Mitch and AJ just found out that Hillsburg’s ONHAND system was hit by a cyberattack. (For details on the cyberattack, refer to the Appendix at the end of the book and read the transcript of the meeting with Hillsburg CFO, Avis Zomer, and the senior members of the Hillsburg audit team.)
1. What types of general and application controls can address cyber risks?
2. Based upon the description of the cyberattack, what concerns should the audit team have regarding the system of internal control?
3. How does the cyberattack impact the risk of material misstatement at the financial statement level? At the assertion level? Discuss the impact of the WannaCry cyberattack on Hillsburg’s financial statement audit.
4. Based upon your assessment of RMM, how should the auditors adjust their overall risk response?