Re-Engineering IT Internal Controls: Applying Capability Maturity Models to the Evaluation of IT Controls

Financial and management accounting relies not only on traditional computerized accounting information systems but also on many application systems that feed data to the entries that make up the financial accounting systems. The importance of IT has been recognized by auditing standards setters. In response, a variety of organizations have developed control frameworks for the IT lifecycle. COBIT, published by the IT Governance Institute (ITGI), is a well understood and widely used control framework. An important element of the various elements and tools that make up the COBIT framework is the Capability Maturity Model (CMM) that is included in the COBIT Management Guidelines. The six-level CMM is drawn from the software engineering research community. A given level of the CMM allows managers and others to determine the capacity of the entity to manage its risks and strategic and operational outcomes, for that particular process. Whether a given capability maturity level correlates to a particular level of internal control, under auditing standards, has not been determined. This research is an exploratory attempt to determine the capability maturity of organizations; address metrication issues in measuring capability maturity and correlate capability maturity with the state of internal control over financial reporting.