ACCT 3233/7233 · LSU · IIA Standards, Cybersecurity Risk & ITGC Testing
Internal auditing provides 4 services:
Goal: create, protect, and sustain value
Three Lines Model:
Evaluates if the control can work (the blueprint):
"A flawed blueprint can never produce a sound structure"
| Frequency | Low Risk | Moderate Risk | High Risk |
|---|---|---|---|
| Annual | 1 | 1 | 1 |
| Quarterly | 2 | 2-3 | 4 |
| Monthly | 2-3 | 4-6 | 8-12 |
| Weekly | 5-9 | 10-15 | 20-25 |
| Daily | 10-15 | 20-30 | 40-60 |
| Per occurrence | 25 | 40 | 60 |
External (SOX/PCAOB):
Internal (IIA-aligned): Critical/High, Medium, Low
Assurance: 3 parties (auditor, auditee, stakeholders); auditor sets scope; formal conclusions; skepticism default. Examples: SOX testing, compliance reviews
Advisory: 2 parties (auditor + client); client sets scope; recommendations only (no "opinion"); collaboration posture. Examples: M&A due diligence, process design
Mandatory when in scope. Effective 12 months after issuance. Must document which apply and rationale for any exclusions.
Cyber risk is adversarial — an intelligent actor actively probes for weaknesses and adapts to your defenses. Most risks are passive; cyber risk is not. Hobbes: cyberspace is close to the "war of all against all."
Info accessible only to authorized users. Protection against unauthorized disclosure.
Threats: Data breaches, unauthorized access, eavesdropping
Info/systems accurate, complete, unaltered except by authorized actions. Protection against unauthorized modification.
Threats: Data tampering, malware, man-in-the-middle attacks
Info/systems accessible when needed. Protection against disruption.
Threats: DDoS attacks, ransomware, system failures
| Control Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop attacks before they succeed | Firewalls, access controls, encryption, patching, security awareness |
| Detective | Identify attacks in progress or after | SIEM, IDS/IPS, log monitoring, anomaly detection, threat hunting |
| Corrective | Respond and recover | Incident response, backup/restore, disaster recovery, forensics |
| Domain | Focus Areas | Key Question |
|---|---|---|
| Governance | Board oversight, strategy, policies, roles, resource allocation | Does leadership own cybersecurity? |
| Risk Management | Asset ID/classification, threat assessment, risk appetite, third-party risk | Do they know what they're protecting? |
| Controls | IAM, network security, data protection, monitoring, incident response, DR | Are the controls actually working? |
Old "Attribute" and "Performance" categories are eliminated. New structure is cleaner, governance-focused.
| Domain | # | Principle | Key Concept |
|---|---|---|---|
| I – Purpose | — | Why IA exists | Assurance, Advice, Insight, Foresight (NEW) |
| II – Ethics | P1 | Integrity | Kant – categorical imperative; truthful even when difficult |
| P2 | Objectivity | Husserl – epoché; bracket assumptions; manage confirmation bias | |
| P3 | Competency | Aristotle – phronesis; know what you don't know; use specialists | |
| P4 | Due Professional Care | Hume – can't test everything; sample intelligently; document reasoning | |
| P5 | Confidentiality | Protect info; breach once = never get candid info again | |
| III – Governing | P6 | Authorized by Board | Charter = source of authority; board approves mandate |
| P7 | Positioned Independently | CAE reports functionally to board; structural independence | |
| P8 | Overseen by Board | Board approves plan, budget, resources; they're accountable too | |
| IV – Managing | P9 | Plan Strategically | Risk-based audit plan; dynamic, not cyclical |
| P10 | Manage Resources | People, tech, budget; document when insufficient | |
| P11 | Communicate Effectively | Bidirectional; listen as much as inform | |
| P12 | Enhance Quality | QAIP; EQA every 5 years with active CIA required | |
| V – Performing | P13 | Plan Engagements | Understand activity, risk assessment, define scope, work program |
| P14 | Conduct Work | Gather evidence, Four C's, recommendations, conclusions | |
| P15 | Communicate & Monitor | No surprises; confirm implementation; follow-up |
| Line | Who | Role | Reports To |
|---|---|---|---|
| 1st Line | Management (Operations, IT, HR) | Owns risk and controls day-to-day | Senior Management |
| 2nd Line | Risk & Compliance (ERM, Legal, Security) | Supports, monitors, provides expertise | Senior Management |
| 3rd Line | Internal Audit | Independent assurance on governance, risk, controls | Board/Audit Committee |
| Governing Body | Board | Accountability to stakeholders | Stakeholders |
"Did the control work when it should have?"
Testing the happy path. Select legitimate transactions and verify approvals obtained, within timeframes, by authorized individuals, with proper documentation.
Limitation: Positive testing alone creates false confidence. A control that approves everything but blocks nothing is useless.
"Did the control prevent what it should have?"
Testing the guardrails. Attempt to bypass: Can terminated users log in? Can users self-approve? Does system block SoD violations? Are unauthorized changes rejected?
Core question: "If everyone followed this control perfectly, would it actually prevent or detect the risk?"
| Method | Description | When to Use | Limitation |
|---|---|---|---|
| Random | Equal probability; use random number generator | Large, homogeneous populations | May miss high-risk items by chance |
| Stratified | Divide into subgroups; sample by risk | Heterogeneous populations with risk strata | Requires understanding of risk factors |
| Haphazard | Without specific pattern; auditor judgment | Small populations; preliminary testing | Unconscious bias; not statistically valid |
| Census (100%) | Test entire population | Small populations; critical controls | Time-consuming; may not be practical |
The control CAN'T work. The blueprint is flawed (policy doesn't exist, gaps, wrong approvers, SLA undefined).
Even perfect execution won't prevent the risk.
Remedy: Policy/process redesign
⚠️ Don't prescribe training for a design problem!
The control DIDN'T work. Good design, but execution failed (approvals missing, SLA breached, reviews not completed).
Remedy: Training, monitoring, automation
| Symbol | Meaning | When to Use |
|---|---|---|
| ✓ | Tested, no exception | Attribute tested and passed |
| ✗ | Exception identified | Attribute tested and failed |
| N/A | Not applicable | Attribute doesn't apply to this item |
| T | Traced/Tied | Amount traced to source document |
| R | Recalculated | Calculation independently verified |
| I | Inquiry | Confirmed via inquiry |
| ⊙ | Inspected original | Viewed original document/screen |
| ◊ | Follow-up needed | Requires additional investigation |
| Rating (External) | Definition | Consequence |
|---|---|---|
| Material Weakness | Reasonable possibility material misstatement not prevented/detected | Adverse ICFR opinion |
| Significant Deficiency | Less than MW but merits oversight attention | Report to Audit Committee |
| Control Deficiency | Design/operation gap not reaching SD/MW level | Management letter |
Originally published in Vogue; later collected in Slouching Towards Bethlehem. Uses "negative definition" — defining the concept largely through what it is not.
Didion argues that self-respect is fundamentally an internal standard, having nothing to do with others' approval or reputation. Its source is character — the willingness to accept responsibility for one's own life. Without it, one becomes an unwilling audience to an interminable documentary of one's own failures, and eventually runs away from oneself to find no one at home.
Self-deception, she argues, is the most difficult deception — far harder to overcome than deceiving others. The tricks that work on others count for nothing in the well-lit back alley where one keeps assignations with oneself.
She begins with not being elected to Phi Beta Kappa — a failure predictable, unambiguous. She had thought herself exempt from cause-and-effect relationships that hampered others. That day marked the end of something: the loss of the comfortable conviction that lights would always turn green for her.
Self-respect has nothing to do with the approval of others — who are, after all, deceived easily enough. It has nothing to do with reputation, which, as Rhett Butler told Scarlett O'Hara, is something people with courage can do without. No winning smiles or prettily drawn lists of good intentions will do here.
"Character — the willingness to accept responsibility for one's own life — is the source from which self-respect springs." People with self-respect have the courage of their mistakes: they do not seek absolution, do not complain unduly of unfairness. They exhibit moral nerve — what was once called character.
To live without self-respect is to be an unwilling audience to a documentary of one's own failings — fresh footage spliced in for every screening. Counting the sins of commission and omission, the trusts betrayed, the promises broken, the gifts wasted through sloth or cowardice. Eventually one lies down alone in that notoriously uncomfortable bed we make ourselves.
Jordan Baker (careless, dishonest in The Great Gatsby) had self-respect — she made her own peace, avoided threats to that peace. Julian English (careless, suicidal in Appointment in Samarra) did not. The paradox: the outwardly dishonest person had it; the seemingly respectable one was hollow. Self-respect is not correlated with conventional virtue.
Self-respect is a discipline, a habit of mind — it can be developed, trained, coaxed forth. Small disciplines represent larger ones — not for the ritual itself but as a way of remembering who and what we are. It is difficult to continue fancying oneself Cathy in Wuthering Heights with one's head in a paper bag.
In its advanced stages, alienation from self means we no longer answer the telephone — someone might want something. We cannot say no without drowning in self-reproach. Every encounter demands too much. Without self-respect, one eventually runs away to find oneself and finds no one at home.
To have that sense of intrinsic worth is potentially to have everything: the ability to discriminate, to love, and to remain indifferent. To lack it is to be locked within oneself — paradoxically incapable of either love or indifference. Without it, we despise those who have so few resources as to consort with us.
| Didion Concept | IIA / Audit Parallel |
|---|---|
| Self-respect ≠ approval of others | Principle 2 (Objectivity) — independence not just attitudinal but structural; not seeking management approval |
| Character = accepting responsibility for one's own life | Principle 1 (Integrity) — the willingness to own unfavorable findings without softening them |
| Discipline as habit of mind | Principle 4 (Due Professional Care) — skepticism not as instinct but as cultivated practice |
| Courage of one's mistakes | Auditors who acknowledge their own errors in prior work rather than burying them |
| The "interminable documentary" | The auditor who compromised integrity — each watered-down finding replays in professional memory |
| Small disciplines represent larger ones | Documentation rigor, tick marks, referencing every exhibit — small habits that hold when under pressure |
| Self-deception is the most difficult deception | Confirmation bias (Principle 2 — most dangerous bias is finding what you expect to find) |
Meridian Energy Holdings, Inc. (MEH)
Mid-sized energy company, Houston TX · NYSE-listed · ~2,800 employees
Regulatory exposure: SOX §404 (ICFR), NERC CIP (cybersecurity), FERC (reporting)
ERP: SAP S/4HANA — financial reporting, procurement, operations
Identity stack:
| ID | Control Objective | Testing Method |
|---|---|---|
| AC-01 | User authentication enforced via Entra ID with MFA | TOD — inspect Entra ID config, MFA policy |
| AC-02 | New access granted only with documented manager + data owner approval, aligned to job role | TOE — attribute test ServiceNow tickets (Exhibit B) |
| AC-03 | Access removed within 4 hours of HR termination | TOE — calculate SLA compliance from Exhibit C |
| AC-04 | Periodic access reviews validate continued appropriateness | TOE — review Exhibit H completion rates |
| AC-05 | SoD conflicts identified and either remediated or mitigated with documented compensating controls | TOE — Exhibits D + E cross-reference |
| User ID | Name | Department | Job Title | SAP Role | Risk Flag |
|---|---|---|---|---|---|
| jsmith01 | John Smith | Accounting | Staff Accountant | Z_FI_GL_POST | — |
| mwilson03 | Maria Wilson | Accounting | Senior Accountant | Z_FI_GL_APPROVE | — |
| bjones22 | Brian Jones | Accounts Payable | AP Clerk | Z_FI_AP_PROC | — |
| klee45 | Karen Lee | Accounts Payable | AP Manager | Z_FI_AP_PAY | — |
| tgarcia08 | Tony Garcia | Treasury | Cash Manager | Z_FI_AP_PAY | ⚠ SoD (Table D) |
| aclark99 | Amy Clark | IT Security | Security Admin | Z_SEC_ADM | CRITICAL role |
| rthomas15 | Robert Thomas | Procurement | Buyer | Z_MM_PURCH | ⚠ SoD (Table D) |
| dkim77 | David Kim | AP | AP Supervisor | Z_FI_AP_PROC + Z_FI_AP_PAY | ⚠ HIGH SoD conflict |
| lmartinez44 | Laura Martinez | Operations | Plant Supervisor | Z_PM_MAINT | — |
| pjohnson88 | Paul Johnson | Finance | Financial Analyst | Z_FI_GL_POST | ⚠ Terminated 1/31 — still in population! |
Paul Johnson appears in the active user population with role Z_FI_GL_POST. Cross-referencing Exhibit C: he was terminated 01/31/2025. Cross-referencing Exhibit H: he shows "NO RESPONSE" on the Q2 access review (July 2025) — meaning his access was never cleaned up even 5+ months after termination. This is a Significant Deficiency or Material Weakness candidate.
| Ticket | User | Req Date | Role | Mgr Approval | Data Owner Appr. | Access Granted | SLA (2 BD) | Exception? |
|---|---|---|---|---|---|---|---|---|
| REQ-2501 | jsmith01 | 01/08 | Z_FI_GL_POST | 01/08 ✓ | 01/08 ✓ | 01/09 | ✅ Met | None |
| REQ-2502 | bjones22 | 01/15 | Z_FI_AP_PROC | 01/15 ✓ | 01/16 ✓ | 01/16 | ✅ Met | None |
| REQ-2503 | rthomas15 | 02/03 | Z_MM_PURCH | 02/03 ✓ | — ✗ | 02/04 | ✅ Met | ⚠ No data owner approval |
| REQ-2504 | nwhite33 | 02/20 | Z_FI_AR_BILL | 02/20 ✓ | 02/21 ✓ | 02/24 | ✅ Met | None |
| REQ-2505 | mchen66 | 03/10 | Z_FI_GL_POST | 03/10 ✓ | 03/10 ✓ | 03/14 | ⚠ 4 days — MISSED | SLA exception |
| REQ-2506 | kpatel91 | 04/05 | Z_SEC_ADM | 04/05 ✓ | 04/07 ✓ | 04/07 | ✅ Met | CRITICAL role — verify CISO approval per Exhibit F |
REQ-2503: No data owner approval documented. Policy requires dual approval (manager + data owner) before access grant. Exception rate: 1/6 = 16.7%. Root cause: likely bypassed due to business urgency or workflow gap. Control Deficiency at minimum.
REQ-2505: Access granted in 4 business days vs. 2-day SLA. No process exception approved. Isolated? Need to expand testing to determine if systemic.
| User | Name | HR Term Date/Time | Entra Disabled | Elapsed | 4-Hr SLA | Last Login | Post-Term Access? |
|---|---|---|---|---|---|---|---|
| pjohnson88 | Paul Johnson | 01/31 17:00 | 01/31 18:30 | 1.5 hrs | ✅ Met | 01/31 16:45 | None |
| swright42 | Susan Wright | 02/14 17:00 | 02/14 17:15 | 0.25 hrs | ✅ Met | 02/14 14:30 | None |
| jdavis55 | James Davis | 03/07 17:00 | 03/08 09:45 | 16.75 hrs | ❌ Missed | 03/07 16:58 | Possibly — login 2 min before term; verify |
| arobinson19 | Alice Robinson | 03/28 17:00 | 03/28 17:30 | 0.5 hrs | ✅ Met | 03/28 15:00 | None |
| mhernandez07 | Miguel Hernandez | 04/15 17:00 | 04/15 18:00 | 1.0 hrs | ✅ Met | 04/15 13:20 | None |
James Davis was terminated Friday 03/07 at 5:00pm. Entra ID wasn't disabled until Saturday 03/08 at 9:45am — 16.75 hours later. Root cause: the batch sync process that triggers Workday → Entra ID only runs on weekday mornings. Friday evening terminations fall into a gap window. This is the canonical example from the 8 Reporting Rules (Card 9 in your notecards).
Exception rate: 1 of 5 (20%). With only 5 terminations in the test window, consider whether this is systemic (the Friday-batch-gap affects all Friday terminations) vs. isolated. Likely Significant Deficiency given the 16.75-hour exposure window on a SOX-regulated system.
| User | Conflict | Risk | Mitigating Control | MC Adequate? |
|---|---|---|---|---|
| dkim77 (David Kim) | Z_FI_AP_PROC (enter invoices) + Z_FI_AP_PAY (release payments) | HIGH — can create fraudulent invoice AND pay it to himself or a shell vendor with no second set of eyes | MC-001: Controller reviews all payment batches >$10K before release | ⚠ PARTIAL — leaves payments <$10K unreviewed; no control over invoice entry itself |
| tgarcia08 (Tony Garcia) | Z_FI_AP_PAY (release payments) + Z_MM_VENDOR (create/modify vendors) | HIGH — can add a fictitious vendor AND pay them; classic ghost vendor fraud scheme | MC-002: Vendor master changes require dual approval; weekly AP Manager review | ✅ Adequate if operating effectively — dual approval breaks the single-person control chain |
| jbrown61 (Jennifer Brown) | Z_FI_GL_POST (post JEs) + Z_FI_GL_APPROVE (approve JEs) | HIGH — can post and self-approve journal entries; enables earnings manipulation | NONE DOCUMENTED | ❌ DEFICIENCY — no mitigating control = unmitigated HIGH SoD conflict on a SOX-material account |
| rthomas15 (Robert Thomas) | Z_MM_PURCH (create PO) + Z_MM_PO_APP (approve PO) | MEDIUM — can create and self-approve own purchase orders | MC-003: All POs require Procurement Director approval regardless of amount | ✅ Adequate — independent director approval at 100% overrides the self-approval risk |
Jennifer Brown has both JE posting and JE approval roles with zero mitigating controls documented. On a SOX engagement for a publicly traded company, an unmitigated HIGH SoD conflict on the general ledger is a strong Significant Deficiency candidate, potentially Material Weakness depending on the population of transactions affected. This requires immediate escalation and remediation — either remove one role or implement a compensating control such as independent GL review.
| Role ID | Description | Function | Risk Level | Required Approver |
|---|---|---|---|---|
| Z_FI_GL_POST | Post journal entries to GL | General Ledger | High | Controller |
| Z_FI_GL_APPROVE | Approve journal entries | General Ledger | High | CFO |
| Z_FI_AP_PROC | Enter/process vendor invoices | Accounts Payable | High | AP Manager |
| Z_FI_AP_PAY | Execute payment runs & release payments | Accounts Payable | Critical | Treasurer |
| Z_MM_PURCH | Create POs | Procurement | Medium | Dept Manager |
| Z_MM_PO_APP | Approve POs | Procurement | High | Proc Director |
| Z_MM_VENDOR | Create/modify vendor master records | Master Data | Critical | Controller |
| Z_SEC_ADM | Administer user accounts & role assignments | IT Security | Critical | CISO |
| Z_PM_MAINT | Create/manage plant maintenance work orders | Operations | Low | Plant Mgr |
| User ID | Name | Role | Reviewer Decision | Date |
|---|---|---|---|---|
| jsmith01 | John Smith | Z_FI_GL_POST | ✅ APPROVED — Access appropriate | 07/10/2025 |
| mwilson03 | Maria Wilson | Z_FI_GL_APPROVE | ✅ APPROVED — Access appropriate | 07/10/2025 |
| bjones22 | Brian Jones | Z_FI_AP_PROC | ✅ APPROVED — Access appropriate | 07/11/2025 |
| lperez29 | Lisa Perez | Z_FI_AR_BILL | 🔄 REVOKED — Transferred to HR | 07/11/2025 |
| pjohnson88 | Paul Johnson | Z_FI_GL_POST | ⚠ NO RESPONSE | — |
Paul Johnson was terminated 01/31/2025 (Exhibit C — SLA met, Entra ID disabled same day). But by Q2 access review in July 2025, he still appears in the SAP user population with an active role (Exhibit A) and shows NO RESPONSE on the review — because there's no active manager to respond. The Entra ID disable didn't trigger SAP account deprovisioning. This means his SAP role persists even though his Entra ID is disabled. If SSO breaks or is reconfigured, this is a reactivation risk.
This illustrates a design gap in AC-03: the control disables Entra ID within SLA but has no corresponding procedure to clean up orphaned SAP roles. The access review (AC-04) should have caught this but failed because the no-response case wasn't escalated.
| Finding | Control | Exception | Classification | Rationale |
|---|---|---|---|---|
| REQ-2503 — no data owner approval | AC-02 | 1/6 (16.7%) | Control Deficiency | Single instance; access aligned to job; no apparent harm. But policy breach = deficiency. |
| REQ-2505 — SLA missed (4 days vs. 2) | AC-02 | 1/6 (16.7%) | Control Deficiency | Isolated timing issue; no unauthorized access risk. May be systemic if root cause is workflow. |
| jdavis55 — 16.75 hr termination gap | AC-03 | 1/5 (20%) | Significant Deficiency | Extended exposure window (16.75 hrs) on SOX system. Root cause systemic (Friday batch gap). |
| pjohnson88 — orphaned SAP role post-term | AC-03 / AC-04 | Design + Operating | Sig. Deficiency → MW candidate | Terminated employee retains SAP role 5+ months later. Access review failed to catch. Reactivation risk. |
| jbrown61 — unmitigated JE post + approve SoD | AC-05 | No MC documented | Significant Deficiency → MW candidate | Unmitigated HIGH SoD on GL in a SOX entity. No compensating control. Direct financial statement risk. |
| dkim77 — partial MC ($10K threshold) | AC-05 | Partial mitigation | Control Deficiency | MC addresses large payments but leaves small-dollar fraud risk unmitigated. |
Diffusion of responsibility: "The IT team disables Entra ID — SAP cleanup is someone else's job." No one person owns the full termination workflow → pjohnson88's SAP role persists for 5 months.
Agentic state: The analyst who processes the AC-03 checklist without flagging the 16.75-hour gap is acting as an instrument, not a moral agent.
The auditor who documents jbrown61's SoD conflict as "noted — management to address" without escalating is participating in a small daily lie. Non-participation = escalating to the audit committee per IIA standards.
The auditor who accepts management's assurance that the $10K MC for dkim77 is "sufficient" without testing it independently is seeking approval rather than applying the internal standard of self-respect / objectivity (P2).
The jdavis55 termination finding is the canonical before/after example from the 8 Reporting Rules: "1 of 5 (20%) terminations exceeded the 4-hr SLA. jdavis55 disabled 16.75 hrs after HR term (Fri 5pm → Sat 9:45am). Compensating: no post-term logins confirmed. Root cause: Friday batch sync gap. Rec: real-time Workday-to-Entra sync."