In accounting systems, certain controls are needed to ensure that employees aredoing their jobs properly and ensure that the system runs properly. These checksare in the best interest of the organization. These controls come in the form ofinternal and external controls for the system. The internal controls are thechecks that are placed in the system my the company’s own management anddirectors. Today more and more companies are moving from the manual accountingsystems to computerized accounting information systems.
The advantages of acomputerized system are increases in the speed and accuracy of processingaccounting information. However, as systems become computerized, the internalcontrols for that system has to be adapted accordingly. This is becausecomputerized systems bring with them certain unique problems that can only beremoved or minimized by adapting the present controls and adding new controls.
In a manual system there is a paper trail for the internal auditor tofollow. All records and transactions are kept on paper and so an auditor hasclear and documented proof of what has transpired. Computerized systems rarelyhave a clear paper trail to follow. Since computers do all of the sorting of theinformation the company rarely sorts the source documents. Also the computerdoes most of the calculations and processing so there would not be the amount ofdocumentation that there would be in a manual system.
Another problem of computer systems is the fact that there can bedifficulty in determining who entered the data. In a manual system the identityof the person entering the data can be identified possibly by the person’shandwriting. This cannot be done in a computerized system. This makes it verydifficult to determine who is responsible for errors or fraud.
Since the computers do all calculations and processing errors canoccur due to bad design of the program. This can be difficult to detectespecially if the error does not occur frequently and only does so underparticular conditions. Computer systems also offer new opportunities for fraud. If acomputerized system is not set up properly and certain checks not put in thenthe computer system can be used to defraud the company. The fact that it isdifficult to trace who enters the data only adds to the magnitude of this.
These administrative controls areDivision of duties. Duties are assigned to different individuals in the organization. Thisis done in such a way that no one person can have full control over atransaction. This ensures that an individual cannot have full control over thecreation and operating of the system. One reason for this division is having oneperson controlling the system can result in fraud if that person is notcompletely trustworthy. Another reason for the division of duties is to preventthe organization from becoming totally dependent on the person controlling thecomputer system. If this person were to leave then the organization would haveno one to run the system. The division of duties ensures that employees canleave without having any major effect on the system.
Operation controls are necessary controls since they since theydetermine what the computer systems and the employees using the system have beendoing. These controls can come in the form ofrotation of shiftsduty logsa manual of operating instructionsattendance controlscomputer logsThese controls can allow an auditor to track the exact actions of thecomputer systems and employees. This documentation allows the to easily spot anyerrors or improper actions that have occurred.
These controls are put in place to minimize the number of errors andomission that occur in the file system. Good file controls areAvailability of a skilled technicianProper procedures for issuing and returning filesproper labeling and indexing of filesprotection of storage media from dust, humidity, fire etc.
The computer hardware is not only important to the processing of theinformation but is also a valuable fixed asset for the company. Thereforecontrols for the protection of the hardware must be put into place. Computerhardware must be placed in a secure area where the access to it is limited onlyto those who need to use it. Certain levels of security must me maintained e.g. only the systems administrator can have access to the CPU and storage systems.
The computer system must also be placed in a control environment to protect itfrom environmental hazards e.g. dust and humidity. Arrangements should be madeto protect the computer against fires and power fluctuations. There should alsobe some controls in place to recover the system in case the hardware fails. These controls would ensure that the breakdown of the hardware would not have aserious effect on the company.
One important control is standardization. These consist of variousstandards that are laid down by management for the design and development of thesystem. These standards include the complete documentation of the development ofthe system. These standards would not only benefit in the correcting of problemsand updating of the system, the documentation would allow the auditor to get abetter idea of how the system works. This would help the auditor in spottingpossible problems in the system.
The involvement of the organizations management in the development ofthe system is an important control. With these controls, management must havedocumentation such as feasibility studies, budgets and performance evaluations. These documents would allow management to decide if the system being developedwould be viable and cost effective. Without such controls, expensive projectscan be started and never finished, costing the organization a great deal in timeand money. These managerial controls force the development team to do athorough job since they are accountable to management.
Testing and trials are important controls and require that systems arethoroughly tested before they become operational. The extensive testing ofprograms will minimize or even eliminate the errors in the computer system. Thetests will show exactly what type of problems occur in the system in theprocessing of certain data and would also indicate any problems in the responsetime of the systems. Also, the benchmarks that are calculated in testing can becompared with benchmarks taken later on to see if the program has been tamperedwith.
Running the old and new systems concurrently is also an importantcontrol. This control would allow the organization to compare the results of thetwo systems when they do different tasks. These results would allow them to findany problems in the new system by validating the results of the new system withthe results of the old one Procedural Controls.
These are procedural controls that are placed on the input of data intothe system. These controls areSerial numbering of documentsValidation checks on documentsBatching documents and checking of batch totalsauthorization procedures. These controls are carried out by the user department. The Data processingdepart also then gets the data and put carry out their own controls. These areVetting of batches to ensure that they are correctchecks on data conversion methodsThese checks are made so that the data that is entered is as accurate and aserror free as possible. Once that data has been entered into the system and is being processed, theprocessing controls are used to ensure that the data is processed properly.
The internal controls that have been put into place for a manual system to helpthe internal auditor cannot fully prevent or minimize the possibility of errorsor fraud that come with the computerized systems. Therefore the old controlsmust be modified for the new system and new controls must be put in. Only thencan the internal auditor ensure that the number of errors that occur within thesystem be minimized or even eliminated.
Bibliography
- Basset P.H. (1993) Computerised accounts, 3rd Edition, Manchester : NCCBlackwell. 1-85554-205-6.
- Grudinsku G., Burch J., (1989), Information Systems Theory and Practice, 5thEdition, John Wiley and Sons, Inc. 0-471-61293-6.
