ACCT 3233/7233 · LSU · IIA Standards, Cybersecurity Risk & ITGC Testing
Internal auditing provides 4 services:
Goal: create, protect, and sustain value
Three Lines Model:
Evaluates if the control can work (the blueprint):
"A flawed blueprint can never produce a sound structure"
| Frequency | Low Risk | Moderate Risk | High Risk |
|---|---|---|---|
| Annual | 1 | 1 | 1 |
| Quarterly | 2 | 2-3 | 4 |
| Monthly | 2-3 | 4-6 | 8-12 |
| Weekly | 5-9 | 10-15 | 20-25 |
| Daily | 10-15 | 20-30 | 40-60 |
| Per occurrence | 25 | 40 | 60 |
External (SOX/PCAOB):
Internal (IIA-aligned): Critical/High, Medium, Low
Assurance: 3 parties (auditor, auditee, stakeholders); auditor sets scope; formal conclusions; skepticism default. Examples: SOX testing, compliance reviews
Advisory: 2 parties (auditor + client); client sets scope; recommendations only (no "opinion"); collaboration posture. Examples: M&A due diligence, process design
Mandatory when in scope. Effective 12 months after issuance. Must document which apply and rationale for any exclusions.
Cyber risk is adversarial — an intelligent actor actively probes for weaknesses and adapts to your defenses. Most risks are passive; cyber risk is not. Hobbes: cyberspace is close to the "war of all against all."
Info accessible only to authorized users. Protection against unauthorized disclosure.
Threats: Data breaches, unauthorized access, eavesdropping
Info/systems accurate, complete, unaltered except by authorized actions. Protection against unauthorized modification.
Threats: Data tampering, malware, man-in-the-middle attacks
Info/systems accessible when needed. Protection against disruption.
Threats: DDoS attacks, ransomware, system failures
| Control Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop attacks before they succeed | Firewalls, access controls, encryption, patching, security awareness |
| Detective | Identify attacks in progress or after | SIEM, IDS/IPS, log monitoring, anomaly detection, threat hunting |
| Corrective | Respond and recover | Incident response, backup/restore, disaster recovery, forensics |
| Domain | Focus Areas | Key Question |
|---|---|---|
| Governance | Board oversight, strategy, policies, roles, resource allocation | Does leadership own cybersecurity? |
| Risk Management | Asset ID/classification, threat assessment, risk appetite, third-party risk | Do they know what they're protecting? |
| Controls | IAM, network security, data protection, monitoring, incident response, DR | Are the controls actually working? |
Old "Attribute" and "Performance" categories are eliminated. New structure is cleaner, governance-focused.
| Domain | # | Principle | Key Concept |
|---|---|---|---|
| I – Purpose | — | Why IA exists | Assurance, Advice, Insight, Foresight (NEW) |
| II – Ethics | P1 | Integrity | Kant – categorical imperative; truthful even when difficult |
| P2 | Objectivity | Husserl – epoché; bracket assumptions; manage confirmation bias | |
| P3 | Competency | Aristotle – phronesis; know what you don't know; use specialists | |
| P4 | Due Professional Care | Hume – can't test everything; sample intelligently; document reasoning | |
| P5 | Confidentiality | Protect info; breach once = never get candid info again | |
| III – Governing | P6 | Authorized by Board | Charter = source of authority; board approves mandate |
| P7 | Positioned Independently | CAE reports functionally to board; structural independence | |
| P8 | Overseen by Board | Board approves plan, budget, resources; they're accountable too | |
| IV – Managing | P9 | Plan Strategically | Risk-based audit plan; dynamic, not cyclical |
| P10 | Manage Resources | People, tech, budget; document when insufficient | |
| P11 | Communicate Effectively | Bidirectional; listen as much as inform | |
| P12 | Enhance Quality | QAIP; EQA every 5 years with active CIA required | |
| V – Performing | P13 | Plan Engagements | Understand activity, risk assessment, define scope, work program |
| P14 | Conduct Work | Gather evidence, Four C's, recommendations, conclusions | |
| P15 | Communicate & Monitor | No surprises; confirm implementation; follow-up |
| Line | Who | Role | Reports To |
|---|---|---|---|
| 1st Line | Management (Operations, IT, HR) | Owns risk and controls day-to-day | Senior Management |
| 2nd Line | Risk & Compliance (ERM, Legal, Security) | Supports, monitors, provides expertise | Senior Management |
| 3rd Line | Internal Audit | Independent assurance on governance, risk, controls | Board/Audit Committee |
| Governing Body | Board | Accountability to stakeholders | Stakeholders |
"Did the control work when it should have?"
Testing the happy path. Select legitimate transactions and verify approvals obtained, within timeframes, by authorized individuals, with proper documentation.
Limitation: Positive testing alone creates false confidence. A control that approves everything but blocks nothing is useless.
"Did the control prevent what it should have?"
Testing the guardrails. Attempt to bypass: Can terminated users log in? Can users self-approve? Does system block SoD violations? Are unauthorized changes rejected?
Core question: "If everyone followed this control perfectly, would it actually prevent or detect the risk?"
| Method | Description | When to Use | Limitation |
|---|---|---|---|
| Random | Equal probability; use random number generator | Large, homogeneous populations | May miss high-risk items by chance |
| Stratified | Divide into subgroups; sample by risk | Heterogeneous populations with risk strata | Requires understanding of risk factors |
| Haphazard | Without specific pattern; auditor judgment | Small populations; preliminary testing | Unconscious bias; not statistically valid |
| Census (100%) | Test entire population | Small populations; critical controls | Time-consuming; may not be practical |
The control CAN'T work. The blueprint is flawed (policy doesn't exist, gaps, wrong approvers, SLA undefined).
Even perfect execution won't prevent the risk.
Remedy: Policy/process redesign
⚠️ Don't prescribe training for a design problem!
The control DIDN'T work. Good design, but execution failed (approvals missing, SLA breached, reviews not completed).
Remedy: Training, monitoring, automation
| Symbol | Meaning | When to Use |
|---|---|---|
| ✓ | Tested, no exception | Attribute tested and passed |
| ✗ | Exception identified | Attribute tested and failed |
| N/A | Not applicable | Attribute doesn't apply to this item |
| T | Traced/Tied | Amount traced to source document |
| R | Recalculated | Calculation independently verified |
| I | Inquiry | Confirmed via inquiry |
| ⊙ | Inspected original | Viewed original document/screen |
| ◊ | Follow-up needed | Requires additional investigation |
| Rating (External) | Definition | Consequence |
|---|---|---|
| Material Weakness | Reasonable possibility material misstatement not prevented/detected | Adverse ICFR opinion |
| Significant Deficiency | Less than MW but merits oversight attention | Report to Audit Committee |
| Control Deficiency | Design/operation gap not reaching SD/MW level | Management letter |
Written Moscow, February 12, 1974 — the day before his arrest and deportation from the Soviet Union. Circulated as samizdat (underground self-published literature).
Solzhenitsyn argues that totalitarian power sustains itself not primarily through overt violence, but through the daily participation of ordinary people in lies. Violence and lies are symbiotic: violence needs lies to maintain a respectable face; lies need violence to be enforced. But here is the key insight — violence cannot act on every person every day. All it demands is obedience to lies and daily participation in lies.
Therefore, the simplest and most accessible act of resistance is personal non-participation in lies. Not revolution. Not mass protest. Just: refuse to say what you do not think.
Lies are compared to a virus: they can survive only in a living organism. When people stop participating, the lies are rendered helpless and subside. The power of the system depends entirely on individual complicity.
Solzhenitsyn frames the choice starkly: every day presents a choice between spiritual independence (truth) or spiritual servitude (lies). There is no neutral ground. Even technically-minded people working in the sciences face this choice daily.
He observes that people don't even fear nuclear war or a third world war — but they deeply fear acts of civil courage: lagging behind the herd, taking one step alone, losing their job, their heating gas, their Moscow registration. Comfort is the prison.
He explicitly calls this "the most moderate of all paths of resistance" — easier than Gandhi's civil disobedience, far easier than a hunger strike or self-immolation. The flames will not touch your body. Your family can still get black bread and fresh water. The bar is low — which makes the failure to clear it all the more damning.
He lists specific commitments: will not sign/write/print phrases that distort truth; will not utter them in public or private; will not cite out of context to please someone; will walk out of a meeting if a speaker tells lies; will not subscribe to publications that distort facts. The pattern, once started, applies itself to new cases.
He invokes Czechoslovakia — "betrayed and deceived by us" — as evidence that even an unarmed people with worthy hearts can stand up to tanks. And: if we are in thousands, they cannot do anything to anyone. If tens of thousands, we will not recognize our country. Individual choices aggregate into collective transformation.
He ends with contempt for those too frightened to act, quoting Pushkin: "What use to the herds the gifts of freedom? The scourge, and a yoke with tinkling bells — this is their heritage, bequeathed to every generation." Those who choose comfort over truth have no right to complain about their suffocation — they are doing it to themselves.
| Solzhenitsyn Concept | IIA / Audit Parallel |
|---|---|
| "Personal non-participation in lies" | Standard 1.1 – Acting Honestly and Courageously; never omitting material facts from findings |
| "Obedience to lies" as the crux of complicity | Softening findings to protect relationships; "reframing" unfavorable results at management's request |
| Violence needs lies; lies need participation | Fraudulent organizations depend on auditors who look the other way or document what they're told |
| Fear of civil courage (losing job/comfort) | Practitioner pressure: "could we reframe this?" — the auditor who backs down under pressure |
| Spiritual independence vs. servitude | Every audit engagement is a choice between objective reporting and management appeasement |
| The code of conduct list | The IIA Code of Ethics; the specific prohibitions in Standards 1.1, 2.1 |
| Kant's categorical imperative (referenced in slides) | If all auditors softened findings, the profession collapses — same logic as Solzhenitsyn |
Originally published in Vogue; later collected in Slouching Towards Bethlehem. Uses "negative definition" — defining the concept largely through what it is not.
Didion argues that self-respect is fundamentally an internal standard, having nothing to do with others' approval or reputation. Its source is character — the willingness to accept responsibility for one's own life. Without it, one becomes an unwilling audience to an interminable documentary of one's own failures, and eventually runs away from oneself to find no one at home.
Self-deception, she argues, is the most difficult deception — far harder to overcome than deceiving others. The tricks that work on others count for nothing in the well-lit back alley where one keeps assignations with oneself.
She begins with not being elected to Phi Beta Kappa — a failure predictable, unambiguous. She had thought herself exempt from cause-and-effect relationships that hampered others. That day marked the end of something: the loss of the comfortable conviction that lights would always turn green for her.
Self-respect has nothing to do with the approval of others — who are, after all, deceived easily enough. It has nothing to do with reputation, which, as Rhett Butler told Scarlett O'Hara, is something people with courage can do without. No winning smiles or prettily drawn lists of good intentions will do here.
"Character — the willingness to accept responsibility for one's own life — is the source from which self-respect springs." People with self-respect have the courage of their mistakes: they do not seek absolution, do not complain unduly of unfairness. They exhibit moral nerve — what was once called character.
To live without self-respect is to be an unwilling audience to a documentary of one's own failings — fresh footage spliced in for every screening. Counting the sins of commission and omission, the trusts betrayed, the promises broken, the gifts wasted through sloth or cowardice. Eventually one lies down alone in that notoriously uncomfortable bed we make ourselves.
Jordan Baker (careless, dishonest in The Great Gatsby) had self-respect — she made her own peace, avoided threats to that peace. Julian English (careless, suicidal in Appointment in Samarra) did not. The paradox: the outwardly dishonest person had it; the seemingly respectable one was hollow. Self-respect is not correlated with conventional virtue.
Self-respect is a discipline, a habit of mind — it can be developed, trained, coaxed forth. Small disciplines represent larger ones — not for the ritual itself but as a way of remembering who and what we are. It is difficult to continue fancying oneself Cathy in Wuthering Heights with one's head in a paper bag.
In its advanced stages, alienation from self means we no longer answer the telephone — someone might want something. We cannot say no without drowning in self-reproach. Every encounter demands too much. Without self-respect, one eventually runs away to find oneself and finds no one at home.
To have that sense of intrinsic worth is potentially to have everything: the ability to discriminate, to love, and to remain indifferent. To lack it is to be locked within oneself — paradoxically incapable of either love or indifference. Without it, we despise those who have so few resources as to consort with us.
| Didion Concept | IIA / Audit Parallel |
|---|---|
| Self-respect ≠ approval of others | Principle 2 (Objectivity) — independence not just attitudinal but structural; not seeking management approval |
| Character = accepting responsibility for one's own life | Principle 1 (Integrity) — the willingness to own unfavorable findings without softening them |
| Discipline as habit of mind | Principle 4 (Due Professional Care) — skepticism not as instinct but as cultivated practice |
| Courage of one's mistakes | Auditors who acknowledge their own errors in prior work rather than burying them |
| The "interminable documentary" | The auditor who compromised integrity — each watered-down finding replays in professional memory |
| Small disciplines represent larger ones | Documentation rigor, tick marks, referencing every exhibit — small habits that hold when under pressure |
| Self-deception is the most difficult deception | Confirmation bias (Principle 2 — most dangerous bias is finding what you expect to find) |
What they share:
Applied to auditing:
Published in Harper's Magazine, December 1973. Adapted from Obedience to Authority. Written in direct response to Hannah Arendt's coverage of the Eichmann trial and her concept of the "banality of evil."
Milgram set out to test empirically what philosophers and historians had theorized: how far will ordinary people go when ordered to harm another person by an authority figure? His answer was disturbing — and directly relevant to anyone who works inside an institution. Most people will comply with harmful orders not because they are sadistic, but because they have entered what Milgram calls the agentic state: they come to view themselves as instruments of another's will, and therefore no longer hold themselves responsible for the content of their actions.
This is, Milgram argues, the most fundamental lesson of his study: ordinary people, simply doing their jobs, without any particular hostility, can become agents in a terrible destructive process.
Two people come to a Yale psychology lab to take part in a study of "memory and learning." One is designated Teacher (the real, naïve subject); the other a Learner (actually an actor/confederate). The Learner is strapped into a chair with an electrode on his wrist. The Teacher sits before a shock generator with 30 switches ranging from 15 to 450 volts, labeled from "Slight Shock" through "Danger: Severe Shock" to simply "XXX."
Each wrong answer from the Learner requires the Teacher to administer a shock of increasing intensity. The Learner — who receives no actual shock — follows a script: grunts at 75V, complains at 120V, demands to be released at 150V, goes silent after 330V.
Predicted: Psychiatrists, college students, and middle-class adults all forecast that virtually all subjects would refuse. Psychiatrists specifically predicted only a pathological fringe of ~1 in 1,000 would reach 450 volts.
Actual: 25 of 40 subjects (62.5%) obeyed to the maximum 450-volt shock. Results replicated across Yale undergrads, New Haven community members, and internationally — Munich: 85% obedient. The result was the same regardless of social class, profession, or background.
A 31-year-old medical technician who had emigrated from Germany. At 210V she tells the experimenter firmly: "Well, I'm sorry, I don't think we should continue." When told she has no other choice, she replies: "I think we are here on our own free will. I don't want to be responsible for anything happening to him." She refuses — and the experiment is terminated. Milgram notes her behavior was "the very embodiment of what I envisioned would be true for almost all subjects."
Unemployed, about 50. Becomes increasingly agitated as the voltage climbs but continues obeying. At 375V the subject stands up. Prozi insists something has happened to the man in there. He continues all the way to 450V — but not from indifference. He is visibly distressed, asking the experimenter who will take responsibility. The experimenter replies: "The responsibility is mine." Prozi continues. The subjects excused their behavior by saying responsibility belonged to the man who actually pulled the switch.
The essence of obedience: a person comes to view himself as the instrument for carrying out another person's wishes, and therefore no longer regards himself as responsible for his actions. Once this critical shift of viewpoint has occurred, all the essential features of obedience follow. The subordinate's morality doesn't disappear — it acquires a radically different focus: shame or pride based on how adequately he has performed the actions called for by authority.
Hannah Arendt contended that the prosecution's effort to depict Eichmann as a sadistic monster was wrong — he came closer to being an uninspired bureaucrat who simply sat at his desk and did his job. Milgram's data confirms: the ordinary person who shocked the victim did so out of a sense of obligation — an impression of his duties as a subject — and not from any peculiarly aggressive tendencies. "The subjects do not derive satisfaction from inflicting pain, but they often like the feeling they get from pleasing the experimenter."
In a variation where the subject only administered the word-pair test while another person pulled the shock lever, 37 of 40 adults continued to the highest level — excusing their behavior by saying responsibility belonged to the man who actually pulled the switch. This illustrates a dangerously typical arrangement in complex organizations: it is easy to ignore responsibility when one is only an intermediate link in a chain of action. No one is confronted with the full consequences of his decision to carry out the evil act.
Physical presence of authority: When orders were given by telephone instead of in person, obedience dropped to roughly one-third of normal levels.
Conflicting authority: When two experimenters of equal status gave incompatible orders, no shocks were delivered past the point of their disagreement.
Rebellious peers: When two other "teachers" (actors) disobeyed and refused to continue, 36 of 40 real subjects joined them and refused as well. One voice of dissent drastically changes the moral landscape.
| Milgram Concept | IIA / Audit Parallel |
|---|---|
| The agentic state — "I'm just carrying out instructions" | Standard 1.1 (Integrity) — "I just did what the partner told me" is not a defense; auditors retain personal responsibility for their work |
| Diffusion of responsibility in a chain of action | In complex audit engagements, each person signs only one workpaper — but the collective failure belongs to all; "someone else checked it" is not sufficient |
| Obedience drops sharply without physical presence | Remote/hybrid audit teams; the importance of direct engagement with management rather than purely email/documentation trails |
| One rebellious peer collapses obedience | Speak-up culture; the IIA's expectation that auditors report impairments to independence; a single auditor voicing concern changes the room |
| Subjects comply out of duty, not sadism | Audit failures are rarely malicious — they are the product of incremental compliance: each small compromise feels manageable until the finding is unrecognizable |
| The banality of evil — bureaucrat at his desk | The auditor who processes 40 workpapers a day without engaging judgment is Eichmann at his desk — technically compliant, morally vacant |
| Experimenter's authority was fragile — no real power to enforce | Management pressure on audit findings is similarly fragile if the auditor simply refuses to capitulate; authority depends on the subject's continued consent |
What they share:
Applied to auditing: