UWCISA Symposium 2007

1. UWCISA Symposium 2007 Auditing system development: Constructing the meaning of “systematic and rational” in the context of legacy code migration for vendor incentives A. Faye BorthickGeorgia State University, borthick@gsu.edu Paul L. BowenFlorida State University, pbowen@cob.fsu.edu J. Mack Robinson College of Business / Georgia State University

2. Simulation in response to learning needs • Growing emphasis on controlling system development to comply with SOX 404 • Scarcity of cases with data for practicing system development audits J. Mack Robinson College of Business / Georgia State University

3. The challenge Design and implement learning experiences for novices to develop expertise in auditing system development The approach Create authentic tasks (tasks that IS auditors would perform on the job) to simulate learning on-the-job J. Mack Robinson College of Business / Georgia State University

4. The task: Organofood system development audit • Organofood: Grocery chain • Objective: Audit migration of vender incentive code to an enterprise system (ES) with database querying • Approach: Audit vendor incentive accounts through analysis of the provided data in the context of the situation J. Mack Robinson College of Business / Georgia State University

5. Organofood: An authentic task in a simulation • Situation narrative: Context in conversation • Transaction data: For analysis with database or audit software querying • Links to background information • SDLC approval for migration project • Reporting template • Readiness questions for Saving Sergeant Pabletti epiphany J. Mack Robinson College of Business / Georgia State University

6. Situation narrative: Context in conversation • The scene: Auditors planning a system development in two parts: • Audit of migration of legacy code for vendor incentives to an enterprise system (ES) for a grocer • Audit of system development generally • Compliance • Productivity J. Mack Robinson College of Business / Georgia State University

7. Transaction data: Testdata database tables • Accounts: Accounts in general ledger • GeneralLedger: GL transactions • Incentive: Terms of vendor incentives • IncentiveCode: Incentive codes by type • Invoice: Vendor invoice • Purchase: Details of purchases • SKU: Information about stock keeping units (SKUs) • StoreSales: Sales by period, 4 weeks by week J. Mack Robinson College of Business / Georgia State University

8. Transaction data: ProgLibrary database tables • LibraryTransaction: Program library transactions • StageCode: Definition of stageCodes J. Mack Robinson College of Business / Georgia State University

9. Four-column reporting template • Audit objective • Audit procedure • Results from executing queries • Reporting • Findings from querying • Recommendations, if any • Data limitations, if any J. Mack Robinson College of Business / Georgia State University

10. J. Mack Robinson College of Business / Georgia State University

11. Prerequisite skills and knowledge • Querying proficiency • Familiarity with system development • Some experience developing audit objectives and procedures J. Mack Robinson College of Business / Georgia State University

12. Analysis tool choices • Microsoft Access QBE • Audit software, e.g., ACL, IDEA • SQL J. Mack Robinson College of Business / Georgia State University

13. Readiness questions: Sergeant Pabletti epiphany • Saving Sergeant Pabletti: Video game played by 80,000 Army recruits each year • Recruits inept in first play of game • With learning, recruits save the sergeant • Vicarious experience for the twitch generation on the value of learning and thinking • Objective: Afford learners in IS audit a Saving Sergeant Pabletti epiphany about the value of thinking deeply about the situation J. Mack Robinson College of Business / Georgia State University

14. Organofood readiness question • The data in OrganofoodProgLibrary.mdb permit verifying: • Completeness of requirements • Effectiveness of user participation • Completeness of quality assurance • The adequacy of the SDLC method • Separation of duties in development J. Mack Robinson College of Business / Georgia State University

15. Learning objectives • Understand up the business situation • Perform audit steps • Develop audit objectives* • Design audit procedures • Execute audit procedures with querying • Communicate objectives, procedures, and results in a report • * Could be provided for AIS classes J. Mack Robinson College of Business / Georgia State University

16. References for situation model building • Barsalou. 1999. Language comprehension: Archival memory or preparation for situated action? Discourse Processes 28 (1): 61-80 • Zwaan and Radvansky. 1998. Situation models in language comprehension and memory. Psychological Bulletin 123 (2): 162-185 J. Mack Robinson College of Business / Georgia State University

17. The task: Organofood audit • Dysfunctional conditions to find: • Sales data not extrapolating to achieving volume discounts • Volume discounts booked at wrong percent (too high) • Developers performing incompatible duties for some components • eXtreme Programming (XP) more productive than a more traditional SDLC approach J. Mack Robinson College of Business / Georgia State University

18. Why are these conditions hard to find? • Developing audit objectives requires integrating the concepts of system development objectives: • Satisfying user requirements • Being on time and on budget • The querying is complicated, requiring sequences of queries, cf. Hendrawirawan et al. 2007 J. Mack Robinson College of Business / Georgia State University

19. Learner reaction to Organofood • Liked readiness questions for calibrating understanding of the situation • Frustrated initially but eventually pleased with developing concept of “systematic and rational” • Appreciated opportunity to test their sense-making ability • Interested in how to develop better audit objectives in future audits J. Mack Robinson College of Business / Georgia State University

20. What is Organofood’s contribution? • Give students practice in: • Making sense of an authentic audit situation from conversation • Developing system development audit objectives • Querying and analyzing transaction data in an authentic audit situation • Interpreting query results J. Mack Robinson College of Business / Georgia State University

21. Access • Web staging of the simulation including a link to the database: • http://www2.gsu.edu/~wwwsys/pro/project/Organofood/site/Organofood.htm • Use name = ac863 and password = Qd0319 J. Mack Robinson College of Business / Georgia State University