Accounting Information System Midterm 1

What happens in the Request Change process?

An official form needs to be filled out, management needs to review and approve the request of change. They need to do an impact assessment on other processes and systems and then IT operations and a security assessment.

What are IT Dependent - Maunal controls also known as?

Hybrid control

What is structured data?

Information easily displayed in titled columns and rows which can easily by ordered and processed

What is an AIS usually called?

Information technology or IT based and is generally computer-based

What is it called to change the source code?

Inherent automation controls

What are several things an AIS can do?

It can capture data about an organization, stores and maintains the data, provides meaningful information for management, produces information that helps monitor and control business processes, ERP systems integrate all aspects of a firm's business processes in one AIS

What is the risk based audit approach?

It is when you identify threats and rely on controls to mitigate and then you do control analysis and testing.

If a goods receipt records incorrect total $ amount do, would would be the control that should be in effect?

It should be an automated prevent control; the system calculated total $ amount due - quantity received on goods receipt * actual unit purchase price from the PO and sum for each line item on the goods receipt

What does the transaction processing systems (TPS) provide valuable input to

Management information systems Decision support systems knowledge management systems

What does management override of controls?

Many controls that are programmed into the system can't be overwritten unless you change the source code, recompile it, and then reload it

What are transaction processing system examples

OLTP - online transaction processing and batch processing system

What is an example of an application control for a goods receipt?

Purchase order being delivered - system requires all goods receipts recorded must be matched against an open purchase order Items - quantity received must be equal to quantity ordered on the matched PO, Use purchase price from matched PO to determine total $ amount due

Where is TPS data often stored?

Relational Database - database software (database mgmt system, DBMS) ex: Oracle, SQL server, Access

What is the ITGC Change Management cycle?

Request change, development environment, testing, promote change, back-out procedures, ITD report reconciliations

What are all the cycles that feed into the general ledger and reporting system?

Revenue, expenditure, production, human resources/payroll, financing

What is the revenue business process?

Sale order (sale order #, date, total $, customer, sales rep...), delivery (delivery #, date, sale order being delivered, customer, etc.), bill, cash receipt (CR#, Date, $ amount received, Customer, cashier, etc.)

What do reliance of controls reduce?

Substantive testing

What is the auditing of internal controls?

- Auditor aims to gain an understanding of how the client uses internal controls - Focusing on these objectives helps auditor select controls for testing to gain greatest assurance that controls are operating effectively - Failure of an entity's controls to meet any of these objectives is a weakness in internal control

What happens in the Development environment cycle?

- Code checkout from production to development - Production access (read, write - change mgmt only, checkout - change mgmt staff only) - Change management Tool (write/checkout audit trail)

What happens in a promote change cycle

- Code promotion is moved from development/test to production - Production access (read, write - change mgmt staff only, Checkout - change mgmt staff only) - Change management tool (write/checkout audit trail)

What happens in the ITD report reconciliations cycle?

- Run/reconcile/document/sign-off - Write/checkout production environment audit log review (reconcile to change mgmt documentation)

What happens in the testing cycle?

- User acceptance testing - Do the controls work? - Do the reports work / do they function correctly?

How does the general ledger and reporting system work?

- gets data from all of the cycles - records the data as J.E. and posts to the general ledger accounts - Provides information for internal and external users

What type of control would be in place if goods were received that were not ordered?

1. Use of information fro prior activities - existing transaction records may help future transaction records 2. Receipt of goods must specify and un-fulfilled purchased order to match against 3. Quantity received (counted) and recorded should be equal to or < than the quantity ordered on the matching PO - system rejects the receipt of goods if the quantities do not fit

What are the 8 objectives of internal controls?

1. Valid - no fictitious or duplicated transactions 2. Complete - prevent or detect omission of transactions 3. Accurate (correct amounts assigned to transactions) 4. Restricted Access 5. Classified - transactions charged to correct account 6. Summarized - transactions summarized and totaled correctly 7. Posted - accumulated totals in transaction file are correctly transferred to the general and subsidiary ledgers 8. Timely - transactions recorded in correct accounting period

When auditing the financial statements what opinions can you give?

1. are the statements free of misstatements 2. After sarbannes-oxley (this is a new option), the opinion is on a company's internal control system and if they have reasonable controls in place

What do the absence of application controls lead to?

1. incomplete, inaccurate, and invalid transaction data which leads to.. 2. Incomplete, inaccurate, and invalid journal entries which leads to... 3. Financial statements filled with material mistatements

What are the four strengths of a database for the AIS?

1. you can create meaningful reports from data in a database 2. your data has a built-in structure to it 3. Information of a given type is always stored only once 4. Databases are concurrent; multiple users can use them at the same time without corrupting the data

Define what an AIS is

A system that is used to identify, analyze, measure, record, summarize, and communicate relevant economic information to interested parties. It is also a system for the collecting, storing and processing of financial and accounting data used by decision makers.

What is an example of an application control with a goods receipt?

AP - overstated if we accept more goods than were ordered, overstated if our purchase price is incorrect from the matched PO Inventory

What is a configurable control?

Allows someone to turn a control off for a little bit of time and then turn it on (on and off repeatedly). if it's configurable and turned off, it might not work.

When do financial statement audits happen?

At periods of time - need to make sure it worked the ENTIRE time

If an item is purchased from a vendor not approved to provide that specific item or a purchase price for an item on a purchase order is incorrect, what is a control that should be in effect?

Automated application controls - usually computer based; programmed into the system. Preprogrammed settings that are generally not over rideable or modifiable without a change to the system. The system should only allow the purchasing of an item to from specified vendors (vendor-parts list). Systems copies standard purchase price from Vendor-Parts List and uses the actual purchase price for the PO.

What does a batch processing system do?

Business transactions are accumulated over a period of time and prepared for processing as a single unit or batch Essential characteristic: the delay between an event and the processing of the related transaction to update the organization's records

What is an example of an application control from a cash disbursement?

Cash - understated if we pay more than we should AP

What is an example of an application control for cash disbursement?

Cash disbursement matched against a goods receipt Dollar Amount - system only allows the payment amount to be equal to the amount calculated for the goods receipt, quantity received * purchase price (from PO)

When there are proper application controls used, what type of data will be fed to the general ledger?

Complete, accurate, and valid

In order for auditors to rely on the controls, what needs to be don?

Controls analysis and testing - sufficient evidence related to operating effectiveness of controls

What for things can the AIS do?

Create (create and add), Retrieve (read), Update (modify), Delete (remove)

What does an OLTP do?

Data processing in which each transaction is processed immediately At any time, the data in an online system reflects the current status Many organizations find that OLTP enables them to provide faster, more efficient service

What is an example of an application control and a purchase order?

During a purchase order there are no journal entries and therefore no direct impact on the financial statements. BUT, if a purchase order is entered and has an incorrect unit purchase price - then that incorrect data will ultimately feed to other events that DO have a direct financial statement impact

What exactly are WCGWs?

Errors that could occur in processing the transactions or in the maintenance of master data that could have an impact on the financial statements. These are the points where application controls are needed to mitigate the threat

In the revenue business processes when are journal entries recorded?

Sale order - nothing Delivery - revenue, cogs, AR, inv't Cash receipt - cash and AR

What are an AIS's internal controls?

The policies, procedures, and computer-programmed logic placed within the AIS to ensure that complete, accurate, and valid business data is maintained within a company (including accounting data)

What happens when there are integrated financial statement audits?

Then the company will issue two statements, instead of doing two separate audit plans they will combine them into one audit plan and apply it to both of the audits

What do AIS transaction processing systems (TPSs) do?

They capture and process detailed data necessary to update the organization's records about fundamental business operations They include sale order entry, inventory control, payroll, accounts payable, accounts receivable, general ledger, etc.

What exactly to controls do?

They mitigate the threat by either preventing or detecting errors

What are WCGWs?

Threats - where errors could occur in processing the transactions or in the maintenance of master data that could have an impact on financial statements. These are the points where application controls are needed to mitigate the threat. Controls mitigate these threats by either preventing or detecting errors (and then correcting the error)

What are the two types of structured data?

Transaction data - generated and captured by operations (orders, cash receipts, deliveries) Master data - applied to multiple transactions, aggregate/categorize transaction data (customers, products)

What is an example of an application control for a purchase order?

Vendor - purchase orders can only be entered for approved and qualified vendors from the vendor master data Items - unit purchase price, price that we will pay vendor from a PO is pulled from the vendor-inventory master data and cannot be overridden

Explain the flow of transactions

You begin with financial statements and inherent and key business risks which lead to significant accounts, significant processes, management assertions, what can go wrongs, and then controls

Why are they called application controls?

each cycle there are different computer applications taking place

What would the absence of application controls lead to?

incorrect, inaccurate, and invalid transaction date which leads to incorrect, inaccurate, and invalid journal entries which lead to financial statements filled with material misstatements

What type of data can you receive from an AIS?

master data and transaction data

What are the two types of application controls?

prevent controls/automated and detect and correct/manual controls

What are the reports used for from an AIS?

the data and reports are used internally by management for making business decisions or externally by other interested parties including investors and creditors

Do all companies rely on application controls across all the cycles?

yes