Literature Review

Risks in the current business environment, such as the 2008 financial crisis or the 2020 COVID-19 pandemic, are growing in complexity and volume, evolving in areas such as cybersecurity threats, economic fluctuations, and external risk events. Organizations using cloud computing face operational, reporting, and compliance risks (Lanz & Nearon, 2022) because their systems depend on nodes within and outside of their organization (Vohradsky, 2019). Substantial threats to cloud security include abuse and nefarious use, vulnerable security and application programming interfaces, data loss or leakage, unknown risk profiles, and inadequate infrastructure design and planning (Wlosinski, 2015). Attacks at the network and application levels can compromise an organization's information's confidentiality, integrity, and availability (De Donno et al., 2019).

Indeed, risks associated with cloud computing are disruptive in nature but not fully understood (Church et al., 2020). These risks highlight the need for mature Enterprise Risk Management (ERM) practices to help organizations manage their response to strategic, operational, and technology risks. Governance demands human intervention with automated processes through the identification of proper controls to mitigate these risks (Vohradsky, 2019). Mackita et al. (2019) and Lanz and Nearon (2022) stress the urgency of addressing enterprise risk management in a cloud computing environment. Mackita et al. (2019) note that major breakdowns in cloud computing functionality stemmed from organizations failing to properly identify, assess, and mitigate risks. Such protocols need to be conducted routinely. They combine elements of the COSO ERM model (2004) and an evaluation method for risk-based security called OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation). While they conclude that their approach provides effective risk management for cloud computing, they employ a framework that is now outdated. COSO updated its ERM model in 2017 to reflect strategic and operational aspects of business risk. Such perspectives are crucial in cloud computing, as evidenced by Grob and Cheng (2021).

In 2021, COSO commissioned a paper related to guidance on how the new COSO ERM framework applies to a cloud computing environment (Grob & Cheng, 2021). The authors walk through the 2017 COSO ERM principles and explain activities relating to cloud computing ERM. Grob and Cheng (2021, p. 25) emphasize the importance of considering risks in a cloud environment, writing: “Cloud computing risks must be identified and managed in the context of the organization's broader ERM program. While tasks, processes, and maintenance can be outsourced, accountability for risks cannot.”

This case uses well-established frameworks—COSO ERM (2017) and COBIT 2019 (ISACA, 2018a; ISACA, 2018b; ISACA 2019)—which can be implemented at various levels of process automation to help mitigate cloud computing risks. Although these frameworks provide useful guidance to organizations, very few cases exist that require students to apply these frameworks to real-world situations. Cereola and Cereola (2011) ask students to evaluate the computer breach at TJX using earlier versions of the COSO ERM and COBIT frameworks. In Haywood (2021), students examine COBIT 2019 principles to demonstrate the vulnerabilities of IT Governance at a community college. In Haywood-Sullivan (2022), students analyze the principles and components of the 2017 COSO ERM framework to analyze the breakdown of enterprise-wide risks at Wells Fargo from 2009 to 2016.

Interestingly, there are even fewer cases that explore process implementation in the cloud. One case study (Gao, 2020) presents a content analysis approach to understanding and analyzing cloud ERP providers’ data processing agreements. The case allows students to explore cloud ERP providers’ data disclosure, security, sub-processing, and data retention and deletion practices. Another study (Alslihat et al., 2018) evaluates the impact of internal control components of the COSO framework on reducing the risk of cloud computing. These authors evaluate the accountant's perception of COSO's internal control framework for reducing the risk of cloud computing in Jordanian public shareholding companies, advocating for a deeper comprehension of the infrastructure and the provision of essential resources in information technology and skills. They propose the development of educational and training initiatives to equip auditors with knowledge of cloud accounting and its associated risks.

Many organizations provide guidance on security assessment, authorization, governance, and monitoring of cloud products and services, such as the Federal Risk and Authorization Management Program (FedRAMP), the National Institute of Standards and Technology (NIST), and the Cloud Security Alliance (CSA). However, no generic security architecture frameworks / models are available that can facilitate understanding the security issues related to implementing accounting processes in the cloud. This case (presented in Appendix A) fills this gap and provides information about the essential security components that must be considered while implementing an accounting process in the cloud. It also provides a structure for understanding the security issues that can arise at various levels of an accounting process implementation in the cloud. The case uses multiple security reference architectures from cloud service providers in the industry (such as Microsoft Azure, Amazon-AWS, CISCO, Google-GCP, and Oracle) in order to create a frame of reference. The details of these security reference architectures are provided in Appendix B.

Learning Objectives

This case aims to educate students about holistic IT security risk from the perspective of implementing applications in the cloud. In addition, the case allows students to leverage their pre-existing knowledge of the COSO ERM and COBIT (DSS: deliver, service, and support) frameworks. Furthermore, this case provides students an opportunity to analyze security and accounting controls for an end-to-end mission-critical accounting process. The specific learning objectives of this case are as follows:

• Students will learn about potential security considerations and external threats and compromises when implementing or migrating applications in a cloud environment.

• Students will assess risks and governance issues as they relate to accounting processes.

• Students will learn about the need for data selection and validation and IT audit controls related to cloud implementations of accounting systems.

Case Background

The case focuses on the service layer of the cloud security architecture. The service layer outlined in this case captures all the physical and logical layers that data travel through as it moves between users and systems.

Enterprise data may originate initially from various sources, including but not limited to ERP systems, legacy systems, historical data sources like archives, and long-term storage. Before the data is loaded into the target system, it must be cleaned, run through business rules for validation, and checked for errors and omissions (Romney & Steinbart, 2020; ISACA, 2018a, DSS06; COSO, 2020). Since enterprise data can also be loaded in machine-readable formats from external systems (XML), it must be scanned for malicious code and other attack vectors like SQL injection attacks (Halfond et al., 2006).

Edge and networking components of the service layer encapsulate the movement of data from the outer layers of a network (edge services) where external host systems are referenced and accessed using authenticated and known IT infrastructure services like a Domain Name System (DNS) and firewalls (ISACA 2018a, DSS05; COSO, 2020). Once past the edge, data is subject to additional checks via integration services like Extract Transform Load (ETL) and cross-platform validation, authentication, and validation (ISACA, 2018a, DSS05; COSO, 2020). Data may end up hosted in different storage silos segregated by origin, type, and target usage. This is achieved by the data and storage (including information protection) components of the service layer. Voluminous data may end up in a data warehouse; relational data would be stored in a structured relational database; and data made available in documents, media files, or other non-structured formats may end up being stored for later presentation in a content management system or document management system. At this stage, to avoid data loss due to unforeseen circumstances, data would also be copied to different data stores.

Depending on the criticality or sensitivity of the data, data may also be copied to different geographical locations to mitigate natural disasters (ISACA 2018a, DSS04 & DSS06; Romney & Steinbart, 2020). Legal and compliance requirements and regulations like the Sarbanes-Oxley Act may also dictate that data be made permanently available for a certain period. Organizations typically store such data in low-cost but secure storage, like encrypted backup tapes stored in off-site storage locations. Once the data is authenticated, it is validated, checked for errors, and made available in storage.

The next component of the service layer, processing and analytics, performs further operations on the data to make it available for consumption by users and other systems as well as additional classification and categorization (ISACA 2018a, DSS06). This is typically achieved by tagging the data with metadata markers, handing it off to content delivery networks, and presenting it visually via dashboards. This is done while capturing and monitoring the quality-of-service metrics to ensure data velocity is maintained so that data is presented promptly and consistently with an organization's internal guidelines. The analytics component makes the data available for further analysis and reporting. Analytics services may also transform the data into other formats for consumption by other systems for reporting and visualization.

Case Description

In this case scenario, the students take on the role of a consultant who has been hired to review the potential risks of the invoice processing and payment process of the Global Investment Fund (GIF). The students must review appropriate accounting and security controls across the entire application to ensure the prevention of fraudulent payments and potential compromises of the DLM (Data Lifecycle Management) process. The students review the process roadmap in the context of data security, accounting control, monitoring, and the potential of external threat vectors like intrusion by malicious actors. Furthermore, students analyze the possibility of introducing additional accounting controls to ensure the process meets compliance and data-governance requirements. For reference, in addition to coverage at varying lengths in other AIS textbooks, these materials are covered in Romney and Steinbart (2020):

• Chapter 10: Control and Accounting Information Systems—control frameworks; assess and respond to risk using ERM model; control activities commonly used in companies

• Chapter 11: Controls for Information Security—fundamental information security concepts; understanding targeted attacks; preventive controls; detective controls; corrective controls; security implications of virtualizations and the cloud

• Chapter 12: Confidentiality and Privacy Controls—preserving confidentiality; encryption

• Chapter 13: Processing Integrity and Availability Controls—processing integrity; availability

To complete this case, the students have an accounting process roadmap (Figure A1) that has been implemented in the cloud. The students must review the material and the diagram provided to assess which COBIT 2019 or COSO ERM standards would be suitable to ensure data integrity as information flows across the accounting process. Using the cloud security guidelines in Appendix B, the students must also assess the potential vulnerabilities of process steps from a security perspective.

Implementation Guidance

Courses that could incorporate the case include Accounting Information Systems (AIS) and IT audit undergraduate or graduate courses. Before introducing this case, the instructor should cover the topics of IT controls, control frameworks, and controls for information security. To go more in depth, the instructor may want to cover the different modes of deployment of the cloud (public, hybrid, and private cloud), the importance of information security irrespective of the traditional implementation or cloud implementation, specific domains of COSO ERM and COBIT 2019 frameworks (as described in Appendix C), expenditure controls, governance, and compliance controls to maintain data integrity in accounting applications and processes. If emerging technologies have not been covered before this case, the instructor could introduce the concept of cloud computing, including definitions, cloud service models (SaaS, PaaS, IaaS), and deployment models. This material, as well as recommended resources, is provided in Appendix B.

After covering the topics, the instructor can introduce the actual case scenario (Figure A1) and the assignment (Appendix A). Students then complete the case and submit a file with the answers to the questions. In a subsequent class, the instructor can review the correct solutions and generate classroom discussion on the various approaches students used to develop their answers.

This case is intended to be completed in groups. It is set up this way because cloud security is a complicated topic, and students will benefit from discussions with each other. In their groups, students should be able to complete the case in 1 hour 15 minutes. However, if the instructor assigns the case individually, the instructor should allocate more time (approximately 2 hours).

The instructor can implement the case in two ways: 1) the teaching and assignment are both done in class, and 2) the teaching is done in class, and students complete the assignment outside of class. If the assignment is to be done in class and the instructor wants to be efficient with class time, this person may distribute resources on the preparatory topics with students ahead of class coverage.

Two professors reviewed the case for its efficacy and relevance in achieving its stated learning objectives and its realism to current professional environments. One professor, who reviewed the case, plans to use the case in a graduate-level internal audit class in the future and suggested discussing the Trust Services Framework—security, privacy, confidentiality, processing integrity, and availability (AICPA & CIMA, 2017) prior to working the case. Another professor who reviewed the case suggested the following approach for implementation:

1. For undergraduate students, use the case over several class sessions that cover COSO/COBIT and IT controls. Introduce the case earlier and use authentic assessment (Wiggins, 2019). Wiggins describes assessment as authentic when we directly examine student performance on worthy individual tasks. He further adds, “Authentic tasks involve ‘ill-structured’ challenges and roles that help students rehearse for the complex ambiguities of the ‘game’ of adult and professional life. Traditional tests are more like drills, assessing static and too-often arbitrarily discrete or simplistic elements of those activities” (Wiggins, 2019, p. 2). Because this case allows students to learn through writing, revision, and discussion in the second part of the case (the assignment part), authentic assessment would work well here. Implementing this case over several weeks will allow for that and, through authentic assessment, provide more clarity in learning IT controls, which is essential for accountants in the workplace.

2. For graduate students, the instructor could use the case in class and have them complete a reflective writing assignment specific to the case, focusing on the importance of security, the understanding of threats, and the need for controls.

Furthermore, the two professors who reviewed this case expressed interest in utilizing it for undergraduate and graduate AIS and audit classes. One professor highlighted the case's value in reviewing IT governance principles.

Case Efficacy

The usefulness of the case was evaluated in Fall 2023 in an undergraduate AIS course at a southwestern university. Thirty students completed the assignment in class. Students were surveyed after the case assignment was completed to assess student perceptions of the case. The survey questions were adopted from Lee and Sawyer (2019).

Table 1 Student Perceptions^a

View Fullscreen

Students responded positively to the case, agreeing that the case helped them learn the importance of cloud security and the nature and types of security compromises (i.e., Q1 mean score: 5.90; Q4 mean score: 5.50). Notably, the respondents agreed that the case would be useful to future accounting undergraduate students (Q8 mean score: 6.03) and recommended continual usage of the case (Q9 mean score: 5.90).

The instructor who assigned the case was pleased with the student outcomes. The instructor shared three learning objectives with the class to assess the outcomes and provided a reflective learning assignment. Students mentioned a new awareness of the importance of security, the understanding of threats, and the need for controls. While this case was implemented with undergraduate students in an AIS class, the core focus of the case related to IT security and cloud implementation, which are topics that are also appropriate for the graduate-level IT audit class.

Conclusion

Overall, this case allows students to understand IT security from the perspective of implementing applications in the cloud and provides an exercise where students can apply their knowledge of COBIT and COSO ERM frameworks. The case also allows instructors to emphasize the importance of IT and accounting controls.