agenda

Company Background

Key Organizational People

A New IT Project

Issues With the IT Project

Your Role

Your Task

Company Background

DentDel is a wholesale distributor of dental equipment. The main business operation involves purchase and resell of dental equipment to dentists. DentDel began operations as a regional provider of dental supplies to dental providers. The initial marketing plan was to employ sales staff, travel to dentist offices and take orders.

Key Organisational People

The top management people at DentDel Inc.:

Dan OReilly, chief executive officer (CEO)

Cedric James, chief information officer (CIO)

Chuck Hernandez, director of systems development

Sarah Stein, vice president of sales

Rafael Colon, chief financial officer (CFO)

Alicia David, audit committee chair

A New IT Project

Dental supplies business is extremely competitive. Timely ordering and delivery of the products is the key differentiator between DentDel and its competitors.

The sales staff would take orders on paper and bring the orders to the office for processing every night.

This order processing method proved to be too costly and time consuming. In response, the sales people were provided with portable fax machines to send the orders after each visit. This, too, was inefficient because the orders had to be transcribed from the faxes, which were often illegible.

A New it project

The IT department, led by Cedric James, decided that wireless technology had become reliable and secure enough to begin equipping the sales team with handheld devices.

Cedric had a Pear P-Phone, and he decided that this would be the platform on which to build a new order entry system. Cedric brought his idea to Chuck Hernandez, who began developing a business case.

A New IT project

Chuck spoke with Sarah Stein and Rafael Colon to get some initial feedback on the current sales system. He also met with several members of the field sales force to determine which technologies would make their sales efforts more efficient.

Chuck completed the business case and conceptual design. He presented it to Cedric, who forwarded it to Sarah and Rafael with a recommendation that they approve it.

A new it project

Cedric, Sarah and Rafael held a 10 minute meeting in which the project was discussed. Cedric presented his representation of the operational benefits and financial savings, using his assumptions and cost estimates.

After limited discussion, based on Cedrics representations of the savings and benefits, Rafael approved the US $20 million project, which included systems development and acquisition of the equipment.

Because of the desire to implement the project development quickly, the project was not presented to the executive committee, comprised of the CEO, CFO, chief operating officer (COO) and general counsel.

A New IT Project

It was decided that Sarah, Cedric and Chuck would oversee the project as an ad hoc committee. Rafael would sit in on meetings affecting financial issues. No chairperson was established. In preparation for the later rollout, Cedric decided to replace the sales teams mobile phones with the P-Phone to save the expense of replacing the phones later.

Issues

At the last status meeting, involving Rafael, Sarah, Chuck and Cedric, the following issues were raised:

The project team has spent US $8 million, but reports that only 25 percent of the project plan has been completed. The original plan was to spend US $3.5 million by this point in the project.

Issues

The project team was having the following internal difficulties:

The business subject matter experts were only available in the late afternoon, after they had finished their routine responsibilities.

The IT project team feels that the business is not providing enough resources or attention.

The project team reports that the sales team has been complaining about phone service at the locations they visit. The IT project team suggests that the signal is good enough and that the sales team members can always find a place with an adequate signal.

The project team has not reported any issues to the executive committee.

Issues

Sarah reported that the dentists have less time to visit with the sales team members and would prefer to have their administrative assistants place the orders directly via the web. She questioned whether it would be best to convert this project to a web-only order entry system and abandon the sales visits. Cedric was angered because Sarah questioned the viability of his technology strategy.

Rafael indicated that he was concerned that the write-off of this project could be unsettling to the shareholders.

Issues

After status meeting, Rafael was quite concerned about the whole tenor of the project and foresaw a write-off of US $8 million, which would be considered financially material and require a US Securities and Exchange Commission (SEC) disclosure. He decided to bring this issue to Dan OReilly.

Dan was extremely concerned and requested an internal audit of the process. Since the situation also involved a material financial impact, he was obliged to notify the audit committee chair, Alicia David. Alicia shared all of the concerns identified by Dan, but felt that the internal audit assessment should have a wider scope.

Your Role

You are internal audit team lead for IT audit at the internal audit department of DentDel Inc.

You have 10+ years of experience with IT auditing, and have very good knowledge of IT governance and COBIT 2019. You have in the past engaged in reviewing and evaluating IT projects for their adequacy and effectiveness on IT planning, IT budgeting, and compliance with corporate policies and procedures.

Your Task

Alicia David requested that the internal audit department prepare a discussion document to provide the audit committee and CEO with an understanding of what happened and what actions should be taken.

In this view

Your Task

Build and execute an IT assurance initiative, in line with the COBIT 2019s guidelines, by:

1.Scoping of the assurance initiative

2.Stating relevant objective components (processes, organization structures, information flows and items, etc.) and suitable assessment criteria to perform the assessment

3.Reporting the results of your assessment including your findings and recommendations