auditors. In this study, the researchers aim to: (1) explore the crucial control items of the purchasing and expenditure cycle in meeting the conditions of SOX 404; (2) develop a computer auditing system based on the recognized control items and requirements of SOX 404; and (3) validate the applicability of the system by using an ISO/IEC 9126 model in meeting organizational needs (ISO, 2001). The Gowin's Vee research strategy developed by Novak & Gowin (1984) was used in the study. In theory, researchers have identified eight operational procedures and 34 critical control items for the purchasing and expenditure cycle. The prototype computer auditing system of this study was then developed. On the experimental side, the researchers conducted two case studies based on the ISO/IEC 9126 software assessment criteria, the result of which showed that the system can provide company internal auditing personnel and their external auditors with a simple, continuous, timely, and analytical tool, which may promptly and effectively help in detecting problem control issues. We believe this study can contribute to the development of a sufficient and manageable computer auditing system, and provide prospective researchers and businesses with future directions in this subject area.Keywords computer auditing, internal control, purchasing and expenditure, SarbanesOxley Act, ISO/IEC 9126The Enron scandal in 2001 unleashed a great impact on investors' confidence. Pressured by investors and critics, the United States Congress hastily passed into federal law the Sarbanes-Oxley Act (SOX) of 2002, with US President George Bush signing the act on July 30, 2002. The most contentious aspect of SOX is Section 404 (SOX 404), which requires management and external auditors to report on the adequacy of the company's Internal Control over Financial Reporting (ICFR). This is noted by companies as the most costly aspect of the legislation to implement since documenting and testing important financial manual and automated controls requires enormous effort (Chan, Farrell, & Lee, 2005). Both management and the external auditor become responsible for performing their assessment in the context of a topdown risk assessment, requiring the management to deliberate both the scope of its assessment and the evidences gathered concerning risks (Romney & Steinbart, 2006). However, the validation and correctness of the internal control has remained an issue to management units and accountants since their key responsibilities revolve around fulfilling implementation and auditing of internal control. While many firms have resorted to computerization of their operations, auditing remains a manual task for some organizations. Similarly, firms that have adopted computer auditing techniques have not yet fully attained effectiveness and efficacy. As such, the need for a useful computer auditing system becomes c...

The Use of an ERP System to Facilitate Regulatory Compliance

“…9) Technology: This concerns the security of systems used for the entry and maintenance of accounting records. As financial reporting data in publicly listed firms is inevitably stored in computer-based systems, the controls are incorporated into each firm's IT processes (Haworth & Pietron, 2006).Wider access must be restricted to those whose duties require access in order to prevent fraud (Chang et al, 2008). Potential systemic weaknesses include inadequate program controls and lack of oversight over access (Stoel & Muhanna, 2011).…”

“…These sections are intended to ensure that companies establish and maintain internal controls with the aim of enhancing corporate accountability, rebuilding shareholder confidence, protecting the public from fraud, and restoring trust in the financial reporting system (Haworth & Pietron, 2006). SOX 404 requires executives and their auditors to confirm the effectiveness and adequacy of the firm's internal controls over financial reporting (Chang, Wu, & Chang;Mock et al, 2009). Its core requirement is an annual report detailing the internal controls in place and assessing the effectiveness of these controls, including the identification of any flaws in the control system (Arnold et al, 2011a).…”

“…Unqualified staff can result in a failure to identify and solve accounting problems as well as a failure to perform effective reviews. Auditing and accounting staff must be adequately trained in the use of any information technology that is used to manage accounting processes (Chang et al, 2008). 5) Revenue recognition: Relates to the design and review of revenue-recognition policies and contracting policies.…”

Adaptation du modèle de développement moral de Kohlberg à l’analyse des chartes éthiques informationnelles dans un contexte multiculturel

“…Dans la pratique, l'éthique des TI/SI existe par ce que ces technologies sont porteuses d'autant de craintes que d'espoirs. Elle vise également à remplir un vacuum normatif et légal grâce notamment à l'édition de codes ou de chartes éthiques, à l'exemple de la Sarbanes-Oxley Act (SOX) qui depuis 2002, se propose de mettre au point les bases éthiques des différents usages des TI/SI aux USA (Chang et al, 2008).…”

The Internal Audit Performance: The Effectiveness of ERM and IT Environments

“…Although the ERP systems and auditing software may be considered beneficial for IA work, internal auditors may still feel it is difficult and complicated to use these systems owing to their lack of sufficient knowledge or unfamiliarity with these new technologies [4,22]. As a result, the ERP system or auditing software may be unable to benefit their work and the performance of IA.…”