Accounting Programs Providing Fundamental IT Control Knowledge?
Joseph O’Donnell and Jennifer Moore
- Auditors often provide assurance on computerized controls,
where electronic transactions are processed without a paper
audit trail. Section 404 of the Sarbanes-Oxley Act (SOA) requires
auditors to evaluate a company’s internal controls.
SAS 94, The Effect of Information Technology on the Auditor’s
Consideration of Internal Control in a Financial Statement
Audit, emphasizes the importance of IT on internal controls
and evidential matter.
pervasive use of systems in organizations and the increased
emphasis on assurance of information technology (IT) processes
has increased the need for accounting professionals with
IT control knowledge and skills. A shortage of well-trained
college graduates has led some large accounting firms to
cross-train current staff. Some CPA firms have hired individuals
with no audit training from other disciplines, such as information
systems. The 2000 report of the Public Oversight Board’s
Panel on Audit Effectiveness saw an increasing need for
auditors to have a higher level of technology skills, and
recommended that firms develop specific training programs
in IT for its auditors. Schools were asked to help with
this effort by providing accounting graduates with the basic
skills to satisfy the expanding need for accountants with
IT control knowledge.
study by Albrecht and Sack recommended reform in accounting
education in several areas, including IT instruction, to
better meet the needs of the accounting profession. They
found that accounting professionals and accounting faculty
ranked information systems as the second most important
topic of study for an accounting major. IT skills were found
to be the fourth most important skill for accounting students,
after analytical and critical thinking, written communication,
and oral communication. An important component of IT skills
is fundamental knowledge of IT controls and processes. Accounting
students typically gain introductory knowledge of IT controls
through an accounting information systems (AIS) course.
authors studied the status of AIS/IT auditing courses in
accounting programs and their relationship to the size of
the accounting department, as well as the IT interests of
full-time accounting faculty members. Smaller departments
may be limited in AIS course offerings due to resource needs
and the ability to recruit qualified faculty. A full-time
faculty’s teaching or research interest reflects an
ability to effectively teach IT-related courses that coincide
with the business environment’s needs.
study examined 210 accounting programs listed in the 2004–2005
Accounting Faculty Directory, compiled by James Hasselback.
The sample of schools was evenly divided into three categories,
based on the number of full-time accounting faculty: large
(more than 10 full-time faculty), medium (6–10 full-time
faculty), and small (1–5 full-time faculty). Coverage
of IT controls was determined by the inclusion of an AIS
course in the curriculum (all IT auditing classes had AIS
as a prerequisite)
results of the study, as shown in the Exhibit,
indicate that 65% of the schools offer AIS; 57% require
it, and the other 9% offer it as an elective. These results
suggest there is a disparity between the current business
needs of large organizations and the education received
by students in approximately one-third of the programs.
These results may also reflect that many companies have
relatively simple IT environments with minimal effect on
the financial statements.
is also useful to understand the interests of full-time
faculty. For 63% of the schools, at least one full-time
faculty member has a teaching or research interest in IT,
similar to the proportion of programs teaching AIS.
large accounting departments, 84% offer an AIS course (79%
required, 6% elective; difference due to rounding). A slightly
lower percentage, 79%, have at least one full-time faculty
member interested in information systems. Consequently,
at least some large schools use part-time faculty to teach
the course. Possible reasons include a lack of financial
resources to fund an IT-related course; a perception that
IT controls knowledge is not an integral component of an
accounting program; and the disincentives of IT research
for non-tenured accounting professors. For instance, in
order to make tenure at the top-tier schools, assistant
professors are typically required to publish in the Journal
of Accounting Research and The Accounting Review,
which publish few IT research articles. Teaching AIS at
large schools may be attributable to the placement of these
institutions’ students in the Big Four, which are
at the forefront of incorporating IT controls knowledge
into their assurance services.
percent of medium-sized accounting departments include AIS
in their programs (59% required, 9% elective). Interestingly,
76% of schools in this category have at least one full-time
accounting faculty member interested in information technology.
Thus, the possible explanations for schools not offering
an AIS course might include a lack of financial resources
or a lack of faculty support for changing the curriculum.
44% of the small accounting departments teach AIS (33% required,
11% elective), and 36% have full-time instructors with an
interest in IT. Thus, some schools are staffing AIS courses
with adjunct faculty, which is consistent with adjunct faculty
teaching specialized courses such as law and income tax.
results of the study suggest that there are still many students
graduating from programs that do not provide training in
IT control knowledge and competencies. Our study is consistent
with other research indicating that students are more satisfied
with the education they receive in financial accounting
theory, auditing, taxation, and managerial accounting than
they are with the education they receive in AIS.
improvement in internal controls instruction can be attained
through combined efforts of the AICPA, state societies,
firms, organizatons, and educators. According to J.E. Boritz
in “The Accounting Curriculum and IT” (www.ifac.org),
a critical step is that IT be considered a core part of
the accounting program rather than a peripheral course.
in firms and industry can influence educational programs
by understanding the importance of IT controls and by hiring
accounting students that possess that knowledge base. Just
as employers expect basic software skills, they should expect
IT control competencies. Being a knowledgeable employer
of graduates with IT control competencies will encourage
accounting faculty to include AIS or IT auditing in their
AICPA can influence the educational curriculum through the
CPA exam’s requirements and content. Requiring extra
courses to sit for the CPA exam would increase the coverage
of topics but reduce schools’ flexibility in designing
their programs. Conversely, under-coverage of topics inadequately
prepares accounting graduates for the profession. Seventeen
percent of the licensing authorities currently require—or
have approved requirements that will require—AIS or
IT (computer) auditing. Licensing authorities that do not
require an AIS or IT auditing course should consider the
importance of IT controls when setting their educational
of IT topics has increased slightly on the recently revised
Uniform CPA Exam. The new format of the exam includes an
IT section in the Business Environment portion of the exam.
In the previous exam, IT controls and IT auditing were covered
in the Auditing section. The separate IT section on the
exam communicates the importance of IT to students, professionals,
professionals can encourage instruction of AIS, but academics
must initiate and maintain the courses. In developing an
AIS course, a school must have sufficient IT resources and
a qualified instructor. Resources include networked computer
labs and business application software; many schools may
already have such resources established for computer science
or management information systems courses.
an accounting professor trained in IT controls is a more
difficult proposition. Few universities currently graduate
PhDs specializing in IT controls and processes; more such
PhD programs would help. In the short term, the solution
is to train accounting faculty or to hire adjuncts with
IT controls knowledge. Professors with knowledge in the
area of auditing have the foundational understanding of
controls but require a further understanding of IT concepts
and IT-based controls. For adjuncts, a possible source of
AIS instructors is experienced IT auditors with certifications
such as a Certified Information System Auditor (CISA).
offering AIS as an elective should consider making it a
required course, which would communicate that AIS is a core
part of the program, like financial and managerial accounting.
A small number of schools offer a major in AIS or financial
information systems (FIS) that extends beyond fundamental
IT controls and general IT knowledge. These programs produce
students that are well suited to help companies and accounting
firms bridge the gap between accounting, auditing, and IT.
the number of schools offering AIS programs would certainly
help educators meet the accounting profession’s expanding
staffing needs for the evaluation and assurance of companies’
IT controls and processes.
O’Donnell, PhD, CPA, is an assistant professor
at Canisius College, Buffalo, N.Y., and
Jennifer Moore is a staff accountant at Lumsden
and McCormick, LLC, Buffalo, N.Y.