CEO, CFO

1
CEO, CFO CIO Engagement in Information
Technology Management The Disciplinary Effects
of Sarbanes-Oxley Information Technology Material
Weaknesses
Discussant Report Terry Hung -
PricewaterhouseCoopers
2
Authors Motivation or Justification

• The authors justification that companies
  reporting IT material weaknesses should result in
  CEO and CFO becoming more involve with IT
  management should not be the sole reason for them
  being involved.
• The study focuses too much on the consequences of
  reported material weaknesses, rather than looking
  at demonstrating the value of IT to senior
  management.
• The alignment of business strategic goals to the
  investment in IT should be a better motivation
  for CEO and CFO involvement.

3
Theoretical Support

• The results are taken from 2004 and 2005 reports.
  The results could be outdated.
• Since the initial introduction of SOX in 2004,
  reported material weaknesses have been on the
  decline due to the improve controls implemented.
  Would the study done on recent reports provide
  the same conclusions?
• The author suggests the delegation of
  responsibility of senior management involvement
  in IT activities to the CIO introduces agency
  problems, such as agency costs, which include
  monitoring and residual losses. Not sure what the
  alternative solution should be and whether the
  alternative solution would be more cost
  effective.

4
Research Method Deployed

• The author has admitted to limitations in the
  method deployed
• The SOX standards leads to judgement as to the
  qualitative nature of a material weakness on
  the part of the reporting firm and their auditors
  and may be different to another report firm and
  auditors.
• Data examined the initial wave of SOX 404 reports
  may be markedly different than SOX 404 reports in
  subsequent periods.
• Executive turnover may be driven by voluntary
  turnover.

5
Analysis of Results

• The study does not look at the lack of other
  business mitigating and compensating controls
  that could have detected an IT material weakness.
  
• If business controls cannot detect systemic IT
  material weaknesses, there is a stronger argument
  for laying responsibility on the CEO and CFO.

6
Conclusion

• Agree with the authors conclusion that the CEO
  and CFO are accountable for serious IT problems,
  but it should not be focused only on SOX related
  control weaknesses.

7
Contribution to Practice

• Effective IT general control should contribute to
  an organizations overall internal control
  structure.
• In practice, senior management are more
  interested in timely and quality IT service
  delivery that aligns with the company goals.
• CEOs and CFOs are generally interested in SOX IT
  material weaknesses as they are certifying on the
  operating effectiveness of the controls.
• More interested if it directly impacts their
  compensation or employment, or if monitored by
  Audit Committees.

8
Exposition

• The conclusion makes sense.
• Practitioners may find the statistics difficult
  to understand.

9

• Terry Hung is a Managing Director with the
  Advisory Services at PricewaterhouseCoopers LLP.
• Contact Details [phone] or
  terry.hung_at_ca.pwc.com
• The views and opinions expressed herein are those
  of the discussant and do not necessarily
  represent the views and opinions of
  PricewaterhouseCoopers LLP.