Professional Documents
Culture Documents
Chapter 12 Solutions Manual
Chapter 12 Solutions Manual
Review Questions
12-1 The proper installation of IT can lead to internal control enhancements by replacing manually-performed controls with computer-performed controls. ITbased accounting systems have the ability to handle tremendous volumes of complex business transactions cost effectively. Computer-performed controls can reduce the potential for human error by replacing manual controls with programmed controls that apply checks and balances to each transaction processed. The systematic nature of IT offers greater potential to reduce the risk of material misstatements resulting from random, human errors in processing. The use of IT based accounting systems also offers the potential for improved management decisions by providing more and higher quality information on a more timely basis than traditional manual systems. IT-based systems are usually administered effectively because the complexity requires effective organization, procedures, and documentation. That in turn enhances internal control. 12-2 When entities rely heavily on IT systems to process financial information, there are new risks specific to IT environments that must be considered. Key risks include the following:
Reliance on the functioning capabilities of hardware and software. The risk of system crashes due to hardware or software failures must be evaluated when entities rely on IT to produce financial statement information. Systematic versus random errors. Due to the uniformity of processing performed by IT based systems, errors in computer software can result in incorrect processing for all transactions processed. This increases the risk of many significant misstatements. Unauthorized access. The centralized storage of key records and files in electronic form increases the potential for unauthorized online access from remote locations. Loss of data. The centralized storage of data in electronic form increases the risk of data loss in the event the data file is altered or destroyed. Visibility of audit trail. The use of IT often converts the traditional paper trail to an electronic audit trail, eliminating source documents and paper-based journals and records. 12-1
Reduced human involvement. The replacement of traditional manual processes with computer-performed processes reduces opportunities for employees to recognize misstatements resulting from transactions that might have appeared unusual to experienced employees. Lack of traditional authorization. IT-based systems can be programmed to initiate certain types of transactions automatically without obtaining traditional manual approvals. Reduced segregation of duties. The installation of IT-based accounting systems centralizes many of the traditionally segregated manual tasks into one IT function. Need for IT experience. As companies rely to a greater extent on IT-based systems, the need for personnel trained in IT systems increases in order to install, maintain, and use systems.
12-3 The audit trail represents the accumulation of source documents and records maintained by the client to serve as support for the transactions occurring during the accounting period. The integration of IT can change the audit trail by converting many of the traditionally paper-based source documents and records into electronic files that cannot be visually observed. Because many of the transactions are entered directly into the computer as they occur, some of the documents and records are even eliminated. 12-4 Random error represents errors that occur in an inconsistent pattern. Manual accounting systems are especially prone to random errors that result from honest mistakes that occur as employees perform day-to-day tasks. When those mistakes do not consistently occur while performing a particular task, errors are distributed randomly into the accounting records. An example of a random error is when an employee accidentally pulls the wrong unit price off the approved price list when preparing a sales invoice for a particular customer. Systematic error represents errors that occur consistently across all similar transactions. Because IT-based systems perform tasks uniformly for all transactions submitted, any mistake in software programming results in the occurrence of the same error for every transaction processed by the system. An example of a systematic error occurs when a program that is supposed to post sales amounts to the accounts receivable subsidiary records actually posts the sales amount twice to customers accounts.
12-2
12-5 In most traditional accounting systems, the duties related to authorization of transactions, recordkeeping of transactions, and custody of assets are segregated across three or more individuals. As accounting systems make greater use of IT, many of the traditional manually performed tasks are now performed by the computer. As a result, some of the traditionally segregated duties, particularly authorization and recordkeeping, fall under the responsibility of IT personnel. To compensate for the collapsing of duties under the IT function, key IT tasks related to programming, operation of hardware and software, and data control are segregated. Separation of those IT functions restricts an IT employees ability to inappropriately access software and data files in order to misappropriate assets. 12-6 General controls relate to all aspects of the IT function. They have a global impact on all software applications. Examples of general controls include controls related to the administration of the IT function; software acquisition and maintenance; physical and on-line security over access to hardware, software, and related backup; back-up planning in the event of unexpected emergencies; and hardware controls. Application controls apply to the processing of individual transactions. An example of an application control is a programmed control that verifies that all time cards submitted are for valid employee id numbers included in the employee master file. 12-7 The typical duties often segregated within an IT function include systems development, computer operations, and data control. Systems development involves the acquisition or programming of application software. Systems development personnel work with test copies of programs and data files to develop new or improved application software programs. Computer operations personnel are responsible for executing live production jobs in accordance with a job schedule and for monitoring consoles for messages about computer efficiency and malfunctions. Data control personnel are responsible for data input and output control. They often independently verify the quality of input and the reasonableness of output. By separating these functions, no one IT employee can make changes to application software or underlying master files and then operate computer equipment to use those changed programs or data files to process transactions. 12-8 If general controls are ineffective, there is a potential for material misstatement in each computer-based accounting application, regardless of the quality of automated application controls. If, for example, the systems development process is not properly controlled, there is a greater risk that unauthorized and untested modifications to accounting applications software have occurred that may have affected the automated control. If general controls are strong, there is a greater likelihood of placing greater reliance on automated application controls. Stronger general controls should lead to greater likelihood that underlying automated application controls operate effectively and data files contain accurate, authorized, and complete information. When general controls are effective, the auditor may not have to test the automated application control in the current year, as long as the automated control has not changed since it was last tested by the auditor and that test was performed within the last three years. 12-3
12-9 Application controls apply to the processing of specific individual transactions within a transaction cycle, such as a computer performed credit approval process for sales on account. Due to the nature of these types of controls, application controls generally link directly to one or more specific transaction objectives. For example, the credit approval application control directly links to the occurrence objective for sales. Auditors typically identify both manual and computer-performed application controls for each transaction-related objective using a control risk matrix similar to the one discussed in Chapter 10. 12-10 Auditing around the computer represents an audit approach whereby the auditor does not use computer controls to reduce control risk. Instead, the auditor uses non-IT controls to support a reduced control risk assessment. In these situations, the use of IT does not significantly impact the audit trail. Typically, the auditor obtains an understanding of internal control and performs tests of controls, substantive tests of transactions, and account balance verification procedures in the same manner as if the accounting system was entirely manual. The auditor is still responsible for gaining an understanding of general and application computer controls because such knowledge is useful in identifying risks that may affect the financial statements. 12-11 The test data approach involves processing the auditors test data using the clients computer system and the clients application software program to determine whether the computer-performed controls correctly process the test data. Because the auditor designs the test data, the auditor is able to identify which test items should be accepted or rejected by the computer. When using this approach the auditor should assess the following:
How effectively does the test data represent all relevant conditions that the auditor wants to test? How certain is the auditor that the application programs being tested by the auditors test data are the same programs as those used by the client throughout the year to process actual transactions? How certain is the auditor that test data is effectively eliminated from the clients records once testing is completed?
Parallel simulation with audit software involves the auditors use of an auditor-controlled software program to perform parallel operations to the clients software by using the same data files. Because the auditors software is designed to parallel an operation performed by the clients software, this strategy is referred to as parallel simulation testing. Parallel simulation could be used in the audit of payroll by writing a program that calculates the accrued vacation pay liability for each employee using information contained in the employee master file. The total liability calculated by the auditors software program would then be compared to the clients calculation to determine if the liability for accrued vacation pay is fairly stated at year-end.
12-4
12-12 Often companies that purchase and install vendor developed software applications on computer hard drives rely on IT consultants to assist in the installation and maintenance of that software because those companies do not have dedicated IT personnel. Also, assignment of responsibility may reside with user departments. Companies can reduce these risks related to not having IT personnel by performing sufficient reference and background checks about software vendor and IT consultant reputations. In addition, companies can load software programs onto hard drives in a format that does not permit changes by client personnel, particularly non-IT user department personnel who may have primary responsibility for the system. Companies should also consider segregating key duties related to access to master files and responsibilities for processing transactions. 12-13 Because many companies that operate in a network environment decentralize their network servers across the organization, there is an increased risk for a lack of security and lack of overall management of the network operations. The decentralization may lead to a lack of standardized equipment and procedures. In many instances responsibility for purchasing equipment and software, maintenance, administration, and physical security, often resides with key user groups rather than with a centralized IT function. Also, network-related software often lacks the security features, including segregation of duties, typically available in traditionally centralized environments because of the ready access to software and data by multiple users. 12-14 In database management systems, many applications share the same data files. This increases risks in some cases given that multiple users, including individuals outside accounting, access and update data files. Without proper database administration and access controls, risks of unauthorized, inaccurate, and incomplete data files increase. The centralization of data also increases the need to properly back-up data information on a regular basis. 12-15 An online sales ordering system poses many potential risks for an audit client. Risks that may exist include: 1. 2. 3. Customer data is susceptible to interception by unauthorized third parties. The client companys data, programs, and hardware are susceptible to potential interception or sabotage by external parties. An unauthorized third party may attempt to transact business with the client company.
12-5
These risks can be addressed by the use of firewalls, encryption techniques, and digital signatures. A firewall is a system of hardware and software that monitors and controls the flow of e-commerce communications by channeling all network connections through a control gateway. A firewall protects data, programs, and other IT resources from external users accessing the system through networks, such as the Internet. Encryption techniques are based on computer programs that transform a standard message into a coded (encrypted) form. One key (the public key) is used for encoding the message and the other key (the private key) is used to decode the message. Encryption techniques protect the security of electronic communication during the transmission process. Finally, the use of digital signatures can enhance internal controls over the online sales order system by authenticating the validity of customers and other trading partners who conduct business with the client company. 12-16 It is unacceptable for an auditor to assume an independent computer service center is providing reliable accounting information to an audit client because the auditor has no firsthand knowledge as to the adequacy of the service centers controls. If the clients service center application is involved in processing significant financial data, the auditor must consider the need to obtain an understanding of internal control and test the service centers controls. The auditor can test the service centers system by use of the test data and other tests of controls. Or, he or she may request that the service center auditor obtain an understanding and test controls of the service center, which are summarized in a special report issued by the service center auditor for use by the customers auditor. Multiple Choice Questions From CPA Examinations b. (1) b. (3) c. (3) c. (2) d. (3) d. (3)
12.19 A schedule showing the pertinent transaction-related audit objectives and application controls for each type of misstatement is as follows:
12-6
MISSTATEMENT 1. A customer number on a sales invoice was transposed and, as a result, charged to the wrong customer. By the time the error was found, the original customer was no longer in business. 2. A former computer operator, who is now a programmer, entered information for a fictitious sales return and ran it through the computer system at night. When the money came in, he took it and deposited it in his own account.
COMPUTER-BASED CONTROLS
Key verification Check digit Reconciliation to
Recorded transactions
Input security
exist
controls over cash receipts records Scheduling of computer processing Controls over access to equipment Controls over access to live application programs
Correct file controls Cutoff procedures Programmed
3. A computer operator picked up a computerbased data file for sales of the wrong week and processed them through the system a second time. 4. For a sale, a data entry operator erroneously failed to enter the information for the salesman's department. As a result, the salesman received no commission for that sale. 5. A nonexistent part number was included in the description of goods on a shipping document. Therefore, no charge was made for those goods.
Recorded transactions
recorded
verification (e.g., key verification) Programmed controls (e.g., check field for completeness)
Preprocessing
recorded
review
Programmed
12-7
6. A customer order was filled and shipped to a former customer that had already filed bankruptcy.
Recorded transactions
Preprocessing
exist
controls (e.g., comparison to customer file) 7. The sales manager approved the price of goods ordered by a customer, but he wrote down the wrong price.
Transactions are stated Preprocessing
review
Programmed
8. Several remittance advices were batched together for inputting. The cash receipts clerk stopped for coffee, set them on a box, and failed to deliver them to the data input personnel.
recorded
Transactions are
reconciled to manual totals of all batches Computer accounts for numerical sequence of batches submitted
12-20
PERSON 1 a. b. c. Systems analyst Programmer Systems analyst Programmer Systems analyst Programmer Data control* PERSON 2
Computer
PERSON 3
Librarian
PERSON 4
Data
operator
Computer
control
Librarian Data control
operator
Computer
N/A N/A
N/A
operator Librarian*
* This solution assumes the data control procedures will serve as a check on the computer operator and will allocate work across both persons. d. If all five functions were performed by one person, internal control would certainly be weakened. However, the company need not be unauditable, for two reasons: First, there may be controls outside the IT function which accomplish good control. For example, users may reconcile all input and output data on a regular basis. Second, the auditor is not required to rely on internal control. He or she may take a substantive approach to the audit assuming adequate evidence is available in support of transactions and balances. 12-8
12-21
a. The important controls and related sales transaction-related audit objectives are:
SALES TRANSACTION-RELATED AUDIT OBJECTIVE
Existing sales transactions are recorded Recorded sales are for shipments made
CONTROL 1. 2. Use of prenumbered sales orders Segregated approval of sales by credit department; customer purchase orders are attached to sales orders; approval is noted on form Segregated entry of approved sales orders
to existing customers
3.
to existing customers
Recorded sales are posted to correct
customer account
CONTROL Prices are entered using an approved price list Sales invoices are prepared from the data file created from sales order entry; hash totals are generated and used; sales invoices are prenumbered; control totals are reconciled by an independent person 4. & 5. Bills of lading are produced with sales invoices and eventually filed with the sales invoice in numerical order; differences in quantities are corrected and transaction amounts are adjusted Hash totals of daily processing matched to hash and control totals generated by independent person
to existing customers
Existing sales transactions are recorded Recorded sales are at the correct
amount
Sales transactions are properly
6.
recorded.
Recorded transactions are for
12-9
b.
Among the audit procedures to be applied to a sample of the invoices and source documents are the following: Account for the sequence of prenumbered sales order forms. Review the sales order forms for agreement with purchase orders from customers. 3. Determine that evidence of approval by the credit department appears on all sales order forms. 4. Account for the sequence of prenumbered sales invoices. 5. Ascertain that bills of lading have been prepared for all invoices and are in agreement therewith. 6. Determine that the price list used by the billing clerk has been properly authorized. Trace prices on the list to invoices, and test the extensions and additions on the invoices. 7. Ascertain that the sales invoices are in agreement with the data on the sales order forms. Among the audit procedures to be applied to the data file are the following: 1. 2. 3. Verify the company's predetermined "hash" totals and control amounts by computing similar totals on selected batches of invoices and items from the data file. Compare totals and see that they reconcile. Arrange for a tabulating run to be made of selected test transactions. Compare the items in this printout with the totals previously compiled from the test transactions. 1. 2.
12-22 a.
b. Generalized audit software could be used for each test as shown on the next page:
12-10
12-22 (continued) DATA FILE OR FILES NEEDED Accounts payable master file KIND OF TEST OR TESTS THE AUDITOR CAN PERFORM USING GAS
PROCEDURE 1. Foot listing and trace to G/L 2. Confirm balances with vendors 3. Review of changes in accounts payable listing
Verifying footings
Tracing total to general ledger Reconciling differences between balances and replies Examination of vendor's statements
Same as 1; and, purchases transaction file Accounts payable master file at beginning and end of year
Match items on two files to identify those that changed in excess of $500 Selecting items for testing Selecting items for testing Match payment and purchase files to test whether discount taken
12-11
Comparison to price lists and catalogs Verifying receiving dates with respect to dates recorded Verifying proper authorization (approval)
12-11
12-23 a.
The major problems the auditor faces in verifying sales and accounts receivable include: 1. 2. 3. Determining that both cash and credit sales are valid, and that all were recorded in the proper amount. Determining that accounts receivable balances are proper and that transactions were recorded in the proper amount and to the proper customer. Determining whether the internal controls are adequate, so that he or she may rely on the system to provide correct information.
In this case, meeting some of these objectives is complicated by the fact that much of the pertinent information is in machinereadable form only. b. The concept of test data can be employed in this audit by having the auditor make test purchases in different departments of the store and observing whether the sales are recorded properly in the appropriate records. The auditor may also wish to enter invalid data to be sure that the programmed controls reject the transactions. Some of the difficulties the auditor would have to overcome in using test data are: 1. 2. 3. The test data must comprise all relevant conditions that the auditor desires to test so as to test every conceivable deficiency possible in the system. The program tested by the auditor's test data must be the same program that is used throughout the year by the client to ensure the validity of results. The test data will probably have to be eliminated from most of the client's records since the auditor's purchases would not be part of the company's regular business.
c.
Generalized audit software can be employed in this audit by following these steps: 1. 2. 3. 4. 5. Decide the objectives of the teste.g., to select and analyze a random sample of sales invoices or to compare the totals of master files to the entries into the general ledger. Begin to design the application by identifying and selecting pertinent data from the client's files. Design the most useful format and contents of the auditor's generalized audit software reports. Complete the application design by developing the logical and programmed approach to extract and manipulate the data to produce reports. Process the program and information to produce the reports. 12-12
12-23 (continued) Several tests that can be conducted using a generalized audit program are: 1. 2. 3. 4. 5. 6. 7. d. Select accounts according to certain selection criteria for accounts receivable confirmation and print the confirmations. Prepare an analysis of sales and cost of sales. Test the year-end cutoff of sales. Review all intercompany sales transactions. Foot the various files and select unusual or large transactions according to certain criteria. Age accounts receivable. Test the recording of sales transactions by parallel simulation.
Several ways to reduce the information entered into the cash register are: 1. 2. 3. 4. 5. By setting the date in the register for the day, there will be no need to enter the date. Same as 1 for store code number and sales clerk number. There is no need to enter cash sale or credit sale since entering the customer account number implies a credit sale. Install optical scanning point of sale equipment. Have the computer pull unit prices based on product number from price list master file.
12-24
a. The nature of generalized audit software is to provide computer programs that can process a variety of file media and record formats to perform a number of functions using computer technology. There are several types of generalized audit software packages. Usually, generalized audit software is a purchased audit software program that is Windows-based and easily operated on the auditors desktop or laptop computer. Other generalized audit software exists that contain programs that create or generate other programs, programs that modify themselves to perform requested functions, or skeletal frameworks of programs that must be completed by the user. A package can be used to perform or verify mathematical calculations; to include, exclude, or summarize items having specified characteristics; to provide subtotals and final totals; to compute, select, and evaluate statistical samples for audit tests; to print results or sequence that will facilitate an audit step; to compare, merge, or match the contents of two or more files, and to produce machine-readable files in a format specified by the auditor.
12-13
12-24 (continued) b. Ways in which a generalized audit software package can be used to assist in the audit of inventory of Boos & Baumkirchner, Inc., include the following: 1. Compare data on the CPA's set of preprinted inventory count cards to data on the disk inventory master file and list all differences. This will assure that the set of count cards furnished to the CPA is complete. Determine which items and parts are to be test-counted by making a random selection of a sample from the audit deck of count cards or the disk inventory master file. Exclude from the population items with a high unit cost or total value that have already been selected for test counting. Read the client's disk inventory master file and list all items or parts for which the date of last sale or usage indicates a lack of recent transactions. This list provides data for determining possible obsolescence. Read the client's disk inventory master file and list all items or parts of which the quantity on hand seems excessive in relation to quantity used or sold during the year. This list provides data for determining overstocked or slow-moving items or parts. Read the client's disk inventory master file and list all items or parts of which the quantity on hand seems excessive in relation to economic order quantity. This list should be reviewed for possible slow-moving or obsolete items. Enter the audit test-count quantities onto the cards. Match these cards against the client's adjusted disk inventory master file, comparing the quantities on the cards to the quantities on the disk file and list any differences. This will indicate whether the client's year-end inventory counts and the master file are substantially in agreement. Use the adjusted disk inventory master file and independently extend and total the year-end inventory and print the grand total on an output report. When compared to the balance determined by the client, this will verify the calculations performed by the client. Use the client's disk inventory master file and list all items with a significant cost per unit. The list should show cost per unit and both major and secondary vendor codes. This list can be used to verify the cost per unit. Use the costs per unit on the client's disk inventory master file, and extend and total the dollar value of the counts on the audit test count cards. When compared to the total dollar value of the inventory, this will permit evaluation of audit coverage.
2.
3.
4.
5.
6.
7.
8.
9.
12-14
12-25 a.
Strengths of current systems development and program change processes at Granger Container:
Eric Winecoffs extensive knowledge of the software being used helps lead to effective program changes and new application software developments. The small size of the IT staff and its team oriented approach allows the IT team to respond quickly to meet Grangers needs for system change. The IT programming staff tests applications using test copies of data files before implementation of the new system. Original data files are locked in the file storage room, which can only be accessed by Eric. Some documentation is maintained for each program change.
Most program change requests are generated by IT personnel, with few program change requests generated by user department personnel who rely on the system to perform day-to-day tasks. No user personnel are involved in the program design and testing processes. Users have less ability to make suggestions of useful programmed controls to be performed automatically by the computer. Over reliance on Eric and the software package purchased from Erics former employer may not always lead to the most effective and efficient system. No written requests for program changes are maintained. Thus, there is no audit trail of program changes that occur over time. No documented approval of program changes is maintained. Eric merely extends verbal approval. Again, the lack of documented approval increases the difficulty in determining that only authorized program changes occur. Periodic progress reports and approvals are not documented. This lack of documentation increases the potential for mismanaged program development. The lack of documentation makes future changes of those programs more difficult and time-consuming. The current review process is dependent on a programmers willingness to bring issues to Erics attention. Eric only becomes involved if a programmer approaches him for input. Too much reliance and trust is placed on programmers. There is no standardized format for designing programs. Rather, each programmer is able to employ his or her own programming style. Thus, it is more difficult to review current 12-15
12-25 (continued) programs under development to determine that only authorized changes are being made. And, future changes involving those programs will be more difficult than if a standardized programming format was employed. Programmers have access to the computer room to load programs for testing. That access may allow a programmer to load a live copy of a program for processing. That could lead to inappropriate processing and manipulation of data, which in turn may lead to misstatements in the financial statements due to unauthorized or inaccurate processing. Programmers make changes directly into the live copies of actual programs that are currently in use. That could result in inaccurate processing of transactions when operators use that program to process actual data before all program changes have been thoroughly tested and debugged. Only Eric reviews test results. Users, internal auditors, and quality assurance personnel should also participate in designing test data and reviewing test results. Users are particularly most knowledgeable of the types of transaction data that the system should be capable of handling. Only Eric generates a limited amount of program change documentation. User and operation manuals and systems flowcharts and narratives are not updated for the change. There is no formal conversion plan developed that includes pilot testing and parallel testing before and during conversion. No user or operator training occurs.
c.
Encourage user personnel to submit written requests for change on a pre-printed program change request form. Change requests should contain the written approval of user department supervisors before submission to IT. Log all program change request forms by assigning a numerical sequence to all program change forms. Maintain a log of all approved and denied program change requests to generate an audit trail of the program change process. Develop a team approach to systems development and program changes. Require teams of programmers, user department personnel, internal audit, and a systems analyst to work on the program change from start to finish. Institute an IT Steering Committee that approves all significant program change requests. Eric should be required to formally report to this committee on a regular basis. For all other program changes, documented approvals should be obtained from Eric and the user department supervisory personnel for the department affected by the application 12-16
Develop a formal Systems Development Methodology (SDM) that is to be used for all program development projects. When designing the SDM, build in required checkpoints for review and approval for each stage of development. Develop standardized programming formats and style to ensure consistent and accurate programming across programmers. Only provide test copies of application programs and data files for use by programmers. Never give the programming staff the actual application program currently in use. Prohibit programming staff from entering the computer operating room or secondary storage. Require programmers to submit test copies of programs and master files to the operations staff for testing. Only accept newly developed software programs into live production if accompanied by all required authorizations and documentation. Develop extensive documentation of the entire development process. Ensure that all user and operations manuals and systems flowcharts and narratives are updated to reflect recent changes. Develop a formal conversion plan that outlines the planned approach to implementing the new program. The plan should include extensive pilot and parallel testing, if possible. Train operators and users on the new system features before relying on the new system to process transactions.
12-26
INTERNAL CONTROL 1 2 3 TYPE OF CONTROL AC AC AC TRANSACTION-RELATED AUDIT OBJECTIVE Recorded payroll transactions exist for valid employees Recorded payroll transactions are at the correct amounts Recorded payroll transactions are summarized and posted to the correct general ledger account at the correct amounts Recorded payroll transactions exist; existing payroll transactions are recorded Recorded payroll transactions exist (i.e., are for time actually worked)
4 5
MC AC
12-17
MC
Recorded payroll transactions exist (i.e., are for time actually worked)
12-26 (continued)
INTERNAL CONTROL 7 8 9 10 TYPE OF CONTROL AC MC AC AC TRANSACTION-RELATED AUDIT OBJECTIVE Recorded payroll transactions exist (i.e.. are for currently employed personnel) Recorded payroll transactions are at the correct amounts Recorded payroll transactions are classified into the correct accounts Recorded payroll transactions exist (i.e., for valid work performed); recorded payroll transactions are at the correct amounts
The Vice President of Information Systems (VP of IS) should report on a day-to-day basis to senior management (i.e. the president) and should not be under the authority of user personnel. This ensures that the IS function is not subordinate to a user function, which might inappropriately allocate IS resources to that user functions projects. The VP of IS should have access to the board of directors and should be responsible for periodically updating the board on significant IS projects. Perhaps, the board should create an IS Steering Committee to oversee IS activities (like the Audit Committee oversees the financial reporting process). Operations staff should not have responsibility for maintaining the operating software security features. This responsibility should be assigned to a more senior, trusted IS individual, such as the VP of IS. Video monitors should be examined continually. The actual monitors could be viewed on an ongoing basis by building security guards. Hardwood should consider taping what the cameras are viewing for subsequent retrieval in the event of a security breach. Consider requiring the use of card-keys and passwords to grant entrance to the computer room to enhance security surrounding unauthorized access to the computer room. Hardwood may consider purchasing a vendor developed access security software package to strengthen on-line security beyond the features currently provided by the operation softwares security features. Restrict programmer access to test copies of software programs for only those programs that have been authorized for program change. Access to copies of other programs may not be necessary when those programs have not been authorized for change. Grant systems programmers access only to approved test copies of systems software, and grant application programmers access only 12-18
Consider hiring a systems analyst to coordinate all program development projects. Systems analysts can strengthen communications between user and programming personnel, and they can increase the likelihood that a strong systems development process is followed. Develop a weekly Job Schedule that outlines the order in which operators should process jobs. The VP of IS should review computer output to determine that it reconciles to the approved Job Schedule. This will increase the likelihood that only approved jobs are processed and that they are processed in the correct sequence. Relocate the secondary storage to a physically secure room separate from the computer room. Only grant the librarian access to this room. This will prevent the unauthorized removal of program and data files. Remove the librarians CHANGE rights to program and data files. The librarian should not be able to make changes to those files. The librarian should only be able to copy the contents of those files. Develop regular procedures for preparing backup copies of programs and data files and ensure those copies are sent to off-site storage. Use internal header and trailer labels on program tapes to ensure that the proper tapes are mounted for processing. Consider purchasing a vendor-developed librarian software package to assist the librarian in maintaining complete and accurate records of secondary storage programs and data files. Make sure only user department personnel have the ability to authorization additions or changes to data files. The following deficiencies in the Parts for Wheels, Inc. online sales system may lead to material misstatements in the financial statements: 1. Lack of Sales System Interface . The lack of automatic interface between the online sales ordering system and the sales accounting system may increase the risk of material misstatements for sales. Sales orders printed from the online system may be lost and not recorded, or they may be recorded more than once if not properly controlled. Additionally, because each sale must be manually entered, there is increased risk that sales may be processed or recorded inaccurately. Lack of Inventory System Interface. The lack of automatic interface between the online sales ordering system and the inventory management system may increase the risk that processed sales may not be properly reflected in the inventory accounting records. Given manual processing, 12-19
12-28 a.
2.
12-28 (continued) there may be some risk that shipments occurred without completion of a proper bill of lading, which is required to adjust inventory records. As a result, shipments will not be accurately deducted from inventory records. Also, if bills of lading are not properly numbered and accounted for, there is a possibility that completed bills of lading are not entered or are entered more than once. Furthermore, the manual process of recording inventory transactions increases the risk of inaccurate posting of bills of lading into the inventory records. Manual Credit Approval. The process of verifying credit authorization with the credit card agency is dependent on human processing. The lack of automatic electronic credit authorization may increase the risk of sales to unauthorized customers. This may lead to an increase risk of collection problems from credit card receivables. Premature Recording. Currently, sales are entered into the sales journal on the date credit is authorized, which is often the date the order is placed. This may result in premature recording of sales, given that sales are recorded before shipment has occurred. As a result, sales may be recorded in accounting periods different from when inventory records are updated for the shipment. Cutoff problems may occur. Inadequate Tracking of Returns . If systems for tracking and estimating online sales returns are inadequate, Parts for Wheels, Inc. may understate estimates of customer returns, including estimated costs for refunding shipping costs. This could result in overstated net sales and understated shipping costs.
3.
4.
5.
b.
Below are suggested changes that could be made to the existing manual system to enhance internal control, without re-designing the online system: 1. When the accounting department prints submitted orders from the online system, each order should be numbered sequentially with the range of used numbers logged daily. When the sales orders are recorded, the order number should be recorded. Pre-numbered bills of lading should be used. All bills of lading should be accompanied by the sales order used by warehouse personnel to process shipment. All bills of lading should be forwarded to accounting on the date of shipment.
2.
12-20
12-28 (continued) 3. Accounting should match the bills of lading with the accounting departments copy of the sales orders before any entries are recorded in the sales journal and inventory system. Entries to the sales journal and inventory records should be made on the same day to ensure consistent cutoff of the recording of transactions.
c.
Customers may have these concerns about ordering parts through the Parts for Wheels Web site: 1. Consumer Privacy. Customers may be concerned about providing credit card information over the Parts for Wheels Web site. The company may consider disclosing information about company policies and procedures designed to reduce risks of breaches of consumer privacy. The company may implement encryption technologies to increase security of the information during transmission. The company may also consider obtaining a WebTrust seal of assurance for its online sales system. Lack of Transaction Confirmation. Given that sales orders are not processed until printed by the accounting department, customers do not receive an electronic confirmation that the sales order has been approved for processing. So, as consumers exit the Web site, they do not have complete confidence that their order will be processed. To address this concern, Parts for Wheels could notify customers via email when the credit authorization occurs. That would indicate the sale is approved for processing. Inaccurate Inventory Listing Information. Consumers may be concerned that the online information about product descriptions and prices is inaccurate. For example, inventory descriptions may be outdated or insufficient and prices may be incorrect. Furthermore, on-hand quantities may be misstated, resulting in unexpected back-orders of products. Parts for Wheels could disclose information about how often the inventory database information is updated and posted. In addition, they could consider more frequent updates than weekly. Lack of Contact Information . Online consumers may want information about how company officials can be reached in the event there are questions and disputes surrounding orders. Parts for Wheels could disclose appropriate contact information, in addition to enabling complaints to be registered online through its Web site.
2.
3.
4.
12-21
1.
Case
12-29 Strengths in lines of reporting from IS to senior management at Jacobsons: Melinda Cullen (IS Manager) and the chief operating officer (COO) work closely on identifying hardware and software needs. Melindas boss, the COO, has access to the board of directors and provides periodic updates about IS issues, if needed. Deficiencies in lines of reporting from IS to senior management: The chief IS person (Melinda) is relegated to a manager level and is not considered a part of the senior executive team. This signals a potential lack of adequate support extended by top management to the IS function. The IS Manager reports to a key user, the COO. The COO may place undue pressure on IS to work on IS related projects that affect the COOs areas of responsibility. Thus, other areas, such as those under the chief financial officers control (i.e., the accounting system), may not receive adequate IS resources. Melinda and the COO make all major hardware and software decisions without input from other user personnel and the board of directors. There does not appear to be a written IS strategic plan that sets direction for the IS function. Recommendations related to the lines of reporting from IS to senior management: The IS Manager should report directly to the president and be considered a part of senior management (i.e. on equal footing relative to the COO, CFO, etc.). The board of directors should receive regular input from the IS Manager about the status of IS projects. A written strategic plan should be developed and reviewed annually by the board. Significant hardware and software changes should be approved by the board or its IS Steering Committee. Other changes to application software should also be approved by affected user departments. 2. Assessment of Melindas fulfillment of IS Manager responsibilities, including her strengths: Melinda is actively involved in the IS function and closely monitors day-to-day IS activities.
12-22
Melinda is experienced in Jacobsons IS function, having been employed by the company for 12 years. She has served in several IS roles at Jacobsons. Thus, she offers stability for the IS function. Melinda performs extensive background checks before offering candidates employment in IS functions. Melinda has successfully maintained a fairly stable IS staff.
12-29 (continued)
Melinda conducts weekly IS departmental meetings to discuss issues affecting the performance of the department. Apparently the IS department is functioning well, given that few ISrelated problems must be reported by the COO to the board.
Concerns about current management of the IS function: Melinda may be over delegating tasks to IS personnel without maintaining close accountability for employee actions. For example, programmers are given extensive leeway in programming changes to software and operators check each others work to ensure that Melindas job schedule was properly followed. Melinda spends too much of her time in the systems analyst role, which leaves little time for her to adequately monitor all IS tasks. Recommendations for change related to the management of the IS department: Consider assigning systems analyst responsibilities to a senior programmer. Establish standardized programming procedures and have Melinda review changed programs for compliance with those procedures. Melinda should reconcile the Job Processed Log to the job schedule developed by her. Melinda should assign or at least approve the assignment of programmer staff responsibilities. 3. Assessment of the strengths of the programming function at Jacobsons: The programming staff is experienced with both systems software and Jacobsons application software. The assignment of projects based on time availability of programmers ensures that each programmer stays familiar with all types of software in use at Jacobsons. Programmers regular attend continued professional education courses. Extensive logs of tape use and of changes made to programs are maintained.
Concerns about the programming function: Programmers work with both systems and application software program changes. Thus, a programmer is more likely to be able to implement an unauthorized change to an application program that 12-23
also requires an unauthorized change to systems software. Programmers are responsible for maintaining secondary storage of live programs and data files. Thus, programmers are able to make unauthorized changes to live production copies of programs and data files. Recommendations for change related to the programming function at Jacobsons: Divide programmers into systems programmers and application programmers. Only assign system software changes to systems programmers and application software changes to application programmers. Reassign responsibility for maintaining secondary storage to either the computer operators or to data control personnel. 4. Assessment of the strengths of the IS operations function at Jacobsons: Melinda prepares a job schedule which operators follow to process transactions. Day-shift operators reconcile Job Processed Logs generated during the night shift to the job schedule, and night shift operators do the same type of reconciliation for jobs processed during the day. Operators perform routine monthly backup procedures. Input batch controls are generated to verify the accuracy and completeness of processing. Concerns about the IS operations function: Backup procedures only occur monthly, which increases the risk of data loss. No one, other than operators, verifies that only jobs included on the job schedule are processed. Melinda depends totally on the completeness of the operators identification of exceptions noted by operators. Jobs Processed Logs are generally discarded, unless the output does not reconcile to the job schedule. Operators have the authority to make small changes to application programs. Comparison of batch input control totals to computer processing is not performed by someone independent of the operator responsible for the processing. Recommendations for change related to the management of the IS operations function: Update key data files and program tapes on a more periodic basis (perhaps daily). Store backup copies offsite. Prohibit operators from performing any programming tasks. Restrict access to program files to a READ/USE only capability. 5. Assessment of the strengths of the IS data control function at Jacobsons: 12-24
Data control personnel review exception listings and submit requests for correction on a timely basis. Data control clerks monitor the distribution of output.
Concerns about the IS data control function: Data control personnel have the authority to approve changes to master files. Thus, they could add a fictitious employee to the employee master file to generate a payroll check for a non-existent employee. Recommendations for change related to the management of the IS data control function: Restrict data control personnel from being able to authorize changes to master files. Only allow the respective user department to authorize changes to master files. Data control clerks should be held accountable for only inputting user department authorized changes to master files. 6. Users should be responsible for approving changes to master files. They should actively compare authorized input to output to ensure the accuracy, completeness, and authorization of output. Users should also be an active participant in the program systems development process. They should participate in program development design, testing, and implementation. In addition, users should have a voice in establishing the job schedule, given that users understand their processing needs best.
12-30 ACL Problem a. There are three transactions with missing dates. There are several negative balance transactions with no indication that they are purchase returns. Total purchases are $300,682.04 (use the Total command on the Amount column). There are twelve gaps and many duplicates (Gaps and Duplicates commands). For gaps, the auditor is concerned that there may be unrecorded purchases. For duplicates, the auditor is concerned that purchases may be recorded more than once. In this case, no duplicate has the same amount as the transaction with the same document number. Using the Summarize command to summarize total purchases by product, the total is the same as in requirement b: $300,682.04. See printout on pages 12-26 and 12-27. Product #024133112 represents 6.15% of total purchases. See report on pages 12-28 and 12-29. See highlighted amount for product #024133112. 12-25
b. c.
d.
e.
12-30 (continued) f. Starting with the classified table from requirement e, students should filter out items less than $1000. Next, run the Stratify command using a minimum value of $1210 (smallest amount in table) and a maximum value of $20,439 (2 nd largest amount in table). See report on page 12-29.
12-26
12-30 (continued)
052204515 052208805 052210545 052484425 052484435 052504005 052530155 052720305 052720615 052770015 060100306 060100356 060102066 060102106 060112296 060217066 070104177 070104347 070104397 070104657 080101018 080102618 080102628 080123438 080123938 080126008 080126308 080935428 080938748 090010011 090069591 090081001 090501051 090501551 090504761 090506331 090507811 090508191 090509561 090585322 090599912 090669611 093788411
Requirement d, cont.
1997.94 10618.25 0.00 726.24 864.00 200.94 122.88 164.00 15826.00 90.52 190.40 318.00 39.80 5014.80 10964.80 2359.80 -6155.52 144.27 4046.43 185.49 8.14 3595.20 413.00 700.29 2798.64 7919.26 381.12 20438.93 5.98 330.67 3647.52 6282.00 1688.80 2774.28 376.37 -27.20 7425.52 101.06 664.02 58702.80 2803.40 7317.00 907.20 300682.04 1 3 1 1 5 3 32 1 2 2 2 2 1 2 2 3 4 1 1 2 1 4 2 1 1 31 10 5 1 2 4 2 3 11 4 1 7 2 4 3 7 4 8 339
12-27
12-28
42 100.00% 100.00%
12-29
12.1 Governance of information technology (IT) has become an increasingly important issue for businesses. Proper governance of IT is a consideration for auditors as well. The IT Governance Institute has developed a wide range of resources for organizations, auditors, and educators to use in addressing IT governance matters and simultaneously leveraging the benefits of technology. Read the IT Governance Executive Summary prepared by the IT Governance Institute at the Website shown below and answer the following questions:
[http://www.itgi.org/ContentManagement/ContentDisplay.cfm?ContentID=19976]
1.
How does IT governance fit into an organizations overall governance? Answer: IT governance is not a separate governance system, but it is a component of an organizations governance system.
2.
The Executive Summary makes five recommendations for management with respect to IT. What are these recommendations? Answer: The five recommendations include: (1) aligning the business and IT strategies of the organization, (2) aligning personnel from IT and other parts of the business and promote coresponsibility for the success of IT projects and the return of business value, (3) ensuring that risk analysis of IT is an integral part of all planning processes, (4) implementing a performance measurement system, and (5) giving the chief information officer sufficient organizational status to implement needed IT changes.
3.
How would an auditor likely view a companys IT environment if the organization had implemented the above recommendations? Answer: If a company were to implement the recommendations discussed above, an auditor would likely have greater confidence in the companys commitment to governance generally and the oversight and management of IT in particular. This information would likely be used in the auditors evaluation of the companys control environment and the general controls over IT. .
(Note: Internet problems address current issues using Internet sources. Because Internet sites are subject to change, Internet problems and solutions may change. Current information on Internet problems is available at www.prenhall.com/arens.)
12-30