The Open Collections website will be unavailable July 27 from 2100-2200 PST ahead of planned usability and performance enhancements on July 28. More information here.

UBC Theses and Dissertations

UBC Theses Logo

UBC Theses and Dissertations

Internal control of computer applications Schroeder, Harold John 1969

Your browser doesn't seem to have a PDF viewer, please download the PDF to view this item.

Notice for Google Chrome users:
If you are having trouble viewing or searching the PDF with Google Chrome, please download it here instead.

Item Metadata

Download

Media
831-UBC_1969_A4_5 S37.pdf [ 3.73MB ]
Metadata
JSON: 831-1.0102337.json
JSON-LD: 831-1.0102337-ld.json
RDF/XML (Pretty): 831-1.0102337-rdf.xml
RDF/JSON: 831-1.0102337-rdf.json
Turtle: 831-1.0102337-turtle.txt
N-Triples: 831-1.0102337-rdf-ntriples.txt
Original Record: 831-1.0102337-source.json
Full Text
831-1.0102337-fulltext.txt
Citation
831-1.0102337.ris

Full Text

INTERNAL CONTROL OF COMPUTER APPLICATIONS by HAROLD JOHN SCHROEDER B. Comm. University of Manitoba, 1965 A THESIS SUBMITTED IN PARTIAL FULFILMENT OF THE REQUIREMENTS FOR THE DEGREE OF Master of Business Administration i n the Department of Commerce and Business Administration We accept this thesis as conforming to the required standard THE UNIVERSITY OF BRITISH COLUMBIA August, 1969 In .presenting this thesis in partial fulfilment of the requirements for an advanced degree at the University of British Columbia, I agree that the Library shall make i t freely available for reference and study. I further agree that permission for extensive copying of this thesis for scholarly purposes may be granted by the Head of my Department or by his representative. It is understood that copying or publication of this thesis for financial gain shall not be allowed without my written permission. H. J. Schroeder ABSTRACT The use of computers i s becoming increasingly prevalent i n business. They are used, not only to store vast amounts of information, but also to carry out record keeping procedures for assets, equities and expenses that may each involve large d o l l a r amounts. There are a variety of factors which make the computer more complex than any of the preceding innovations i n the f i e l d of data pro-cessing. Perhaps the most important of these factors i s the non-readable form of records that could previously be read. In t h e i r new form they are readable only when a s p e c i f i c e f f o r t i s made to put them into readable form. Such complexities, i t i s suggested, mean that a new system of i n -ternal control must be prepared and maintained to ensure the protection of the records and hence the assets of the organization, especially the mone-tary assets. How can in t e r n a l control be maintained? This i s a very im-portant problem that needs to be solved by every firm contemplating the acquis i t i o n of a computer. Failure to solve this problem p r i o r to the time when a computerized system becomes operational, could have very serious repercussions. Retailers offering customer c r e d i t , for example, have accounts receivable that constitute a large percentage of t o t a l assets. The loss of a l l , or part, of the subsidiary ledger could pre-c i p i t a t e f i n a n c i a l ruin. The question of i n t e r n a l control must, therefore, be faced and procedures devised to achieve and maintain control. But how? Obviously the drastic changes i n a system employing a computer leave some of the old methods of control out of date and completely inadequate. Moreover, the complexity of the new system and i t s machinery creates new situations requiring controls heretofore never required or visual ized. It is the purpose of this thesis to identify and outline some of the internal control problems that arise with the introduction and operation of a computerized system. An attempt is made to provide so l -utions to these new problems as they are presented in this thesis. The problems and their solutions have been identif ied and organized using two main sources of information: a) the specialized l i terature in the f i e l d . b) case histories available to the writer, as an internal auditor s ignif icantly involved in the internal control of computerized systems. Brian E . Burke Supervisor TABLE OF CONTENTS Page PART I - INTRODUCTION 1 History 1 Computer Systems 2 New Control Problems 3 PART I I - CONTROL OF THE E.D.P. FUNCTION 9 Introduction 9 Organizational Control 9 Administrative Control 14 Systems Analysis & Programming 14 Computer Operations and Data Processing 16 Summary 20 PART I I I - THE CONVERSION PROCESS 22 Introduction 22 Gaining Confidence i n the System 24 A period of Adjustment for User Personnel 30 An I l l u s t r a t i o n 34 Summary 41 PART IV - CONTROL OF COMPUTER APPLICATIONS (COMPUTERIZED SYSTEMS) 43 Introduction 43 Input Controls 43 Processing Controls 46 " B u i l t - i n " Controls 46 Programmed Controls 48 An I l l u s t r a t i o n 53 Output Controls 57 The Internal Audit Department 58 Summary 62 PART y - CONCLUSION 64 PART y i - BIBLIOGRAPHY 67 - i i -LIST OF TABLES Page Table I - Summary of Control Problems posed by E.D.P. 7 Table I I - Simplified Accounts Receivable Computer System 54 - i i i -LIST OF FIGURES Page Figure I - Control of the Conversion Process 36 a. - i v -ACKNOWLEDGEMENT The writer wishes to acknowledge and express his appreciation for the suggestions and assistance received from Dr. B. E. Burke and Dr. B. Schwab, both of the Faculty of Commerce and Business Administration, The University of B r i t i s h Columbia. PAET I INTRODUCTION H i s t o r y I t i s w e l l over one hundred years s i n c e the c o n s t r u c t i o n of the f i r s t computer. In 1830 Charles Babbage constructed what he termed an " a n a l y t i c a l engine". This machine could s t o r e numbers, perform a s e r i e s of c a l c u l a t i o n s , p r i n t the r e s u l t s and repeat the process. The machine r e c e i v e d i n s t r u c t i o n s from punched cards and performed i t s c a l c u l a t i o n s without human i n t e r v e n t i o n , hence i t can t r u l y be c l a s s i f i e d as the f i r s t computer. However, i n s p i t e of the e f f o r t s of Babbage, and'sub-sequently those of h i s son, l a c k of funds and f a c i l i t i e s and other f a c t o r s prevented the success of the p r o j e c t . I t was some time before 1-a c t i v i t y i n t h i s f i e l d was r e v i v e d and working models became a v a i l a b l e . I t was not u n t i l 1946 th a t the f i r s t a l l - e l e c t r o n i c d i g i t a l com-2 puter was b u i l t at the U n i v e r s i t y of Pennsylvania and others q u i c k l y f o l l o w e d . The m a j o r i t y of t h i s e a r l y e l e c t r o n i c equipment was not designed f o r business but f o r d i s c i p l i n e s l i k e mathematics, p h y s i c s , astronomy, t h a t i s s c i e n t i f i c a p p l i c a t i o n s . Gradually the use of computers i n business increased u n t i l approximately s e v e n t y - f i v e or more percent of the computers i n use were used i n business f o r systems l i k e p a y r o l l , i n v e n t o r y , 3 accounts r e c e i v a b l e and v a r i o u s forms of i n f o r m a t i o n . In e a r l y 1957 1. C C . G o t l i e b and J.N.P. Hujn i e, High Speed Data P r o c e s s i n g , New York: McGraw H i l l Book Co. Inc., 1958, pp. 2-4. 2. Canadian I n s t i t u t e of Chartered Accountants, A P r a c t i c a l I n t r o d u c t i o n to Computer Systems, June, 1965, p. I - 3. 3. Gardner M. Jones, E l e c t r o n i c s i n Business, East Lansing: Michigan State U n i v e r s i t y , 1958, p. 14. k there were only seven computers i n Canada. In 19&3 there were nearly two hundred and by 19&7 "their number had increased to over twelve 5 hundred. Computer Systems . Today there i s available a considerable variety i n the makes, types and sizes of computers as we l l as the peripheral machinery. A l l computer systems can, however, be divided as follows: - Input/Output Devices - The Central Processing Unit - Storage - main and a u x i l i a r y Input/Output devices generally include three main types. F i r s t l y , there i s usually.a need for an apparatus which converts manually made data Into machine readable form. These have, i n the main, been machines which create punched cards or punched tape but more recently i t i s possible to convert d i r e c t l y onto magnetic tape. Secondly, the input/ output group includes a control console which acts as a means of communi-cation between the computer and i t s operator. Thirdly, there must be the necessary f a c i l i t i e s to put converted data into the system as w e l l as to remove data from the system. Machinery to read punched cards, magnetic ink coded forms, previously written tapes or drums i s necessary. S i m i l a r l y , there must be machinery to record data on cards, tape, disks, drums or printed reports. ^T. R. J . Anderson, "Training of Audit Personnel", Electronic Data Processing i n Canada, Canadian In s t i t u t e of Chartered Accountants, Toronto, 1963, p. 33 . 5. Special Committee to assess the Impact of Electronic Data Processing on the Profession. Canadian In s t i t u t e of Chartered Accountants, Canadian Chartered Accountant, Special Issue, August, 1967, p. 15. - 3 -The central processing unit i s the portion of the system which does the actual c a l c u l a t i o n , a l t e r i n g or transferring of data. The storage portion of the system, as the name implies, stores data within the system and i s accessible to the central processing unit. This stored data may.be located within the computer i t s e l f (main storage -generally the program being used and the data to be used i n the calcu-l a t i o n s presently) or on a u x i l i a r y storage i n the form of magnetic tape, 6 disks or drums. New Control Problems The decision to computerize a system naturally gives r i s e to new control problems. I t has been said that the strongest element of control i s a wel l conceived and r i g i d l y enforced system. A system using electronic data processing can follow only the instructions of the program. I f the l a t t e r Is wel l conceived, then i t can be argued that standardization and enforcement of the prescribed system Is at a maximum and control problems 7 should therefore be at a minimum. The prob a b i l i t y of error, especially i n the area of the computer's calculations, c e r t a i n l y i s less than that of a manual system. Nevertheless, while some problems are removed or al l e v i a t e d by mechanization, new control problems arise and the solutions to some of these require a new approach. 6^ Benjamin Conway, "Electronics i n Business", Systems and Procedures, Vic t o r Lazzaro, ed., Englewood C l i f f s , N.J., Prentice-Hall, Inc., 1 9 5 9 , pp. 338-42. 7 . Jennie M. Palen, ed. , Encyclopedia of Auditing Techniques, Volume 1 , Englewood C l i f f s , W.J., Prentice H a l l , pp. 8 1 - 8 2 . -h-To begin with, the process of converting from the manual to the computerized system gives r i s e to s i g n i f i c a n t problems. The system to be changed must be reviewed and properly documented so that programs can be written. Moreover, some serious communication and co-ordination problems.can arise from the fact that there are two d i s t i n c t groups involved namely E.D.P. personnel and the personnel of the department whose system i s to be mechanized. The former, while f a m i l i a r with computer technology, may not be f a m i l i a r with the procedures to be computerized. Conversely, the l a t t e r , while f a m i l i a r with the system, may not be wel l versed i n computers. Most important of a l l , the mechanized system must be such that records are complete and correct and information i s retrievable i f necessary. A second problem arises from the fact that technical and'cost factors generally make i t more p r a c t i c a l for E.D.P. to operate as a separate department servicing the" departments whose systems have been computerized. Under the manual system, the person i n charge of the department controlled the employees who did the work and was therefore also i n control of the work i t s e l f . Under the new system, the work i s done In another department (namely E.D.P.) and by a machine with which he i s probably not very f a m i l i a r . I f he i s to be held responsible for the work, then i t becomes necessary to i n s t i t u t e some arrangement whereby he can re t a i n control over the work. Thirdly, i n most systems i t i s necessary to convert data from o r i g i n a l to machine readable form. I t therefore becomes necessary to i n s t i t u t e controls to ensure the comprehensive and correct conversion of media. - 5 -F o u r t h l y , the department whose system i s t o be computerized i s now faced w i t h the f a c t that i t s records and the processing t r a i l of the t r a n s a c t i o n s w i l l g e n e r a l l y not be i n readable form. P r o v i s i o n s must t h e r e f o r e be made t o make p o s s i b l e conversion t o readable form of a l l v i t a l records and inf o r m a t i o n regarding t r a n s a c t i o n s and t h i s at a l l c r u c i a l p o i n t s i n the processing procedure. F i f t h l y , i n most instances i n the manual system the tasks i n v o l v e d were done by numerous people making increased c o n t r o l by segregation of d u t i e s , double checking, proper approval and s u p e r v i s i o n ; a r e l a t i v e l y simple matter. A manual p a y r o l l system, f o r example, may have tasks l i k e the timekeeping,, the p a y r o l l r e c o r d keeping, the p r e p a r a t i o n of cheques, s i g n i n g and co - s i g n i n g of the cheques,, accounting, and bank r e c o n c i l i a t i o n a l l done by d i f f e r e n t people. In the mechanized system, one machine does a l l the task s and i t i s under the c o n t r o l of two persons; the programmer and the operator. Good c o n t r o l must t h e r e f o r e i n c l u d e new steps t o 8 overcome t h i s new weakness. S i x t h l y , the complexity of the systems r e q u i r e s t h a t the o r i g i n a l programs and subsequent a l t e r a t i o n s be documented. Programming, t e s t i n g and documentation standards are t h e r e f o r e necessary f o r the w e l l c o n t r o l l e d a d m i n i s t r a t i o n of the E.D.P. department. Seventhly, since records are on tape or d i s k and not readable, a .machine breakdown would leave such i n f o r m a t i o n i n a c c e s s a b l e . P r o v i s i o n must t h e r e f o r e be made f o r such a contingency. In a d d i t i o n t o the c o n t r o l problems o u t l i n e d above, there i s , of course, the huge problem of cost c o n t r o l as regards machine a c q u i s i t i o n 8. " S e c u r i t y - Can i t Keep Up w i t h Crime?", S t o r e s , Jan., 1968, p. 10. and usage as w e l l as the mechanization of s p e c i f i c systems. This i s a vast subject i n i t s e l f and therefore beyond the scope of t h i s analysis. This analysis w i l l l i m i t i t s e l f to the i n t e r n a l control problems of the computer applications themselves (alternately c a l l e d computerized systems or mechanized systems) and the solutions to these problems. They w i l l be divided into two main categories namely: - those aspects of control which are not part of the system or application i t s e l f but are nevertheless necessary for the w e l l controlled functioning of the system, i . e . the organization and administration of the E.D.P. function. - those controls necessary within the system i t s e l f , i . e . control of conversion, input, processing and a l t e r a t i o n of data within the computer system and output. In addition to these two main categories, there w i l l be a b r i e f discussion of the Internal Audit Department as an element of i n t e r n a l control. An outline of the main control problems created by the introduction of Electronic Data Processing i s presented on page 7 . -7-Table I - Summary of Control Problems Posed by E.D.P. CONTROL PROBLEMS IN THE E.D.P. DEPARTMENT Organization - Location of E. D. P. department i n the ov e r a l l organization structure. Organization within the E.D.P. department. - Control of user department over E.D.P. department's services rendered. Administrative Programming Department - Ensure programs perform tasks they are intended to perform. - Ensure programming standards and ef f i c i e n c y . - Ensure adequate man-readable documentation of programs. Ensure adequate program t e s t i n g . - Ensure proper authorization and testing of program changes. Operating Department Ensure proper conversion of data to machine-readable form. - Entry of data into computer - operator fraud - operator error - Ensure adequate f i l e handling, retention and back-up. - Ensure adequate arrangements for machinery back-up i n case of breakdown. CONTROL PROBLEMS IN COMPUTERIZED SYSTEMS  Conversion to New System - Proper planning of the conversion process. - Education of user personnel. "One-time" conversion programs. - Ensure correct creation of new master f i l e s . - P a r a l l e l operation and error correction procedures. - Y e r i f i c a t i o n of new system output. - Employees' fears of computerization. - Temporary additional s t a f f requirements. Controls Within a Functioning New System  Input Proper preparation and authorization of source media. Physical movement from user department to E.D.P. department. - Entry into computer. -8-Processing - Ensure the computer programs have ample controls to f a c i l i t a t e proper manipulation of data. Output - Ensure output i s prepared and distributed. - Ensure output i s "verified to input. Periodic check to ensure a l l output i s required. INTERNAL AUDIT AS AN ELEMENT OF CONTROL - Alternate approaches to E.D.P. - Auditing "around the computer" - Auditing "through the computer" New audit techniques. -9-PAET I I CONTROL OF THE E.D.P. FUNCTION Introduction As mentioned i n Part I , in t e r n a l control of computerized systems can be separated into two categories: control of the E.D.P. function or department and controls placed within the system i t s e l f . While the l a t t e r i s self-explanatory, some c l a r i f i c a t i o n might be In order with regard to the former. In a manual system, the machinery used i s generally not complicated and r e l a t i v e l y e a s i l y operated by user personnel. In a computerized system, machinery i s complex, expensive and operates at high speeds. To attain maximum u t i l i z a t i o n i t i s necessary to have a fu l l - t i m e s t a f f who do nothing but operate t h i s machinery. Moreover, computers require a detailed set of instructions for every job that they do and, therefore, a programming s t a f f i s required. Computerization, therefore, gives r i s e to a group of personnel that was previously not required. I t follows that i f control of a computerized system i s to be complete, i t must include control of the personnel operating the machinery used i n that system. It i s the purpose of Part I I to examine the organizational and administrative control problems a r i s i n g i n t h i s area. Organizational Control The decision to computerize a system immediately poses a problem of organization. Programs need to be written and the computer needs to be operated and a decision needs to be made as to where such E.D.P. personnel should be organizationally located. There are two main p o s s i b i l i t i e s : i ) locate the programming and operating personnel within the department -10-whose system i s to be computerized. organize an independent E.D.P. department and have i t operate as a 9 "service centre" to the department(s) with mechanized systems. I t i s suggested here that the f i r s t of these alternatives i s neither economical nor advisable and so for three main reasons. F i r s t l y , i t i s very seldom that one single department i s large enough to warrant a programming s t a f f and have a system large enough to keep even a small computer i n operation most of the time. The resu l t i n g i d l e time i s necessarily a waste of funds. Secondly, i f other departments i n the firm u t i l i z e t h i s i d l e time then the f i r s t department l i t e r a l l y becomes, i n part,' a "service centre" i n which case a "service centre" independent of a l l user departments would have been more advisable i n the f i r s t place. Thirdly, the organizational separation of E.D.P. and the user group i s desirable from a control point of view. One of the basic pri n c i p l e s of control i s the segrega-t i o n of duties concerning the custody of an asset from the record-keeping duties for that asset. Since much of the work done by computers i s i n fact the maintenance of records for assets (e.g. Accounts Receivable or Inventory) the separation of the E.D.P. from the user departments (frequently referred to as a "service centre" or "closed shop" arrangement) i s the f i r s t of three main elements of organizational control. 9. Controllers I n s t i t u t e Research Foundation, Inc., Business Experience  with Electronic Computers, New York, 1 9 5 9 , p. 144. (Now the Financial Executive's Institute) -11-The inauguaration of the arrangement described above immediately poses a new problem. This problem i s twofold. On the one hand, i n some manual systems, .segregation of duties was possible within the user department. The personnel performing custodial duties and the personnel keeping records for the asset were both under the control of the department manager. In Accounts Receivable, for example, credit granting and c o l l e c t i o n procedures and the maintenance of subsidiary ledgers may both have been controlled by the Accounts Receivable manager. With the computerization of accounts receivable, the subsidiary ledger work i s done by the computer outside the Accounts Receivable department. He i s thus faced with the dilemma of having l o s t control over some of the Accounts Receivable work but nevertheless being held responsible for the good administration of the Accounts. On the other hand, i n some manual systems segregation was maintained by having duties performed i n separate departments. Computerization of the two tasks put both duties i n the E.D.P. department destroying the previous segregation of duties control. Mechanization of banking and cheque d i s -bursements serves as a good example. On a manual system, cheques may have been prepared and mailed by'the Treasury department with'the accounting and bank r e c o n c i l i a t i o n duties performed by the General Accounting department. When the system i s mechanized, both duties are performed by one department 10 namely the E.D.P. department The necessity of a second element of organizational control therefore becomes evident. The work done by the computer must be controlled by a 10. Walter F. Frese, "Organization E f f e c t s " , Electronics i n Management, Lowell H. Hattery & Georgy P. Bush, eds., Washington: University Press of Washington D. C , 1956, p. 158. -12-group independent of the E.D.P. department. This control group must ensure that information to be processed does not originate i n the E.D.P. department and that a l l information to be processed i s processed 11 correctly . This control should be achieved by having the control group v e r i f y proper, o r i g i n a t i o n , preparation and authorization of input informa-t i o n before i t i s processed by computer and subsequently v e r i f y i n g output to input. There are two points of view as to the exact organizational location of t h i s control group. I t i s argued by some that the control group should be part of the user department. In t h i s way user department management can reta i n more direct control over work on. assets for which they are held responsible. Others suggest that there should be one group cont r o l l i n g flow of data from a l l user departments and that t h i s group 11 a should be independent of both E.D.P. and user departments. I t i s suggested here that t h i s i s not a. question of major significance. A decision as to which arrangement should be i n s t i t u t e d would need to take into consideration a v a r i e t y of factors including the number of systems mechanized, the types of systems ,•the degree of integration, the degree of j o i n t r e s p o n s i b i l i t y between E.D.P. and user management, the ov e r a l l organizational structure, the calibr e of personnel and others. The important issue.here i s that the control group i s independent of the E.D.P. department ensuring the proper processing of authorized data. 11. Price Waterhouse & Co., The Auditor Encounters Electronic Data Processing, New York: I.B.M., Technical Publications Department, p. 3 . 11 a. International E.D.P. Research Subcommittee, Institute of Internal Auditors, Internal Auditing of Electronic Data Processing Systems, New York: 1967, p. I I - 4. -13-The t h i r d element of organizational control i s the matter of organization within the E.D.P. i t s e l f . Tasks.that were formerly done by many people are now done by one machine, reducing the degree of human involvement. "The reduction of human effo r t through a high degree of mechanization greatly increases the importance of the human elements 12 remaining." A portion of the "remaining human element" i s the control group discussed above. The other portion i s the E.D.P. personnel namely systems analysts and programmers and computer operators. The advent of changeable computer instructions has given r i s e to a unique control problem. The programmer, having written a program, i s , of course, completely f a m i l i a r with t h i s set of computer instructions. I f t h i s programmer i s allowed to operate the computer while t h i s program i s i n use, i t may be possible for him to a l t e r the instructions to his advantage using the console or operating switches as the means of al t e r i n g the program i n use. Both the organizational and physical separation of systems work and programming from computer operations therefore becomes an important part of the control of the E.D.P. function. In a m u l t i - d i v i s i o n a l corporation there i s an additional organiza-t i o n a l problem. Should there be one computer system which a l l d i v i s i o n a l managements are to use, or should each d i v i s i o n a l management be allowed to make decisions i n t h i s area and have t h e i r own computer system? Ob-viously, the main consideration here i s the size of the company and i t s . d i v i s i o n s . A very large company w i l l have d i f f i c u l t y obtaining a computer large enough to make a centralized i n s t a l l a t i o n possible. A small d i v i s i o n , 12. Leo C. Simmons, "Executive Problems and Opportunities A r i s i n g Out of Automatic Systems", Hattery & Bush, eds., op. c i t . , p. l6h. -14-on the other hand, w i l l have d i f f i c u l t y i n attaining f u l l u t i l i z a t i o n 12 a of even a small i n s t a l l a t i o n , making decentralization i n f e a s i b l e . There w i l l , of course, he numerous intermediate situations and decisions "based on in d i v i d u a l f e a s i b i l i t y studies w i l l need to be made. This, however, becomes an element of cost control, which as mentioned previously, i s beyond the scope of t h i s paper. Administrative Control I t was pointed out above that good organizational control requires the separation of programming and computer operating personnel. This analysis of administrative control w i l l therefore be s i m i l a r l y divided. Systems Analysis and Programming After a decision has been made to computerize a system, the f i r s t important i n t e r n a l control consideration i s to ensure that the computer programs w i l l i n fact perform i n accordance with the system prescribed. . I t i s therefore very important that the system i s closely examined, c l e a r l y defined, completely charted and documented before programming begins. System alterations become more expensive, more d i f f i c u l t and more dangerous -13. as programming progresses towards completion. Documentation should be i n the hands of, not only the programmers, but also the user department and should e x p l i c i t l y outline procedures and include samples of input and 14 output documents Secondly, i n the interests of programming e f f i c i e n c y , inter-pro-12 a. Perlman, J . A., "Centralization Versus Decentralization," Datamation, September, 1965. 13. H.N. Laden and T.R. Gildersleeve, Systems Design for Computer  Applications, New York: John Wiley & Sons, Inc., 1963, pp. 272-273. 14. David D. McCracken, Harold Weiss and Tsai-Hwa Lee, Programming Business  Computers, New York: John Wiley & Sons, Inc., 1959, p. 390. -15-grammer communication, programmer t r a i n i n g , program accessability and review, a set of programming standards and techniques should be prescribed. Docu-mentation of these standards should be i n the possession of and adhered to by a l l programmers. This documentation should specify requirements i n the areas of coding, compiling, t e s t i n g , flow charting, recording, symbols, 15 nomenclature, f i l e indices and other techniques Thirdly, there are several reasons why the programs themselves should be wel l documented. Documentation i s very valuable as a reference i n locating errors and implementing corrective and other alterations. I t serves as a means of inter-programmer communication and becomes especially important when there i s s t a f f turnover. In cases where the corporation concerned i s divided into geographical d i v i s i o n s , i t can become very valuable as a reference i n i n t e r - d i v i s i o n a l use of programs. I t has been said that 16 "a system i s next to worthless i f i t i s not adequately documented." Each program should therefore have a "run book" which should include the following: - Narrative description - Output samples - High. Level Flow Chart - Log of program modifications - D e t a i l Flow Chart - Testing procedure and data l i s t i n g - F i l e layout description - Operating instructions - Memory All o c a t i o n 17 - Documentation of a l l relevant procedures. 15. Controller's I n s t i t u t e , op. c i t . , p. I l 6 . 16. McCracken, et. a l . , op. c i t . , p. 387. 17. Ronald F. Denz, "Auditing the Data Processing Department". P.P.M.A.  Quarterly. A p r i l I967, p. 4 4 . - 1 6 -Fourthly, i t goes without saying that there must he some control to ensure that the computer system does i n fact do what i t i s intended to do. Such control i s achieved by an adequate degree of program testing and documentation of such testing for both the o r i g i n a l programs and a l l sub-sequent program alterations. Testing of the o r i g i n a l programs should generally take the form of a volume test and p a r a l l e l i n g of the manual and the computerized systems just p r i o r to the complte conversion to the mechanized system. This aspect of testing w i l l be treated i n greater d e t a i l i n the f i r s t portion of part I I I which w i l l analyse control con-siderations during the conversion of the system. After the o r i g i n a l programs have been written and "de-bugged" and the computerized system i s i n operation, the necessity for changes and the r e s u l t i n g program maintenance w i l l invariably arise for two main reasons. I t i s not uncommon to f i n d programming errors even after programs may have been i n use f o r months. These errors, of course, need to be corrected. Also, alterations i n company p o l i c y , reporting procedures, laws, union contracts and general improvements, w i l l necessitate corresponding a l t e r a -tions i n the programs. To ensure that the computer system continues to do what i t i s intended to do i t i s important that a l l program alterations are properly authorized and tested with adequate user department involvement and that these authorization and testing procedures are wel l documented 18 for future reference. Computer Operations and Data Processing Most of the data to be processed by a computer has been, and to a large extent s t i l l i s , documented i n a form not readable by computer. 1 8 . McCracken, et. a l . , op. c i t . , pp. 3 9 0 - 3 9 1 . - 1 7 -The f i r s t prime control feature i n trie processing of data therefore i s to ensure the accurate conversion of data to computer-readable form. Two aspects are involved: a l l data must be converted and t h i s data must be converted correctly. The controls necessary to ensure the conversion of a l l data are generally handled by a control group outside the data processing department and w i l l therefore be dealt with i n the second section of Part Ty^ on input controls. With some exceptions, the conversion of data to machine readable form to date.has generally involved the keypunching of information taken from the source document onto cards or tape. The important control using cards, i s to have a l l , or at least a l l s t r a t e g i c , information key-verified by a second operator. This acts as a check for inadvertent errors and also makes collusion necessary for fraud to be successful. In the case of punched tape the same control can be achieved by having the key-punch machine prin t a batch control t o t a l which should then be agreed to a predetermined t o t a l by a person other than the key-punch machine operator. More recently available machinery makes i t possible to key i n f o r -mation d i r e c t l y onto magnetic tape. Here also key v e r i f i c a t i o n i s possible and should be used as a data conversion control. In some other cases source documents may be written or printed i n machine-readable form. Bank cheques, for example, may have the name and account number pre-printed with magnetic ink leaving only the do l l a r amount to be converted to machine readable form. V e r i f i c a t i o n of t h i s conversion Is best achieved by agreeing the do l l a r amounts printed i n magnetic ink to the d o l l a r amounts hand written into the cheque by the payer. Data - 1 8 -to be processed may also be i n the form of a punched tape or a tape using magnetic ink produced by a cash r e g i s t e r . To v e r i f y t h i s data, register t o t a l s should be agreed to the t o t a l of sales invoices or simi l a r docu-ments. In the case where data i s i n the form of machine-readable, hand-written characters t h i s type of control should also be used, but there i s the additional problem of the education of personnel originating the documents so that they are i n fact machine-readable. While the methods of cont r o l l i n g the physical movement of data w i l l vary with the organization and the physical environment, some standard aspects of control i n t h i s f i e l d can be formulated. Especially i f key-punching (or other type of data conversion.) i s not done i n the user depart-ment, i t i s advisable to record receipt of data i n the keypunch department. This record should, of course, be updated when conversion i s completed and source documents returned to user department. A similar control of data returned to the user department for correction of coding errors i s also desirable. The converted data must, of course, be fed into the computer. While operating systems are fast becoming more sophisticated, there s t i l l exists the necessity f o r a computer operator. Since a l l data to be processed must be channelled into the computer, the operator w i l l have access to a great deal of information and proper control i n t h i s area i s therefore imperative. This control can be divided into two aspects namely the pre-vention of inadvertent error and the prevention of fraud by the operator. Prevention of fraud by the operator presents a unique dilemma. I f the operator i s reasonably w e l l versed i n programming, he w i l l be able to perform his duties and cope with, emergencies better. However, he w i l l -19-then also be able to better understand the program i n use by the computer and t h i s knowledge combined with the a v a i l a b i l i t y of data would make fraudulent manipulation much easier. Good control therefore requires that the operator should not be very f a m i l i a r with programming techniques but have adequate a n a l y t i c a l a b i l i t y , good education i n computer operations 19 and e x p l i c i t operating instructions for each program Wherever i t i s economically f e a s i b l e , the computer i n s t a l l a t i o n should be equipped with a console typewriter such that attempts at fraud w i l l be recorded on the print-out. The print-out should be i n pre-numbered form so that removal of portions thereof would be detected. Other checks against attempts at fraud include adequate supervision, rotation of s h i f t s , and the use of more than one operator wherever economically feasible. Since i t i s desirable that the operator i s not too f a m i l i a r with programming, operating instructions become an important factor i n the prevention of non-fraudulent errors. These should be e x p l i c i t and a v a i l -able f o r every program i n the system. The operator should also be ade-quately trained and educated so he i s thoroughly f a m i l i a r with the machinery and keeps informed of changes and developments i n computer and peripheral machinery. Computer usage for the various applications should, of course, be well scheduled to obtain maximum u t i l i z a t i o n and to ensure that user de-partments receive reports, and other output on time. An accurate record 19. E. Wainwright Martin J r . , Electronic Data Processing, Homewood, 111.: Richard D. Irwin, Inc., 1965, pp. 463-467. - 2 0 -of time spent on each application should be kept to f a c i l i t a t e proper al l o c a t i o n of costs and analysis of l o s t time. One of the important features of a l l mechanized systems i s the fact that a great deal of important information i s stored on magnetic tapes and disks. This information i s not readable by the human eye and i s highly vulnerable to destruction. Information on magnetic tape i s destroyed when new information i s written onto the tape and a control to prevent the use of the wrong tape i s therefore necessary. This control generally takes the form of a l i b r a r i a n . Access to the l i b r a r y should be li m i t e d to authorized persons. Tapes should be c l e a r l y l a b e l l e d and f i l e d and a record kept showing the physical location and content of each tape. These records should also show which, tapes are available for use at any one time and include a usage history so that old tapes are r e t i r e d when necessary. Control of tapes should also include adequate back-up retention of im-portant tapes, especially master f i l e s . For protection i n case of disaster l i k e f i r e , i t i s desirable for some of t h i s back-up to be kept off the 20 premises i n f i r e proof f a c i l i t i e s Summary A decision to use a computer gives r i s e to a new group of personnel who look, after the technical aspects of operating the machinery. This, i n turn, generates some new organizational and administrative problems. There are two main organizational control problems. F i r s t l y , the location of the E.D.P. function within the ove r a l l organization needs to 2 0 . W. T. Porter, J r . , "Auditing and the Computer", The Internal Auditor, F a l l , 1 9 6 7 , pp. 3 5 - 3 6 . - 2 1 -be determined. It was suggested that E.D.P. should operate as a separate department servicing user departments, and that the latter should have adequate control over work done for them by the E.D.P. department. Secondly, i t was pointed out that good control requires that the E.D.P. department i t s e l f be divided into two sections: computer operations and programming. Discussion of the administrative control of the department was simi-l a r l y divided. The systems analysis and programming section should have in effect the mechanics necessary to ensure that computer programs do what they are intended to do, that they are well documented, well tested and that only desirable alterations are made. With regard to computer opera-tions , controls should be installed to ensure correct conversion of data to machine-readable form, to detect operator fraud or error and to prevent loss of important information due to mishandling of storage devices or breakdown of machinery. Having examined the organization and administration of the E.D.P. department, attention w i l l now be directed to the process of converting a system from a manual basis to one using a computer installation. - 2 2 -PAET I I I THE CONVERSION PROCESS Introduction In Part I I we examined the control problems involved i n organizing and administering an E.D.P. department. It was pointed out that the department does not exist for i t s e l f but acts as a service department to user departments. In order for t h i s user department to actually become a user of the computer services, i t must, of course, discard the manual system and adopt a new system u t i l i z i n g the computer. This changeover or conversion brings with, i t a variety of problems, which can be said to revolve around two main issues: i . ) developing and testing the computer system to a point where i t i s considered trustworthy', i i . } employee education, r e - t r a i n i n g and morale. Part I I I w i l l examine these two issues and t h e i r peripheral problems. The conversion process might be defined as "the changeover from 21 tbe previous data processing methods to the computer systems." Ob-vio u s l y , such, a changeover must not be f i n a l i z e d and the previous methods discontinued u n t i l the parties concerned are confident that the computer system does i n fact produce a l l the required results correctly. While no responsible party w i l l argue with t h i s basic premise, there has been some disagreement as to how t h i s confidence i n the new system i s to be achieved. I t might seem l o g i c a l , indeed e s s e n t i a l , to some that the only way i n which the desired degree of confidence i n the new system can be attained i s to operate the new system concurrently with the old system for a period long enough to allow adequate v e r i f i c a t i o n of the computer 21. McCracken, et. al.-, op. c i t . , p. 3 8 6 . -23-system's results by comparison with those of the previous system. On the other hand, there are those who argue that: users of automatic equipment f i n d that output from a l o g i c a l l y correct and de-bugged program i s extremely accurate, so that l i t t l e or no p a r a l l e l operation i s needed to v e r i f y the accuracy of the new system results.22 The p a r a l l e l operation i s said merely to uncover the errors of the previous 23 system instead of those of the new one. There i s some merit i n the argument since programs are undoubtedly very accurate i f they are l o g i c a l l y correct and completely de-bugged. However, i t can be very d i f f i c u l t , and frequently i s , to determine d e f i n i t e l y whether or not the program i s en-t i r e l y correct.in i t s lo g i c and has been completely de-bugged. In the f i r s t place, i n a large and complicated system i t i s l i t e r a l l y impossible for a test deck to be r e a l l y comprehensive by virtue of the large number of p o s s i b i l i t i e s involved. Secondly, i n such complex systems i t i s un^ -l i k e l y that the test deck i s r e a l l y adequate unless'the programmer has "In-depth" experience i n the actual implementation of the p o l i c i e s , pro-cedures and intracacies of the system. Frequently t h i s w i l l not be the case. T h i r d l y , for testing to be adequate, a considerable amount of user department involvement w i l l be necessary, and t h i s involvement can be meaningful and genuine only i f user department personnel have a reasonable knowledge of computers and testing techniques. Moreover, an independent appraisal of testing procedures i s highly desirable especially i n cases where the system i s of a f i n a n c i a l nature or where i t involves complex record keeping and reporting of assets. While i n t e r n a l and external audit a c t i v i t y i n computerized systems has undoubtedly increased i n recent years, i t has generally taken the form of control evaluation and the use of audit 22. Eobert H. Gregory and Richard L. Van Horn, Automatic Data-Processing  Systems, San Francisco, Wadsworth Publishing Co., Inc., 196®, p. 571. 23. I b i d . , p. 427 . -24-programs after the implementation of the system. Current and recent news indicates that the number of cases where conversion d i f f i c u l t i e s have been encountered and reported has been r e l a t i v e l y s i g n i f i c a n t . I t would not be unreasonable to assume that the number of such cases that have gone unpublicized would be even greater. The re s u l t s of such conversion problems can be substantial f i n a n c i a l losses, strained employer-employee r e l a t i o n s , accounting problems and i n some cases deterioration of customer goodwill. Therefore, i t i s suggested here that to r e l y e n t i r e l y on simula-t i o n i n testing a system i s inadequate. The importance of a p a r a l l e l operation should not be minimized; the r i s k i s too great. The authors of Programming Business Computers go as f a r as to say that a decision against the use of a p a r a l l e l operation i s a "false economy", i n spite of the fact that an attitude minimizing i t s importance has been prevelant 24 for some time. Assuming, therefore, that a p a r a l l e l operation i s necessary,'it can be viewed as having a dual purpose: i . ) i t makes i t possible for us to gain confidence i n the new system, I i . ) i t gives user department personnel a period of adjustment, thereby 25 helping to prevent morale problems. Gaining Confidence i n the System The f i r s t step i n a successful conversion process i s to make early plans.for the orderly and scheduled execution of each of the steps i n the process. "One time" conversion programs w i l l need to be written, 24. McCracken, et. a l . , op. c i t . p. 380. 25. E. Waingrlght Martin J r . , Electronic Data.Processing An Introduction, Revised E d i t i o n , Homewood, 1 1 1.:Richard Irwin, Inc., 1 9 6 5 . , pp. 273-274. -25-imich key punch a c t i v i t y may be necessary to create new master f i l e s , user department personnel w i l l need to be educated i n the new c l e r i c a l routines, additional temporary personnel may be necessary and errors i n the old 26 system records w i l l be located and w i l l need correction. A great deal of time w i l l be necessary i n some of t h i s preparatory a c t i v i t y and unless t h i s i s planned w e l l i n advance, the re s u l t i n g confusion w i l l p recipitate serious and expensive d i f f i c u l t i e s or costly postponements. When the planning and necessary preparation has been completed, the equipment should be i n s t a l l e d . To have the equipment i n s t a l l e d e a r l i e r can be unnecessarily costly especially i f i t i s a f i r s t attempt 27 at computerization. To begin the actual conversion process, i t may be advisable to create a "skeleton" master f i l e . This w i l l reduce the work load consider-28 ably when the p a r a l l e l operation-is to begin. For example, i f the system being mechanized i s an inventory control system, permanent information l i k e stock number, name, minimum and maximum quantities, primary and alternate suppliers, order quantity, terms, year-to-date figures, warehouse location and perhaps cost and s e l l i n g prices might be placed on t h i s "skeleton" master f i l e . When the p a r a l l e l operation i s ready to proceed, a l l that w i l l be necessary to complte the master f i l e i s to insert variable informa-t i o n l i k e quantity and do l l a r value of goods on hand. Thus the work load at t h i s c r u c i a l time i s reduced considerably. At the time when the new master f i l e i s completed and before i t i s updated with any current transactions, an important aspect of i n t e r n a l control should be exercised. I t i s important that new master control t o t a l s 27. Oscar S. Nelson and Richard S. Woods, Accounting Systems and Data  Processing,•Cincinnati: South-Western Publishing Co., 1 9 6 l , ' p. 634. 28. ' McCracken:, et. a l . , op. c i t . , pp. 386-387. - 2 6 -are v e r i f i e d to the control t o t a l s of the old system before the new master i s updated with any current a c t i v i t y . In an accounts receivable system, for example, the sum of balances owing according to the new system should be checked to that of the old system. Errors i n the creation of the new master f i l e can, i n t h i s way, be i s o l a t e d , located and corrected much more e a s i l y than i f the new master f i l e were allowed to be "cluttered" with, a large volume of current transaction data. Once control t o t a l s have been agreed, corrections, i f any, have been made and control t o t a l s have subsequently been found to be i n agreement, t h i s v e r i f i c a t i o n serves as a valuable "check point" i n the proceedings. I t i s of value i n that i t provides assurance that the conversion procedure i s correct to that point and that i f errors are found l a t e r they must be i n areas of the procedure subsequent to t h i s point. Subsequent errors are therefore more e a s i l y located. I t i s also advisable at t h i s point to obtain a copy of the new system master i n printed form for two reasons. F i r s t l y , i t w i l l be nec-essary f o r the location of differences i f control t o t a l s do not agree. Secondly, i t .makes possible the v e r i f i c a t i o n of information other than quantities or do l l a r amounts used i n the control t o t a l s . This i s highly desirable, at least on a sample basis. I t should be stressed at t h i s point that i f the p a r a l l e l operation i s to be performed with l i v e data to be used concurrently by the old system, then the v e r i f i c a t i o n of the new master f i l e s must not be allowed to become too time consuming. I f i t becomes too time consuming, i t w i l l cause a delay i n the regular processing of current transactions and the resultant problems and costs. I t may therefore be necessary to have temporary addi--27-t i o n a l s t a f f available and/or to make trie necessary provisions for over-time work by user department personnel. When the new master f i l e i s complete and correct, the emphasis must, of course, s h i f t to the v e r i f i c a t i o n and control of input (current' transactions) to the two systems which begin actual p a r a l l e l operations at t h i s point. There i s a very r e a l danger that the emphasis p r i o r to and during the conversion w i l l have been placed too heavily on the creation of master f i l e s and programs at the expense of f a m i l i a r i z a t i o n with 29 peripheral c l e r i c a l routines. To ensure that a l l required input reaches the computer, i t i s essential that these routines are w e l l planned and that the personnel involved are w e l l informed i n t h i s regard. I t i s im-perative that a l l input to the old system i s also input to the new system. To ensure that this- i s the case, current transactions should be batched and these hatches l i s t e d as they enter into the system that f i r s t uses them. A copy of t h i s l i s t i n g should then be used as a "check l i s t " as the input enters the other system. I f inputs to the two systems are iden-t i c a l , then subsequent differences must be errors of commission and cannot be errors of omission. I s o l a t i o n , location and correction of errors w i l l therefore be less d i f f i c u l t . The conversion process i s now at a stage where the computer programs w i l l for the f i r s t time update master f i l e s and produce printed output. The key aspect of the entire p a r a l l e l operation i s to ensure that these programs process the data correctly and produce the required output. To v e r i f y the F i l e Maintenance (updating of master f i l e ) , the program should accumulate quantities arid/or d o l l a r amounts of items processed and p r i n t 2 9 . Controller's I n s t i t u t e Research Foundation, Conway et. a l . , op. c i t . , p. 1 3 3 . (Now the Financial Executive's I n s t i t u t e ) . - 2 8 -these r e s u l t s at the end of the run. The r e s u l t s should then he v e r i f i e d to input t o t a l s . The computer should also p r i n t the new control t o t a l s and these should be v e r i f i e d i n two ways. F i r s t l y , they should be v e r i -f i e d to the previous c o n t r o l t o t a l s adjusted by current input t o t a l s . In an accounts receivable system, f o r example, the old control t o t a l , plus current c r e d i t sales l e s s current c o l l e c t i o n s should equal the new control t o t a l . Secondly, the new system co n t r o l t o t a l s should be v e r i f i e d to those of the o l d system. Most systems w i l l have subsidiary programs and these should be v e r i f i e d i n a s i m i l a r manner. Each of the programs' outputs should also be checked, at l e a s t on a sample b a s i s , to those of the o l d system. During the process of v e r i f i c a t i o n , ' differences between the r e s u l t s of the two systems w i l l be located. One of the major problems of the conversion process i s the fac t that these differences are frequently due to, not the malfunctioning of the new system, but errors i n the o l d system. 30 The programs used i n the new system cannot detect these e r r o r s . There-fore i t i s possible f o r the new master f i l e to be a l t e r e d from correct to Incorrect figures unless the necessary precautions are taken to prevent t h i s . I t i s suggested that a l l differences should be l i s t e d and the master f i l e of the o l d system very c a r e f u l l y examined f o r errors before any corrections to the new master f i l e are made. Corrected input t o t a l s should, of course, be used to v e r i f y corrected output t o t a l s and con t r o l t o t a l s of the new system should be agreed to those of the o l d system a f t e r corrections have been made. 30. ' Nelson & Woods, op. c i t . , pp. 632-633 • - 2 9 -I t should be pointed out that where the system being converted i s a large and complicated one, i t may be advisable to perform the p a r a l l e l 31 operation on a c y c l i c a l basis. In the case of any inventory control system, for example, the procedure might-begin with the creation of a new master f i l e for one department (or one group of departments) only. After operating t h i s department(s) i n p a r a l l e l for a few days, the new master' for a second department (or group of departments) might be created. This process would be thus repeated u n t i l a l l departments are on p a r a l l e l operation. When the l a s t department i s thus placed on p a r a l l e l operation, the new system res u l t s of the f i r s t department may have been tested and v e r i f i e d enough to permit discontinuance of the old system for that department. Quite aside from avoiding the "shock" of starting and stopping the huge p a r a l l e l operation at one point i n time, there are some d i s t i n c t advantages of performing the p a r a l l e l operation i n t h i s way. F i r s t l y , i t allows much more time for the creation of the new master f i l e s than would be available i f they a l l had to be ready by the same deadline. Secondly, the amount of v e r i f i c a t i o n work"begins with a minimum and does not reach a maximum u n t i l a l l departments are on p a r a l l e l operation.- Moreover, t h i s maximum w i l l generally not have to be maintained for a long time because departments converted early i n the process may no longer require the p a r a l l e l operation of the old system. Thirdly, errors are more easily located and corrected because volume i s at a minimum i n the early stages of the process. 31. McCracken, et. a l . , op. c i t . , pp. 386-387• -30-A Period of Adjustment for User Personnel It i s common knowledge that the acquisition of a computer as well as the mechanization of any one system can give r i s e to serious problems i n the morale of the personnel involved. At f i r s t glance, t h i s might seem to be beyond the scope of an examination of inte r n a l control of computer applications. However, i f a conversion process were to be un-successful for any reason, there would be no computer application and hence no need for a discussion of in t e r n a l control i n such applications. An examination of the process of converting a manual system to a computer application must, therefore, consider the personnel problems involved because i t involves people. In other words, i f there i s no control over the people involved and the tasks they perform, there w i l l be no computer application. Some of the morale problems involved and methods which experience has proven h e l p f u l i n a l l e v i a t i n g these problems w i l l , there-fore, b r i e f l y be discussed here. The computer gives r i s e to personnel morale problems mainly because i t s appearance creates certain fears i n user, department personnel. People are a f r a i d that they may be displaced and hence unemployed once the system i s computerized. Even after having been assured that they w i l l not be unemployed, they may be af r a i d that, since, the jj.ob they are now.doing i s to be computerized, they may be l e f t with a menial and boring job. Some are afr a i d that they w i l l become subordinate to the machine - mere robots 32 forced to obey t h i s mechanical "master of men." In addition to these fears (which i n some instances may well be j u s t i f i e d ) the conversion process i t s e l f 32. C. L. L i t t l e f i e l d and R. L. Peterson, Modern Office Management, Englewood C l i f f s , Prentice H a l l , Inc., 1956, p. 229. - 3 1 -may "be very demoralizing i n that i t highlights the errors of both the old 3 3 and the new system. I f many problems are encountered and the errors i n the new system are numerous, personnel may get the feeling that nothing i s to be gained by the change. The support of personnel for the system may thus be lo s t precisely at the time when i t i s needed most. It i s suggested here that the most important factor i n overcoming, or preferably preventing, the demoralization caused by fear i s the educa-t i o n of the personnel involved. I f t h i s personnel i s knowledgeable about what a computer can do and how the new system w i l l work, u n j u s t i f i e d fears w i l l be removed. Moreover, keeping them informed, we l l i n advance, of what i s about to happen and what part they w i l l play i n the new procedures, w i l l give them a fe e l i n g of involvement. In cases where fears are j u s t i f i e d , that i s , where the old job as such w i l l no longer exist i n the new system, re-training the people i n -volved should be used wherever possible. This statement may sound l i k e a generalization or part of the platform of a vanguard of the working class. However, i n an accounting application i t i s more than that and therefore warrants closer examination. F i r s t l y , i t w i l l be necessary to ret a i n t h i s personnel as long as the old system i s being operated which w i l l include at least the major portion of the p a r a l l e l operation. Thus, at a c r u c i a l period when t h e i r co-operation i s needed most, t h e i r d i s -s a t i s f a c t i o n would be at i t s peak i f they knew they were to be displaced and unemployed i n a short time. Secondly, i f some people are displaced, i t w i l l be very d i f f i c u l t to convince the others that they never w i l l be. 3 3 . Martin, op. c i t . p. 2 7 5 . -32-Remaining personnel may feel that i t is just a matter of time u n t i l they are also displaced. And even i f this were not the case, there would he a tendency for them to he very unhappy about the.::, displacement of their fellow-employees. Thus morale would be low for practically a l l personnel involved precisely at a crucial time when co-operation i s needed most. Thirdly, there i s some question as to whether displacement necessarily always needs to generate unemployment. While personnel requirements may decrease in one area, they may increase in others. In some cases, ex-perience in the latter i s not essential and a brief period of on the job training may be adequate. In other cases, of course, re-training w i l l be necessary and this w i l l involve some additional expense. An early exam-ination as to which areas' requirements w i l l decrease or increase and care-f u l planning as to how these are to be handled w i l l pay significant d i v i -dends in the form of better employee .morale during and after the period of conversion. The parallel operation gives rise to another personnel problem in that i t usually must have both the old and new system operating con-currently. This, and the fact that huge new master f i l e s need to be created, temporarily increases the work load immensely and a considerable amount of temporary additional staff may be required. This problem i s further, amplified by the fact that many of the jobs in the old system may be non-existant when the parallel operation is• comp3e'tecL. Thus, at a time when i t may seem like a reduction in staff might be in order, a temporary increase in staff w i l l in fact be necessary. Moreover, since W. Ibid. , p.275. -33-the purpose of the p a r a l l e l operation i s to v e r i f y and.gain confidence i n the new system, i t will.he necessary to have personnel available to compare the results of the two systems and i n i t i a t e corrections where required. An attempt to remove displacement fears by re-training and educa-t i o n and also to meet the above-mentioned personnel requirements' generates another problem. I f personnel i n jobs i n the old system are to be r e t r a i n -ed to do jobs i n the new system, they w i l l not be available to operate the old system, neither during the re- t r a i n i n g period nor the p a r a l l e l opera-t i o n . Before re- t r a i n i n g of permanent s t a f f can begin i t w i l l therefore be necessary to t r a i n temporary s t a f f to perform the old jobs i n the old system. F a i l i n g t h i s , the old system may not be r e l i a b l e before and during the p a r a l l e l operation. Needless to say, i f these requirements are to be met, both the planning and the actual t r a i n i n g and r e - t r a i n i n g w i l l have to commence long before the p a r a l l e l operation i s to begin. I t should also be pointed out that the re- t r a i n i n g may result i n numerous inter-departmental transfers of personnel from the user depart-ment to the Data Processing department. Moreover, the defining of the systems, the wr i t i n g of the programs and the actual conversion process w i l l require exhaustive communications between the two departments. Such communications can become d i f f i c u l t at times because the two departments may not always have a clear understanding of the functions and d e t a i l s of each other. Therefore, i t i s suggested that when a decision to mechanize a system i s made, a co-ordinator to head the complete project should be appointed as soon as possible... This co-ordinator whould be knowledgeable - 3 4 -i n both computer technology and the function of the user department. I t would be the job of the co-ordinator to act as a l i a i s o n between the two departments and to plan and carry out the conversion procedure. An I l l u s t r a t i o n To i l l u s t r a t e more e x p l i c i t l y the conversion and p a r a l l e l opera-t i o n and the i n t e r n a l control involved, an example w i l l be described at t h i s point. The example used i s that of an Accounts Receivable system. It i s not suggested that the procedure described i s the only approach to the problem; different procedures may supply the required confidence i n the system equally w e l l . However, the v e r i f i c a t i o n of the new system's results to those of the old system must be included either i n the manner suggested or i n some.other similar manner. I t i s also suggested that for i n t e r n a l control to be adequate, the procedure should be subject to independent review preferably by an in t e r n a l audit department. Early audit involvement can be separated into two areas. F i r s t l y , there should be audit department p a r t i c i p a t i o n i n the i n i t i a l planning of the system i t s e l f and the computer programs to ensure that i n t e r n a l control within the system i s adequate. This aspect w i l l be further discussed i n a subsequent section on the i n t e r n a l audit department. Secondly, the i n t e r n a l audit department should become involved i n the conversion process to ensure that the v e r i f i c a t i o n of the new system i s i n fact carried out as planned. To achieve t h i s the i n t e r n a l audit department should make periodic investigations to ensure that the checks and v e r i f i c a t i o n s as outlined above and i n the following i l l u s t r a t i o n are i n fact carried out. -35-The f i r s t step, as previously suggested, i n the successful con-version procedure i s the appointment of a co-ordinator. He should then commence l i a i s o n , planning and supervisory duties as'shown below. These may not necessarily be performed i n the order l i s t e d and some aspects may be i n progress simultaneously. 1 . ) Ensure that the system and a l l procedures are adequately analysed and documented. 2. ) Ensure that the wri t i n g of the new system's computer programs commences and progresses on schedule. 3. ) Ensure that a l l peripheral c l e r i c a l routines are duly es-tablished and the pertinent personnel educated as necessary. 4. ) Ensure that the wri t i n g of "one time" programs commences and progresses as required. 5. ) Inform and educate a l l user department key personnel on de-velopment s. 6. ) Plan and schedule the conversion procedure and advise per-sonnel involved accordingly.-7. ) Ascertain what jobs w i l l be displaced and what permanent new jobs w i l l be created and plan transfers and re-t r a i n i n g accordingly. 8. ) Ascertain what temporary help may .be necessary, what t r a i n -ing they w i l l need- and where they w i l l be obtained. 9. ) Establish and document the comparison, v e r i f i c a t i o n and error correction procedures. 1 0 . ) . Make arrangements to get actual r e - t r a i n i n g underway. - 3 6 -11. ) When both the old. system with temporary help and the new system with re-trained permanent s t a f f are completely operational and a l l v e r i f i c a t i o n routines established and learned, decide precisely when p a r a l l e l operations are to begin and inform a l l personnel involved. 12. ) Carry out p a r a l l e l operations as shown on the chart (exhibit l ) . 13. ) When p a r a l l e l operation has proven the new system to be r e l i a b l e , make a decision as to when p a r a l l e l operations are to cease and the old system can be discarded. Comments on Chart (See Figure I , page 36 a) General i . ) The chart shows source media as being converted onto punched cards. This could, of course, take a different form l i k e punched tape or other machine readable forms. i i . ) The chart shows master f i l e s as being on tape. These Jiiight, of course, be on disk or durm. i i i . ) The chart i l l u s t r a t e s the v e r i f i c a t i o n of the two most im-portant outputs of the new system, but other parts of the system (e.g. credit reporting, w r i t e - o f f s , aging reports etc.) would need to be tested i n a sim i l a r manner. iv . ) The conversion procedure might be carried out i n a c y c l i c a l fashion. The Accounts Receivable might, for example, be divided into 10 parts to be converted i n one month or, say, 20 working days. The master for part one would then be completed on day one and part one updated with current transactions for two days before the p a r a l l e l operation i s begun with part two. On day three, the new system master for part two would Figure I - Control of the Conversion Process. I II CREATION OF SKELETON MASTER COMPLETION OF NEW MASTER -36 a-III PARALLEL OPERATION AND VERIFICATION OF NEW SYSTEM OUTPUT -36a-FINAL CORRECTION OF NEW MASTER Performed, by "one time" computer programs used only during the conversion process. • y e r i f y new control t o t a l s of old system. 1. I f c o n t r o l t o t a l s are not equal check new-system's i n d i v i d u a l " ^ amounts to old system's. Check new system non- ^ f i n a n c i a l information to old- system at l e a s t on a sample basis. Error corrections to become part of input for updated runs during p a r a l l e l operation. (E, Column III) y e r i f y new system control t o t a l s (Bl) to old system control t o t a l s ( c ) . V e r i f y transaction t o t a l s (B2) to input t o t a l s (A). Performed by the computer programs of the new system i . e . the programs whose r e l i a b i l i t y the p a r a l l e l operation i s t e s t i n g . V e r i f y new system con-t r o l t o t a l s to old system control t o t a l s . V e r i f y new system b i l l i n g t o t a l s to old system b i l l i n g t o t a l s . Compare new system and. old system customer statements at least on a sample basis. V e r i f y corrected new system control t o t a l s to o l d system control t o t a l s . Test check new master to old master. I f both agree, then a complete cycle of operation by the new system has been successful and p a r a l l e l operation may no longer be necessary. -37-then be created and for the next two days both of the f i r s t two parts would be on p a r a l l e l operation. S i m i l a r l y part three would go on p a r a l l e l on day f i v e , part four on day seven, part f i v e on day nine and so on. The portion of the Accounts Receivable on p a r a l l e l would thus increase gradually u n t i l a l l receivables would be on p a r a l l e l at the month end. At t h i s point, part one would have a f u l l month of p a r a l l e l operation.and, depend-ing on r e s u l t s , the old system might be discarded for part one. S i m i l a r l y part two would then have a f u l l month's p a r a l l e l operation two days l a t e r , part three another two days l a t e r and so on. These might then also be discarded on the old'system as they reach a f u l l month's p a r a l l e l operation. This c y c l i c a l operation reduces f u l l duplication to only two days and the volume of error corrections w i l l be small i f they are detected early. Column I Creating a skeleton master i n advance of the date when the complete master i s required w i l l decrease the key punching work load i n the rush when the complete master i s required. I t could include information l i k e name, address, account number, credit l i m i t , occupation, employer, previous payment history and other information of a general, h i s t o r i c a l " qr permanent nature. Column I I Just p r i o r to commencement of p a r a l l e l operation, but after the old system master has been brought completely up to date, a l l additional infor-' mation should be put on the skeleton master to create a complete new master. Before'the master f i l e s of either systems are updated with any current transactions, the new master should be v e r i f i e d to the old master as outlined -38-at the bottom of column I I . Column I I I The operation shown i n column three w i l l be performed.daily, i . e. both masters w i l l be updated with current transactions d a i l y . To ensure proper processing by the system and to ensure that a l l items to be processed have i n fact been processed, computer output for each run should be v e r i f i e d to input. This should be done by type of transaction, e.g. Assume transaction t o t a l s for the day are as follows: - Sales on account - $ 10,000 - Collections on account - 8,000 -• Negative adjustments - 1,000 - Positive adjustments - 2,000 These t o t a l s should be established and recorded p r i o r to entry into the computer system. The computer program should then accumulate dol l a r amounts of transactions by type (as categorized above) as each transaction i s pro-cessed. These accumulated figures should then be printed at the end of the computer run and manually v e r i f i e d to the pre-established input figures. To ensure that the computer program updates control t o t a l s correct-l y , the new system's updated control t o t a l s should also be v e r i f i e d to a pre-determined manually calculated figure. e.g. using the input figures mentioned above and assuming, that the t o t a l Accounts Receivable control figure was $ 100,000. pr i o r to the run, the new control t o t a l should be: 100,000 +10,000 - 8,000 - 1,000 + 2,000 = 103,000. The control t o t a l pro-duced by the computer should be v e r i f i e d to t h i s figure. -39-Column IV V e r i f i c a t i o n of the new system up to t h i s point has placed heavy emphasis on input and control t o t a l s with very l i t t l e v e r i f y i n g of i n d i v i d -ual amounts. This, of course, leaves open the p o s s i b i l i t y of an in d i v i d u a l amount being posted to the wrong customer's account i n error. V e r i f i c a -t i o n of new system customer statements to those of the old system i s there-fore necessary, at least on a sample basis. To ensure that a statement i s printed for each account, the new system b i l l i n g t o t a l s should be v e r i f i e d to those of the old system. Column V Since the process of comparing customer's statements may reveal errors, corrections may be necessary. This might be done by a "one time" program which corrects the new system master f i l e . A printed new system master w i l l be necessary to check that error corrections have been made. Another-verification of new system control t o t a l s w i l l ensure that they have also been corrected i f necessary or that they are s t i l l the same i f they did not require correction. An alternate to t h i s method might be to use the regular program ( i . e . master f i l e maintenance - column I I I ) to process these corrections i n the same manner that i t processes adjustments. A printed corrected new master would, -however, be necessary to ensure correction of errors. Discussion of the conversion process to t h i s point has been focused mainly on control of the p a r a l l e l operation of the two systems. There may, however, be procedures i n the new system which were not performed by the old system. A p a r a l l e l operation, as described above, w i l l , therefore, not test or v e r i f y such portions of the new system. - 4 0 -In a system of an accounting nature some of the basic elements of control w i l l , of course, be prevalent whether the system i s computerized or manual. An Accounts Receivable system, for example, should have a running control figure to which the subsidiary ledger must balance. Simi-l a r l y , an inventory control system should have a t o t a l inventory on hand figure which should equal the sum of the i n d i v i d u a l items on hand. The existence of these very important basic controls i n the new system can be v e r i f i e d - u s i n g the p a r a l l e l procedure described above. Nevertheless, new procedures adopted w i l l have to be v e r i f i e d i n some other way. The number of additional or new tasks and procedures to be i n t r o -duced at computerization i s very large and to develop a stereotyped v e r i -f i c a t i o n procedure would be d i f f i c u l t . I t i s suggested that i f the new procedure i s an important one, that i t should be done on a manual basis during the p a r a l l e l operation. This would, i n f a c t , create a p a r a l l e l operation for the newly adopted procedure, even though i t was not previously part of the old system. No doubt, i t could be argued that t h i s i s a costly suggestion. However, i t could be used for a short period of time or done on a s t a t i s t i c a l sample basis, with the length of time or the size of the sample dependent on the importance of the procedure. I t should also be pointed out that, while the conversion procedure described has emphasized a manual to computerized system, i t can, generally speaking, be applied i n a computer to computer conversion. The major difference that should be taken into consideration i s the fact that i t may not be necessary to key punch master f i l e information to create the new system master f i l e . Since the old master i s already i n machine readable -41-form (on tape or disk) i t may "be possible to use a "one-time" program to create the new master f i l e . The new master f i l e can then be checked using a combination of two techniques: i . ) v e r i f y f i n a n c i a l accuracy by checking new control t o t a l s to old control t o t a l s . i i . ) obtain a s t a t i s t i c a l sample of printed records from each master f i l e to compare non-financial data. Summary The conversion process i s the process of changing from the old system to a new system using a computer, A period of p a r a l l e l operation of the two systems i s important because i t generates confidence i n the new system and helps maintain morale of user department personnel. The most important aspect of the conversion process i s early planning so that the steps of wri t i n g conversion programs, creating and v e r i f y i n g new master f i l e s , commencement of p a r a l l e l operations, v e r i f i -cation of new system output, correction of errors and discontinuance of p a r a l l e l operations w i l l be performed on schedule. To prevent serious deterioration of user department personnel morale, they should be kept informed of developments and given opportunity to become as. knowledgeable of the new system as possible. In cases where jobs w i l l become ext i n c t , personnel should be re-trained for new jobs wherever possible; There should also be adequate provision for temporary additional s t a f f to meet the p a r a l l e l operation work load. Since planning i s such, a v i t a l part of the conversion process, a project co-ordinator should be appointed as early as possible. This co-- 4 2 -ordinator should act as a l i a i s o n between the E.D.P. and user departments and be responsible for the complete conversion process. When the new system has been adequately tested and v e r i f i e d , the old system w i l l be discontinued. At t h i s point, the new system can be said to become operational. This- new system w i l l , of course, have to have i t s own set of controls. While i t was necessary here to postpone exami-nation of these controls u n t i l after a discussion of the conversion process, i t should be stressed that t h i s should not be the case i n practice. They should be given due consideration during the planning of the system and be incorporated into the system when i t i s devised. Part IV w i l l examine the control requirements of a computerized system. -43-PART IV CONTROL OF COMPUTER APPLICATIONS (COMPUTERIZED SYSTEMS) Introduction Like any other system, a system using a computer must have a set of controls. While the purpose of these controls i s not necessarily altered, the techniques used to achieve adequate control " w i l l , of neces-s i t y , he different from those of a manual system. A computerized system can he conveniently divided into three areas: i . ) preparation, of input data and entry into the computer, i i . ) processing' of data by the computer, i i i . ) preparation and d i s t r i b u t i o n of output. In addition to examining the control problems i n these three areas, Part i y w i l l b r i e f l y - discuss the role of the i n t e r n a l audit department as an element of control. Input'Controls • In many computerized systems, the o r i g i n a l data to be processed' i s not i n machine -readable form and must be converted. Key punching of data into cards or paper tape (or, more recently, keying of data d i r e c t l y onto magnetic tape) w i l l , therefore, be an Important and expensive aspect of the o v e r a l l system. . This being the case, i t becomes important that source documents be i n such form as to maximize key punching e f f i c i e n c y and.minimize c l e r i c a l error. Positioning of data on the source docu-ment should be as close to that of the card as possible and data should 35 -be e a s i l y i d e n t i f i e d . Since human involvement i s considerably reduced 35. McCracken et. a l . , op. c i t . p. 380. -44-with computerization, i t i s suggested that some source documents should also be authorized by a person other than the person originating the source document. For example, adjustments to Accounts Receivable would be an easy means to fraud i f . such authorization were not required. In large systems, and especially where physical, inter-depart-mental movement of documents takes place, some controls and mechanics to enable tracing should be used. For example, source documents may have to be moved from the user department to the key punching area and punched cards from here to the computer room, with a l l three of these i n d i f f e r -ent physical locations. I f this i s the case, i t i s suggested that data should be logged and receipted as i t i s received and subsequently sent to the next department. While this might be considered a rather moot point i n some cases, i t becomes s i g n i f i c a n t i n others. Logging and receipting would, for example, be very valuable i f the credit sales input to an Accounts Receivable system were l o s t . With regard to ensuring correct conversion to machine-readable form, the use of the key v e r i f i e r i s common knowledge and general prac-t i c e . I t acts as a check for errors and makes collusion necessary for fraud to be successful. After conversion to machine-readable form, two further input controls are necessary. There must be checks to ensure that: i.) a l l items gain entry to the computer system. 36 i i . ) and that a l l items do so only once. 36. C. O r v i l l e E l l i o t t and Robert S. Wasley, Business Information Processing Systems, Homewood: Richard D. Irwin, Inc. 1965. p.268. -45-To achieve t h i s , a rather simple routine, using the following steps, might he used: i . ) batch source documents and manually obtain and attach batch t o t a l (dollar amount or a count). i i . ) manually calculate a t o t a l of batches t o t a l s . I i i . ) key punch data i n batches including a control card with the batch t o t a l . i v . ) P r i o r to the processing of any data, have a computer edit program: a. ) Add i n d i v i d u a l items i n each batch and check t h i s sum to the t o t a l on the control card. I f they do not agree, an item(s) i s either missing or duplicated and the batch, should be discarded. b. ) accumulate balanced batch t o t a l s and print the t o t a l ( i . e . the sum of the t o t a l s ) on the console typewriter. This t o t a l plus the t o t a l s of batches discarded should equal the manually calculated t o t a l of batch t o t a l s . I f i t does not, then a. batch i s either missing or duplicated. Batches accepted w i l l then become t o t a l input for that computer run. Dollar amount (or record count) of t o t a l input should be kept on hand for v e r i f i c a t i o n of future computer runs. I f , f o r example, the program i s updating inventory master records with current purchases ( i . e . additions to stock), the computer should accumulate the do l l a r amount each time a master record i s updated. This t o t a l should be printed at the end of the run and v e r i f i e d to the t o t a l input figure. Rejected batches w i l l , of course, need to be corrected and subse-quently processed. -46-Processing Controls Processing controls w i l l be defined here as those controls that are i n effect while the computer and i t s peripheral equipment are reading, w r i t i n g , t r a n s f e r r i n g , calculating and p r i n t i n g data. They can be divided into two categories: i . ) controls b u i l t into the machinery by the manufacturer, referred to as " b u i l t - i n " controls, machine controls or hardware controls, and i i . ) controls written into the program, referred to as programmed 36 a controls. For purposes of t h i s analysis, control of the programs themselves, that i s , t h e i r handling, testing and a l t e r i n g i s considered to be part of the administration of the E.D.P.- department and'was, therefore, examined i n Part I I . . There i s a considerable variety of processing controls that can be used. The manner i n which, and the places, where they are used, w i l l vary witb the type of system. This discussion of processing controls w i l l , therefore, be presented i n two parts. F i r s t l y , the various types of " b u i l t - i n " and programmed controls w i l l be outlined. Secondly, an example of where and how programmed controls might be used w i l l be presented. " B u i l t - i n " controls w i l l not be used i n t h i s example because they are generally part of the "one-time" decision of computer acquisition. In other words, they are not a variable that the programmer can work with as be is-preparing-his program. " B u i l t - i n " Controls •- ' Probably the most widely used " b u i l t - i n " control i s the p a r i t y 36 a. I b i d . pp. 270-271. check. I t i s a check that uses a redundant character to detect the loss of data on magnetic tape. For i l l u s t r a t i o n purposes, l e t us assume a computer system uses even pa r i t y . When information i s being written on the tape, each column i s checked to see whether the number of b i t s i s odd or even. I f i t i s odd, then an additional b i t , called a check b i t or parity b i t , i s added to that column. A l l columns w i l l , therefore, have an even number of b i t s . When the computer subsequently reads the data from the tape, i t w i l l check the number of b i t s i n each column. I f i t i s not even, then a b i t has been l o s t . A less widely used form of redundancy for checking magnetic tape i s the double track recording and reading of data on tape. Data i s written and read twice and the two compared to ensure they are equal. I f they are, 37 then the l i k e l i h o o d of information having been l o s t i s very small. Duplication can also be used i n the arithmetic unit c i r c u i t r y . Some Univac computers, for example, use such duplication to have a l l c a l -culations done i n duplicate and the results are compared. I f they disagree, an alarm goes o f f . There are also some computers using t r i p l i c a t e calcu-38 lations with an alarm going off i f a l l three disagree. Duplication i s also used as a check i n some card input/output devices. The check i s performed by using two reading stations and have data agreed before i t goes into computer storage. The reverse i s used for card output. 37. Benjamin Conway, "Electronics i n Business," Systems and Procedures, Victor Lazzaro, ed., Englwood C l i f f s : Prentice-Hall, Inc., 1959, pp. 356-357. 38. Gotlieb & Hume, op. c i t . , pp. 148-149. -48-With regard to printed output, a control ca l l e d an Echo check i s available. The mechanical operation of the printer causes an e l e c t r i c a l impulse which i s compared to the signal from the central processing unit. This i s to ensure that the printer i s , i n f a c t , p r i n t i n g the data as sent from the central processing unit. Proper preventive 'maintenance should, of course, be part of the buy or lease contract. This might include a "maintenance check" which 39 i s a test problem that activates and tests a l l portions of the c i r c u i t r y . This could take the form of "marginal checking" where various parts are tested under conditions more extreme than usual. I f any components are 40 close to f a i l u r e , they w i l l frequently f a i l during such a te s t . Tape rings are generally provided with reels of magnetic tape. These r i n g s , which are fastened to the r e e l s , act as a control i n that 41 they prevent the w r i t i n g of new information on the tape. Programmed Controls Perhaps the most important and most widely used programmed control i s the v a l i d i t y or redundancy check. This check can be used very effec-t i v e l y i n t e s t i n g the v a l i d i t y of items l i k e account numbers, order num-bers, employee numbers and inventory numbers. There i s a considerable v a r i e t y of ways i n which t h i s check can be performed and i t w i l l not be possible to make a detailed examination of the subject here. An example 39- Conway, op. c i t . , pp. 356-358. 40. Gatlieb and Hume, op. c i t . , pp. 147-148. 41. E l l i o t and Wasley, op. c i t . , pp. 271-272 - 4 9 -w i l l i l l u s t r a t e how the check might he used. Assume that, p r i o r to computerization, an account had the number 12345. Let us assume further that, when computerizing the system, we wish to i n s t i t u t e a check that w i l l ensure that input for t h i s account has the correct number and that posting w i l l be made to the correct account. To effect such a v a l i d i t y test a "check d i g i t " would be added to the account number. The value, or number, to be used i n t h i s check d i g i t p o s i t i o n might be determined as follows: Give the f i r s t . d i g i t i n the regular account number a weighting of 1. Give the second d i g i t a weighting of three, the third.a weighting of one, the fourth a weighting of three and the f i f t h a weighting of one. The account number and the d i g i t weightings would then be: account number - 12345 ( l ) weighting - 13131 (2) Multiply i n g each d i g i t i n ( l ) by the corresponding d i g i t i n ( 2 ) and adding, we get 1 x 1 = 1 2 x 3 = 6 3 x 1 = 3 4 x 3 =12 5 x 1 =_5 Total 27 -50-Discard the f i r s t d i g i t of the t o t a l (27), i n t h i s case two, and the re-maining number, i n t h i s case seven, should he the value of the check d i g i t . The new account number would thus he 123457. A part of a computer program would go through the log i c outlined above. I f i t arrived at an answer other than seven, i t would discard that 42 input item as i n v a l i d . I t should be noted that t h i s check w i l l detect, not only omissions of numbers and most insertions of incorrect numbers, but also transposi-t i o n s . The l a t t e r i s not detected i f d i g i t s are merely added and the l a s t 3^ d i g i t of the sum used as a check d i g i t . Another method that can be used i s the Hash Total, sometimes c a l l e d the "Nonsense Sum Method." In an inventory control system, for example, i t might be used to ensure that current transactions update the correct records on the master f i l e . The item numbers of transactions are added manually to obtain one "nonsense sum". As the computer updates the master f i l e , the program w i l l accumulate the item numbers and prin t a t o t a l when 44 i t i s finished. The two t o t a l s should, of course, agree. 42. Eichard G. Canning, Electronic Data Processing for Business and  Industry, New York: John Wiley and Sons, Inc., 1 9 5 6 , pp. 1 8 9 - 1 9 0 . 4 3 . For example, see J. Sanford Smith, The Management Approach to  Electronic D i g i t a l Computers, London: MacDonald and Evans Ltd., 1 9 5 7 , PP. 9 2 - 9 3 4 4 . Sanford L. Optner, Systems Analysis for Business Management, Englewood C l i f f s : Prentice-Hall,' Inc. I 9 6 0 , pp. 6 7 - 6 8 . -51-With regard to the checking of c a l c u l a t i o n s , s e v e r a l methods are a l s o a v a i l a b l e and the examples given here are not a comprehensive treatment of the s u b j e c t . Assume, f o r example, t h a t a program i s doing a s e r i e s of c a l -c u l a t i o n s i n v o l v i n g the m u l t i p l y i n g p r i c e times q u a n t i t y . As a check on the c a l c u l a t i o n s , each r e s u l t might be m u l t i p l i e d by an a r b i t r a r y number (the same one f o r each c a l c u l a t i o n ) and the r e s u l t i n g amounts accumulated. At the end of the run, t h i s accumulated t o t a l would then be compared to the t o t a l q u a n t i t y m u l t i p l i e d by t o t a l cost m u l t i p l i e d by the number p r e v i o u s l y chosen. I f the two are not equal, an e r r o r i n c a l c u l a t i o n has been made.^ Another method that might be used i s the Zero Balance check, the c a l c u l a t i o n c a l l s f o r X to be m u l t i p l i e d by Y, as a check, a l s o mul t i p l y Y times X and s u b t r a c t the r e s u l t from the f i r s t answer. I f the answer i s not zero, an e r r o r has been made.^ A t h i r d check that should be mentioned i s the " c a s t i n g out of n i n e s . " Assume we want the computer to add 67 and 28 and check the r e -s u l t . The answer, of course, should be 95. To v e r i f y the c a l c u l a t i o n , d i v i d e 67 by nine and r e t a i n the remainder of f o u r . D i v i d e 28 by nine and r e t a i n the remainder of one. Add the four and the one to o b t a i n 5; r e t a i n the f i v e . Now d i v i d e the c a l c u l a t e d answer ( i n t h i s case 95) by 45. Conway, op. c i t . , pp. 358-360. 46. Optner, op. c i t . , pp. 67-68. - 5 2 -nine and ret a i n the answer (in t h i s case f i v e ) . Since i t agrees with the other f i v e , the o r i g i n a l calculation of 67 plus 28 must he correct. 1*7. I f they were not equal, an error should be reported. Cross footing balance checks can be very effective i n some cases. In a p a y r o l l system, for example, t o t a l net wages plus t o t a l deductions should equal t o t a l gross wages. Another check that i s very applicable i n a p a y r o l l system i s the l i m i t check sometimes c a l l e d the "reasonable-ness check." This check provides for the p r i n t i n g of a message i f net pay exceeds a specified amount. To ensure that a l l input items are pro-cessed and that there has been no duplicate processing, record counts or accumulations of dol l a r amounts can be used to check to manually c a l -culated record counts or d o l l a r t o t a l s . Where the volume of data i s large, i t i s advisable to use check points. At such points a l l output w i l l be written on tape or disk. I f there i s an error subsequent to the check point, the volume of input pro-cessed p r i o r to the check point w i l l not need to be processed again. Tapes should have i d e n t i f y i n g l a b e l s . On master f i l e tapes, information on t h i s l a b e l should include the date before which the tape must not be written. This w i l l ensure master f i l e back-up for the correct number of generations. With master f i l e s on tape, a sequence check should also be used to ensure transactions and master records are i n ascending or de-48 scending order as required. 47. Gotlleb and Hume, op. c i t . , pp. 148-150 48. Conway, op. c i t . , pp. 358-360. -53-An I l l u s t r a t i o n To i l l u s t r a t e where and how some of the programmed controls might be used, a s i m p l i f i e d accounts receivable computer system w i l l be pre-sented. The chart on page 54 shows the series of programs used i n the system and b r i e f descriptions of the function of each program. The system presented i s not meant to be r e a l i s t i c , but has been s i m p l i f i e d for the sake of c l a r i t y . Following i s a resume of the programmed con-t r o l s that might be used i n each of the programs. Program 1 - EDIT: This program w i l l have three main controls, i . ) A redundancy check w i l l check the v a l i d i t y of the account numbers on a l l input. i i . ) Other important f i e l d s i n the input w i l l be checked for correct length, whether alphabetic or numeric and, i n some cases, whether the value i s within a predetermined l i m i t (e.g. transaction code between one and four). i i i . ) The program i t s e l f i s an input control i n that i t : a. ) adds a l l batch items and checks sum to batch t o t a l . This ensures no omission or duplication of items. b. ) prints t o t a l of batches accepted (in balance as i n a.) and t o t a l of batches rejected (not i n balance) - the t o t a l of these two i s then checked to the t o t a l of batch t o t a l s (calculated .manually) to ensure that no batches are omitted or duplicated. SIMPLIFIED ACCOUNTS,. RECEIVABLE COMPUTER SYSTEM •TABLE II Program 1 Edit Program 2 Sort 1 Program 3 F i l e Maintenance i Program 4 Statement Print I Program 5 Collection Letters & Reports Program 6 Accounting -Edits a l l input and checks for account number v a l i d i t y . -Checks a l l input batches for balance. I f i n balance ( i . e . con-t r o l t o t a l = sum of amounts):,-accepts. I f not,. rejects. -Prints t o t a l of batches accepted & of batches re-jected. Operator checks t h i s to manually calculat-ed t o t a l of input " batch t o t a l s . - Sorts input (batches accepted during edit run) into account aumber sequence. - Updates Account Receivable master f i l e with trans-actions edited and sorted by programs 1 and 2 respectively. s - At month end, prints a state-ment of account for each customer. - Prints the various types of co l l e c t i o n letters for accounts 15, 30, 45, 6 0 , 75, 90 etc. days over-due . - Prints l e t t e r s . for accounts to be passed on to a Collection Agency. - Prints working papers necessary for follow-up of overdue accounts. - Prints Accounts Receivable. Aging Analysis. - Calculates and prints bad debt write-off figure for the month. - Adds up a l l account balances and prints t o t a l for balancing to General Ledger Control Account. -55-Program 2 - SORT: The important control necessary here i s to ensure that no items are l o s t during the sort. This can be achieved by having the program do either a record count or a t o t a l l i n g of dol l a r amounts after sorting i s completed. This would then be printed and checked to the doll a r value of batches accepted i n run one (or, i f a record count i s used, check t h i s to a manually predetermined count). Program 3 - MASTER FILE MAINTENANCE: Since t h i s i s the program that updates the master f i l e ( i . e . the accounts receivable subsidiary ledger), i t i s important that i t i s w e l l controlled. This should include the following: i . ) To ensure the posting of the correct amount, the program should accumulate amounts as they are posted and print the t o t a l at the end of the run. This t o t a l should be equal to the t o t a l of batches accepted i n program 1. i i . ) To ensure posting to the correct account, two checks should be considered: a. ) A sequence check should d e f i n i t e l y be used at points where transactions and the master f i l e records are read for pro-cessing. b. ) A hash t o t a l , or "nonsense sum" might be used. In t h i s case the program would accumulate a t o t a l of the account numbers of a l l input and also accumulate the account numbers.of a l l jnaster records being updated. The two should, of course, be equal i f no incorrect postings were made. -56-i i i . ) There should be a check on the arithmetic ( i . e . the addition to or the subtraction from the old balance of the current transaction amount) to ensure that the new balance owing.as shown on the master record i s correct. This could take the form of one of the programmed controls described above, or i t might be considered unnecessary i f the manufac-turer provided the " b u i l t - i n " control of duplicate calculation. iv.) I t would be advisable to subject both the amount of the trans-action and the balance owing on the master record to a l i m i t check or "reasonableness" check. That i s , i f they exceed specified amounts, de-t a i l s w i l l be printed and can subsequently be examined as to whether corrective action i s necessary. v.) Master f i l e tapes should have labels to ensure proper i d e n t i -f i c a t i o n . These labels should indicate the date p r i o r to which no writing on the tape i s permitted. This w i l l ensure proper master f i l e retention and back-up. vi . ) I f input volume i s considerable, a series of check points would help avoid r e p e t i t i o n of a l l the processing p r i o r to an error when one occurs. Program 4 - STATEMENT PRINT: The important control consideration i n this program i s to ensure that a l l accounts receivable have a statement printed. The computer pro-gram should accumulate balances uncollected, as these are printed, and the t o t a l should equal the accounts receivable control figure. Program 5 - COLLECTION LETTERS & REPORTS: In t h i s program the s i g n i f i c a n t aspect of control i s to ensure correct calculation of the number of days that amounts are overdue. -57-This could be accomplished by the use of a programmed calculation check and/or a " b u i l t - i n " duplicate calculation f a c i l i t y . Program 6 - ACCOUNTING: Checking of calculations i s also the most important aspect of control i n this program. The calculations involved are that of deter-mining the size of the bad debt write-off and of obtaining a t o t a l of the accounts receivable subsidiary ledger for r e c o n c i l i a t i o n with the con-t r o l account. As i n program 5, either a programmed check or " b u i l t - i n " duplicate c i r c u i t r y , or both, might be used. Output Controls As mentioned i n the section on the administration of the computer operating department, the careful handling of tapes and disks i s an important part of control. I t was also mentioned that master f i l e tapes should have a la b e l using a programmed check to prevent writing on them prior to a specified day. This ensures retention of master f i l e i n f o r -mation as back-up for an adequate period of time. I t i s suggested that off-premises, fireproof storage of back-up master f i l e s be used as a further precaution. For example, the most recent master might be stored i n a vault on the premises with several generations of back-up master f i l e s kept i n one or more bank vaults.49 With regard to printed output to be sent to a user department (or a special control group) three elements are of importance. F i r s t of a l l , i t i s suggested that an employer, other than the computer operator 49. E l l i o t t and Wasley, op. c i t . , p. 277. - 5 8 -check that a l l required output has been produced and i s sent to the correct personnel i n the user department. Logging and receipting of output may be advisable i n some cases. Secondly, there should be some v e r i f i c a t i o n of the output by 50 the user department. In the accounts receivable i l l u s t r a t i o n used above, the user department should re-check the following: i . ) that, after the edit program, the sum of batches accepted and rejected i s equal to the pre-determined input t o t a l . i i . ) that the t o t a l ' of transactions processed by the f i l e main-tenance run i s equal to the t o t a l batches accepted by the edit run. i i i . ) that, after the f i l e maintenance run, the old accounts re-ceivable t o t a l , adjusted by the t o t a l d o l l a r value of t h i s run's trans-actions, i s equal to the new accounts receivable t o t a l . Iv.) that the sum of balances due on statements i s equal to the t o t a l accounts receivable as at month end. Thirdly, i t i s suggested here that the user department period-i c a l l y review the necessity of a l l output and discontinue reports or other output that are no longer used due to changes i n conditions. The Internal Audit Department The i n t e r n a l audit department i s , of course, not an element of control within a computerized system i t s e l f . I t i s , however, one of the main functions of the department to see that i n t e r n a l control i s adequate 51 i n a l l areas. Computer applications should not be exceptions to t h i s 5 0 . I b i d . , pp. 2 7 6 - 2 7 7 . 5 1 . R. T. Culey and Royal D. W. Bauer, Auditing, Cincinnati, South-western Publishing Co., 1 9 5 3 , p. 5 3 1 . -59-r u l e . For this r e a l l y to be the case, therefore, the in t e r n a l audit de-partment w i l l need to be knowledgeable of electronic data processing i f proper assessment of in t e r n a l control i s to be made. With the a r r i v a l of computerization, the i n t e r n a l audit department w i l l , therefore, need to adopt some new techniques and i n i t i a t e some changes. I t should be stressed, however, that while auditing methods w i l l change, the objec-tives of the audit procedures w i l l remain unchanged. There are, on the other hand, those who argue that the appear-ance of a computer should have a ne g l i g i b l e effect on auditing techniques. What i s important, i s that the end resul t i s adequately checked and, i f i t i s correct, then the means by which i t i s determined, within reasonable cost-benefit l i m i t s , are ir r e l e v a n t . I t has been pointed out, however, that the most important factor i n determining the size of the sample of the end res u l t to be checked, i s the r e l i a b i l i t y of the means by which the end i s 53 obtained. Moreover, when the auditor i s faced with r e a l time processing, he may have neither an output (end result) to v e r i f y to input nor the audit t r a i l that was available i n the batch processing situation.^4 This being the case, the auditor w i l l have to examine the "means" because the "end" i s not readily available for inspection. This leads us to two important changes that computerization forces on the inte r n a l auditor. F i r s t l y , he must become knowledgeable of elec-tronic data processing because he w i l l have to examine the means by 52. Jennie M. Palen, ed., Encyclopedia of Auditing Techniques, Volume 1, Englewood C l i f f s : Prentice-Hall, Inc., p. 80. 53. McCracken, et. a l . , op. c i t . , pp. 417-418. 54. Franz E. Ross, "Internal Control and Audit of Real-Time D i g i t a l Systems," Journal of Accounting, A p r i l , 1965. p. 46. \ - 6 0 -which data i s processed. Secondly, he w i l l need to become involved i n the early planning of systems and the wri t i n g of programs so he w i l l know whether i n t e r n a l control i s adequate when the system becomes opera-t i o n a l . Having taken thse f i r s t two steps, the in t e r n a l auditor w i l l need to make a t h i r d change and that i s the planning and implementing of a s p e c i f i c audit procedure for the computerized system when i t i s opera-t i o n a l . There i s a wide variety of sp e c i f i c techniques that can be used and a detailed examination of t h i s area i s beyond the scope of t h i s paper. A b r i e f analysis of general methodology should, however, be made. In keeping with the two c o n f l i c t i n g points of view presented above, there are two basic approaches to the problem. i . ) Auditing "around the computer" i s based on the premise that, i f an adequate sample of output i s v e r i f i e d to input, then control can be assumed to be adequate without an examination and testing of the pro-grams . i i . ) Auditing "through the computer" r e l i e s on the testing of pro-grams by having them process a variety of test transactions with the auditor checking these results to his own manually calculated r e s u l t s . I f a l l major combinations of possible 'types of transactions are tested and found correct, then i t can be safely assumed that the programs w i l l pro-cess a l l input correctly because they process i d e n t i c a l items i n an iden-55 t i c a l manner. In some cases, examination of programs i s advocated. 55. W. Thomas Porter, "Evaluating Internal Controls i n E.D.P. Systems," Journal of Accounting, August, 1964, pp. .34-40. -61-It is suggested that a combination of the two methods be adopted, keeping in mind the unique features of the system being audited. A fourth important consideration that should be mentioned is the fact a progressive internal auditor w i l l learn, not only how to audit a computerized system, but also how to use the computer for auditing pur-poses. In a very big business, the manual auditing of an adequate sample of mill ions of records is a very tedious and boring task. If he can get this auditing done by the computer, then the machine that might formerly have been considered an obstacle and d i f f i cu l ty , w i l l become an aid to-wards better and faster auditing.-'^ For example, a program might be written to decide, by s t a t i s t i c a l methods, which records are to be examined and subsequently examine these records. It should be mentioned again that, while audit techniques w i l l change, computerization does not change the objectives of internal audit ac t iv i ty . The major objective of this act iv i ty is the maintenance of adequate internal control. It should also be pointed out that, i f the changes in audit techniques are not made, then the objective of maintaining adequate i n -ternal control w i l l not be achieved. A progressive internal audit de-partment that is knowledgeable of electronic data processing and wi l l ing 56. James A. Cashin and Garland C. Owens, Auditing, New York: The Ronald Press Co. , 1963, p. 594. 57. Herbert Arkin, "Computers and the Audit Test," Journal of Accounting, October, 1965, pp. 45-48 - 6 2 -to make changes as necessary i s , therefore, an important element of the int e r n a l control of a computer application. Summary A computer application or computerized system can be divided into three phases: i . ) preparation of input and entry into computer, i i . ) processing of data by the computer, i i i . ) preparation and d i s t r i b u t i o n of output. The preparation and entry of input involves four main control problems. F i r s t l y , to minimize errors and maximize e f f i c i e n c y , source documents should be wel l formulated and clear. Secondly, where physical movement takes place, some tracing mechanics are necessary. Thirdly, • key v e r i f i c a t i o n should be used to ensure correct conversion to machine readable form. L a s t l y , an edit run can be used to ensure that a l l input gains entry into the machine and that no items are duplicated. The controls i n effect while the computer i s processing data can be divided into two types: those controls that are part of the ma-chinery as supplied by the manufacturer and those controls i n s t a l l e d i n the program by the programmer. These are call e d " b u i l t - i n " controls and programmed controls respectively. " B u i l t - i n " controls include items l i k e the p a r i t y check, double track recording on tape, duplicate arithmetic, the echo check, maintenance and marginal checking and rings on magnetic tape r e e l s . There i s a variety of programmed checks including redundancy checking, the "hasb" t o t a l , calculation checks, record counts, d o l l a r value accumulations, check points and l i m i t checks. Where and how they are used varies witb each system and cannot be stereotyped. - 6 3 -Adequate c o n t r o l of output i n c l u d e s the proper handing of tapes and d i s k s , as w e l l as the v e r i f i c a t i o n of p r i n t e d output "by the user department. While the i n t e r n a l audit department i s not a par t of a computer a p p l i c a t i o n i t s e l f , i t p l a y s an important r o l e w i t h regard t o i n t e r n a l c o n t r o l i n the system. Computerization n e c e s s i t a t e s changes i n audi t techniques and the i n t e r n a l audit o b j e c t i v e of ensuring adequate i n t e r n a l c o n t r o l w i l l not he met i f these changes are not made. An i n t e r n a l a u d i t department t h a t i s f a m i l i a r w i t h E.D.P. and ready t o make the changes tha t i t n e c e s s i t a t e s i s , t h e r e f o r e , an important aspect of i n t e r n a l con-t r o l i n a computer a p p l i c a t i o n . -64-PART V CONCLUSION This examination of the control problems generated by computer-ization has concerned i t s e l f mainly with the more established develop-ments in computer technology. This technology, however, is changing rapidly. A brief analysis of more recent developments and some of the resulting control problems w i l l , therefore, be made here. An obvious recent development is that of real time processing. In this s ituation, input w i l l not be batched and grouped for processing. With neither batch totals nor run totals available, the important control of verifying output to input w i l l be lost . This w i l l generate two re-quirements : i . ) a greater reliance w i l l need to be placed on processing controls, and i i . ) early participation in systems planning by a control conscious C O group (e.g. the internal audit department) w i l l become very important. Another development that w i l l cause some new control problems is the remote access feature. Remote input-output devices can be expec-ted to continue to increase. Many of them are, and w i l l be, a consider-able, distance from the central computer location. How can unauthorized access to remote input-output devices be prevented? Should authorized remote access users have access to a l l information on f i le? If not, what information should be accessible? Who w i l l decide this and how? What controls are available to ensure enforcement when the decisions have been 58. Ross, op. c i t . , pp. 46-47. -65-made? These are some of the c o n t r o l , problems that w i l l need s o l u t i o n s i f proper c o n t r o l i s to be maintained. With numerous remote access devices requesting i n f o r m a t i o n i t may be necessary to remove, from working storage, the program i n oper-a t i o n a t the time of a request and read i n t o storage the program and f i l e s r e q u i r e d to f u l f i l l the request. F a i l i n g t h i s , optimum computer u t i l i z -a t i o n w i l l be d i f f i c u l t to achieve. The operating system r e q u i r e d to perform t h i s w i l l need c o n t r o l s to ensure that no in f o r m a t i o n i s l o s t and that processing continues where i t l e f t o f f p r i o r to the remote access i n f o r m a t i o n request. As the length of time during which computers have been i n use i n c r e a s e s , the degree of systems i n t e g r a t i o n w i l l a l s o i n c r e a s e . I n -creased i n t e g r a t i o n w i l l , i n t u r n , cause new problems of c o n t r o l . An e r r o r on a master f i l e , f o r example, may now cause e r r o r s i n a v a r i e t y of outputs, p r i n t e d or otherwise. As i n t e g r a t i o n i n c r e a s e s , the amount of i n f o r m a t i o n on master f i l e s can a l s o be expected to in c r e a s e . C o n t r o l of the misuse or abuse of t h i s i n f o r m a t i o n by personnel who have access to these f i l e s can, t h e r e f o r e , be expected to become a problem of i n -cre a s i n g magnitude. Moreover, when i n t e g r a t i o n goes beyond the " i n t r a -f i r m " stage and becomes " i n t e r - f i r m " , the problem of c o n t r o l l i n g access to c o n f i d e n t i a l i n f o r m a t i o n w i l l a l s o need to be sol v e d . Computer technology has been changing r a p i d l y i n recent years and there i s not much doubt that there w i l l be other developments that w i l l cause new c o n t r o l problems. I t should, however, be remembered that the computer has a l s o made improved i n t e r n a l c o n t r o l p o s s i b l e i n some r e s p e c t s . -66-In closing, let us bri e f l y outline these factors. i.) Increased speed makes possible an increased amount of detailed checking. i i . ) A l l like transactions are treated the same way. Thus, i f we can determine definitely that one was processed correctly, i t i s safe to assume that they w i l l a l l be processed correctly. i i i . ) Since the computer has decision making a b i l i t y , controls can be installed as part of the program (programmed controls). iv.) If a policy or procedure change needs to be made, a l l that is required i s to alter the program. Before computerization, the re-educa-tion of a large number of clerks was necessary. v.) Since programs are changeable and have decision making a b i l i t y , i t i s possible to pre-plan for any circumstances and prevent undesirable future events. Advances in computer technology w i l l continue to present a distinct challenge to those concerned with internal control. Clearly, the emphasis on controls within the computer system i t s e l f w i l l increase sig-nificantly, necessitating increased involvement of control conscious per-sonnel in the planning and implementation stages of systems development. They w i l l , therefore, need to maintain an adequate knowledge of computer systems and their capabilities. This being the case, they w i l l be able to not only use present f a c i l i t i e s to maintain control, but also be alert to the po s s i b i l i t i e s of improved control generated by technological changes. 59. Robert F. Garland, "Five Ways in Which Computer Systems Strengthen Internal Control," N.A.A. Bulletin, July, 1962, pp. 21-28. PART VI-BIBLIOGRAPHY Books Anthony, Robert N., Deardon, John, and V a n c i l , R ichard F., Management C o n t r o l Systems, Homewood: Ric h a r d D. I r w i n , I n c . , 1 9 6 8 . Bout e l l , Wayne, S., Au'diting w i t h the Computer, Berkeley, C a l i f o r n i a : U n i v e r s i t y of C a l i f o r n i a , 1 9 6 5 . B r i n k , V i c t o r Z. and Cashin, J . A., I n t e r n a l A u d i t i n g , New York: Ronald P r e s s , 1 9 5 8 . Burck, G i l b e r t , and the e d i t o r s of Fortune, The Computer Age, New York: Harper and Row. Burton, A. J . and M i l l s , R. G., E l e c t r o n i c Computers and The i r  Business A p p l i c a t i o n s , London:E. Benn, i 9 6 0 . Canadian I n s t i t u t e of Chartered Accountants, A P r a c t i c a l  I n t r o d u c t i o n t o Computer Systems, 1 9 6 5 . Canning, R i c h a r d G. , E l e c t r o n i c Data Processing f o r Bussiness  and I n d u s t r y . , New York: John T. Wiley & Sons, 1 9 5 7 . Cashin, James A., and Owens, Garland C , A u d i t i n g , New York: The Ronald Press Co., 1 9 o 3 . Conway, B., Business Experience w i t h E l e c t r o n i c Computers, New York: C o n t r o l l e r s I n s t i t u t e Research. Foundation, 1 9 5 9 . Culy, R. T., and Bauer, D. N. R o y a l , A u d i t i n g , C i n c i n n a t i : South-Western P u b l i s i n g Co., 1 9 5 3 . Edge, C. G. Roy, and Sandford, P. J . , The Impact of Systems ' and Computers on Management and on the Accountant, Hamilton: The S o c i e t y of I n d u s t r i a l and Cost Accountants of Canada, 1 9 6 6 . E l l i o t t , C. O r v i l l e , and Wasley, Robert S., Business Information  Processing Systems, Homewood: Ric h a r d D. I r w i n , I n c . , 1 9 6 5 . G i l l e s p i e , C e c i l , Accounting Systems, Englewood C l i f f s . - P r e n t i c e -H a l l , I n c . , 1 9 6 l . -68-Gotlleb, C. C , and Hume, J . N. D., High. Speed Data Processing, New: York.: McGraw-Hill Book Co., Inc., 1958. h Gregory, Robert H., and Van Horn, Richard L., Automatic Data  Processing Systems, San Francisco: Wadsworth P u b l i s i n g Co., Inc., 1963. Johnson, Eldred A., Accounting Systems i n Modern Business, New York: McGraw-Hill Book Co., Inc., 1959-Jones, Gardner M., Electronics i n Business, East Lansing: College of Business and Public Service, Michigan State University, 1958. Kaufman, F e l i x , Electronic Data Processing and Auditing, New York: The Ronald Press Co., 1961. Kozmetsky, George-and Kircher, P., Electronic Computers and Management Control, New York: McGraw-Hill Book Co., Inc., 1956. Laden, H. N. and Gildersleeve, T. R., Systems Design for Computer  Applications, New York: John Wiley & Sons, Inc., 1963. Lazzaro, V i c t o r , Ed., Systems and Procedures, Englewood C l i f f s : P rentice-Hall, Inc., 1959. L i t t l e f i e l d , C. L. and Peterson, R. L., Modern Office Management, Englewood C l i f f s : Prentice-Hall, Inc., 1956. Martin, E. Wainwright, J r . , Electronic Data Processing - An  Introduction j Homewood: Richard D. Irwin, Inc., 196l. McCraken, Daniel D., Weiss, H. and Lee, Tsai-Hwa, Programming  Business Computers, New York: John Wiley & Sons Inc., 1959. Meigsj Walter B. , P r i n c i p l e s of Auditing, Homewood: Richard D..Irwin, Inc., 1962. : Moore, Frances E., and S t e t t l e r , Howard F., Accounting Systems for Management Control, Homewood: Richard D, Irwin, I N c , 1963. Murphy, Mary E., Managerial Accounting, Princeton, N. J . : D. Van Nostrand Co., Inc., 1963. -69-Nelson, Oscar S., and Woods, Richard S., Accounting Systems arid Data  Processing, C i n c i n n a t i : South-Western Publishing Co., 1961. Optner, Sanford L., Systems A n a l y s i s . f o r Business Management, Englewood C l i f f s : P r e n t i c e - H a l l , Inc., 1960. Palen, Jennie M., Ed., Encyclopedia of Auditing Techniques, Englewood C l i f f s : P r e n t i c e - H a l l , Inc. Porter, W. Thomas, J r . , Auditing E l e c t r o n i c Systems, Belmont, C a l i f o r n i a : Wadsworth Publishing Co., Inc., 1966. Pr i c e Waterhouse & Co., Use of Computers i n Auditing, New York: P r i c e Waterhouse & Co. Prince, Thomas R., Information Systems f o r Management and Control, Homewood: Richard D. Irwin, Inc., 1966. Smith, J . Sanford, E l e c t r o n i c D i g i t a l Computers, London: Macdonald and Evans L t d . , 1957. Smith, J . Sanford, The Management Approach to E l e c t r o n i c D i g i t a l Com- puters, Macdonald and Evans Ltd., 1957. Sprague, R.E., E l e c t r o n i c Business Systems - Management- Use of On-Line  Real-Time Computers, New York: The Ronald Press Co., 1962. Systems, and Procedures Association, Business Systems. Cleveland: Systems and Procedures Asso c i a t i o n , 1966. Reports Cadematori, Kenneth G., "The Impact of E.D.P. on Auditing", E.D.P. and  the Auditor, American Management Association, B u l l e t i n 81, 1966. Canadian I n s t i t u t e of Chartered Accountants, Special Committee to assess the Impact of E l e c t r o n i c Data Processing on the Profession, Special Issue, Canadian Chartered Accountant, August, 1967. -70-Controllers I n s t i t u t e Research Foundation, Inc., Business Experience  with Electronic Computers, New York: 1959. (Controllers I n s t i t u t e i s now the Financial Executives I n s t i t u t e ) . Department of the A i r Force, Guide for Auditing Automatic Data Processing  Systems, 1966. International Business Machines, Management Control of Electronic Data Processing, Form F20-0006-0. Message Control System Concepts, Form C20-1609-0. In s t i t u t e of Internal Auditors, International E.D.P. Research Subcommittee, Internal Auditing of Electronic Data Processing, New York: 1967. Price Waterhouse & Co., The Auditor Encounters Electronic Data Processing, New York: IBM Technical Publications Department. A r t i c l e s Anderson, R. J . , "Training of Audit Personnel," Electronic Data Processing i n Canada. Toronto: Canadian I n s t i t u t e of Chartered Accountants, 1963. Arkin, Herbert, "Computers and the Audit Test," Journal of Accounting, October, 1965. Baurle, F. C. "Case Study of a Computer Audit Program," The Review, Spring, 1963. B e l l , William R., "Program Maintenance (The Key to Progress)," Journal of Data Management, A p r i l , 1965. Blank, V i r g i l F., "Auditing i n the Age of EDP," Journal of Machine  Accounting, J u l y , 1961. Boni, Gregory M., "Impact of EDP on Auditing," The Journal of Accountancy, September, 1963. Bo u t e l l , W. S., "Auditing though the Computer," The Journal of Accountancy, November, 1965. Brown, R. Gene, "Data Processing, Accounting and Business Administration," The Journal of Accountancy, November, 1962. Cadematori, Kenneth G., "An Auditor's Experience with Electronics," The Internal Auditor, Winter, 1961. Denz, Ronald F., "Auditing the Data Processing Department," P.P.M.A. Quarterly, A p r i l , 1967. -71-Conway, Benjamin, "Electronics i n Business", Systems and Procedures, Victor Lazzaro, Ed., Englewood C l i f f s : Prentice-H a l l , Inc., 1959. CRuttenden, P h i l l i p S., "How Much Data Screening to Minimize Computer-Detected Errors?", NAA B u l l e t i n , A p r i l , i 9 6 0 . Curka, Frank J . , "The Effect of Electronic Data Processing on Auditing," NAA B u l l e t i n , A p r i l , 1 9 6 l l Dearden, John, "How to Organize Information Systems," Harvard Business Review, March-April, 1965. D i l l , S. L. and Adams, D. L., "Automated Auditing," The  Journal of Accountancy, May, 1964. Dudley, Carlton L., J r . , "Management Audits of EDP In s t a l l a t i o n s Banking, March, 1965. E i t z p a t r i c k , Robert J . , "The Influence of EDP on Internal Control," The Fianancial Executive, Marvh, 1 9 6 l . Frese, Walter F., "Organization Ef f e c t s , " Electronics i n  Management, Lowell H. Hattery and Gregory P. Bush, eds., Washington: University Press of Washington D.C., 1956. Garland, R. F., "Five Ways i n which Computer Systems Strengthen Internal Control," NAA B u l l e t i n , J u l y , 1962. G a r r i t y , John T. "The Management Information Dream; The End of a New Beginning," The Fin a n c i a l Executive, Deptember, 1964 Guidrey, J . J . , "Auditor's Contribution to Organization and Control i n a Data-Processing Program," The Federal Accountant September, 1961. Jones, Richard P., " P r a c t i c a l Control of Preparatory Programming Time f o r a Computer Ins t a l a t i o n , " NAA B u l l e t i n , A p r i l , 1962. J o p l i n , H. V., "An Internal Control Checklist for EDP," Management Services, July-August, 196U. Kaufman, F e l i x , "EDP Control Problems," The F i a n c i a l Executive, J u l y , 1962. Keenoy, C. L., "The Impact of Automation on the F i e l d of Accounting." Accounting Review. -72-Moore, Michael R., "E.D.P. Audits - A Systems Approach," The I n t e r n a l  A u d i t o r , May/June, 1969. N a t i o n a l R e t a i l Merchants' A s s o c i a t i o n , " S e c u r i t y - Can I t Keep Up With Crime?", St o r e s , January, 1968. Perlman, J . A., " C e n t r a l i z a t i o n versus D e c e n t r a l i z a t i o n , " Datamation, September, 1965. P o r t e r , W. Thomas, J r . , " E v a l u a t i n g I n t e r n a l Controls i n EDP Systems," The J o u r n a l of Accountancy, August, 1964. P o r t e r , W. Thomas, J r . , " A u d i t i n g and the Computer," The I n t e r n a l  A u d i t o r , F a l l , 1967. P o r t e r , W. Thomas, J r . , "A C o n t r o l Framework f o r E l e c t r o n i c Systems," The J o u r n a l of Accountancy, October, 1965. Ross, Franz E., " I n t e r n a l C o n t r o l and Audit of Real-Time D i g i t a l Systems," J o u r n a l of Accounting, A p r i l , 1965. Simmons, Leo E., "Executive Problems and Opportunities A r i s i n g Out of Automatic Systems," E l e c t r o n i c s i n Management, Lowell H. Hattery and Georgy P. Bush, Eds., Washington: U n i v e r s i t y of Washington P r e s s , 1956. Trombly, Robert N., " A u d i t i n g Through EDP Equipment," NAA B u l l e t i n , May, 1961. V a l l e e , Ralph J . and Reece, J . C , "Guidance C o n t r o l f o r Business Systems," Business Automation, November, 1965. W h i s l e r , T. H., "The Manager and the Computer," The J o u r n a l of Accountancy, January, 1965. 

Cite

Citation Scheme:

        

Citations by CSL (citeproc-js)

Usage Statistics

Share

Embed

Customize your widget with the following options, then copy and paste the code below into the HTML of your page to embed this item in your website.
                        
                            <div id="ubcOpenCollectionsWidgetDisplay">
                            <script id="ubcOpenCollectionsWidget"
                            src="{[{embed.src}]}"
                            data-item="{[{embed.item}]}"
                            data-collection="{[{embed.collection}]}"
                            data-metadata="{[{embed.showMetadata}]}"
                            data-width="{[{embed.width}]}"
                            data-media="{[{embed.selectedMedia}]}"
                            async >
                            </script>
                            </div>
                        
                    
IIIF logo Our image viewer uses the IIIF 2.0 standard. To load this item in other compatible viewers, use this url:
https://iiif.library.ubc.ca/presentation/dsp.831.1-0102337/manifest

Comment

Related Items