Books, Articles, Instructions, and Guidance

[1] American Institute of Certified Public Accountants Reporting on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy. Durham, NC: American Institute of Certified Public Accountants; 2012.

[2] American Institute of Certified Public Accountants Service organizations: reporting on controls at a service organization relevant to user entities’ internal control over financial reporting. Durham, NC: American Institute of Certified Public Accountants; 2013.

[3] Office of Management and Budget Audits of states, local governments, and non-profit organizations. Washington, DC: Office of Management and Budget; 2007. [OMB Circular A-133].

[4] Barney JB, Clark DN. Resource-based theory. Oxford, UK: Oxford University Press; 2007. [5] Bazerman MH, Moore D. Judgment in managerial decision making. Hoboken, NJ: John Wiley & Sons; 2009. [6] Board of the International Federation of Accountants Statement of membership obli-

gations. New York, NY: International Federation of Accountants; 2012. [7] Cartlidge A, Hanna A, Rudd C, Macfarlane I, Windebank J, Rance S. An introductory overview of ITIL ® V3. Wokingham, UK: IT Service Management Forum, UK Chapter; 2007.

[8] Cascarino RE. Auditor’s guide to IT auditing Hoboken, NJ, 2nd ed. : John Wiley & Sons; 2012. [9] Chambers A, Rand G. The operational auditing handbook: auditing business and IT processes. West Sussex, UK: John Wiley & Sons; 2010. [10] International Ethics Standards Board Code of ethics for professional accountants. New York, NY: International Ethics Standards Board; 2009. [11] Committee of Sponsoring Organizations of the Treadway Commission Enterprise risk management—Integrated framework. New York, NY: Committee of Sponsoring Organizations of the Treadway Commission; 2004.

[12] Committee of Sponsoring Organizations of the Treadway Commission Internal control—Integrated framework. New York, NY: Committee of Sponsoring Organizations of the Treadway Commission; 2013.

[13] Crouhy M, Galai D, Mark R. The essentials of risk management. New York, NY: McGraw-Hill; 2006. [14] Davis C, Schiller M. IT auditing: using controls to protect information assets, 2nd ed. New York, NY: McGraw-Hill; 2011. [15] Deming WE. Out of the crisis. Cambridge, MA: MIT Center for Advanced Educational Services; 1986. [16] Internal Revenue Service Examination of returns, appeal rights, and claims for refund.

Washington, DC: Internal Revenue Service; 2008. IRS Publication 556. [17] Office of Management and Budget FEA consolidated reference model version 2.3. Washington, DC: Office of Management and Budget; 2007. [18] Government Accountability Office Federal information system controls audit manual

(FISCAM). Washington, DC: Government Accountability Office; 2009. [19] Government Accountability Office Government auditing standards. Washington, DC: Government Accountability Office; 2011. [20] Office of Management and Budget Guidance on Exhibit 300—planning, budget- ing, acquisition, and management of it capital assets. Washington, DC: Office of

Legislation and Statutes 223

[21] National Institute of Standards and Technology Guide for assessing the security controls in federal information systems and organizations. Gaithersburg, MD: National Institute of Standards and Technology, Computer Security Division; 2010. [Special Publication 800-53A revision 1].

[22] National Institute of Standards and Technology Guide for conducting risk assess- ments. Gaithersburg, MD: National Institute of Standards and Technology, Computer Security Division; 2012. [Special Publication 800-30 revision 1].

[23] International Auditing and Assurance Standards Board Handbook of international quality control, auditing review, other assurance, and related services pronouncements. New York, NY: International Auditing and Assurance Standards Board; 2012.

[24] Institute of Internal Auditors International Professional Practices Framework (IPPF) 2013 Edition. Altamonte Springs, FL: Institute of Internal Auditors; 2013. [25] ISACA. COBIT 5: a business framework for the governance and management of enterprise IT; Rolling Meadows, IL: ISACA; 2012. [26] ISACA COBIT 5 for assurance. Rolling Meadows, IL: ISACA; 2013. [27] ISACA ITAF: a professional practices framework for IS audit/assurance, 2nd ed.

Rolling Meadows, IL: ISACA; 2013. [28] Federal Financial Institutions Examination Council IT examination handbook. Arlington, VA: Federal Financial Institutions Examination Council; 2012. [29] IT Governance Institute Board briefing on IT governance, 2nd ed. Rolling Meadows, IL: IT Governance Institute; 2003. [30] IT Governance Institute COBIT 4.1. Rolling Meadows, IL: IT Governance Institute; 2007. [31] Cabinet Office. ITIL glossary and abbreviations. London, UK: Cabinet Office; 2011. [32] Kissel R., Stine K., Scholl M., Rossman H., Fahlsing J., Gulick J. Security consid-

erations in the system development life cycle. Gaithersburg, MD: National Institute of Standards and Technology, Computer Security Division; 2008. [Special Publication 800-64 revision 2].

[33] National Institute of Standards and Technology Managing information security risk: organization, mission, and information system view. Gaithersburg, MD: National Institute of Standards and Technology, Computer Security Division; 2011. [Special Publication 800-39].

[34] Moeller R.R. IT audit, control, and security. Hoboken, NJ: John Wiley & sons; 2010. [35] Organisation for Economic Cooperation and Development OECD guidelines on

the protection of privacy and transborder flows of personal data. Paris, France: Organisation for Economic Cooperation and Development; 1980.

[36] Orr A.T. Introduction to the ITIL service lifecycle. London, UK: Cabinet Office; 2011. [37] Parasuraman A, Zeithaml VA, Barry LL. SERVQUAL: a multiple-item scale for meas-

uring consumer perceptions of service quality. J Retailing 1988;64(1):12–40. [38] Project Management Institute A guide to the project management body of knowledge, 4th ed. Newtown Square, PA: Project Management Institute; 2008. [39] National Institute of Standards and Technology. {tag as book}Recommended security controls for federal information systems and organizations. Gaithersburg, MD: National Institute of Standards and Technology, Computer Security Division; 2009. [Special Publication 800-53 revision 3].

[40] Russell JP, editor. The ASQ auditing handbook (4th ed.). Milwaukee, WI: ASQ Quality Press; 2013. [41] National Institute of Standards and Technology Security and privacy controls for fed-

224 References

Standards and Technology, Computer Security Division; 2013. [Special Publication 800-53 revision 4].

[42] Senft S, Gallegos F, Davis A. Information technology control and audit Boca Raton, FL, 4th ed. : CRC Press; 2013. [43] Teece D. Dynamic capabilities and strategic management. New York, NY: Oxford University Press; 2009. [44] VA Office of the Inspector General Audit of veteran-owned and service-disabled veteran-owned small business programs. Washington, DC: Department of Veterans Affairs; 2011. Available from: http://www.va.gov/oig/52/reports/2011/VAOIG-10- 02436-234.pdf .

[45] Wrightson MT, Caldwell SL. Further refinements needed to assess risks and prioritize protective measures at ports and other critical infrastructure. Report to Congressional Requesters. Washington, DC: Government Accountability Office; 2005. GAO 06-91.

Books, Articles, Instructions, and Guidance