3-1

Fundamentals I: Accounting Information Systems McGraw-Hill/Irwin Copyright © 2012 by The McGraw-Hill Companies, Inc. All rights reserved.

3-3 Information System Business and Internal Control Processes Business and Internal Control Processes The Internal Control Process Components of Internal Control Processes Transaction Processing Controls General Controls Application Controls Application of Internal Control Principles to the Basic Transaction Cycles Examples of Internal Control Problems Systems Development

3-4 Business Processes A process is a set of coordinated activities and tasks that accomplish some organizational goal. There is no one right way to divide a company’s AIS into component business processes. One traditional approach is to divide the major operational activities into four transaction cycles: revenue, expenditures, production, and finance. SAP divides the IS into modules: In this schema, the four transaction cycles are found in the four SAP modules, Financial Supply Chain Management, Procurement and Inbound/Outbound Logistics, Product Manufacturing and Deployment, and Sales and Service.

3-5 Transaction Cycles

3-6 Transaction Cycle View Versus SAP View of the IS

3-7 Internal Control Defined Internal control is a process effected by management, the board of directors, and other personnel that is designed to minimize risk exposures to an acceptable level given the company’s objectives. Risk exposures include events that can adversely affect the company, such as asset losses due to theft or spoilage, accounting errors and their consequences, revenue losses, expense overruns, business interruptions, fraud and embezzlement, fines and penalties, civil liabilities, and losses of competitive advantage. The general rule is that internal controls must provide a reasonable assurance (rather than a perfect assurance) that they will achieve their objectives. That is, they must reflect a balance between the benefits of reducing risk exposures versus the costs of implementing the controls.

3-8 Objectives and Components of Internal Control Specific objectives of internal control include the following: Ensuring the integrity and reliability of the financial reports. Ensuring compliance with applicable laws, regulations, professional rules, and contractual obligations. Promoting strategic, tactical, and operational efficiency and effectiveness. The components of effective internal control processes are the control environment, risk assessment, control activities, information and communication, and monitoring.

3-9 Transaction Processing Controls Transaction processing controls are those controls that are relevant to implementing good internal control processes within specific transaction cycles. General controls and application controls are the two types of transaction processing controls. General controls pertain to the overall environment and apply to all transactions. Application controls, on the other hand, apply to specific applications, processes, and transactions.

3-10 General Controls The general plan of organization for data processing should include segregation of duties so that data processing is segregated from other organizational functions. General operating procedures include good documentation, training, and systems for the prevention, detection, and correction of internal control violations. Hardware control policies and procedures limit exposures to hardware problems. For example, regular data backups can permit recovery if an online data storage unit fails. General access controls for data and hardware prevent unauthorized changes to critical data.

3-11 Application Controls Generally classified as input, processing, and output controls. These controls ensure the accuracy, integrity, and security of the processes of collecting input data, processing input data, and distributing processed data, respectively. Accuracy means that data are free from errors. Integrity means that the data remain intact in that nothing is added to or removed from the transaction data as they pass through the system. Security in this context means that only authorized persons are granted access to the system

3-12 Real-time Sales Order Process

3-13 Real-time Purchasing Process