Integrating IT Frameworks into the AIS Course
The contemporary business and regulatory environment dictate that accountants develop greater expertise in information technology, particularly in its risk and control aspects. Several approaches exist to assist with these aspects of information technology, with the primary ones being COSO ERM, COBIT, ITIL, and the ISMS family of standards, each developed by different groups with different objectives. While accounting students likely receive training in COSO ERM and COBIT, exposure to ITIL and the ISMS family is less common. This paper is motivated from the view that all four approaches are vital to the accountant's professional toolbox and should be incorporated into the AIS course. In this paper, we provide AIS instructors with a concise overview of the four approaches and offer an integrated framework that can guide teaching plans. We discuss how the approaches should not be viewed as separate and redundant bureaucratic models, but as complementary approaches that help an organization manage risks and controls.ABSTRACT
INTRODUCTION
Information technology (IT) has evolved into an essential infrastructure for organizations: an infrastructure that is the foundation for enterprise risk management and internal control. This infrastructure has taken on an even greater importance with regulations such as the Sarbanes-Oxley Act (SOX), which requires an increased level of assurance in the quality of corporate information. Accordingly, it is critical that organizations develop and maintain effective risk management practices and controls over the system that produces this information. Several approaches exist to assist with the risk and control aspects of the IT infrastructure. Four established approaches1 include the Committee of Sponsoring Organizations of the Treadway Commission's Enterprise Risk Management-Integrated Framework (COSO ERM), Control Objectives for Information Related Technology (COBIT), Information Technology Infrastructure Library (ITIL) and the Information Security Management System (ISMS) family of standards2, each developed by different groups with different objectives.
Our primary objective in this paper is to encourage the inclusion of all four approaches in accounting information systems (AIS) courses in order to provide exposure to IT risk and control frameworks. Researchers and practitioners alike suggest that the evolution of business and the increasingly demanding regulatory environment dictate that accountants possess greater knowledge of IT (Cegielski 2008). O'Donnell and Moore (2005, 65) cite deficiencies in the accounting curriculum for a shortage of accountants and auditors proficient in information systems/information technology (IS/IT) “control knowledge, or competencies.” Indeed, our examination of the most common textbooks in AIS indicates that most of the textbooks introduce COSO ERM and COBIT, but contain little or no coverage of ITIL or the ISMS family. Accounting students must likely venture into the IS/IT department to access meaningful coverage of ITIL and the ISMS family.
In this paper, we develop an integrated framework to present these four approaches and discuss how they can be viewed not as separate and redundant bureaucratic models, but as complementary approaches that help an organization manage IT risks and controls. We hope to provide AIS instructors with a concise overview of four approaches to IT risks and controls that have been developed and utilized in both disciplines, and offer an integrated framework that can guide teaching plans. Our goal is to expose students to these accepted IT approaches, develop some understanding of their purposes and uses, and thus provide a basis for further study and development.
We begin by providing our rationale for including this topic in AIS courses, and then we introduce the four approaches. We next discuss how these approaches differ from and complement each other and present our integrated framework. The final section offers some concluding remarks.
BACKGROUND
The primary objective of an AIS is to originate, capture, process, store, and distribute information for decision-making (Hurt 2010). Although AIS existed long before computers (Hall 2011), one would be hard-pressed to find a company that does not rely on IT to achieve this objective. Today, documents are electronic, transactions are automated, and paper trails are non-existent (Coe 2006; Helms and Mancino 1998). Traditional financial accounting practices such as fixed asset valuation and impairment have been changed by process automation, web services architecture, and Internet-based supply chain management (Ho et al. 2008). Business reorganization resulting from enterprise system adoption requires cost reallocation and business process redesign (Ho et al. 2008; Kinney 2000). In sum, IT has revolutionized contemporary business—a reality that creates new expectations of the accounting profession.
As the demands on the profession have expanded with IT, so have the demands on education. In 1995, the International Federation of Accountants (IFAC) stated that IT “requires special attention due to its explosive growth and its rapid rate of change” (IFAC 1995, 1–2). Their 2001 exposure draft again addressed the pervasiveness of IT in business and reiterated, “Competence with this technology is an imperative for the professional accountant” (IFAC 2001, 6). The need for accounting students to develop IT control knowledge was further defined in IFAC's 2003 and 2007 education papers and statements (IFAC 2003, 2007). Similarly, other researchers, educators, and professional organizations have called for teaching efforts directed towards IT risk and control concepts (Coe 2006; American Accounting Association 2003; Kinney 2001; Albrecht and Sack 2000). Clearly, the need for a quality IT education for accountants remains a relevant issue.
Keeping pace with the increasing complexity of IT and the demands of contemporary business requires some convergence of the accounting and IT disciplines (Walters 2007). Prior researchers have addressed the relationship between the AIS and IS/IT curriculum, (e.g., Murthy and Ragland 2009; Sutton and Arnold 2002; Sutton 1992), often debating whether AIS is in danger of being subsumed by IS/IT. We do not propose a further blurring of the disciplines, but rather propose that IT risk and control frameworks represent one area where accounting students can benefit from exposure to IT concepts. We offer several reasons for this position.
First, the impact of IT on internal controls cannot be overstated, and internal controls are critical to virtually all accounting specializations. It is nearly impossible to successfully develop or audit internal controls and financial reports without understanding the computer-based information system (Cegielski 2008). SOX redoubles the importance of controls over the AIS and IT infrastructure (Walters 2007), where management's responsibility for internal controls (Section 404) and the accuracy of financial report information (Section 302) are explicitly identified. Given that the reliability of financial information is dependent on an organization's IT (Fox and Zonneveld 2003), competence in IT is a requisite condition for SOX compliance (Walters 2007). Accounting professionals, whether they are managerial accountants who must embed controls or auditors who must evaluate them, clearly require knowledge of IT controls to meet regulatory demands (Ho et al. 2008).
Second, and relatedly, SOX compliance “requires an integrated evaluation of automated, IT-dependent, and manual controls in relation to each other” (Chan 2004a, 33). Accountants must possess a combination of knowledge in accounting, internal controls, and IT to effectively complete this integrated evaluation (Kay and Ovlia 2012). The accounting program of study is ideally suited to provide this instruction. Murthy and Ragland (2009) indicate that comprehensive teaching of internal controls remains firmly in the domain of AIS courses, thereby representing a unique value-added skill for accountants.
Third, a recent survey of Big 4 firms suggests that they actively recruit students who possess an educational background in both accounting and information systems (Cegielski 2008). Unfortunately, audit firms have accepted “that the traditional education model for professional accountancy offered by many colleges and universities around the nation is inadequate to address the current demands within the profession for technology-based knowledge and skills” (Cegielski 2008, 34). Addressing this deficiency seems imperative if accounting education is to remain relevant.
Finally, accountants play critical roles in organizational IT, far beyond the responsibilities of internal control assessment, compliance, and financial reporting. For example, because IT is fundamental to company performance (Hermanson et al. 2000), accountants can help organizations use it to develop competitive advantages. Accountants are often called upon to direct strategic planning and capital budgeting activities for investments in IT systems (Hermanson et al. 2000; IFAC 1995), while at the same time dealing with the resulting organizational restructuring and business process redesign (Kinney 2000). Also, as traditional boundaries are relaxed and procedures reconfigured, controllers and internal and external auditors must assess and manage the organization-wide risks that IT has introduced (Hermanson et al. 2000). Accountants must now be concerned with many aspects of IT, including proper governance and service performance in addition to risks and controls.
Recognizing this need, and to address the call for increased exposure to IT concepts, we propose that the study of risks and controls in AIS be complemented with an introduction to risk and control approaches rooted in the IS/IT discipline. Specifically, we suggest students should be exposed to COSO ERM, COBIT, ITIL, and the ISMS family of standards. These four approaches have been recognized in research and practice as established, reliable, and valid (e.g., Huang et al. 2011; Vaassen et al. 2009; Sahibudin 2008; Schlarman 2007; Tuttle and Vandervelde 2007; Wendle 2007; Hill and Turbitt 2006; Symons 2005; von Solms 2005). While none are sufficiently comprehensive to meet IT risk and control objectives on their own (Sahibudin 2008; Schlarman 2007; Hill and Turbitt 2006), presenting them together provides a comprehensive approach to IT risk and control.
Others have recognized the need to integrate these approaches in order to achieve IT control objectives. Sahibudin et al. (2008), Schlarman (2007), and ITGI et al. (2005) suggest the use of COBIT, ITIL, and the ISMS family; Huang et al. (2011) and Chan (2004b) discuss COSO ERM and COBIT; Hill and Turbitt (2006) couple COBIT and ITIL; and von Solms (2005) maps COBIT and the ISMS family. All but one (Huang et al. 2011) of these publications are aimed at managers, and none link all four approaches. We add to this literature by presenting an integrated framework of all four approaches for AIS instructors to use in their courses.
We use COSO ERM as the starting point for our integrated framework because it provides a high-level focus on risk and control. An integrated framework for accountants is not complete without COSO ERM since “risk and control are virtually inseparable – like two sides of a coin – meaning that risks first must be identified and assessed; then managed and mitigated by the implementation of a strong system of internal control” (IIA 2003, 1). COSO ERM provides the highest-level approach for identifying and assessing enterprise-wide risks, including IT. COBIT then offers high level guidance for governing the IT infrastructure. Finally, for detailed IT processes, ITIL and the ISMS family cover specific areas of concern and provide the how (Hill and Turbitt 2006; von Solms 2005).
In sum, we propose that instruction on all four approaches and their complementarities provides our students with an introduction to the IT concepts expected in today's technology-dependent business environment. The accountants and auditors of tomorrow are expected to possess knowledge and awareness of IT-related issues, including security, controls, and risks. While COSO ERM and COBIT provide some guidance for meeting these expectations, ITIL and the ISMS family are important approaches in the IS/IT discipline. The integration of these four approaches form a hierarchy of guidelines for meeting IT risk and control objectives.3 We expand on this discussion in the Comparison and Complementarities section of this paper.
Instruction on the integrated framework is appropriate for either undergraduate or graduate students. While COSO ERM and COBIT both appear to have established a foothold in the standard undergraduate AIS course, coverage of ITIL and the ISMS family appears scarce. Our examination of AIS textbooks offered by the major publishers indicates that most cover COSO ERM and COBIT, while ITIL and ISMS receive very little, if any, coverage (see Appendix 1 for a list of textbooks examined). However, ITIL and ISMS, along with COBIT, are consistently recognized as the most widely-used IT approaches (e.g., Schlarman 2007; Vaassen et al. 2009; ITGI et al. 2005). Either level of student can benefit from exposure to the widely-used IT control approaches and gain some recognition of their potential use as an integrated hierarchy of guidelines. Basic learning objectives include the following:
-
To become aware of commonly used approaches for IT risk and control.
-
To recognize the governing bodies that created each approach.
-
To understand the primary purpose of each approach.
-
To understand how the different approaches can be used together by focusing on the common elements.
Instructors wishing to offer greater coverage of the approaches may use Internet-available documents provided by the governing bodies of each approach.
In the following sub-sections, we provide a brief narrative overview of the four approaches. We offer a more detailed summarization of the primary components of each in Tables 1 through 4. We then compare and describe the complementarities between the approaches and introduce our mapping diagram.
OVERVIEW OF THE APPROACHES
COSO ERM
In the early nineties, leading professional accounting and finance associations4 collaborated to create COSO. This committee develops and disseminates frameworks and guidance on ERM, internal controls, and fraud deterrence. In the aftermath of the financial scandals of the early 2000s and consequent stakeholder demands for improved corporate governance, the committee released ERM-Integrated Framework (COSO 2004). The key purpose of this now widely-used framework (Power 2007) is to integrate various concepts and viewpoints of risk management into a framework that provides a common definition and understanding of enterprise-wide risk management.
COSO's previous publication, Internal Control-Integrated Framework (COSO IC), remains a well-accepted standard for satisfying SOX compliance needs, and is not replaced by COSO ERM (COSO 2004). However, COSO ERM incorporates the COSO IC framework within it, and expands on it to provide a broader and more robust focus on enterprise-wide risk management (COSO 2004). There is growing recognition that compliance with SOX necessitates an integrated focus on risk management and internal control (IFAC 2011). COSO suggests that companies may use COSO ERM “both to satisfy their internal control needs and to move toward a fuller risk management program” (COSO 2004, v). We include COSO ERM in this paper precisely because it provides the risk management focus to our integrated framework.
The COSO ERM framework consists of eight interrelated components that are derived from the way a business is run and integrated with the management process. These components start at the highest abstract level, the internal environment, and move down to the level of policies and procedures, with a continuous monitoring process to ensure the framework is being properly employed. Each is briefly described below and summarized in Table 1.
The first component is the internal environment. The internal environment is a high-level perspective of risk and provides the basic structure and discipline of how risk and control are viewed and addressed by the organization's employees. It is the tone of the organization, including management philosophy, integrity and ethical values, and risk appetite. The second component of COSO ERM is objective setting, including high-level strategic objectives, operational objectives, reporting objectives, and compliance objectives. In objective setting, it is important to establish objectives that are consistent with the entity's philosophy and risk appetite reflected in the internal environment.
Once the objectives have been determined, the third step is to identify any potential events that might have an impact on the organization's ability to achieve their objectives. The identified threats should be categorized based on management's understanding and identification of interrelationships among the events in order to form a basis for risk assessment and an enhanced common risk language across the entity. The fourth component of COSO is to assess and analyze the identified risks based on their likelihood of occurrence and the magnitude the events would have on organizational objectives if they do occur. The fifth component is for management to plan appropriate responses to the assessed risks. The primary categories of risk responses include the choice to avoid, accept, reduce, or share the risk.
Control activities represent the sixth component. The aim of control activities, especially on information, is to provide assurance that the selected risk responses will be effectively carried out. The seventh component is information and communication. Internal and external pertinent information used for identifying, assessing and responding to risks should be sourced, identified, captured, analyzed, processed, reported, and communicated at each level of an entity in a form that enables people to carry out their responsibilities. This challenge can be met via clear and effective communication by an established information systems infrastructure. Finally, the enterprise risk management process must be monitored on an ongoing basis by assessing the functioning of its components and the quality of performance over time, with corrective modifications made as necessary.
While the COSO ERM framework presents an integrated procedure for enterprise risk management, it does not directly address IS/IT. However, IS/IT is used to support risk responses and to ensure smooth communication throughout the organization. Within COSO ERM, IS/IT control is introduced at a high level. The requirement for more detailed IS/IT control objectives and related control activities leads us to the next approach, COBIT.
COBIT
In 1993, the IT Governance Institute (ITGI) and the Information Systems Audit and Control Association (ISACA) created COBIT as an internal control approach for IT. Since then, COBIT has become an internationally accepted standard for the control and governance of IT (Lainhart 2000). The COBIT control approach is designed for achieving business objectives. It covers the full range of IT activities. COBIT addresses IT concerns such as IT decision-making, controls, and maintenance. It ensures that the IT systems which perform data movement, transformation, and storage, are secure, and it acts as an umbrella IT governance approach, helping manage the risks and benefits associated with IT (ITGI 2007).
The COBIT approach has four main characteristics: it is business-focused, process-oriented, controls-based, and measurement-driven. Aspects of COBIT's business orientation include the linking of IT goals to business goals, providing metrics to measure their alignment, and identifying the associated responsibilities and ownership of IT processes.
The underlying principle of COBIT is that IT resources (applications, information, infrastructure, and people) are managed by IT processes, are based on control objectives, and are monitored using metrics to deliver information and achieve IT goals that respond to the business requirements for information and governance. The process approach of COBIT subdivides IT into four domains in line with the responsibilities of planning, building, running, and monitoring (See Table 2 for a summary). These domains map to 34 corresponding processes, each of which is a high-level control objective, essentially following a systems development lifecycle (Panko 2006).
ITIL
ITIL was initially developed in the late 1980s by a branch of the British Government referred to as the Office of Government Commerce (OGC). The original objectives of ITIL were to improve IT services, increase IT business effectiveness, and reduce costs (Laurent 2005). The focus of ITIL is on IT service management (ITSM) and alignment of IT with the business (Hill and Turbit 2006). ITIL can be viewed as an approach of best practices for managing IT services. It is currently going through its third revision to reframe service management as a lifecycle, extending the approach by focusing on the service lifecycle of design, transition, and operation. ITIL describes how to organize and implement IT service management. This approach provides standards that are designed to show goals, activities, inputs and outputs of a variety of processes incorporated within IT organizations. Additionally, the ITIL approach provides a clearly structured context in which to evaluate existing methods and activities so that companies can meet or anticipate customers' needs (OGC 2010). While ITIL is not directly related to IT risk management, its support for IT service quality indirectly impacts organizational and IT-related risks. ITIL practices address system performance, problem resolution, and security, which are all critical issues in risk management (Worthen 2005). The latest version of the ITIL approach, v3, is separated into five service areas based on the service lifecycle (See Table 3).
The ISMS Family of Standards
Under the auspices of the World Trade Organization, the International Standards Organization (ISO) and the International Electrotechnical Commission (IEC) develop international standards related to topics with a technical component. The ISO is a network of representatives from 161 countries designed to develop standards that cross national boundaries. The IEC is a similar organization focusing on the development of international standards for electrical, electronic, and related technologies. The ISO and the IEC are jointly developing a series of standards, frequently identified as the ISMS family of standards (also referred to as the ISO/IEC 27000 series), to establish and maintain an effective information security management system (ISMS) that supports business objectives (ISO/IEC 2009). The ISO/IEC views the use of the ISMS family as an approach for managing the security of information assets and as a standard for supporting the independent assessment of information security. The ISMS family is categorized into four structural and interrelated components, each containing one or more standards. The four categorized components and corresponding standards consist of terminology (standard no. 27000), general/normative requirements (standards nos. 27001, 27006), general/informative guidelines (standards nos. 27002 – 27005, 27007), and sector-specific guidelines (standards nos. 27011, 27799) (See Table 4 for a summary).
COMPARISON AND COMPLEMENTARITIES
Having presented an overview of each approach, we compare the approaches via Table 5. This section also discusses how the four approaches complement each other. All of the four approaches are business-oriented and independent of organizational structures, architectures, or technologies, which allows them to be implemented in most organizations. These approaches can be integrated to form a comprehensive approach to IS/IT risk and control with COBIT nested within the control aspects of the COSO ERM framework, ITIL nested within the processes of the COBIT approach, and the ISMS family contributing to the information security risk objectives of COSO ERM and COBIT.
The integration of COSO ERM, COBIT, ITIL and the ISMS family of standards is summarized and illustrated using Figure 1.5 Figure 1 represents both a top down and bottom up analysis of the four frameworks. First, the conceptual aspects of the four frameworks were integrated. For example, COSO is an organization-wide approach to risk management, while COBIT focuses on information technology. Thus, the integration begins with the establishment of business goals enabled by a continuously improving IS infrastructure that is supported by the best practices. These conceptual level relationships were used to lay out the overall diagram. Next, the basic concepts of each framework (e.g. “control activities,” “monitor and evaluate”) were examined to determine how the individual concepts fit together within the overall conceptual diagram. These conceptual relationships are explored in more details in the following section.
Citation: AIS Educator Journal 7, 1; 10.3194/1935-8156-7.1.1
After we mapped the concepts of all the frameworks, we examined each framework from the bottom up. Each framework provides practitioners with detailed guidance on how to implement the frameworks. The detailed guidance was examined and mapped from a bottom-up perspective to the conceptual diagram in Figure 1. The support for Figure 1, including the detailed mapping, is provided in the Appendices.
Note that in Figure 1, we use abbreviations to replace full names, making the figure more concise and easier to follow. The counterpoint between abbreviation and full name for Figure 1 is outlined in Appendix 2. Also, Figure 1 is based on our assessment of the quantity of mapping areas among these frameworks (See Appendices 3–5). The number of mapping areas represents the extent to which a certain component of one framework maps with a certain domain or section of another framework.
COSO ERM and COBIT
COBIT complements COSO ERM in two main ways: as a mechanism for aligning IT with enterprise objectives, and as detailed support for IT controls. After establishing the internal environment, the COSO ERM framework promotes the development of business goals built on the enterprise's philosophical approach to risk. COBIT supports these business goals by establishing policies, processes, and procedures for the overall IT infrastructure that promote the alignment of IT with business goals. COSO ERM establishes the business objectives COBIT uses to drive alignment of IT governance with the organization.
The second aspect of complementarity between COSO ERM and COBIT is in development of detailed internal controls. COSO ERM and COBIT differ in the depth of control coverage due to their different purposes and domains. COSO ERM's focus on enterprise risk management necessitates strong internal controls to ensure the accuracy of data and to provide controls for financial processes and accounting procedures. COSO ERM falls short, however, in providing detailed functional area guidance for establishing this strong internal control environment. This is an area where COBIT can be of value.
COBIT covers arguably the most important foundation of the creation and movement of financial information in the organization: the information systems technology infrastructure. It acts as an umbrella IT governance approach and can fulfill the COSO ERM requirements for the IT control environment. COBIT is an approach for control over IT “that fits with and supports” COSO ERM (ITGI 2007, 5). One way to think about this is to view COSO ERM as the generally-accepted enterprise internal control framework, while viewing COBIT as the generally-accepted IT internal control approach (ITGI 2007, 7).
A more detailed analysis reveals that COBIT supports and extends COSO ERM's components of Control Activities, Information and Communication, and Monitoring. COBIT addresses the high-level IT governance and overall control aspects of IT, aligning IT with business requirements. It also aids in implementing a control system for improved regulatory compliance and improves the quality and measurability of IT governance across the entire life cycle of application implementation. COBIT further supports COSO ERM by reducing IT-related risks and by increasing the quality of information.
Integrating ITIL
ITIL complements the role of COBIT by further supporting IT service management, including continuously improving IT customer service quality and IT operations efficiency. As such, ITIL largely complements COSO ERM via COBIT and in the same two aspects as COBIT: IT alignment with business and IT controls. First, ITIL impacts both the IT strategy and the organizational structure, thus impacting IT alignment. ITIL focuses on business value through the management of IT services and is designed for continuous process improvement. It is by providing better IT services to the business that ITIL promotes alignment of IT with the business (Kashanchi and Toland 2006).
Second, ITIL's process approach complements COBIT's control focus. Although COBIT is process-oriented, its focus is on control and audit functions. Therefore, COBIT is viewed as a control approach. This control focus makes COBIT normative, addressing the processes necessary to meet the needs for control and audit. ITIL, alternatively, can be viewed as a process approach that focuses on prescriptive processes for IT service management. This can be seen in the description of each approach. COBIT documentation refers to COBIT as “good” practice (ITGI 2007), underlying the point that COBIT is focusing on process control, not prescriptive performance-oriented processes. ITIL, on the other hand, discusses “best” practices and is oriented towards performance and continuous improvement. Thus, using COBIT and ITIL not only optimizes the maturity of IT controls, but also promotes the use of best practice processes for better alignment and performance.
Looking deeper into the complementarity of control, ITIL provides more details to COBIT's control objectives in the area of IT service management. This is similar to how COBIT provides more details on IT control than COSO ERM. In particular, ITIL focuses on optimizing operations management by providing definitions together with functional, operational, and organizational criteria for operations management. ITIL especially extends and deepens two of COBIT's four domains, the Acquire and Implement and the Deliver and Support domains, through its Service Transition, Service Design, and Service Operation areas.
While in general, ITIL can be thought of as addressing a subset of COBIT, COBIT complements ITIL by providing an environment for implementing ITIL. The high-level process control model of COBIT molds the ITIL processes to the business needs, ensuring a successful ITIL implementation and further supporting alignment with business goals. COBIT also provides a control checklist against defined IT processes as an effective mechanism for measuring and managing progress and improvement in implementing ITIL processes. The result is an improvement to internal control and improvement to the organization's ability to manage enterprise risks, the underlying purpose of COSO ERM.
Integrating the ISMS Family of Standards
Similar to COBIT, the ISMS family complements COSO ERM by supporting risk management and by providing detailed control support. First, the focus on information security risk management of ISO/IEC 27005 directly supports the risk management aspect of COSO ERM by focusing on risks that could impact information, including financial information. This is consistent with SOX and the intent of COSO ERM. Second, the controls of the code of practice in ISO/IEC standard no. 270026 support the need for controls suggested in COSO ERM. The ISMS controls cover information security on an enterprise-wide basis and are not as focused on the IT domain as are COBIT and ITIL. For example, sections 5 through 9 of ISO/IEC 27002 cover enterprise physical or human resources security management, while sections 10 to 15 cover various aspects about information security.
Although we find similarities and support between the two, COBIT and the ISMS family do differ. First, the ISMS family of standards focuses on an enterprise-wide approach to information security while COBIT, as its names implies, focuses on the IT domain. COBIT addresses the alignment of IT with the organization and performance of IT, while ISMS family of standards focuses on information security via the creation of an information security management system. For example, the scope of such a system is the confidentiality, integrity, and availability (CIA) of information, a traditional information security approach. COBIT addresses CIA but also addresses the effectiveness and efficiency of information as it supports organizational goals. The information security management system is supportive of COBIT, but using solely the ISMS family does not support all of the objectives COBIT covers.
In considering how the ISMS family complements the other models, it is important to note that the ISMS family of standards is international while the others are not: COSO ERM and COBIT are U.S.-centric while ITIL is British. Further, the use of the term “standard” is significant. COBIT as a methodology helps an organization meet its compliance needs and improves the organization's IT performance. Implementing the ISMS family of standards alternatively allows an organization to be certified as compliant with the standard, which is independent of any other audit or compliance needs.
Summary
Because COSO ERM, COBIT, ITIL, and the ISMS family of standards are developed for different purposes and possess distinct focuses and features, they are in essence more complementary to each other than competitive. Their focuses on different levels allow them to be integrated: COSO ERM addresses enterprise-level risk management and controls, COBIT addresses the IT domain, ITIL addresses IT service management, and the ISMS family of standards addresses information security management. The IT governance and control focus of COBIT directly supports the control needs of COSO ERM, and the IT service focus of ITIL supports the process controls of COBIT. Using both COBIT and ITIL assists in the alignment of IT with business objectives. Also, different components of COSO ERM, COBIT and ITIL can be further strengthened and enriched by different components of the ISMS family, with different supportive levels from an information security perspective.
CONCLUSION
The importance of information and the systems that supply this information to contemporary business is undeniable. Increasingly complex and sophisticated information technology that underlies these systems offers greater benefits, but also introduces greater risks. Effective risk management and control over the information system is therefore critical to an organization. In this paper, we have provided an overview of four approaches—COSO ERM, COBIT, ITIL, and the ISMS family—that addresses the risk and control issues surrounding information systems and technology. We propose that these four approaches are not redundant, but rather are complementary models that assist organizations in managing IT risk and controls. To this end, we offer an integrated framework to highlight the complementarities and suggest ways in which the four approaches can be used in concert. Because the accounting and auditing function bears significant responsibility for risk management and control, it is imperative that accountants understand these established approaches. However, two approaches important in the IS/IT discipline, the ISMS family and ITIL, appear largely absent from accounting education.
An accounting student today cannot become a successful, value-adding professional tomorrow without a solid foundation in both accounting and IT. If the primary characteristics of useful information are relevance and faithful representation (FASB 2010), and this information is supplied by an IT system, it must follow that accountants need skills and expertise in IT risk and control to ensure information usefulness. Although one might argue that accounting students can gain this knowledge in IT courses, they would likely miss the complementary aspects that are so important to comprehensive risk management and control. We encourage inclusion of the four approaches in AIS courses by providing a concise overview of each and by offering an integrated framework that can be used to introduce the approaches and to guide teaching plans. This knowledge, we believe, is essential to the success of our students in their future accounting careers.
Mapping Diagram of COSO ERM, COBIT, ITIL and ISMS