CVS Pharmacy: An instructional case of internal controls for regulatory compliance and IT risks

The objective of the CVS Pharmacy case study is to teach students how to assess and integrate internal controls from regulatory compliance and information technology (IT) perspectives. The case focuses on the failure of CVS Pharmacy, Inc. to implement necessary controls to comply with regulations that limit the sales of pseudoephedrine. The case gives you the opportunity to systematically apply the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control - Integrated Framework (May 2013) and the COBIT 5 Framework issued by ISACA to investigate real business and IT issues. More specifically, you can use the frameworks to identify internal control deficiencies, compliance risks, and IT risks. Based on this assessment, you can recommend relevant control measures. The case is appropriate for undergraduate accounting information systems courses, as well as courses such as audit and IT audit by utilizing only one of the frameworks.