L e a r n I n g o b j e c t I v e s

LEARNING OBJECTIVES After studying this chapter, you should be able to. Explain basic control concepts and explain why computer control and security are important. Compare and contrast the COBIT, COSO, and ERM control frameworks. Describe the major elements in the internal environment of a company. Describe the four types of control objectives that companies need to set. Describe the events that affect uncertainty and the techniques used to identify them. Explain how to assess and respond to risk using the Enterprise Risk
Management (ERM) model. Describe control activities commonly used in companies. Describe how to communicate information and monitor control processes in organizations.
Control and Accounting Information Systems
Jason Scott, an internal auditor for Northwest Industries, is auditing Springer’s Lumber & Supply, Northwest’s building materials outlet in Bozeman, Montana. His supervisor, Maria
Pilier, asked him to trace a sample of purchase transactions from purchase requisition to cash disbursement to verify that proper control procedures were followed. Jason is frustrated with this task, and for good reasons The purchasing system is poorly documented He keeps finding transactions that have not been processed as Ed Yates, the accounts payable manager, said they should be Purchase requisitions are missing for several items personally authorized by Bill
Springer, the purchasing vice president Some vendor invoices have been paid without supporting documents, such as purchase orders and receiving reports.
INTEGRATIVE CASE
SPRINGER’S LUMBER & SUPPLY
C HAP TE R
7

189
● Prices for some items seem unusually high, and there area few discrepancies in item prices between the vendor invoice and the corresponding purchase order.
Yates had a logical answer for every question Jason raised and advised Jason that the real world is not as tidy as the world portrayed in college textbooks. Maria also has some concerns
Springer’s is the largest supplier in the area and has a near monopoly Management authority is held by the company president, Joe Springer, and his two sons, Bill (the purchasing vice president) and Ted (the controller. Several relatives and friends are on the payroll. Together, the Springers own 10% of the company Lines of authority and responsibility within the company are loosely defined and confusing Maria believes that Ted Springer may have engaged in creative accounting to make
Springer’s one of Northwest’s best-performing retail outlets.
After talking to Maria, Jason ponders the following issues. Because Ed Yates had a logical explanation for every unusual transaction, should Jason describe these transactions in his report. Is a violation of control procedures acceptable if management has authorized it.
Maria’s concerns about Springer’s loosely defined lines of authority and possible use of creative accounting are matters of management policy. With respect to
Jason’s control procedures assignment, does he have a professional or an ethical responsibility to get involved?
Introduction
WHY THREATS TO ACCOUNTING INFORMATION SYSTEMS ARE INCREASING
In most years, more than 60% of organizations experience a major failure in controlling the security and integrity of their computer systems. Reasons for the failures include the following Information is available to an unprecedented number of workers. Chevron, for example, has over 35,000 PCs Information on distributed computer networks is hard to control. At Chevron, information is distributed among many systems and thousands of employees worldwide. Each system and each employee represent a potential control vulnerability point Customers and suppliers have access to each other’s systems and data. For example, Walmart allows vendors to access their databases. Imagine the confidentiality problems as these vendors form alliances with Walmart competitors.