Topic 2 - Part
111
Ethics, Fraud,
and Internal
Control
James A. Hall, Accounting Information Systems, 10th Edition. © 2019
Cengage. All Rights Reserved. May not be scanned, copied or
duplicated, or posted to a publicly accessible website, in whole or in part.
Learning Objectives
• Understand the broad issues pertaining to business
ethics.
• Have a basic understanding of ethical issues related to
the use of information technology.
• Be able to distinguish between management fraud and
employee fraud.
• Be familiar with common types of fraud schemes.
• Be familiar with the key features of the COSO internal
control framework.
• Understand the objectives and application of both physical
and IT control activities.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 2
Computer (IT)
Controls
James A. Hall, Accounting Information Systems, 10th Edition. © 2019
Cengage. All Rights Reserved. May not be scanned, copied or
duplicated, or posted to a publicly accessible website, in whole or in part.
IT Controls
• IT controls relate to the computer
environment:
– General control pertain to entity-wide IT
concerns.
– Application controls ensure the integrity of
specific systems.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved. 4
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
IT GENERAL CONTROLS
• Pertain to all activities involving a firm’s AIS and resources (assets).
• Pertain to entity-wide concerns such as controls over the data center,
organization databases, systems development, & program
maintenance.
• to ensure that its overall computer system is stable and well managed.
• Categories:
(a) Segregation of duties within the systems
(b) Physical access controls
(c) Logical access controls
(d) Data storage controls
(e) Data transmission controls
(f) Internet and e-Commerce controls
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
Segregation of Duties Within
the Systems Function
• Authority and responsibility must be clearly divided among the following
functions:
1. Systems administration
2. Network management
3. Security management
4. Change management
5. Users
6. Systems analysis
7. Programming
8. Computer operations
9. Information system library
10. Data control
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
(b) Physical Access Controls
• Ability to physically use computer equipment.
• How can physical access security be achieved?
– Place computer equipment in locked rooms and restrict access to
authorized personnel
– Have only one or two entrances to the computer room
– Require proper employee ID
– Require that visitors sign a log
– Use a security alarm system
– Restrict access to private secured telephone lines and terminals or PCs.
– Install locks on PCs.
– Restrict access of off-line programs, data and equipment
– Locate hardware and other critical system components away from
hazardous materials.
– Install fire and smoke detectors and fire extinguishers that do not
damage computer equipment
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
(c) Logical Access Controls
• The ability to use computer equipment to access
company data.
• Users should be allowed access only to the data they are
authorized to use and then only to perform specific
authorized functions.
• What are some logical access controls?
– passwords
– physical possession identification
– biometric identification
– compatibility tests
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
(d) Data Storage Controls
• Computer storage is the holding of data in an electromagnetic form
for access by a computer processor.
• Primary storage is data in random access memory (RAM) and
other "built-in" devices.
• Secondary storage is data on hard disk, tapes, and other external
devices.
***Random Access Memory***
• The place in a computer where the operating system, application
programs, and data in current use are kept so that they can be
quickly reached by the computer's processor.
• The memory in a computer that can be overwritten with new
information repeatedly. It is erased when the computer is turned off.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
(e) Data Transmission Controls
• Methods of monitoring the network to detect weak
points, maintain backup documents, and ensure that
the system can still communicate if one of the
communications paths should fail.
• Designed to minimize the risk of data transmission
errors.
• To
reduce the risk of data transmission failures,
companies should monitor the network.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
Data Transmission Controls
• Data Transmission Controls take on added importance in
organizations that utilize electronic data interchange (EDI) or
electronic funds transfer (EFT).
• How can data transmission errors be minimized?
– data encryption (cryptography)
– routing verification procedures
– adding parity
– message acknowledgment techniques
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
Internet and e-Commerce Controls
• Another control is installing a firewall, hardware
and software that control communications between
a company’s internal network (trusted network)
and an external network.
– The firewall is a barrier between the networks
that does not allow information to flow into and
out of the trusted network.
• Electronic envelopes can protect e-mail messages
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
IT Application Controls
• Pertain directly to the transaction processing systems.
• Ensure the integrity of specific systems / applications
(eg. : sales order, accounts payable, & payroll applications).
• Objective: to ensure that all transactions are legitimately
authorized and accurately recorded, classified, processed,
and reported.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
Application Controls
• Risks within specific applications
• Application controls are subdivided into:
INPUT PROCESSING OUTPUT
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 14
Application Control
• Input control (edits) perform tests on transactions to
ensure they are free from errors.
– Check digit is a control digit(s) that is added to the data
code when originally assigned. Allows integrity to be
established during processing and helps prevent two
common errors:
• Transcription errors occur when (1) extra digits are
added to a code, (2) a digit is omitted from a code, or
(3) a digit is recorded incorrectly.
• Transposition errors occur when digits are reversed.
– Missing data check identifies blank or incomplete input
fields.
– Numeric-alphabetic check identifies data in the wrong
form.
– Limit checks identify fields that exceed authorized limits.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 15
Application Control
• Input controls (cont’d):
– Range checks verify that all amounts fall within an
acceptable range.
– Reasonableness checks verify that amounts that have
based limit and range checks are reasonable.
– Validity checks compare actual fields against acceptable
values.
• Processing controls are programmed procedures to
ensure an application’s logic is functioning properly.
– Batch controls manage the flow of high volume
transactions and reconcile system output with original
input .
– Run-to-run controls monitor batch from one process to
another.
• A hash total is the summation of a nonfinancial field to
keep track of records.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 16
Application Control
• Audit trail controls ensure every transaction can be
traced through each stage to processing from source to
financial statements.
– Every transaction the system processes, including
automatic ones, should be recorded on a transaction
log.
• Master file backup controls may be viewed as either a
general control or an application control.
– GFS (grandfather-father-son) backup is used with
systems that use sequential master files.
– The destructive update approach leaves no backup
copy and requires a special recovery program if data is
destroyed or corrupted.
– Real-time systems schedule backups at specified daily
intervals.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 17
Application Control
• Output controls are procedures to ensure output is not lost,
misdirected or corrupted and that privacy is not violated.
– Can cause disruption, financial loss and litigation.
• Controlling hard-copy output:
– Output data can become backlogged (spooling) requiring
an intermediate output file in the printing process.
• Proper access and backup procedures must be in place
to protect these files.
– Print programs controls should be designed to prevent
unauthorized copies and employee browsing of sensitive
data.
– Sensitive computer waste should be shredded for
protection.
– Report distribution must be controlled. End-user should
examine reports for correctness, report errors and maintain
report security.
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 18
Internal Control Limitations
• Staff size
• Human error, misunderstandings, fatigue, stress
• No out-of-pocket costs
• Designing and establishing effective internal control is not
always a simple task and cannot always be accomplished
through a short set of quick fixes.
*** there is no such thing as a perfect control system***
James A. Hall, Accounting Information Systems, 10th Edition. © 2019 Cengage. All Rights Reserved.
May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.