MGT422H5 Lecture Notes - Lecture 9: Antivirus Software, Penetration Test, Financial Statement
Document Summary
Outsourcing e. g. rogers outsource to ibm when make this decision to outsource, they do not also pass on accountability (rogers is still accountable to it"s customers). The one who outsources is still accountable and not the outsourcer. Ey can look for compensating controls at rogers (if ibm doesn"t have certain controls, can rogers do so?) If not then send report: control effectiveness over period of time e. g. if controls seem reasonable then step 2 is testing these controls. When auditor goes in to check for controls then they have tested the operating test of the controls. Ey does not reference deloitte"s auditor report in their audit report. Subsequent events that may potentially affect the decision making of users. Service auditor"s report is not standardized (not all controls are tests, the auditor will choose what controls to cover). Therefore cannot just look at the last page and say they are good .
