computer-based information systems controls

Computer-Based Information Systems

Controls

SISTEM INFORMASI AKUNTANSI (AK069)

GASAL 2007/2008

Pendahuluan

• Jason Scott dipekerjakan sebagai Auditor internal oleh Northwest Industries, sebuah perusahaan kehutanan yang memiliki berbagai jenis produk

• Dia ditugaskan untuk mengaudit Springer’s Lumbers & Supply, sebuah toko bahan bangunan milik Northwest di Bozeman, Montana.


GASAL 2007/2008

Pendahuluan• Supervisornya, Maria Pilier, telah meminta Jason untuk melacak contoh

transaksi – transaksi pembelian dari permintaan pembelian hingga kepembayaran tunai, untuk memverifikasi bahwa prosedur pengendalian yang sesuai, telah diikuti. Pada tengah hari Jason merasa Frustasi dengan tugas ini.

• Mengapa Jason Frustasi ?– Sistem pembelian tidak didokumentasikan

dengan baik.– Jason kerap menemukan transaksi yang belum

diproses Padahal menurut Ed Yates, Manajer bagian Hutang, seharusnya diproses.


GASAL 2007/2008

PendahuluanJason’s frustrations, continued– Beberapa faktur penjualan dari Vendor telah dibayar tanpa adanya dokumen

pendukung, seperti pesanan pembelian dan laporan penerimaan.– Beberapa permintaan pembelian untuk beberapa jenis barang yang secara

pribadi di otorisasi oleh Bill Springer, Wakil presiden bagian pembelian, telah hilang.

– Harga yang dibebankan ke beberapa barang terlalu tinggi.– Springer’s adalah pemasok terbesar di wilayah tersebut dan hampir dapat

dikatakan merupakan usaha monopoly.– Otoritas manajemen dipegang oleh Presiden perusahaan, Joe Springer,

beserta kedua anaknya, yaitu Bill (wakil presiden bag. Pembelian) dan Ted (Controller), serta beberapa saudaranya dan teman mereka yang bekerja di bagian penggajian. Springer memiliki 10 % saham perusahaan.

– Maria yakin Bahwa Ted Springer tampaknya terlibat dalam praktek “creative accounting.” untuk membuat Springer’s menjadi salah satu toko Northwest dengan kinerja terbaik.


GASAL 2007/2008

Pendahuluan• Jason mempertimbangkan isu – isu berikut:– Haruskan Jason mendeskripsikan transaksi tersebut

dalam Laporannya?– Apakah pelanggaran atas prosedur pengendalian yang

sesuai dapat diterima apabila hal tersebut telah diotorisasi oleh pihak management?

– Berdasarkan tugas mengenai prosedur pengendalian yang diberikan ke Jason, apakah dia memiliki tanggung jawab Profesi atau Etika untuk ikut campur dalam hal tersebut ?


GASAL 2007/2008

Ancaman – Ancaman atas SIA

• Kehancuran karena bencana Alam dan Politik?– Kebakaran atau panas berlebih (fire or excessive

heat)– Banjir (floods)– Gempa bumi (earthquakes)– Badai Angin (high winds)– Peperangan (war)


GASAL 2007/2008


• Error pada Software dan tidak berfungsinya peralatan?– Kegagalan Hadrware – Kesalahan atau kerusakan pada software– Kegagalan sistem Operasi– Gangguan dan Fluktuasi Listrik– Kesalahan pengiriman data yg tidak terdeteksi


GASAL 2007/2008


• Tindakan yang tidak disengaja?– Kecelakaan yang disebabkan oleh kesalahan

manusia– Kesalahan atau penghapusan karena

ketidaktahuan– Hilangnya atau salah letaknya data– Kesalahan pada logika sistem– System yang tidak memenuhi kebutuhan

perusahaan atau tidak mampu menangani tugas yang diberikan.


GASAL 2007/2008


• Tindakan sengaja (Kejahatan Komputer)– Sabotase– Penipuan melalui komputer– Pencurian


GASAL 2007/2008

Mengapa Ancaman – ancaman SIA Meningkat ?

• Peningkatan Jumlah of client/server systems berarti bahwa Informasi yang tersedia untuk Jumlah yang tidak terprediksi bagi para pekerja.

• Karena LANs and client/server systems mendistribusikan data kebanyak pemakai, mereka lebih sulit dikendalikan daripada sistem komputer utama yang terpusat.

• WAN memberikan pelanggan dan Pemasok akses ke sistem dan data mereka satu sama lain, yang menimbulkan kekhawatiran dalam hal kerahasian.


GASAL 2007/2008

Mengapa Pengendalian dan Keamanan Komputer Penting

• Sebagai seorang yang mengerti Akuntansi dan Teknologi Informasi Anda harus memahami bagaimana cara melindungi sistem dari ancaman- ancaman yang dihadapi. Sehingga dapat menggunakan Teknologi informasi dalam mencapai tujuan pengendalian Perusahaan.


GASAL 2007/2008

Tinjauan Menyeluruh Konsep – konsep pengendalian

Apakah Internal Control?Internal Control adalah rencana organisasi dan metode bisnis yang digunakan untuk menjaga aset, memberikan informasi yang akurat dan handal, mendorong dan memperbaiki efisiensi jalannya organisasi, serta mendorong kesesuaian dengan kebijakan yang telah ditetapkan.


GASAL 2007/2008

Overview of Control Concepts• What is management control?• Management control encompasses the following three features:1 It is an integral part of management responsibilities.2 It is designed to reduce errors, irregularities, and achieve organizational

goals.3 It is personnel-oriented and seeks to help employees attain company

goals.


GASAL 2007/2008

Internal Control Classifications

• The specific control procedures used in the internal control and management control systems may be classified using the following four internal control classifications:1 Preventive, detective, and corrective controls 2 General and application controls3 Administrative and accounting controls4 Input, processing, and output controls


GASAL 2007/2008

Information Systems Auditand Control Foundation

• The Information Systems Audit and Control Foundation (ISACF) recently developed the Control Objectives for Information and related Technology (COBIT).

• COBIT consolidates standards from 36 different sources into a single framework.

• The framework addresses the issue of control from three vantage points, or dimensions:


GASAL 2007/2008

Information Systems Auditand Control Foundation

1 Information: needs to conform to certain criteria that COBIT refers to as business requirements for information

2 IT resources: people, application systems, technology, facilities, and data

3 IT processes: planning and organization, acquisition and implementation, delivery and support, and monitoring


GASAL 2007/2008

The Control Environment

• The first component of COSO’s internal control model is the control environment.

• The control environment consists of many factors, including the following:1 Commitment to integrity and ethical values2 Management’s philosophy and operating style3 Organizational structure


GASAL 2007/2008

The Control Environment4 The audit committee of the board of directors5 Methods of assigning authority and responsibility6 Human resources policies and practices7 External influences


GASAL 2007/2008

Control Activities

• The second component of COSO’s internal control model is control activities.

• Generally, control procedures fall into one of five categories:1 Proper authorization of transactions and activities2 Segregation of duties


GASAL 2007/2008

Control Activities3 Design and use of adequate documents and

records4 Adequate safeguards of assets and records5 Independent checks on performance


GASAL 2007/2008

Proper Authorization of Transactions and Activities

• Authorization is the empowerment management gives employees to perform activities and make decisions.

• Digital signature or fingerprint is a means of signing a document with a piece of data that cannot be forged.

• Specific authorization is the granting of authorization by management for certain activities or transactions.


GASAL 2007/2008

Segregation of Duties

• Good internal control demands that no single employee be given too much responsibility.

• An employee should not be in a position to perpetrate and conceal fraud or unintentional errors.


GASAL 2007/2008


Recording FunctionsPreparing source documents

Maintaining journalsPreparing reconciliations

Preparing performance reports

Custodial FunctionsHandling cash

Handling assetsWriting checks

Receiving checks in mailAuthorization Functions

Authorization oftransactions


GASAL 2007/2008

Segregation of Duties• If two of these three functions are the responsibility of a single person,

problems can arise.• Segregation of duties prevents employees from falsifying records in order

to conceal theft of assets entrusted to them.• Prevent authorization of a fictitious or inaccurate transaction as a means

of concealing asset thefts.


GASAL 2007/2008


Segregation of duties prevents an employee from falsifying records to cover up an inaccurate or false transaction that was inappropriately authorized.


GASAL 2007/2008

Design and Use of Adequate Documents and Records

• The proper design and use of documents and records helps ensure the accurate and complete recording of all relevant transaction data.

• Documents that initiate a transaction should contain a space for authorization.


GASAL 2007/2008

Design and Use of Adequate Documents and Records

• The following procedures safeguard assets from theft, unauthorized use, and vandalism:– effectively supervising and segregating duties– maintaining accurate records of assets, including information– restricting physical access to cash and paper assets– having restricted storage areas


GASAL 2007/2008

Adequate Safeguards ofAssets and Records

• What can be used to safeguard assets?– cash registers– safes, lockboxes– safety deposit boxes– restricted and fireproof storage areas– controlling the environment– restricted access to computer rooms, computer

files, and information


GASAL 2007/2008

Independent Checkson Performance

Independent checks ensure that transactions are processed accurately are another important control element.


GASAL 2007/2008


• What are various types of independent checks? – reconciliation of two independently maintained sets of records– comparison of actual quantities with recorded amounts– double-entry accounting– batch totals


GASAL 2007/2008


• Five batch totals are used in computer systems:1 A financial total is the sum of a dollar field.2 A hash total is the sum of a field that would

usually not be added.


GASAL 2007/2008


3 A record count is the number of documents processed.

4 A line count is the number of lines of data entered.

5 A cross-footing balance test compares the grand total of all the rows with the grand total of all the columns to check that they are equal.


GASAL 2007/2008

Learning Objective 5

Evaluate a system of internal accounting control, identify its deficiencies, and prescribe modifications to remedy those deficiencies.


GASAL 2007/2008

Risk Assessment• The third component of COSO’s internal control model is risk assessment.• Companies must identify the threats they face:

– strategic — doing the wrong thing– financial — having financial resources lost, wasted, or stolen– information — faulty or irrelevant information, or unreliable systems


GASAL 2007/2008

Risk Assessment

• Companies that implement electronic data interchange (EDI) must identify the threats the system will face, such as:1 Choosing an inappropriate technology2 Unauthorized system access3 Tapping into data transmissions4 Loss of data integrity


GASAL 2007/2008

Risk Assessment

5 Incomplete transactions6 System failures7 Incompatible systems


GASAL 2007/2008

Risk Assessment

Some threats pose a greater risk because the probability of their occurrence is more likely. For example:

• A company is more likely to be the victim of a computer fraud rather than a terrorist attack.

• Risk and exposure must be considered together.


GASAL 2007/2008

Learning Objective 6

Conduct a cost-benefit analysis for particular threats, exposures, risks, and controls.


GASAL 2007/2008

Estimate Cost and Benefits

• No internal control system can provide foolproof protection against all internal control threats.

• The cost of a foolproof system would be prohibitively high.

• One way to calculate benefits involves calculating expected loss.


GASAL 2007/2008

Expected loss = risk × exposure

Estimate Cost and Benefits

• The benefit of a control procedure is the difference between the expected loss with the control procedure(s) and the expected loss without it.


GASAL 2007/2008

Information and Communication

• The fourth component of COSO’s internal control model is information and communication.


GASAL 2007/2008

Information and Communication• Accountants must understand the following:

1 How transactions are initiated2 How data are captured in machine-readable form or converted from

source documents3 How computer files are accessed and updated4 How data are processed to prepare information5 How information is reported6 How transactions are initiated


GASAL 2007/2008

Information and Communication• All of these items make it possible for the system to have an audit trail.• An audit trail exists when individual company transactions can be traced

through the system.


GASAL 2007/2008

Monitoring Performance

• The fifth component of COSO’s internal control model is monitoring.

• What are the key methods of monitoring performance?– effective supervision– responsibility accounting– internal auditing


GASAL 2007/2008

Case Conclusion

• What happened to Jason’s report?• A high-level internal audit team was

dispatched to Montana.• The team discovered that the problems

identified by Jason occurred almost exclusively in transactions with three large vendors from whom Springer’s had purchased several million dollars of inventory.


GASAL 2007/2008

Case Conclusion• One of the Springers held a significant ownership interest in each of these

three companies.• They also found evidence that several of Springer’s employees were paid

for more hours than documented by timekeeping, and that inventories were overstated.

• Northwest settled the case with the Springers.