1

Chapter 9 Controlling Information

Systems: Business Process and Application Controls

Accounting Information Systems 7eUlric J. Gelinas and Richard Dull

Copyright © 2008 Thomson Southwestern, a part of The Thomson Corporation. Thomson, the Star logo, and South-Western are trademarks used herein under license.

Learning Objectives• Complete the steps in the control framework

and prepare a control matrix.• Write explanations that describe how the

business process and application controls introduced in this chapter accomplish control goals.

• Describe the importance of business process and application controls to organizations with enterprise systems and those engaging in e-Business.

3

The Control Matrix

• The control matrix is a tool designed to assist you in analyzing the effectiveness of controls (PCAOB Auditing standard #2 – “Effectiveness of Control Design”)

• It establishes the criteria to be used in evaluating the controls in a particular business process.

4

Sample Control Matrix  Control Goals of the Lenox Cash Receipts Business Process

  Control goals of the operations process (a) Control goals of the information process (a)

Recommended control plans (b)

Ensure effectiveness of operations Ensure efficient employ-ment of resources (eg. people and computers)

Ensure security of resources (eg. Checks and AR data)

For the remittance advice inputs, ensure: For the AR master data, ensure:

  A B IV IC IA UC UA

Present Controls                  

P-1: Immediately endorse incoming checks

      P-1 (c)          

P-2: Compare input (remittance advices [RAs]) with master data (AR master data)

P-2 P-2     P-2   P-2    

Missing Controls                  

M-1 Immediately separate checks and RAs

                 

M-2 Compare checks and RAs                  

5

Lenox Company Annotated Systems Flowchart

Cu stome r

M AILROOM ACCOUNTS RECEIVABLE COM PUTER CASHIER

RAs

Ch e cks

End orse dCh e cks

A

RAs

Ke y cu sto me rn umb e r,inv o ice

n umb e r,amo un t andch e ck n u mb e r

"Acce p te dan d

p ro ce sse d "

Acco un tsre ce iv ab le

maste r data

Prin t de p ositslip

A

End orse dCh e cks

Te mpfile

F ile d un tild e p osit s lipis re ce iv e d

End orse dCh e cks

Erro r ro u tin en ot sh ow n

Co mp areEnd orse dCh e cks

De po sitslip

1

De po sitslip

De po sitslip

1

2

Ban k

Cashre ce ip ts

e v e n t d ata

Ve rify, log e v e n t oncash re ce ip ts e v e n t

d ata, u pd ate AR,n o tify cle rk

At e ndo f d ay

RA = Re mittan ce ad v ice

End orsech e cks

M -1

P-1M -2

P-2

6

Steps in Preparing Control Matrix

I. Specifying control goals represents the first step in building a control matrix. The goals are listed across the top row of the matrix.

1. Identify the operations process goalsa. Effectiveness goalsb. Efficiency goalsc. Security goals

2. Identify Information Process Goalsa. Input Goalsb. Update Goals

7

Operations Process Goals: Effectiveness Goals

i. Ensure the successful accomplishment of the goals set forth for the business process

ii. Different processes have different effectiveness goals. For Lenox’s cash receipts process we include only two examples here:

– A — Timely deposit of checks– B — Comply with compensating balance agreements with the

depository bank– Other possible goals of a cash receipts would be shown as

goals C, D, and so forth, and described at the bottom of the matrix (in the matrix legend).

iii. With respect to other business processes, such as production, we might be concerned with effectiveness goals related to the following:

– Goal A—to maintain customer satisfaction by finishing production orders on time.

– Goal B—to increase market share by ensuring the highest quality of finished goods.

8

Operations Process Goals: Efficiency Goals

i. The purpose of efficiency control goals of the operations process is to ensure that all resources used throughout the business process are being employed in the most productive manner

ii. In parentheses, notice that we have listed two resources of the cash receipts process for which efficiency is applicable—people and computers.

• In fact, people and computers would always be considered in the efficiency assessments related to accounting information systems.

iii. In other business processes, such as receiving goods and supplies, we might also be concerned with the productive use of equipment such as trucks, forklifts, and hand-held scanners.

9

Operations Process Goals: Security Goals

i. The purpose of security control goals of the operations process is to ensure that entity resources are protected from loss, destruction, disclosure, copying, sale, or other misuse.

ii. In parentheses, we have included two resources of the cash receipts process over which security must be ensured—cash and information (accounts receivable master data). • With any business process, we are concerned with information that is

added, changed, or deleted as a result of executing the process, as well as assets that are brought into or taken out of the organization as a result of the process, such as cash, inventory, and fixed assets.

iii. With regard to other business processes, such as shipping, we might include customer master data and shipping data. • Note: The security over hard assets used to execute business

processes, such as computer equipment, trucks, trailers, and loading docks, is handled through pervasive controls (discussed in Chapter 7).

10

Information Process Goals: Input Goals

i. With respect to all business process data entering the system, the purpose of input goals of the information process is to ensure:

• input validity (IV)• input completeness (IC) and • input accuracy (IA).

ii. With the cash receipts process, we are concerned with input validity, accuracy, and completeness over cash receipts

• Here, they are in the form of remittance advices• Notice that we specifically name the input data of concern in

parentheses.

iii. With respect to other business processes, such as hiring employees, we would be concerned with other inputs, such as employee, payroll, and benefit plan data.

11

Information Process Goals: Update Goals

i. Update goals must consider all related information that will be affected by the input data, including master file data and ledger data. For the business process input data, the purpose of update control goals of the information process is to ensure:• The update completeness (UC) and • Update accuracy (UA)

ii. With regard to the cash receipts information process, we recognize that the accounts receivable data will be updated by cash receipts • Cash received reflects the debit and customer account reflects the

credit). • Notice that we list accounts receivable master data in the control

matrix.

iii. Other business processes, such as cash payments, would involve different update concerns, such as vendor, payroll, or accounts payable master data.

12

Steps in Preparing the Control Matrix

II. Recommending Control Plans1. Annotating “Present” Control Plans

2. Evaluating “Present” Control Plans

3. Identifying and Evaluating “Missing” Control Plans

13

Annotating Present Control Plans

• Start on the upper left-hand column of the systems flowchart and spot the first manual keying symbol, manual process symbol, or computer process symbol (process related symbols)

• Then, follow the sequential logic of the systems flowchart and identify all of the process-related symbols.

• Each process-related symbol reflects an internal control plan which is already present.

• It is important to recognize that while a control plan may be present, it may not be working as effectively as it should; thus, you might recommend ways to strengthen or augment existing control plans

14

Annotate the Process Flow Chart

• Review the flowchart and determine whether a control is present (P-) or missing (M-)

• Annotate the flowchart– If controls are present, mark P-– If controls are absent, mark M-

15

Annotating Present Control Plans

a. Reviewing the Lenox systems flowchart (Figure 9.2), you will find that the first process-related symbol is entitled “Endorse checks.” – Because this process appears on the flowchart, this

control plan already exists, meaning, it is present as opposed to missing.

– Accordingly, place a P- beside the process, indicating that is it present, and a 1 beside the P- reflecting the first present control plan on the flowchart.

– As a result, you should have annotated the systems flowchart with a P-1.

16

Annotating Present Control Plans

b. Continue reviewing the systems flowchart by following its sequential logic, annotating the flowchart with P-2, P-3, and so on until you have accounted for all present control plans.

17

Evaluating “Present” Control Plans:

• Write number (P-1, P-2, P-3 through P-n) and name of each control plan in the left-hand column of the control matrix.

• Then, starting with P-1, look across the row and determine which control goals the plan addresses and place a P-1 in each cell of the matrix for which P-1 is applicable.

• It is possible that a given control plan can attend to more than one control goal.

• Continue this procedure for each of the present control plans.

• Simultaneously, in the legend of the matrix, describe how the control plan addresses each noted control goal.

18

Identifying and Evaluating “Missing” Control Plans:

• The next step in recommending control plans is to determine if additional controls are needed to address missing control goal areas, strengthen present control plans, or both.

19

Identifying and Evaluating “Missing” Control Plans:

• Examining the controls matrix: The first place to start is to look at the control matrix and see if there are any control goals (operations or information) for which no present control plan is addressing.

• If so, you need to do the following:i. In the left-hand column of the matrix, number the first missing control plan

as M-1 and label or title the plan.ii. Across the matrix row, place M-1 in each cell for which the missing control

is designed.iii. In the legend of the matrix, explain how the missing control will address

each noted control goal.iv. On the systems flowchart, annotate M-1 where the control should be

inserted.v. If there are still control goals for which no control plan has addressed,

develop another plan (M-2) and repeat the four previous steps (i through iv). Continue this procedure until each control goal on the matrix is addressed by at least one control plan.

• With regard to Lenox, we have noted two missing control plans in the sample control matrix for the Cash Receipts Business Process

• M-1 and M-2, although more might exist

20

Evaluating the systems flowchart:

• Even though all of the control goals on the matrix are now addressed, closely review the systems flowchart one more time.

• Look for areas where further controls are needed. • Just because all control goals on the matrix have one or

more associated control plans, we might have to to add more control plans or strengthen existing plans to reduce residual risk to an acceptable level in certain areas.

• It takes training and experience to spot risks and weaknesses of this nature

• In Chapters 10 through 16 you will learn more about how to make such critical internal control assessments.

21

Sample Control Plans for Data Input

1. Manual and automated data entry

2. Data entry with batches of input data

22

Manual And

Automated Data Entry

Data e ntry cle rkCe ntral com pute r

(s e rve r )

Inte rnal par tyinput s ource

M as te rdata

Ke y docum e ntdata

"Acce pte dfor

proce s s ing"

P-1P-2

P-5

P-3P-4

P-6

P-7

P-10P-11P-12

Populate inputs cre e n w ithm as te r data

M as te rdata

Eve ntdata

Edit and re cordinput, notify cle rk

End

Com pare inputw ith m as te r data

Edit and re cordinput, notify We b

s e rve r

We b s e rve r

Ke y m as te rre cord ID

Input docum e nt

We b s e rve r

V e r ify digitals ignature

Com pare inputw ith m as te r

data

Error routinenot s how n

P-8

P-9

P-8

P-6

P-9

Error routinenot s how n

P-7

23

Control Matrix for

Automated and Manual

Entry

  Control Goals of the (blank) Business Process

  Control Goals of the Operations Process Control Goals of the Information Process (a)

  Ensure Effectiveness of Operations

Ensure Efficient Employment of

Resources (people,

computers)

Ensure Security of Resources (event data,

assets)

For the (blank) inputs, ensure: For the (blank) master data,

ensure: 

 

 

 

Recommended Control Plans

  A       IV IC IA UC UA

Present Controls                  

P-1: Document design P-1   P-1       P-1    

P-2: Written approvals       P-2 P-2        

P-3: Preformatted screens P-3   P-3       P-3    

P-4: Online prompting P-4   P-4       P-4    

P-5: Populate input screen with master data

P-5   P-5   P-5   P-5    

P-6: Compare input data with master data

P-6   P-6   P-6   P-6    

P-7: Procedures for rejected Inputs           P-7 P-7    

P-8: Programmed edit checks P-8   P-8 P-8 P-8   P-8    

P-9: Confirm input acceptance           P-9      

P-10: Automated data entry P-10   P-10       P-10    

P-11: Enter data close to the originating source

P-11   P-11     P-11 P-11    

P-12: Digital signatures       P-12 P-12   P-12    

Missing Controls                  

None noted                  

24

Available Control Plans for Data Input

• P-1: Document design– source document is designed to easily complete and key data

• P-2: Written approvals– signature or initials indicating approval of event processing

• P-3: Preformatted screens– defines acceptable format for each data field (e.g., 9 numeric

characters for SSN)

• P-4: Online prompting– requests user input or asks questions, e.g., message box

25

Available Control Plans for Data Input

• P-5: Populate input screen with master data– User enters an entity’s ID code and the system then

retrieves certain data about that entity from existing master data.

– User might be prompted to enter the customer ID (code). – By accessing the customer master data, the system

automatically provides data such as the customer’s name and address, the salesperson’s name, and the sales terms.

– This reduces the number of keystrokes required, making data entry quicker, more accurate, and more efficient.

– Therefore, the system automatically populates input fields with existing data

26

Available Control Plans for Data Input, Cont’d.

• P-6: Compare input data with master data– the system compares inputs with standing (master) data to ensure their accuracy and

validity– Input/master data dependency checks

• These edits test whether the contents of two or more data elements or fields on an event description bear the correct logical relationship.

• For example, input sales events can be tested to determine whether the salesperson works in the customer’s territory.

• If these two items don’t match, there is some evidence that the customer number or the salesperson identification was input erroneously.

– Input/master data validity and accuracy checks• These edits test whether master data supports the validity and accuracy of the input. For example, this edit

– might prevent the input of a shipment when no record of a corresponding customer order exists.– If no match is made, we may have input some data incorrectly, or the shipment might simply be invalid.

• We might also compare elements within the input and master data.

• P-7: Procedures for rejected Inputs– After processing the input, the user compares the input with the master data to determine

whether the input either is acceptable or contains errors, and that any errors are corrected and resubmitted

27

Available Control Plans for Data Input, Cont’d.

• P-8: Programmed edit checks

– Automatically performed by data entry programs upon entry of data• Reasonableness checks (limit checks)—tests input for values within predetermined limits

• Document/record hash totals—compares computer total to manually calculated total

• Mathematical accuracy checks—compare calculations performed manually to computer calculations, e.g., compare

invoice total to manually entered to computer calculated total

• Check Digit verification – a functionally dependent extra digit is appended to a number; if mis-keying occurs, a

check digit mismatch occurs and the system rejects the input

• Document/Record Hash Totals – summarization of any numeric data on the source document

• P-9: Confirm input acceptance– These interactive programmed features inform the user that the input has been accepted and

recorded or rejected for processing.

• P-10: Automated data entry

– stores the accurate, valid input data onto digital media in a timely manner with minimal use of

resources.

• P-11: Enter data close to the originating source– OLTE and OLRT– No transportation of source documents, no transcription of source documents– Easier to recognize mistakes

• P-12: Digital signatures– Validates the identify of the sender

28

Data Entry with Batches

• Data entry with batches involves collecting inputs into work units called batches; batched inputs are then keyed into system as a batch– Implies some delay between the economic event

and its reflection in the system– Allows for controls focusing on the batch, e.g.,

batch control totals (hash or other totals from batch)

– Batch entry is often followed by an exception and summary report

29

Data Entry with Batches System Flowchart

Figure 9-5 – system flowchart here

30

Data Entry with Batches Control Matrix  Control Goals of the Shipping Business Process

  Control Goals of the Operations Process Control Goals of the Information Process

  Ensure Effectiveness of

Operations

Ensure Efficient Employment of

Resources (people,

computers)

Ensure Security of Resources (inventory, AR master data)

For the picking ticket inputs, ensure: For the AR master data, ensure:

 

 

 

 

Recommended Control Plans

  A     IV IC IA UC UA

Present Controls                

P-1: Turnaround documents P-1 P-1   P-1   P-1    

P-2: Manually reconcile batch totals       P-2 P-2 P-2    

P-3: Agree run-to-run totals (reconcile input and output batch totals)     P-3 P-3 P-3 P-3 P-3 P-3

P-4: Review tickler file (file of pending shipments) P-4       P-4      

P-5: One-for-one checking (compare picking tickets and packing slips)     P-5 P-5 P-5 P-5 P-5 P-5

Missing Controls                

M-1: Key verification           M-1    

M-2: Sequence check       M-2 M-2      

M-3: Computer agreement of batch totals M-3 M-3   M-3 M-3 M-3    

31

Data Entry with Batches Control Plans

Present Controls• P-1: Turnaround documents

– to capture and input a subsequent event• P-2: Manually reconcile batch totals• P3: Run-to-Run Totals• P-4: Review tickler file (file of pending

shipments)– Check business events pending further action

• P5: One-for-One checkingMissing Controls• M-1: Key verification

– Data are re-entered and checked• M-2: Sequence check• M-3: Computer agreement of batch totals

32

P-2: Manually reconcile batch totals

• a. First, one or more of the batch totals are established manually

• b. As individual event descriptions are scanned, the data entry program accumulates independent batch totals.

• c. The computer produces reports (or displays) with the relevant control totals that must be manually reconciled to the totals established prior to the particular process.

• d. The person who reconciles the batch total must determine why the totals do not agree and make corrections as necessary to ensure the integrity of the input data

33

P-3: Agree run-to-run totals (reconcile input and output batch totals)

• This is a variation of the agreement of batch totals controls. • With agreement of run-to-run totals, totals prepared before a

computer process has begun are compared, manually or by the computer, to totals prepared at the completion of the computer process.

• These post-process controls are often found on an error and summary report.

• When totals agree, we have evidence that the input and the update took place correctly.

• This control is especially useful when there are several intermediate steps between the beginning and the end of the process and we want to be assured of the integrity of each process.

34

P-5: One-for-one checking (compare picking tickets and packing slips)

• Differences may indicate errors in input or update.

• This procedure provides us detail as to what is incorrect within a batch.

• Being very expensive to perform, one-for-one checking should be reserved for low-volume, high-value events.

35

M2: Sequence Checks• Whenever documents are numbered sequentially, a sequence check can be

automatically applied to those documents. • Batch sequence checks work best when we can control the input process and

the serial numbers of the input data, such as payroll checks. – In a batch sequence check, the event data within a batch are checked as follows:

• a. The range of serial numbers constituting the batch is entered.• b. Each individual, serially pre-numbered event data is entered.• c. The computer program sorts the event data into numerical order; checks the documents

against the sequence number range; and reports missing, duplicate, and out-of-range event data.

• Cumulative sequence check provides input control when the serial numbers are not entered in sequence (i.e., picking tickets might contain broken sets of numbers).

– Matching of individual event data (picking ticket #s) is made to a file that contains all document numbers (all sales order numbers).

• Periodically, reports of missing numbers are produced for manual follow-up.– Reconciling a checkbook is another example of a situation where the check numbers

are issued in sequence. • However, the bank statement we receive may not contain a complete sequence of checks. • Our check register assists us in performing a cumulative sequence check to make sure that all

checks are eventually cleared.

36

Batch Control Plans

• Batch control plans, to be effective, should ensure that:– All documents are included in batch– All batches are submitted for processing– All batches are accepted by computer– All differences are disclosed, investigated

and corrected on a timely basis

37

Batch Control Plans• Batch control procedures start by grouping event data and calculating totals for

the group: Several different types of batch control totals can be calculated– Document/record counts are simple counts of the number of documents entered in a

batch• This procedure represents the minimum level required to control input completeness. • Because one document could be intentionally replaced with another, this control is not

effective for ensuring input validity and says nothing about input accuracy.– Item or line counts

• Counts number of items or lines entered, such as a count of the number of invoices being paid by all the customer remittances.

• By reducing the possibility that line items or entire documents could be added to the batch or not be input, this control improves input validity, completeness, and accuracy.

• Remember, a missing event record is a completeness error and a data set missing from an event record is an accuracy error.

– Dollar totals• Sum of dollar value of items in batch• By reducing the possibility that entire documents could be added to or lost from the batch

or that dollar amounts were incorrectly input, this control improves input validity, completeness, and accuracy.

– Hash totals• Are a summation of any numeric data existing for all documents in the batch, such as a

total of customer numbers or invoice numbers in the case of remittance advices. • Unlike dollar totals, hash totals normally serve no purpose other than control.• Hash totals can be a powerful batch control because they can determine if inputs have

been altered, added, or deleted. • These batch hash totals operate for a batch in a manner similar to the operation of

document/record hash totals for individual inputs.