Chapter 13
Control and Accounting
Information Systems
Introduction
• Control - the process of exercising a
restraining or directing influence over the
activities of an object, organism, or system
– The goal is to prevent losses from the many
possible hazards that businesses face.
• The accountant’s job is to take a proactive
approach to eliminating threats and detect,
correct, and recover from threats if they occur.
Introduction
• Threat - any potential adverse occurrence or
unwanted event that could injure either the
AIS or the organization
• Exposure - the potential dollar loss of a
particular threat if that threat occurs
• Risk - the likelihood that the threat will
actually come to pass
Overview of Control Concepts
• Historical developments
–
–
–
–
–
–
–
1949 - AIA
1958 - SAP No. 29
1972 - SAP NO. 54
1977 - Foreign Corrupt Practices Act
1981 - Research Foundation of the FEI
1988 - SAS No. 55
1992 Committee of Sponsoring Organizations
(COSO)
Overview of Control Concepts
• Internal control - the plan of organization and
the methods a business uses to safeguard assets,
provide accurate and reliable information,
promote and improve operational efficiency, and
encourage adherence to prescribed management
policies
• Management control - designed to reduce errors
and irregularities and help employees achieve
goals by following policies
Overview of Control Concepts
• Administrative controls - help ensure
operational efficiency and adherence to
managerial policies
• Accounting controls - safeguard assets and
ensure the reliability of accounting records
• Internal control structure - policies and
procedures established to provide reasonable
assurance that objectives will be achieved
Overview of Control Concepts
• Internal control classifications
–
–
–
–
Preventive, Detective, and Corrective
Feedback and Feedforward
General and Application
Input, Processing, and Output
Internal Control Classifications
• Preventive - designed to stop problems before
they arise
• Detective - designed to find problems if they
arise
• Corrective - designed to fix problems once they
are found
– Find the cause of the problems
– Correct the results of the problem
– Modify the system to keep problem from
happening again
Internal Control Classifications
• Feedback controls - measure a process and
correct it when deviations from normal
occur
• Feedforward controls - monitor a process
and inputs to that process and try to predict
potential problems
Internal Control Classifications
• General controls - ensure that the control
environment is stable and well managed to
enhance the effectiveness of application
controls
• Application controls - used to prevent,
detect, and correct errors and irregularities
during processing
Internal Control Classifications
• Input controls - ensure that only accurate,
valid, and authorized data are entered into
the system
• Processing controls - ensure that all data are
processed completely and accurately and all
applicable files are updated correctly
• Output controls - ensure that output is
properly controlled
The Foreign Corrupt
Practices Act
• Passed by Congress in 1977 in response to a
bribery scandal
– Primary purpose was to prevent the bribery of
foreign officials in order to obtain business
– Significant effect was to require all publicly
traded companies to have a good system of
internal controls
The Foreign Corrupt
Practices Act
• Requires all SEC registrants to have a system
that provides reasonable assurance that:
– Transactions are executed with management’s
authorization
– Transactions are recorded to permit preparation of
financial statements and maintain accountability for
assets
– Access to assets is permitted only with authorization
– Recorded assets are compared to existing assets and
action taken with respect to differences
Committee on Sponsoring
Organizations (COSO)
• Defined internal control as the process
implemented to provide reasonable assurance
that control objectives are achieved with
regard to:
– Effectiveness and efficiency of operations
– Reliability of financial reporting
– Compliance with applicable laws and regulations
Committee on Sponsoring
Organizations (COSO)
• Five interrelated components of internal
control:
–
–
–
–
–
Control environment
Control activities
Risk assessment
Information and communication
Monitoring
The Control Environment
• Management philosophy and operating style
– Employees follow the lead of management.
– Assessing management’s philosophy:
• Does management take undue risks to achieve
objectives?
• Does management attempt to manipulate
performance measures to make the company look
better?
• Does management pressure employees to achieve
results regardless of the methods required?
The Control Environment
• Organizational structure - defines the lines of
authority and responsibility and provides the
overall framework for how things are done
• Audit Committee of the Board of Directors composed of entirely outside directors
(directors who are not employees of the
company) - provides an independent review of
management
The Control Environment
• Methods of assigning authority and
responsibility - job descriptions, employee
training, and operating plans, schedules, and
budgets
– Formal code of conduct addresses issues such as
ethics, acceptable business practices, and conflicts
of interest.
– Written policy and procedures manuals spell out
exactly what is expected of employees.
The Control Environment
• Human resources policies and procedures rules for hiring, evaluating, compensating, and
promoting employees
– Hire and promote employees based on performance.
– Background checks on applicants are very
important.
• External influences - FASB or SEC
requirements and government regulations
Control Activities
• Control activities - rules that provide reasonable
assurance that management’s control objectives
are achieved.
• Five categories:
–
–
–
–
–
Proper authorization of transactions and activities
Separation of duties
Design and use of adequate documents and records
Adequate safeguards over assets and records
Independent checks on performance
Control Activities
• Proper authorization
– General authorization - authorize employees to
handle routine transactions without explicit
approval from management (daily sales)
– Specific authorization - require employees to
obtain approval for unusual or large
transactions (sale in excess of a certain amount,
write off of an A/R over a certain amount)
Control Activities
• Separation of duties - no single employee
should have too much responsibility - must
separate the authorization, recording and
custody of assets involved in a transaction
• Documents and records - help to ensure
accurate and complete recording of all
relevant data about transactions and events
– Keep forms simple and include room for
authorization
Control Activities
• Safeguarding of assets - both physical assets
and information
–
–
–
–
–
–
–
Supervise and separate duties
Maintain accurate records
Restrict physical access to assets
Restrict access to certain critical locations
Physically protect documents and records
Control the environment
Restrict access to systems with passwords
Control Activities
• Independent checks
– Reconciliation of two independent sets of records
– Comparison of actual quantities to recorded
amounts
– Double-entry accounting
– Batch totals (financial total, hash total, record
count, line count, cross-footing balance test)
– Independent review for authorization, supporting
documentation, and accuracy
Risk Assessment
• Steps in assessing risk:
– Identify threats - natural or manmade
– Estimate the risk - likelihood that a threat will
happen
– Estimate exposure - potential dollar loss
– Identify controls - consider effectiveness and
timing
– Estimate costs and benefits - design to provide
reasonable assurance
– Determine cost/benefit effectiveness
Risk Assessment
• Compliance with the Foreign Corrupt
Practices Act
– Document existing control system
– Evaluate the quality of the internal control
system - within bounds of reasonable assurance
– Evaluate the costs and benefits of instituting
controls
– Weigh the costs and benefits to determine
whether more control is needed
Information and Communication
• The primary purpose of an AIS is to record,
process, store, and communicate information
about an organization; therefore, accountants
must understand:
–
–
–
–
–
how transactions are initiated
how data are captured
how computer files are accessed and updated
how data are processed to prepare information
how information is reported to internal users and
external parties
Information and Communication
• According to the AICPA, an AIS has 5
primary objectives
–
–
–
–
–
Identify and record all valid transactions
Properly classify transactions
Record transactions at their proper value
Record transactions in the proper period
Properly present transactions and related
disclosures in the financial statements
Monitoring Performance
• Effective supervision - training and assisting
employees, monitoring performance, correcting
errors, and safeguarding assets by overseeing
employees who have access to them
• Responsibility reporting - use of budgets,
quotas, standard costs, and investigation of
variances
Monitoring Performance
• Internal auditing - reviewing the reliability of
financial and operating information and
providing and appraisal of internal control
effectiveness
– Also involves assessing employee compliance with
policies and procedures and applicable laws and
regulations and assessing the efficiency and
effectiveness of management
– Internal audit must be separate from accounting and
operating functions of the organization