Breach of Data at TJX: An Instructional Case Used to Study COSO and COBIT, with a Focus on Computer Controls, Data Security, and Privacy Legislation

Abstract

Internal control frameworks (ICF) provide a basis for understanding controls in an organization and for making judgments about the effectiveness of controls. The Sarbanes-Oxley Act of 2002 (SOX) requires companies to report, on an ongoing basis, the effectiveness of their internal controls in their annual filings. The Securities and Exchange Commission (SEC) recommends companies use ICF to help achieve compliance with SOX. ICF provide a useful tool for management and auditors evaluating and addressing the adequacy of controls in their organization. As there is no such thing as a “risk-free” enterprise, developing an understanding of ICF is important for students entering the accounting profession. This instructional case provides students the opportunity to assess internal control risks within an organization's information system using a “real-world” problem following COSO (SEC-recommended ICF) and/or COBIT as a guide. Students then evaluate the organization's overall level of internal control risks and formulate recommendations for mitigating such risks.

Audit Firm Assessments of Cyber-Security Risk: Evidence from Audit Fees and SEC Comment Letters

“…Given that IT internal control weaknesses may increase cyber-security risk (Klamm & Watson, 2009;Cereola & Cereola, 2011), we test the robustness of our results by adding such a factor in the regression models presented in Equation 1and Equation 3. We also run the regressions with and without the indicator variable for internal control weakness (ICWEAK) to avoid potential multicollinearity-related bias.…”

Information Technology Controls Quality and Audit Fees: Evidence From Italy

“…The two frameworks, COSO Report and COBIT, most widely used on a voluntary basis in Italy (Azzali & Mazza, 2013) were selected for our study to investigate IT CONTROLS FRAMEWORKS COMPLIANCE . Many studies examine COSO and COBIT reports (Bernroider & Ivanov, 2011; Cereola & Cereola, 2011; Garelli, 2009; Kuhn, 2007; Lainhart, 2000; Merhout & Havelka, 2008; Mishra & Weistroffer, 2007; Panko, 2006; Tuttle & Vandervelde, 2007). COSO is a model for internal controls and corporate governance (Harris, 2006).…”

The Status of Internal Controls in Fast Moving Small Medium and Micro Consumer Goods Enterprises within the Cape Peninsula

“…In addition, such frameworks are useful tools for both management and internal auditors to evaluate and address the adequacy of internal controls in their respective organisation(s) (Cereola & Cereola, 2011). The internal control frameworks that are of particular importance are that of the COSO internal control framework, COBIT framework and the COCO framework.…”

“…According to Cereola and Cereola (2011) internal control frameworks provide a basis for internal controls in any organisation and is also used to make decisions around the effectiveness of existing internal controls. In addition, such frameworks are useful tools for both management and internal auditors to evaluate and address the adequacy of internal controls in their respective organisation(s) (Cereola & Cereola, 2011).…”