RAZPRAVE B Methodologies for conducting information system audit: case study of Sarbanes-Oxley compliance MARIO SPREMIČ, Ph.D., Associate Professor Faculty of Economics and Business Zagreb. University of Zagreb Kennedy's sq G. 10000 Zagreb, CROATIA e-mail: mspremic@efzg.hr MATIJA POPOVIC, M.Sc., CISA Ernst S Young, Dublin. IRELAND Senior IT Auditor e-mail: matiia.popovie@ie.ey.com Abstract Although information systems (IS) and information technology (IT) are taking significant role in businesses with its innovating and supporting potential, it seems that it is the least understood company asset. Successful organizations manage IT function in much the same way that they manage their other strategic fuoctions and processes. This in particular means that they understand the IT control environment and manage the risks associated with growing IT opportunities, such as increasing regulatory compliance as well as critical dependence of many business processes on IT and vice-versa. They are doing so by engaging in IT Governance and information system audit (IS Audit! activities. In recent years there are a number of world-wide used standard, regulatory frameworks and best practices in IT governance and process management area such as CobiT, ITIL, Basel II Sarbanes-Oxley act (SoX), ISO 27000, which helps management to measure the actual IT performance end comply to regulatory demands. In this paper we present the case study of conducting IT compliance audit according to SoX After brief explanation of key terms, the methodology of complex SoX compliance audit is given and key performance indicators for major business processes stressed. The IS Audit process resulted in recommendations for business process change. Keywords: IT Governance, Information System Audit, Business Process Improvements. Case study, Sarbanes-Oxley compliance Povzetek Metodologije za izpeljavo revizije informacijskega sistema: študij primera usklajenosti i uredbo Sarbanes-Oxley Kljub temu da informacijski sistemi US) in informacijska tehnologija s svojimi inovativnimi in podpornimi zmožnostmi v poslovnih organizacijah pridobivajo na pomembnosti, se zdi, da so Se vedno med najmanj razumljenimi prednostmi podjetij. Uspešne poslovne organizacije namreč upravljajo s svojimi IT funkcijami približno tako kot z drugimi strateškimi funkcijami in procesi. To v bistvu pomeni, da razumejo okolje nadzora IT in da uravnavajo tveganja, ki izhajajo iz vse večjih zmožnosti IT. kot je vse večja možnost regulatornega usklajevanja ali kritična odvisnost vse več poslovnih procesov od IT in obratno, Tega se lotevajo tako. da vpeljujejo v IT nadzor in revizijske dejavnosti (IS Audit!. Zadnja leta so na voljo po vsem svetu znani in na široko uporabljani standardni regulatomi sistemi in dnbre prakse na področju IT-nadzora (governanceJ in upravljanja procesov, kot so CobiT. ITIL, Basel II Sarbanes Oxley act (SoX), ISO 27000. ki pomagajo menedžmentu izmeriti dejansko učinkovitost (performance) IT in njeno skladnost z regulatornimi zahtevami. V prispevku obravnavamo Študij primera izvajanja revizije in ugotavljanja skladnosti IT z uredbo 5oX Po kratki obrazložitvi ključnih pojmov predstavimo metodologijo kompleksnega ugotavljanja skladnosti s SoX in nato izpostavimo ključne indikatorje uspešnosti glavnih poslovnih procesov. Preskus IS se zaključi s predlaganjem sprememb v poslovnem procesu, ki jih priporočamo podjetni. Ključne besede: nadzor IT. revizija informacijskega sistema, izboljšave poslovnega procesa, študij primera, uskladitev Sarbanes-Oxley 1 Introduction source of sustainable competitive advantage (Peppard In today's highly competitive business environment, and Ward, 2004). The business value derived from IT effective and innovative use of information technology investments only emerges through business process (IT) has the potential to transform businesses as well as changes and innovations; whether they are product/ to positively affect organizations' performance. A num- service innovation, new business models, or process ber of researches showed that technology itself has no changt?. Organizations which intensively use IT as a inherent value and that IT alone is unlikely to be a means of improving efficiency and/or as an enabler of 2008 -številka 3 -letnik XVI uporabni informatika 133 Mario Spremic. Maiija Popovic Methodologies lor conducting information system audit: case study of Sarbanes-Oxley compliance business innovation and competitive advantage need to set-up IT governance processes and start to systematically measure the IT performances. The primary focus of IT governance is on the responsibility of the board and executive management to control formulation and the implementation of IT strategy, to ensure the alignment of IT and business, to identify metrics for measuring business value of IT and to manage IT risks in an effective way (ITG1, 2007). Nolan and Mc-Farlan (2005) recently pointed out that 'a lack of board oversight for IT activities is dangerous; it puts the firm at risk in the same way that failing to audit its books would'. In recent years various groups have developed world-wide known IT Governance frameworks and/or industry specific regulations (such as CobiT, ITU, Sarbanes-Oxley act, Basel II, ISO 27000) to assist management in managing risk and measuring the performance of IT initiatives. The main focus of our interest in this paper is the case study of Sarbanes-Oxley IS audit and IT control practices compliance in a large telecommunication company. After brief discussion about the frameworks for conducting IS Audit and IT Governance, the methodologies for conducting Sarbanes-Oxley (SoX) audit compliance are presented in Chapters 3 and 4. In Chapter 5 the description of the 'as-is' business processes in the company is given and according to SoX requirements risks identified and control deficiencies assessed. Chapter 6 refers to IS audit findings on IT control SoX compliance and discussion about the possible changes. The case study results showed how recommendations that arise from a systematic and thorough IS audit may help companies becoming aware of the deficiencies in the control environment and may enable business process change. 2 Emerging issues in IT governance, IS audit and compliance IT Governance represents the organizational capacity exercised by the Board, executive management and IT management to control the formulation and implementation of IT strategy and in this way ensure the fusion of business and IT (Van Grembergen and Guldentops, 2004; Spremic and Popovic, 2008). A good, or rather, inevitable approach for measuring the performance of IT should include thorough audit of all aspects of IS and IT, including hardware, software, data, networks, organization and key business processes. The primary goal of the information system audit (IT audit) is to identify the key business processes that depend on IT, to systematically and carefully examine their IT controls efficiency, to identify key risk areas and constantly measure the risk level, to warn about possible failures, as well as to offer suggestions to the executive management how to improve current IT risk management practices (Spremic, 2008). Engaging in IT audit is crucial for measuring the performance of IT as well as to manage the IT/business alignment, which makes IT audit the key cornerstone of IT Governance concept. Worldwide or industry specific regulations and IT Governance frameworks (such as CobiT, I TIL, SoX, SAS 70, HIEP A, Basel II, ISO 27000, NIST 800, etc,) help companies assess the level of IT control efficiency compliance and manage the associated risks. Through the information system audit process companies' management become aware of the control deficiencies and the IT auditor recommendations may drive the business process change, in order to mitigate recognized risks and deficiencies. The need for assurance about the value oi IT, the management of IT-related risks and increased requirements for control over information are now understood as key elements of enterprise governance. The issues raised in the control environment component apply throughout an organization. However, IT frequently has characteristics that may require additional emphasis on business alignment, roles and responsibilities, policies and procedures, and technical competence. The following list describes some considerations related to the control environment and IT (1TG1,2003); • IT is often mistakenly regarded as a separate organization of the business and thus a separate control environment. . IT is complex, not only with regard to its technical components but also in how those components integrate into the organization's overall system of internal control. ■ IT can introduce additional or increased risks that require new or enhanced control activities to mitigate successfully. • IT requires specialized skills that may be in short supply. ■ IT may require reliance on third parties where significant processes or IT components are outsourced. > Ownership of IT controls may be unclear, especially for application controls. Contemporary frameworks for conducting IT Governance and IT Audit are: 134 u e o n a u n a INFORMATIKA ?ma - f.tevilka 3 - letnik XV] Mario SpreiYifc, M.itijj Popovic: Methodologies for conducing information system audit: case study of Sarbanes-OKtey compliance . CobiT (Control Objectives of Information and related Technology), • ISO 27000 'famity (ISO 27001:2005, ISO 27002:2005), and • Sarbanes-Oxley act, ■ ITIL (IT Infrastructure Library), etc. CobiT, for example, is the widely accepted IT governance framework organized by 34 key IT processes (or key IT control objectives), which are broken into more than 300 detailed IT controls. For each of the 34 IT processes CobiT defines: ■ performance goals and metrics (for example, RPO, RTO, availability time), . KRI (Key Risk Indicator), KPI (Key Performance Indicator) ■ maturity models {0-5 scale) to assist in benchmarking and decision-making for process improvements, • a RACI chart identifying who is Responsible, Accountable, Consulted, and/or Informed for specific IT process. On the other hand, Sarbanes-Oxley Act (SoX), enacted in 2iX)2 by the US Congress in response to series of business failures and corporate scandals (Enron, etc.), represent an internal control framework for financial reporting, prescribed by SEC (US Securities and Exchange Commission) which is obligatory for SEC registrants. The stated purpose of SoX is to protect investors by improving accuracy and reliability of corporate disclosures. If a company wants to do business in USA it has to be SEC registrant. The SEC in its final rules regarding the SoX made specific reference to the recommendations of the Committee of the Sponsoring Organizations of the Tread way Commission (COSO). While there are many sections within the SoX, this paper focuses on section 404, which addresses interna! control over financial reporting. Section 404 requires the management of public companies specified by the Act to assess the effectiveness of the organization's internal control over financial reporting and annually report the result of that assessment. It is well known that reliability of financial statements largely depends on information system environment which needs to be adequately controlled, and in compliance with the SoX section 404.' Also, all daughter-companies oper- ating all over the world whose parent companies are SEC registrants, need to be SoX compliant, which increases the number of companies obliged to conduct the information systems auditing process, 3 Description of assessment procedures for compliaoce with Sarbaoes Oxley act Independent auditor is obliged to issue a report regarding internal controls of a company which has to contain assessment of the management's evaluation, and assessment of the design and Operating effectiveness of controls over financial reporting. Test procedures are as following: • assessment of the controls' design effectiveness ■ assessment of the controls' operating effectiveness. In order to 'cover' or rather manage various business risks, assessment of the effectiveness of controls' design relates to reasoning whether the identified control is designed adequately. Operating effectiveness is basically testing controls itself. If the application controls contain both manual, and automated part, i.e. IT dependant manual control, it is necessary to divide them and each part should be assessed separately, bearing in mind that manual part of the control cannot be assessed on a sample of one which is the case with automated part. After the scope of the review has been defined it is necessary to conduct control assessment. In the following table, SoX assessment plan is described which is used in the case study. Categorization of deficiencies While assessing the deficiencies in control environment, the following categorization is possible: a) No deficiency b) Deficiency in documentation c) Control evidence insufficient d) Control not identified, yet existing e) Design insufficient 0 Functionality insufficient g) Both e) and f) If design is categorized as a) and b), it is proceeded to the next step, which is operating effectiveness assessment. 1II Gove mar«» institute 12006): IT Control Objectives for$artxnK<¡ Oxley, tT Governance Instituto. Rollins Moutiows, Illinois, SAD., (j[j. 5 2008 - številka 3 - lei nik XVI imiiitii informatika 135 Mario Spremit. M.iIijj Popovic Methodologies for conducting information system audit: case study of Sarbanes-Oxley compliance Table 1. Sarbanes-Oxley act compliance process' Procedure Step Question 1 Review of Design Elfectiveness Review Process Documentation Is the process description complete, plausible, detailed enough and understandable? Additional important points Sufficient segregation of duties des on bed? Are IT Systems and interfaces completely included' Review Control Documentation Is the control description complete, plausible, detailed enough and undei-standable? Is the control adequate to achieve the control objective? Additional important points: Is the documentation of control performance sufficient? Is the handling of errors descrihed? Are the control attributes complete and plausible? Are Significant Accounts and Assertions complete and plausible? Are the people performing the control sufficiently qualified? Performance of Walkthroughs Was our understanding of the process, the control design, the involved entities, IT-Systems etc confirmed' What changes or deviations were noticed compared to the documentation? Are the controls actually implemented or are target controls or processes described? Evaluation of Design Effectiveness on Control Level Summary Are the controls adequate to cover the control objectives and to prevent misstatements? A categorization nf deficiencies (if applicable I has to be done (see Procedure "evaluation of deficiencies") to reach a conclusion ("adequate", "inadequate") and to define the following steps [Testing Operating Effectiveness or additional deficiency evaluation) Evaluation of Design Effectiveness on Process Level Summary: Are all Significant Accounts S Assertions that are relevant for the process covered by controls? Are IT Application controls documented completely' 2. Review of Operating Effectiveness Development ol a Test Plan Develop a test plan for all controls with adequate control design Selection of test tetnniquefs) (Inquiry. Observation. Examination. Re performance) taking into account: Kind of control (approval, authorization, segregation of duties, review system control), control frequency, level of automation, importance of control, security of testing result. Determination of sample sire taking into account Control frequency, level of automation, control complexity, experience of the control performer Perform Independent Testing Selection of sample size [adequate allocation over period under observation) Tasting according to test plan and results [in case of identified exceptions' stop testing or increase the sample size) Evaluation of Operating Effectiveness Does the control operate as described' Is the control able to identify potential errors? Are the control performances and the control results documented adequately' 3. Overall Evaluation Review Summary lor Design Summary: an Process Levai Effectiveness anri Operating Are all Significant Accounts 5 Assertions that are relevant for the process covered Effectiveness by documented and effective controls? tf deficiencies were identified: wera existing compensating controls considered during evaluation? 4. Evaluation Categorization of Deficiencies on Identify kind of deficiency: of Deficiencies Control and Process Level Documentation deficiency, process deficiency, transaction contrat deficiency, IT General Controls- deficiency. Quantitative & Qualitative Classification of affected Significant Accounts & Assertions Evaluation of Deficiencies nn Determination of likelihood of a misstatement Control and Process Level Determination of a potential quantitative magnitude of misstatement (if applicable take into account the ad¡usted exposure method) Determination of potential qualitative magnitude Definition of the Priority of Review ol the evaluation ol deficiencies and predelinition of the priority concerning Deficiencies possible relevance Discussion of weaknesses! 1 This is the working material used when conducting IS audit in this ease study. The material is particularly based on (TCI (2006) publication (IT Governance Insli tute (20061: IT Control Objectives fof Sarbanes-Oxley: The Role of IT in the Design and Implementation of Internal Control Ovor Hnancia! Reporting. 2nd Edition. Rolling Meadows, Illinois. SAO I, but lias been massively changed and expanded to serve as compliance process model for this particular case study. 136 g f ü > i ■ il i 1nformatika 2008 • stevilka 3 - lolnik XVI Mario Spremic, Matija Popovic: Méthodologies for conduclirig information system audit: case study ol Sarbanes-Oxley compliance Table 2. Design effectiveness11 Contrai Design Effectiveness Results of design testing Next steps Assessment Deficiency Detailed deficiency categorization® evaluation No deficiency Testing Operating Effectiveness Effective a) No Documentation deficiency1 Testing Operating Effectiveness ineffective b) No Not existing control identified in process No testing, deficiency evaluation Ineffective d) Yes Design deficiency No testing, deficiency evaluation Ineffective el Yes Tahie 3. Operating effectiveness' Control Operating Effectiveness Results of operating effectiveness testing Next steps Result document at ion Deficiency categorization Detailed deficiency evaluation needed No deficiency - Effective a) Exactly 1 Exception identified New testing by doubling the sample size: deficiency evaluation, if applicable Effective Ino new exception) or Ineffective (further exceptions) al or f) Yes if f] More then one exception Stop testing, deficiency evaluation Ineffective f) Yes Gaps in the control performance documentation, but functionality generally testable throughout period Deficiency evaluation Ineffective c) No While performing the walkthrough the auditor encounter the control which management has not identified as a key control Testing by the auditor, if control is operating effectively. (If the control is effective it should be categorized In issue category d). If the central is not effective the deficiency should be categorized in category f). Ineffective dlorf) Yes Control not being performed Deficiency evaluation Ineffective f] Yes 4 Description of the business processes in the company „Happy Phone",5 before the business process change In this case study, research objective is the billing process of the local/ non interconnection traffic in the large telecommunication company (let's call it 'Happy Phone'). The company is the leading telecommunication provider of both fixed telephony and Internet services, with broad spectrum of services offered to millions of users (voice telephony, data transmission, fast Internet access, digital television, wide range of mobile services, wireless Internet access, etc.). According to the fact that her parent company is listed on USA slock markets, the Company was obliged to do conduct the SoX compliance audit. In this chapter business process will be described on a high level, without detailed description of the control points, and in the next chapter control compliance with the SoX will be assessed. For the testing purposes and compliance assessment with the SoX it is necessary to comprehend the process and mapped them. This is the only way how could the potential mitigating controls be understood, and how to confirm the completeness of the management's control identification. During the audit, business processes which are driven by the IT are mapped by information system auditors (IT auditors). The same assumption is adopted in this case study, where integrated audit approach is applied, meaning that interim audit findings can be taken in the consideration during SoX review. 3 Ibidem, 4 Ibidem. '' Due to complexity and confidentiality o(the project, it isn't possible to iridicam any other relevant data about the company itself and about the project itself (duration, possible financial savings, Ihe estimation or the risks and damages in current system, etc.). It is important to notice that this is a IS compliance audit project and case study. Despite ihe (act lhat the companies rarely eniJage in them, it appears that tho results of IS compliance audit projects may came up with financial savings as well. Unfortunately, [urther data are not available due to the company's communication policy. 2008 -Številka 3 -letnik XVI updhahua INFORMATIKA 137 Mario Spremic, Mali ja Popovtc: Methodologies (or conducting information system audit: case study of Sarbanes-Oxtey compliance Process which is mapped in the interim audit can be used for understanding the processes during SoX review. Process mapping is performed that one transaction is captured on the beginning of the business process and is traced to its end, which may not always be possible in the IT driven business processes, because in the certain points in the process data is transformed to the format not comparable to the format prior to its transformation. When the end user of the telecommunication service makes a call, Call Detail Record (CDR) is generated at the switch. CDR contains the following information: • A Number - Calling number > B Number - Number that is being called • Date and time of the Call • Call duration . Call route . Unique call identifier Every call conducted in the certain moment in the telecommunication network, is according to the caller location, generated and recorded on certain switches. Each call generates at least one CDR. CDRs are according to the geographical and other significant criteria routed to the corresponding mediation devices. In Croatia, there are two types of the switches that are being used. On the switch type one data file, which will be transferred later on to the mediation device, is being filled with the CDRs until defined data threshold or fined amount of time elapses one of the criteria is met, data file is automatically transferred to the one ^^ of the mediation devices. Other type of the switch uses cyclical data file. After defined period of time a pointer is set on the file, and data captured between previous set up (if the pointer and the current pointer are packed in the non cyclical data file and is sent to the predefined mediation device. Current pointer becomes point from which data will be captured when next pointer is set. The process is continued likewise until cyclic file doesn't reach its end and CDRs are ginning of the cyclic file. In addition to the described process of capturing traffic, call can be captured in the pulse counters on the switches as well, now days used for control purposes only. After the data is transferred to the mediation device, data is transformed lo the format readable to the billing system. In addition to the mediation devices used for the data transformation, there is a monitoring mediation device, used for managing and monitoring of the traffic on the remaining devices. After the data is transformed to the format readable to the billing system, data from each mediation device arc every half an hour transferred to the billing system. In the billing system, the process is performed in 5 steps. Process begins with the data acceptance, followed by the data validation, and with adding the billable amounts to the data. After that billable data is aligned to the end users and finally invoiced. According to A number, end user is identified to whom invoice will be issued, and based on a B number and call duration in certain CDR value is added to a call, making thisa billable data. Information identifying A number is transferred in a real time from the CRM system to the billing system, so that the billable data can be identified to a customer. At the end of the month, in iff)"' Switch 1 *_* Switch 2 t_/t\^ until oeoneu u © A Data P re-Validation RATING BILLING ▼ 9 ® 1 Not for rating CDR control £2) Erronous CDRs control '3) Rating control 4 End of month completeness control (i) Alternative method of revenue calculation Picture 4 Dataflow in the hilling system after business process change 144 uforubnh INFORMATIKA 200fl - številka 3 ■ letnik XVI Mario Sprerriid, Matija Popovic; Methodologies for conducting information system audit; case study of Sarbanes-Oxley compliance and invoicing. This additional control on the process could cover potential deficiencies of other controls. Nevertheless in the company's documentation there are also other deficiencies, in no case except the one described, deficiency remediation wouldn't cause the change to the process. It can be seen on the chart that the control "5, "Alternative method of revenue calculation" is a new control added to the process. Therefore the company has to include this control and perform self assessment in a same manner as it is performed for the rest of the controls. Also, independent auditor has to perform an assessment in a way described in Chapter 4, 7 Conclusion In this paper we presented a case study of Sarbanes-Oxley compliance audit in a large telecommunication company. Fven though the company was obliged to comprise with SoX regulatory requirements, it appears that systematically conducted IT audit may still find certain control deficiencies and propose business process changes. After understanding the actual business processes in details, after reviewing the process documentation and after conducting tests on processes control effectiveness, an IT (information system) auditor summarizes the findings on the control deficiencies. As presented in this case study, all control deficiencies may be remediated through systematic audits and assessment process. The crucial fact is that an auditor should challenge whether a risk identified by the company's management had been adequately addressed by the existing controls. Moreover, the completeness of the risks identified has to be challenged by the auditor. In this case, it has to be stated in the report that there is no control which completely covers the identified risks, and its implementation should be included in the recommendation. Auditors are not responsible for the design and implementation of the control. An auditor should identify that certain control is missing, and assess it in the next iteration after the company had accepted and implemented the recommendation. Therefore the understanding of the environment is critical for an auditor to practice reasonable assurance during the assessment. Also, the case study reveals the fact that the nature ot business risks has changed and new IT risks emerged. IT risks are risks associated with intensive use of IT to support and improve business processes and business as a whole. They are related to threats and dangers that intensive use of IT may cause undestred or unexpected damages, misuses and losses in whole business model and its environment. Although, traditionally, only the IT departments were responsible for managing IT risks, their importance affects the fact that the number of companies starting to systematically deal with such problems is ever increasing. Thus the issue of managing the IT risks becomes less and less a technical problem, and more and more the problem of the whole organization i.e. a 'business problem', which can be managed by engaging in IT Governance activities and conducting periodic IT Audits. References 1. Champlain, J.J (2003): Auditing Information Systems, 2nd ed. John Wiley & Sons, SAD. 2. Epstein, M. J.. M. J. Roy, (2004): "How Does Your Board Rate?." Strategic Finance, February, p. 25-31, 2004. 3. H union, J.E., Bryant, S. M., Bagranoff, N A ■ (2004): Core Concepts ol Information Technology Auditing, John Wiley & Sons Inc., SAD. 4. IT Governance Institute (2003): Board Briefing on IT Governance, 2nd ed., IT Governance Institute. Rolling Meadows, Illinois, SAD. 5. IT Governance Institute (2006): IT Control Objectives for Sarbanes-Oxley; The Rote of IT in the Design and Implementation of Internai Control Over Financial Reporting. 2nd Edition, Rolling Meadows, Illinois, SAD 6. Nolan. R. and McFarlan. F.W. (2005): Information Technology and Board of Directors. Harvard Business Review, October, 2005. 7. Spremià, M , Popovic. M. (2008): Emerging issues in IT Governance: implementing the corporate IT risks management model, WSE4S Transaction on Systems, Issue 3, Volume 7. March 2008. pp. 219-228. 8. Spremic, M . Jmirak. Z Kraljevic. K. (2008}: Evolving IT Governance Model - Research Study on Croatian Large Companies, Transactions on Business and Economics, Issue 0, Volume 5. May 2008, pp. 244-253. 9. Symons, C. (2005): IT Governance Framework; Structures, Processes and Framework, Forrester Research, Inc 10. Van Grembergen, Guldentops, D R. (2004): Structures, Processes and Relational Mechanisms for IT Governance. Idea Group. 11. Venkalraman, N. (1999): Valuing the IS Contribution to the Business. Computer Scte ne e s Cor porati o n. 2Q08 - iteviika 3 - letnik XVI up0h4bn» informatika 145 Mario Spremic. Malija Popovic; Methodologies lor conducting information system audit: case study of Sarbanes-Oxtey compliance 12. Ward, J., Peppard, J. {2002}: Strategic Planning for Information Systems, 3"' ed., John Wiley & Sons. 13. Weill, P., Ross, J. W. (2004): IT Governance: How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business School Press, 2004 Mario Spre m tč je izredni profesor na Oddelku za informacijske sisteme in upravljalsko informatiko na Ekonomsko-po s lovni fakulteti Univerze v Zagrehu Je tudi programski vodja Ekonom s ko-poslovnega mednarodnega programa (EBIB) Diplomiral je iz matematičnih znanosti, magistriral i L menedimenta informacijskih tehnologij in doktoriral na zagrebški univerzi na področju informacijskih sistemov Je avtor 0 knjig in vrč kot 130 Člankov v strokovnih revijah, knjigah in zbornikih, v glavnem s področij e poslovanja, upravljanja i IT, upravljanja s tveganji IT. IS strategi]ami, kontrolami in revizijami. Predava na številnih podiplomskih Študijih na različnih univerzah in je sourednik več strokovnih publikacij. ■ Matija Po povili se je po končanem študiju na Poslovno-ekonom s ki fakulteti v Zagrebu zaposlil v za gre hš ki izpostavi družbe Emst S Young. Kot usposobljen (certificiran) revizor informacijskih sistemov je sodeloval v številnih revizijah IT in svetovalnih projektih na Hrvaškem, Irskem, SlovaSkem in v Veliki Britaniji. Po treh letih delovanja v družbi Ernst E, Young, Hrvatska, je bil premeščen v izpostavo v Dublmu, kjer se je specializiral kot svetovalec za tveganja Opravil je magisterij na Poslovno-akonomski fakulteti v Zagrehu in je avtor dveh člankov. 146 uoosishi informatika 2000 - številka 3 - letnik XVI