9. DISASTER RECOVERY PLAN – Hexagon
a. The internal control weaknesses at Hexagon include:
The building is constructed with fire prone exterior wooden shingles with exposed
end of the week. A midweek fire could destroy the most current backup data.
Documentation and recovery instructions should be stored off-site not in the data
binding contract that would guarantee assistance in the event of a disaster.
Members to the agreement will discover that when a disaster strikes one or more
b. The components that should have been included in the disaster recovery
plan at Hexagon to ensure rapid computer recovery include the following:
Chapter 1 Page 2
should be assigned specific tasks consistent with their skills and functions.
The duties and responsibilities of the recovery team include:
c. Factors, other than those included in the disaster recovery plan itself, that
should be considered when formulating the plan include:
10.INTERNAL CONTROL AND DISTRIBUTED SYSTEMS
a. This company needs to make sure that the following items are included in
their LAN and PC design.
Chapter 1 Page 3
i. sensitive files may be intercepted as they are traveling around the LAN cabling
devices.
ii. unauthorized access to sensitive files on the file server and user PCs.
iii.data loss from poor backup.
Chapter 1 Page 4
11. INTERNAL CONTROL RESPONSIBILITY FOR OUTSOURCED IT
Management may outsource their organizations’ IT functions, but they cannot
outsource their management responsibilities under SOX for ensuring adequate IT
internal controls. The PCAOB specifically states in its Auditing Standard No. 2,
“The use of a service organization does not reduce management’s responsibility
12. COMPETING SCHOOLS OF THOUGHT REGARDING OUTSOURCING
Core competency theory argues that an organization should focus
exclusively on its core business competencies while allowing outsourcing
Commodity IT assets are not unique to a particular organization and are
thus easily acquired in the marketplace. These include such things as
network management, systems operations, server maintenance, and
Chapter 1 Page 5
Cost Economics (TCE) theory is in conflict with the core competency school
by suggesting that firms should retain certain specific non-core IT assets in
house. Because of their esoteric nature specific assets cannot be easily
Naturally, a CEO’s perception of what constitutes commodity IT assets plays
an important role in IT outsourcing decisions. Often this comes down to a
matter of definition and interpretation. For example, most CEOs would define
Chapter 1 Page 6
outsourcing.
13. DISTRIBUTED DATA PROCESSING
Cost reductions. In the past, achieving economies of scale was the principal justification for
the centralized approach. The economics of data processing favored large, expensive,
powerful computers. The wide variety of needs that such centralized systems had to satisfy
called for computers that were highly generalized and employed complex operating systems.
Powerful yet inexpensive small scale, which can cost effectively perform specialized functions,
Improved cost control responsibility. Managers assume the responsibility for the financial
Improved user satisfaction. Perhaps the most often cited benefit of DDP is improved
user satisfaction in three areas: (1) users desire to control the resources that influence their
Backup. The final argument in favor of DDP is the ability to back up computing facilities to
Chapter 1 Page 7