Critical thinking involves systematically applying concepts in different situations. Today’s exercise will apply some of the “Performing IS Audits” concepts by reviewing a recent IS audit conducted by the Oregon Secretary of State's Audit Division. Thinking through the case can help you master course material. Perhaps interestingly, three of the auditors are OSU College of Business grads including Jessica Ritter who took this course a few years ago.

The OLCC audit introduces many topics we will cover this term. We will talk about only a few of them in this assignment. But if you have a few minutes, read the rest of the report.

Before you begin answering the questions, review the following:

- The summary page with the highlights.

- Pages 5 and 6 which present the audit plan.

- The findings sections labelled:

o OLCC lacks processes to monitor some third-party service providers (p 12)

o Interface reconciliation processes non-existent (p 13)

o Test data in Marijuana Licensing System production environment (p 13)

o User account management processes lacking (p 14)

• Explain in your own words, the difference between audit objectives and audit procedures. Use one or more details from the report as examples in your answer.

• Name thing(s) the OLCC should have done but did not do before contracting with Franwell.

• According to the report, what are the interface controls supposed to accomplish? (Note, interface here, does NOT mean a user interface. Check your context)

• In your own words, explain the provided evidence that test data was not properly managed.

• Choose an element included in the bullet points in the Methodology sectionon page 5 of the report. Explain (in perhaps 2-3 sentences) what the auditor might have done to evaluate or test listed control practices. The idea is to practice formulating and audit procedure. Is it clear that what you wrote describes an audit procedure?

Complete answers should take more than a half page but fit on one page. They will be graded mostly for effort, but partly for correctness - think carefully did you answer the question as presented?