Question

The sales staff would take orders on paper and, nightly, bring the orders to the office for processing. This proved to be too costly and time consuming, and in response, the sales people were provided with portable fax machines to send the orders after each visit. This, too, was inefficient because the orders had to be transcribed from the faxes, which were often illegible. The IT department, led by Cedric James, decided that wireless technology had become reliable and secure enough to begin equipping the sales team with hand-held devices. Since Cedric had a Pear P-Phone, he decided that this would be the platform on which to build a new order entry system. Cedric brought his idea to Chuck Hernandez, who began developing a business case. Chuck spoke with Sarah Stein and Rafael Colon to get some initial feedback on the current sales system. He also met with several members of the field sales force to determine which technologies would make their sales efforts more efficient. Chuck completed the business case and conceptual design. He presented it to Cedric, who forwarded it to Sarah and Rafael with a recommendation that they approve it.Cedric, Sarah and Rafael held a 10-minute meeting in which the project was discussed. Cedric presented his representation of the operational benefits and financial savings, using his assumptions and cost estimates. After limited discussion, based on Cedric’s representations of the savings and benefits, Rafael approved the US $20 million project, which included systems development and acquisition of the equipment. Because of the desire to implement the project development quickly, the project was not presented to the executive committee, comprised of the CEO, CFO, chief operating officer (COO) and general counsel. It was decided that Sarah, Cedric and Chuck would oversee the project as an ad hoc committee. Rafael would sit in on meetings affecting financial issues. No chairperson was established. In preparation for the later rollout, Cedric decided to replace the sales team’s mobile phones with the P-Phone to save the expense of replacing the phones later. At the last status meeting, involving Rafael, Sarah, Chuck and Cedric, the following issues were raised: • The project team has spent US $8 million, but reports that only 25 percent of the project plan has been completed. The original plan was to spend US $3.5 million by this point in the project. • The project team was having internal difficulties: • The business subject matter experts were only available in the late afternoon, after they had finished their routine responsibilities. • The IT project team feels that the business is not providing enough resources or attention. • The project team reports that the sales team has been complaining about phone service at the • locations they visit. • The IT project team suggests that the signal is good enough and that the sales team members can always find a place with an adequate signa Questions As the internal audit team lead for IT Audit, you have been asked to utilize COBIT as a framework to Case Exercise: Student Book COBIT: IT_Gov_Using_COBIT_and_ValIT_Student_Book_2ndEd_Research.pdf 1.Identify which processes were ineffective and allowed this situation to occur, using COBIT to justify your responses. 2.Suggest the steps management should take to assess the situation and create an action plan. 3.Identify which governance processes should be initiated to prevent reoccurrence of a project failure such as this one. 4.What are the five steps required for the IT assurance of a specific area? 5.Based on the results of question 4 and your understanding of the control environment, identify the high-risk areas requiring audit attention. As an IT auditor, suggest the steps senior management should take to assess the a failed IT implementation using COBIT and IT governance and create an action plan.

Answer 1

Ans 1- Plan and Organise process were ineffective and allowing this critical situation.

· The project as initiated without take the agreement of leadership team.

· The risk assessment process not effective which can prevent this situation.

· Cost analysis not done properly.

Ans 2- Steps Management Should take to assess the Situation –

· Identify the problem in the project.

· Meeting with the project team.

· Understand the where the mistake happed to spent $ 8 million against the plan for $3.5 million.

· Do the risk assessment (Take consideration -cost, time, employee etc.).

· Prepare the plan to complete the project with remaining budget or what best can do.

· Meeting with the top leadership and explain about the project involve executive committee.

· Share the current status and the action plan how we can do further to complete the project.

· Try to get the approval for dedicated project team.

Ans 3- The Two governance process should initiate to prevent reoccurrence of project failure –

· Value Delivery – The IT value are the project should complete on time and within the budget with achieve the benefits agreed.

· Risk assessment – During this analyse all risk such as financial risk, technology risk, systemic risk and the information security risk.

Ans 4- Steps for IT assurance plan –

· Establish the IT assurance universe.

· Select an IT control Framework.

· Perform risk-based IT insurance planning.

· Perform high level assessments.

· Scope and define the high-level objectives for initiative.

Ans 5- The Steps should take by senior management –

· Make the Procedure that project approval by senior leader ship in mandatory.

· Review the project detail.

· Make the schedule for project review.