TheAlpha Corporationis a large retailer of fine clothing. It has recently fired its Information Systems Director after experiencing several years of budget overruns in systems development and computer operations. An internal auditor with computer management experience has been appointed as acting Information Systems Director.

A significant obstacle to your review has been the lack of written information about the activities of the department or the policies under which it was managed. The previous director apparently managed in an informal manner, communicating assignments, standards, and performance evaluations to his employees verbally.

An IT Governance Committee is established, which is a sub-committee of the Corporate Governance Committee, established by the Board. The members of the IT Governance Committee consist of: three board members; Vice Presidents on the business side as well as Vice Presidents on the IT side; the chief financial officer; other stakeholders as appropriate.Any major IT capital expenditure and computer developments that exceed $500,000 have to beapprovedby the IT Governance Committee who in turn recommendthemto the Board of Directors for approval.

During initial discussions with information systems personnel you note the following:

A new outsourced information systems project is currently underway to improve the functionality of the company's sales web site whichis 6 to 10 weeks behind schedule. TheAlphaproject leader,Ermen, has reassured you that he has never missed a deadline in his 30 years of work and knows that the programmers are always overestimating the time that Information Systems takes to test the new system. You are surprised upon hearing about this new project since theinternal audit departmenthad not heard of this major undertaking.

When asked for the business case for the web site project Ermen mumbled that the business caseneeded to be changed some time after the contract was signed, however he's too busy to get the case for you.Ermen indicated that Hugo Consultants, a third party, will host the new web site for Balderssarini. Ermen is excited about Hugo's new technology which is not well understood at Balderssarini. Hugo representatives have assured him that additional resources will be made available to theAlphaproject since some of Hugo's bigger clients are expected to have their projects completed soon. Ermen notes that the coding phase of the web site project has started since businessspecifications arealmost 50% complete.

Users have complainedaboutreporting problemsinthe inventory system, so a meeting was set up with Edmonds, a very knowledgeable programmer, to try to pinpoint the cause of thesedifficulties. Edmonds is frustrated with the number of source code changes that he needs to implement to meet user reporting requirements. He would like computer operations to become more involved, but is concerned as new operations staff do not even know how to move source code into production. He notes that this doesn't matter much since most of the changes are treated as emergency changes. All emergency changes areverballyapproved.

The computer operations manager gave you a tour of the area. You note that backup tapes are kept in the file cabinet in her office. Themanagerwas complaining about not being able to monitor all her staff after recent company cutbacks.

Required:(24marks)

1.Evaluatethe strengths and weaknesses ofIT governance atAlpha Corp.(6marks)

2.

a.Based on the Canadian audit standards, why are auditors required to understand the information systems and related business processes? (4 marks)

b.How does the quality of the IT governance affect your ability to conduct an information systems audit of general controls?(Address both financial statement and operational audit.)(4 marks)

3.Explainfourcharacteristics of the computer environment that may impact the control environment.(4marks)

4.The CEO would like to you to compare and contrasttheCOSO and COBIT models. Provide 3 similarities and 3 differences between the models.(6 marks)