needs to address for its information technology; they plan to prepare a report
recommending internal controls that address each risk. They have located the five
sources of information listed below, but want to use no more than three in their report.
Use the UMUC criteria to explain which sources they should use.
a. A software documentation manual for the general ledger system used at NSR
Corporation. The manual contains a section on troubleshooting the software, which
briefly discusses common risks and problems associated with its installation. The
manual’s title page lists the software company as its author.
b. A web site, first published in 2009 and last updated in 2014, for an information
technology consulting firm. The web site lists and discusses twenty common internal
controls for information technology based on the firm’s past clients.
c. An article published in Information Security, a practitioner journal. The article,
published in 2013, was co-authored by a university professor and the chief information
officer of a Fortune 100 corporation. It analyzes five common internal controls for
information technology, including a description of each control, the costs of
implementing it and the benefits of implementing it.
d. The American Institute of CPAs list of “top ten technologies” for 2014, published on
the AICPA web site. The list was developed via a survey of practicing CPAs throughout
the United States; it includes several items related to information technology control,
and also provides suggestions about where to find additional information.
e. The third edition of a management information systems textbook. It was published in
1999 and includes two chapters on information technology security. The textbook was
written by a team of three authors: one information systems auditor with three years’
experience, and two university professors with advanced degrees but little experience.
Refer to the following case as you respond to the question:
The Celebration Theatre is a small, independent theatre that puts on 12 plays per year.
30 days before the start of each calendar quarter, Celebration prepares advertising for
the productions in the upcoming quarter. They advertise on their web site, via e-mail to
their season subscribers and via direct mail and brochures to others.
Patrons can buy tickets for a single play; alternatively, they can subscribe to all three