Analyzing the TJ Maxx Data Security Fiasco: Lessons for Auditors

In January 2007, TJX Companies Inc (TJX), the parent company of retail chains such as TJ Maxx and Marshalls, issued a press release announcing that its computer systems had been breached and that customer information had been stolen. Investigations into the TJX case appear to indicate that the company was not in compliance with the Payment Card Industry data security standards established in 2004 by American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International. At first, the TJX fiasco appears to offer an object lesson for retailers' IT departments, rather than auditors. With the advent of Statement on Auditing Standard (SAS) 109, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, internal control clearly extends beyond protecting one's own assets. Specifically, SAS 109 requires an understanding of: 1. the entity and its environment; 2. the entity's internal control environment; and 3. susceptibility of the entity's financial statements to material misstatement resulting from liabilities.