Information Fusion in Continuous Assurance Discussed by Dr. Graham Gal University of Massachusetts at Amherst University of Waterloo Conference on Information Systems Assurance October 1-3, 2009

Previous Sensor Fusion Research – Multi-Sensor Environments – Information Systems Layers of fusion hierarchy Implications for Research Presentation Outline University of Waterloo Conference on Information Systems Assurance October 1-3, 2009

Multi-Sensors University of Waterloo Conference on Information Systems Assurance October 1-3, 2009

Different reliability rates – Failure rates – False alarms Interpreting data and making a decision – Fire a missile – Do not Problem of data from sensors October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Processes p x Multiple Monitoring points or modules – m 1.. m k – Reliability rates – Importance of different monitoring points Decision – In control – Not in control – Collect more data Continuous Assurance Problem October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Monitoring Layer Exceptions Credit Sales Process p x Process Exceptions e p e p e p Monitoring Module Exceptions e m e m e m or e mj e mj e mj October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Information and Exceptions – Aggregations on objects – i m should probably be i mo Level 3 exceptions are across the REA Duality Data Aggregation Layer October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Level 3 exceptions – Separation of duties at Type or Instance level – Type level specification occurs at design time – Binding of instances to types is a run time issue Level 5 exceptions – Roles for event types are specified at design time – Database operations would be as well Design of sales processing includes base tables to be changed Data Aggregation Layer October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Design, Test, and Production Processes – Production processes can change base table information – Design and test processes impact the execution of Production processes – Monitoring must also occur on these processes Inclusion of more Processes October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Object Evaluation versus Decision Making – Object evaluation result in O x or P x state – Decision Making layer aggregates across the P and O to come to an overall evaluation – Problem of subjective evaluation of materiality of control issues What does 3% of weakness of IC system mean? – Previous fusion research was based on sensors with know reliability rates Evaluation Layers October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance

Presents a description of activities that must be performed in making a determination of the overall state of the system The paper makes a clear distinction of what activities occur at various levels and the data that is provided at these levels Researchers and practitioners have a ways to go to understand how to reduce alarm rates (only raise “real” exceptions) and how to integrate the exceptions Conclusion October 1-3, 2009 University of Waterloo Conference on Information Systems Assurance