Electronic Connections Ltd. (ECL) is a major supplier of computer networkrelated services. It was started by two young programmers in 1963 who purchased a (then) large secondhand mainframe computer to provide timesharing services to customers. ECL expanded it services throughout the 1960s and 1970s. In particular, it developed large, complex commercial, scientific, and engineering software, initially to meet the specific needs of particular customers and then to address the needs of a wider customer base. Early in the 1980s, it established a hardware and software infrastructure to provide electronic funds transfer services to financial institutions. Because of its innovative, high-quality support, its electronic funds transfer services were a major success, particularly with small- to medium-sized financial institutions. In the late \(1980 \mathrm{~s}\), it began to provide a range of electronic data interchange services and electronic mail services. In the early 1990s, it entered the Internet market aggressively by providing a wide range of relatively cheap services to support its customers' use of the World Wide Web. ECL's management had a view that having customers use their Internet services in due course could be used to leverage their use of other, more profitable services that ECL provided.

About 18 months ago, senior management of ECL initiated a major study of physical security controls and logical access controls. Senior management had increasingly recognized that there were some significant exposures in relation to the facilities and systems that ECL operated. Since the early 1980s, ECL has had in place a small but effective internal audit function. The problem that senior management has perceived, however, is that changes to the control system have been unable to keep pace with changes to the hardware-software platform that ECL uses to support its customers. Because of this, they asked a firm of external consultants who offered a "packaged" physical security and logical access controls solution to evaluate its feasibility within ECL.

You are the manager of internal audit for ECL. You were appointed about 12 months ago to fill the vacancy created by the retirement of the previous manager of internal audit (who had filled the position since it was created). Previously you were a manager in a major public accounting firm. Senior management has asked your advice on the recommendations provided by the external consultants who have been examining physical security and logical access controls within ECL. Basically, their report recommends that ECL purchase and implement their packaged controls solution to reduce exposures to acceptable levels.

You are concerned, however, because you also have a report prepared independently by your two most senior staff auditors on the work undertaken by the external consultants. Each has been with ECL for more than ten years, and they know the company well. In one part of their report, they have undertaken a discounted cash flow analysis of the packaged solution proposed by the consultants. In addition to basing their analysis on information provided by the consultants, they have also collected their own data on the likely benefits and costs of the control system. Their most optimistic estimate of the net present value (NPV) of the control system over its estimated six-year life is \(-\$ 325,000\) (that is, the NPV is negative). Their most pessimistic figure is \(\$ 2,063,700\). In calculating the NPV, they have used discount rates that vary between 10 percent and 15 percent. Unfortunately, the consultants' report provides no discounted cash flow analysis. Indeed, the hard quantitative data they provide on costs and benefits is sketchy.

Required: Make a list of issues you feel you should take into account in preparing your report for senior management. You need to consider the situation carefully because some of the issues you identify could have a significant impact on the recommendations you ultimately make to senior management.