Compliance by design – Bridging the chasm between auditors and IT architects

Abstract

System and process auditors assure -from an information processing perspective -the correctness and integrity of the data that is aggregated in a company's financial statements. To do so, they assess whether a company's business processes and information systems process financial data correctly. The audit process is a complex endeavor that in practice has to rely on simplifying assumptions. These simplifying assumptions mainly result from the need to restrict the audit scope and to focus it on the major risks. This article describes a generalized audit process. According to our experience with this process, there is a risk that material deficiencies remain undiscovered when said simplifying assumptions are not satisfied. To address this risk of deficiencies, the article compiles thirteen control patterns, which -according to our experience -are particularly suited to help information systems satisfy the simplifying assumptions. As such, use of these proven control patterns makes information systems easier to audit and IT architects can use them to build systems that meet audit requirements by design. Additionally, the practices and advice offered in this interdisciplinary article help bridge the gap between the architects and auditors of information systems and show either role how to benefit from an understanding of the other role's terminology, techniques, and general work approach.

Data-Oriented Interface Responsibility Patterns

“…Data-oriented methods are well suited to identify Information Holder endpoints, but sometimes go too far. 18 The counter position is taken by a post in M. Nygard's blog 19 for a responsibility-based strategy for avoiding pure Information Holder Resources, which he refers to as "entity service anti-pattern": He recommends to always evolve away from this pattern 20 (because it creates high semantic and operational coupling) and rather "focus on behavior instead of data" (which we describe as Processing Resource and "divide services by life cycle in a business process" (which we see as one of several service identification strategies). In our opinion, this advice goes too far as well: Information Holder Resources do have their place, but any usage should be a conscious decision motivated and justified by the business and integration scenario at hand -because of the impact on coupling that Nygard describes.…”

Modeling the Organizational Regulatory Space: A Joint Design Approach

“…Compliance is a well-known research subject in IS. The literature addresses topics such as the compliance of business processes and services [14][15][16], requirements engineering and conceptual modeling [17,18], auditing IS compliance [19,20], and the alignment between law and IT compliance [21]. However, the majority of studies focus on the perspective of modeling and checking compliance [10], lacking the human behavior in that regulatory space and the guidance to allow cooperation between different experts, not specific to a technology or IT architecture.…”

“…There are similarities between the development methods of the IS and of specific systems that define the ORS, for instance, the ISO 9001 management system [27]. As stated by [2,20,21], both the IS and regulatory compliance should be achieved by an holistic design.…”

Auditing service providers: supporting auditors in cross-organizational settings

“…Audits commonly validate the adequacy and effectiveness of internal controls (Carlin and Gallegos, 2007;Julisch et al, 2011). Currently, auditors performing audits at service providers largely rely on manual approaches to information procurement.…”