UBC Theses and Dissertations

UBC Theses Logo

UBC Theses and Dissertations

Internal control of computer applications Schroeder, Harold John 1969

Your browser doesn't seem to have a PDF viewer, please download the PDF to view this item.

Item Metadata

Download

Media
831-UBC_1969_A4_5 S37.pdf [ 3.73MB ]
Metadata
JSON: 831-1.0102337.json
JSON-LD: 831-1.0102337-ld.json
RDF/XML (Pretty): 831-1.0102337-rdf.xml
RDF/JSON: 831-1.0102337-rdf.json
Turtle: 831-1.0102337-turtle.txt
N-Triples: 831-1.0102337-rdf-ntriples.txt
Original Record: 831-1.0102337-source.json
Full Text
831-1.0102337-fulltext.txt
Citation
831-1.0102337.ris

Full Text

INTERNAL CONTROL OF COMPUTER APPLICATIONS by HAROLD JOHN SCHROEDER B. Comm. U n i v e r s i t y of Manitoba, 1965  A THESIS SUBMITTED IN PARTIAL FULFILMENT OF THE REQUIREMENTS FOR THE DEGREE OF Master of Business Administration i n the Department of Commerce and Business Administration We accept t h i s t h e s i s as conforming to the required standard  THE UNIVERSITY OF BRITISH COLUMBIA August, 1969  In .presenting this thesis in partial fulfilment of the requirements for an advanced degree at the University of British Columbia, I agree that the Library shall make i t freely available for reference and study.  I further agree  that permission for extensive copying of this thesis for scholarly purposes may be granted by the Head of my Department or by his representative.  It is understood that copying or  publication of this thesis for financial gain shall not be allowed without my written permission.  H. J. Schroeder  ABSTRACT The use of computers i s becoming i n c r e a s i n g l y prevalent i n business.  They are used, not only to store vast amounts of information,  but also to carry out record keeping procedures f o r assets, e q u i t i e s and expenses that may each involve large d o l l a r amounts. There are a v a r i e t y of f a c t o r s which make the computer more complex than any of the preceding cessing.  innovations i n the f i e l d of data pro-  Perhaps the most important of these f a c t o r s i s the non-readable  form of records that could previously be read.  I n t h e i r new form they  are readable only when a s p e c i f i c e f f o r t i s made to put them i n t o readable form.  Such complexities, i t i s suggested, mean that a new system of i n -  t e r n a l c o n t r o l must be prepared and maintained t o ensure the p r o t e c t i o n of the records and hence the assets of the o r g a n i z a t i o n , e s p e c i a l l y the monetary assets. How can i n t e r n a l c o n t r o l be maintained?  This i s a very im-  portant problem that needs to be solved by every f i r m contemplating the a c q u i s i t i o n of a computer.  F a i l u r e to solve t h i s problem p r i o r to the  time when a computerized system becomes o p e r a t i o n a l , could have very serious repercussions.  R e t a i l e r s o f f e r i n g customer c r e d i t , f o r example,  have accounts receivable that c o n s t i t u t e a large percentage of t o t a l assets.  The l o s s of a l l , or p a r t , of the subsidiary ledger could pre-  cipitate financial ruin. The question of i n t e r n a l c o n t r o l must, therefore, be faced and procedures devised to achieve and maintain c o n t r o l .  But how?  Obviously  the d r a s t i c changes i n a system employing a computer leave some of the o l d methods of c o n t r o l out of date and completely  inadequate.  Moreover, the  complexity of the new system and i t s machinery creates new s i t u a t i o n s  requiring controls heretofore never required or v i s u a l i z e d . It i s the purpose of t h i s thesis to identify and outline some of the i n t e r n a l control problems that arise with the introduction and operation of a computerized system.  An attempt i s made to provide s o l -  utions to these new problems as they are presented i n this t h e s i s . The problems and t h e i r solutions have been i d e n t i f i e d and organized using two main sources of information: a)  the specialized l i t e r a t u r e i n the f i e l d .  b)  case h i s t o r i e s available to the w r i t e r , as an i n t e r n a l auditor s i g n i f i c a n t l y involved i n the i n t e r n a l control of computerized systems.  Brian E . Burke Supervisor  TABLE OF CONTENTS Page PART I  -  INTRODUCTION History Computer Systems New Control Problems  1 1 2 3  PART I I  -  CONTROL OF THE E.D.P. FUNCTION Introduction Organizational Control A d m i n i s t r a t i v e Control Systems A n a l y s i s & Programming Computer Operations and Data Processing Summary  9 9 9 14 14 16 20  PART I I I  -  THE CONVERSION PROCESS Introduction Gaining Confidence i n the System A period of Adjustment f o r User Personnel An I l l u s t r a t i o n Summary  22 22 24 30 34 41  PART IV  -  CONTROL OF COMPUTER APPLICATIONS (COMPUTERIZED SYSTEMS) Introduction Input Controls Processing Controls " B u i l t - i n " Controls Programmed Controls An I l l u s t r a t i o n Output Controls The I n t e r n a l Audit Department Summary  43 43 43 46 46 48 53 57 58 62  PART y  -  CONCLUSION  64  PART y i  -  BIBLIOGRAPHY  67  -iiLIST OF TABLES Page Table I  -  Table I I -  Summary of Control Problems posed by E.D.P. S i m p l i f i e d Accounts Receivable Computer System  7 54  -iiiLIST OF FIGURES Page Figure I  -  Control of the Conversion Process  36 a.  -ivACKNOWLEDGEMENT The w r i t e r wishes t o acknowledge and express h i s appreciation f o r the suggestions and assistance received from Dr. B. E. Burke and Dr. B. Schwab, both of the Faculty of Commerce and Business A d m i n i s t r a t i o n , The U n i v e r s i t y o f B r i t i s h Columbia.  PAET I INTRODUCTION History I t i s w e l l over one hundred y e a r s s i n c e t h e c o n s t r u c t i o n o f t h e f i r s t computer.  I n 1830 C h a r l e s Babbage c o n s t r u c t e d what he termed an  " a n a l y t i c a l engine". of  T h i s machine c o u l d s t o r e numbers, p e r f o r m a s e r i e s  c a l c u l a t i o n s , p r i n t t h e r e s u l t s and r e p e a t t h e p r o c e s s .  r e c e i v e d i n s t r u c t i o n s from punched c a r d s and performed  The machine  i t s calculations  w i t h o u t human i n t e r v e n t i o n , hence i t can t r u l y be c l a s s i f i e d as t h e f i r s t computer.  However, i n s p i t e o f t h e e f f o r t s o f Babbage, and'sub-  s e q u e n t l y t h o s e o f h i s s o n , l a c k o f funds and f a c i l i t i e s and o t h e r f a c t o r s p r e v e n t e d t h e success o f t h e p r o j e c t .  I t was some t i m e b e f o r e 1-  a c t i v i t y i n t h i s f i e l d was r e v i v e d and w o r k i n g models became a v a i l a b l e . I t was n o t u n t i l 1946 t h a t t h e f i r s t a l l - e l e c t r o n i c d i g i t a l com2 p u t e r was b u i l t a t t h e U n i v e r s i t y o f P e n n s y l v a n i a and o t h e r s q u i c k l y followed.  The m a j o r i t y o f t h i s e a r l y e l e c t r o n i c equipment was not  designed f o r business but f o r d i s c i p l i n e s l i k e mathematics, p h y s i c s , astronomy, t h a t i s s c i e n t i f i c a p p l i c a t i o n s .  G r a d u a l l y t h e use o f computers  i n b u s i n e s s i n c r e a s e d u n t i l a p p r o x i m a t e l y s e v e n t y - f i v e o r more p e r c e n t o f t h e computers i n use were used i n b u s i n e s s f o r systems l i k e p a y r o l l , i n v e n t o r y , 3 accounts r e c e i v a b l e and v a r i o u s forms o f i n f o r m a t i o n . I n e a r l y 1957  1.  C C . G o t l i e b and J.N.P. H u j n , H i g h Speed Data P r o c e s s i n g , New York: McGraw H i l l Book Co. I n c . , 1958, pp. 2-4.  2.  Canadian I n s t i t u t e o f C h a r t e r e d A c c o u n t a n t s , A P r a c t i c a l I n t r o d u c t i o n t o Computer Systems, June, 1965, p. I - 3.  3.  Gardner M. J o n e s , E l e c t r o n i c s i n B u s i n e s s , E a s t L a n s i n g : S t a t e U n i v e r s i t y , 1958, p. 14.  ie  Michigan  there were only seven computers i n Canada.  k  In 19&3 there were nearly  two hundred and by 19&7 "their number had increased t o over twelve 5 hundred. Computer Systems . Today there i s a v a i l a b l e a considerable v a r i e t y i n the makes, types and s i z e s of computers as w e l l as the p e r i p h e r a l machinery.  All  computer systems can, however, be divided as f o l l o w s : - Input/Output  Devices  - The C e n t r a l Processing Unit - Storage - main and a u x i l i a r y Input/Output devices g e n e r a l l y include three main types.  Firstly,  there i s u s u a l l y . a need f o r an apparatus which converts manually made data Into machine readable form.  These have, i n the main, been machines  which create punched cards or punched tape but more r e c e n t l y i t i s p o s s i b l e t o convert d i r e c t l y onto magnetic tape.  Secondly, the i n p u t /  output group includes a c o n t r o l console which acts as a means of communication between the computer and i t s operator.  T h i r d l y , there must be  the necessary f a c i l i t i e s to put converted data i n t o the system as w e l l as t o remove data from the system.  Machinery t o read punched cards,  magnetic i n k coded forms, p r e v i o u s l y w r i t t e n tapes or drums i s necessary. S i m i l a r l y , there must be machinery t o record data on cards, tape, d i s k s , drums or p r i n t e d r e p o r t s . ^T. R. J . Anderson, "Training of Audit Personnel", E l e c t r o n i c Data Processing i n Canada, Canadian I n s t i t u t e of Chartered Accountants, Toronto, 1963, p. 33. 5.  S p e c i a l Committee t o assess the Impact of E l e c t r o n i c Data Processing on the P r o f e s s i o n . Canadian I n s t i t u t e of Chartered Accountants, Canadian Chartered Accountant, S p e c i a l Issue, August, 1967, p. 15.  -3-  The  c e n t r a l processing u n i t i s the p o r t i o n of the system which  does the a c t u a l c a l c u l a t i o n , a l t e r i n g or t r a n s f e r r i n g of data. The  storage p o r t i o n of the system, as the name i m p l i e s ,  stores  data w i t h i n the system and i s accessible t o the c e n t r a l processing u n i t . This stored data may.be located w i t h i n the computer i t s e l f (main storage generally the program being used and the data t o be used i n the c a l c u l a t i o n s presently)  or on a u x i l i a r y storage i n the form of magnetic tape,  6 disks or drums. New Control Problems The  d e c i s i o n t o computerize a system n a t u r a l l y gives r i s e t o new  c o n t r o l problems.  I t has been s a i d that the strongest element of c o n t r o l  i s a w e l l conceived and r i g i d l y enforced system.  A system using e l e c t r o n i c  data processing can f o l l o w only the i n s t r u c t i o n s of the program.  I f the  l a t t e r I s w e l l conceived, then i t can be argued that standardization and enforcement of the prescribed  system Is at a maximum and c o n t r o l problems 7  should therefore be at a minimum.  The p r o b a b i l i t y of e r r o r , e s p e c i a l l y  i n the area of the computer's c a l c u l a t i o n s , c e r t a i n l y i s l e s s than that of a manual system.  Nevertheless, while some problems are removed or  a l l e v i a t e d by mechanization, new c o n t r o l problems a r i s e and the solutions to some of these require a new approach. 6^ Benjamin Conway, " E l e c t r o n i c s i n Business", Systems and Procedures, V i c t o r Lazzaro, ed., Englewood C l i f f s , N.J., P r e n t i c e - H a l l , Inc., 1959,  7.  pp. 338-42.  Jennie M. Palen, ed. , Encyclopedia of Auditing Techniques, Volume 1 , Englewood C l i f f s , W.J., Prentice H a l l , pp. 8 1 - 8 2 .  -h-  To begin w i t h , the process of converting from the manual t o the computerized system gives r i s e t o s i g n i f i c a n t problems.  The system t o  be changed must be reviewed and properly documented so that programs can be w r i t t e n .  Moreover, some serious communication and co-ordination  problems.can a r i s e from the fact that there are two d i s t i n c t groups involved namely E.D.P. personnel and the personnel of the department whose system i s t o be mechanized.  The former, while f a m i l i a r w i t h  computer technology, may not be f a m i l i a r w i t h the procedures t o be computerized.  Conversely, the l a t t e r , while f a m i l i a r w i t h the system, may  not be w e l l versed i n computers.  Most important of a l l , the mechanized  system must be such that records are complete and correct and information i s r e t r i e v a b l e i f necessary. A second problem a r i s e s from the f a c t that t e c h n i c a l and'cost f a c t o r s g e n e r a l l y make i t more p r a c t i c a l f o r E.D.P. t o operate as a separate department s e r v i c i n g the" departments whose systems have been computerized.  Under the manual system, the person i n charge of the  department c o n t r o l l e d the employees who d i d the work and was therefore a l s o i n c o n t r o l of the work i t s e l f .  Under the new system, the work i s  done In another department (namely E.D.P.) and by a machine w i t h which he i s probably not very f a m i l i a r .  I f he i s t o be held responsible f o r the  work, then i t becomes necessary t o i n s t i t u t e some arrangement whereby he can r e t a i n c o n t r o l over the work. T h i r d l y , i n most systems i t i s necessary t o convert data from o r i g i n a l t o machine readable form.  I t therefore becomes necessary t o  i n s t i t u t e controls t o ensure the comprehensive and correct conversion of media.  -5-  F o u r t h l y , t h e department whose system i s t o be c o m p u t e r i z e d i s now f a c e d w i t h t h e f a c t t h a t i t s r e c o r d s and t h e p r o c e s s i n g t r a i l o f t h e t r a n s a c t i o n s w i l l g e n e r a l l y n o t be i n r e a d a b l e  form.  Provisions  must t h e r e f o r e be made t o make p o s s i b l e c o n v e r s i o n t o r e a d a b l e  form o f  a l l v i t a l r e c o r d s and i n f o r m a t i o n r e g a r d i n g t r a n s a c t i o n s and t h i s a t a l l c r u c i a l p o i n t s i n t h e processing procedure. F i f t h l y , i n most i n s t a n c e s i n t h e manual system t h e t a s k s i n v o l v e d were done by numerous p e o p l e making i n c r e a s e d c o n t r o l by s e g r e g a t i o n o f d u t i e s , double c h e c k i n g , p r o p e r a p p r o v a l and s u p e r v i s i o n ; a r e l a t i v e l y simple matter.  A manual p a y r o l l system, f o r example, may have t a s k s  t h e timekeeping,,  like  t h e p a y r o l l r e c o r d k e e p i n g , t h e p r e p a r a t i o n o f cheques,  s i g n i n g and c o - s i g n i n g o f t h e cheques,, a c c o u n t i n g , and bank r e c o n c i l i a t i o n a l l done by d i f f e r e n t p e o p l e .  I n t h e mechanized system, one machine does  a l l t h e t a s k s and i t i s under t h e c o n t r o l o f two p e r s o n s ; and t h e o p e r a t o r .  t h e programmer  Good c o n t r o l must t h e r e f o r e i n c l u d e new s t e p s t o  8 overcome t h i s new weakness. S i x t h l y , t h e c o m p l e x i t y o f t h e systems r e q u i r e s t h a t t h e o r i g i n a l programs and subsequent a l t e r a t i o n s be documented.  Programming, t e s t i n g  and d o c u m e n t a t i o n s t a n d a r d s  f o r the w e l l c o n t r o l l e d  are t h e r e f o r e necessary  a d m i n i s t r a t i o n o f t h e E.D.P. department. S e v e n t h l y , s i n c e r e c o r d s a r e on t a p e o r d i s k and n o t r e a d a b l e , a .machine breakdown would l e a v e such i n f o r m a t i o n i n a c c e s s a b l e . must t h e r e f o r e be made f o r such a  Provision  contingency.  I n a d d i t i o n t o t h e c o n t r o l problems o u t l i n e d above, t h e r e i s , o f c o u r s e , t h e huge problem o f c o s t c o n t r o l as r e g a r d s machine a c q u i s i t i o n 8.  " S e c u r i t y - Can i t Keep Up w i t h C r i m e ? " , S t o r e s , J a n . , 1968, p. 10.  and usage as w e l l as the mechanization of s p e c i f i c systems.  This i s a  vast subject i n i t s e l f and therefore beyond the scope of t h i s a n a l y s i s . This a n a l y s i s w i l l l i m i t i t s e l f to the i n t e r n a l c o n t r o l problems of the computer a p p l i c a t i o n s themselves ( a l t e r n a t e l y c a l l e d computerized systems or mechanized systems) and the solutions to these problems. They w i l l be d i v i d e d i n t o two main categories namely: - those aspects of c o n t r o l which are not part of the system or a p p l i c a t i o n i t s e l f but are nevertheless necessary f o r the w e l l c o n t r o l l e d functioning of the system, i . e . the organization and administration of the E.D.P. f u n c t i o n . - those controls necessary w i t h i n the system i t s e l f , i . e . c o n t r o l of conversion, input, processing  and a l t e r a t i o n of  data w i t h i n the computer system and output. In a d d i t i o n to these two main categories, there w i l l be a b r i e f discussion of the I n t e r n a l Audit Department as an element of i n t e r n a l control. An o u t l i n e of the main c o n t r o l problems created by the of E l e c t r o n i c Data Processing  i s presented on page 7 .  introduction  -7Table I - Summary of Control Problems Posed by E.D.P. CONTROL PROBLEMS IN THE E.D.P. DEPARTMENT Organization -  Location of E. D. P. department i n the o v e r a l l organization s t r u c t u r e . Organization w i t h i n the E.D.P. department. Control of user department over E.D.P. department's services rendered.  Administrative Programming Department -  Ensure Ensure Ensure Ensure Ensure  programs perform tasks they are intended t o perform. programming standards and e f f i c i e n c y . adequate man-readable documentation of programs. adequate program t e s t i n g . proper a u t h o r i z a t i o n and t e s t i n g of program changes.  Operating Department  -  Ensure proper conversion of data t o machine-readable form. Entry of data i n t o computer - operator fraud - operator error Ensure adequate f i l e handling, r e t e n t i o n and back-up.  -  Ensure adequate arrangements f o r machinery back-up i n case of breakdown.  -  CONTROL PROBLEMS IN COMPUTERIZED SYSTEMS Conversion t o New System -  Proper planning of the conversion process. Education of user personnel. "One-time" conversion programs. Ensure correct c r e a t i o n of new master f i l e s . P a r a l l e l operation and error c o r r e c t i o n procedures. Y e r i f i c a t i o n of new system output. Employees' fears of computerization. Temporary a d d i t i o n a l s t a f f requirements.  Controls Within a Functioning New System  -  Input Proper preparation and a u t h o r i z a t i o n of source media. P h y s i c a l movement from user department t o E.D.P. department. Entry i n t o computer.  -8Processing -  Ensure the computer programs have ample c o n t r o l s t o f a c i l i t a t e proper manipulation of data. Output  -  Ensure output i s prepared and d i s t r i b u t e d . Ensure output i s "verified t o input. P e r i o d i c check t o ensure a l l output i s required. INTERNAL AUDIT AS AN ELEMENT OF CONTROL  -  A l t e r n a t e approaches t o E.D.P. - A u d i t i n g "around the computer" - A u d i t i n g "through the computer" New audit techniques.  -9-  PAET I I CONTROL OF THE E.D.P. FUNCTION Introduction As mentioned i n Part I , i n t e r n a l c o n t r o l of computerized systems can be separated i n t o two categories:  c o n t r o l of the E.D.P. f u n c t i o n or  department and controls placed w i t h i n the system i t s e l f .  While the  l a t t e r i s s e l f - e x p l a n a t o r y , some c l a r i f i c a t i o n might be In order with regard t o the former. In a manual system, the machinery used i s generally not complicated and r e l a t i v e l y e a s i l y operated by user personnel.  In a computerized  system, machinery i s complex, expensive and operates at high speeds.  To  a t t a i n maximum u t i l i z a t i o n i t i s necessary t o have a f u l l - t i m e s t a f f who do nothing but operate t h i s machinery.  Moreover, computers require a  d e t a i l e d set of i n s t r u c t i o n s f o r every job that they do and, t h e r e f o r e , a programming s t a f f i s required.  Computerization,  t h e r e f o r e , gives r i s e t o  a group of personnel that was p r e v i o u s l y not required.  I t follows that  i f c o n t r o l of a computerized system i s t o be complete, i t must include c o n t r o l of the personnel operating the machinery used i n that system. I t i s the purpose of Part I I t o examine the o r g a n i z a t i o n a l and a d m i n i s t r a t i v e c o n t r o l problems a r i s i n g i n t h i s area. Organizational Control The d e c i s i o n t o computerize a system immediately poses a problem of organization.  Programs need t o be w r i t t e n and the computer needs t o  be operated and a d e c i s i o n needs t o be made as t o where such E.D.P. personnel should be o r g a n i z a t i o n a l l y located.  There are two main  possibilities: i)  l o c a t e the programming and operating personnel w i t h i n the department  -10whose system i s t o be computerized. organize an independent E.D.P. department and have i t operate as a 9  "service centre" t o the department(s) w i t h mechanized systems.  It  i s suggested here that the f i r s t of these a l t e r n a t i v e s i s neither economical nor advisable and so f o r three main reasons.  Firstly,  i t i s very seldom that one s i n g l e department i s large enough t o warrant a programming s t a f f and have a system large enough t o keep even a small computer i n operation most of the time. i d l e time i s n e c e s s a r i l y a waste of funds.  The r e s u l t i n g  Secondly, i f other  departments i n the f i r m u t i l i z e t h i s i d l e time then the f i r s t department l i t e r a l l y becomes, i n part,' a "service centre" i n which case a "service centre" independent of a l l user departments have been more advisable i n the f i r s t place.  would  T h i r d l y , the o r g a n i z a t i o n a l  separation of E.D.P. and the user group i s d e s i r a b l e from a c o n t r o l point of view.  One of the basic p r i n c i p l e s of c o n t r o l i s the segrega-  t i o n of duties concerning the custody of an asset from the recordkeeping duties f o r that asset.  Since much of the work done by  computers i s i n f a c t the maintenance  of records f o r assets (e.g. Accounts  Receivable or Inventory) the separation of the E.D.P. from the user departments  (frequently r e f e r r e d t o as a "service centre" or "closed  shop" arrangement) i s the f i r s t of three main elements of o r g a n i z a t i o n a l control. 9.  C o n t r o l l e r s I n s t i t u t e Research Foundation, Inc., Business Experience w i t h E l e c t r o n i c Computers, New York, 1 9 5 9 , p. 144. (Now the F i n a n c i a l Executive's I n s t i t u t e )  -11-  The inauguaration of the arrangement described above immediately poses a new problem.  This problem i s twofold.  On the one hand, i n some  manual systems, .segregation of duties was p o s s i b l e w i t h i n the user department.  The personnel performing c u s t o d i a l duties and the personnel  keeping records f o r the asset were both under the c o n t r o l of the department manager.  In Accounts Receivable, f o r example, c r e d i t granting and c o l l e c t i o n  procedures and the maintenance of s u b s i d i a r y ledgers may both have been c o n t r o l l e d by the Accounts Receivable manager.  With the computerization  of accounts r e c e i v a b l e , the s u b s i d i a r y ledger work i s done by the computer outside the Accounts Receivable department.  He i s thus faced w i t h the  dilemma of having l o s t c o n t r o l over some of the Accounts Receivable work but nevertheless being held responsible f o r the good a d m i n i s t r a t i o n of the Accounts. On the other hand, i n some manual systems segregation was maintained by having duties performed i n separate departments.  Computerization of the  two tasks put both d u t i e s i n the E.D.P. department destroying the previous segregation of duties c o n t r o l .  Mechanization of banking and cheque d i s -  bursements serves as a good example.  On a manual system, cheques may have  been prepared and mailed by'the Treasury department with'the accounting and bank r e c o n c i l i a t i o n duties performed by the General Accounting department. When the system i s mechanized, both duties are performed by one department 10  namely the E.D.P. department The n e c e s s i t y of a second element of o r g a n i z a t i o n a l c o n t r o l therefore becomes evident. 10.  The work done by the computer must be c o n t r o l l e d by a  Walter F. Frese, "Organization E f f e c t s " , E l e c t r o n i c s i n Management, Lowell H. Hattery & Georgy P. Bush, eds., Washington: U n i v e r s i t y Press of Washington D. C , 1956, p. 158.  -12-  group independent of the E.D.P. department.  This c o n t r o l group must  ensure that information t o be processed does not o r i g i n a t e i n the E.D.P. department and that a l l information t o be processed i s processed 11  correctly  . This c o n t r o l should be achieved by having the c o n t r o l group  v e r i f y proper, o r i g i n a t i o n , preparation and a u t h o r i z a t i o n of input informat i o n before i t i s processed by computer and subsequently v e r i f y i n g output to input. There are two points of view as t o the exact o r g a n i z a t i o n a l l o c a t i o n of t h i s c o n t r o l group.  I t i s argued by some that the c o n t r o l  group should be part of the user department.  In t h i s way user department  management can r e t a i n more d i r e c t c o n t r o l over work on. assets f o r which they are held responsible.  Others suggest that there should be one group  c o n t r o l l i n g flow of data from a l l user departments and that t h i s group 11 a should be independent of both E.D.P. and user departments. here that t h i s i s not a. question of major s i g n i f i c a n c e .  I t i s suggested  A d e c i s i o n as t o  which arrangement should be i n s t i t u t e d would need t o take i n t o consideration a v a r i e t y of f a c t o r s i n c l u d i n g the number of systems mechanized, the types of systems ,•the degree of i n t e g r a t i o n , the degree of j o i n t r e s p o n s i b i l i t y between E.D.P. and user management, the o v e r a l l o r g a n i z a t i o n a l s t r u c t u r e , the c a l i b r e of personnel and others.  The important issue.here i s that the  c o n t r o l group i s independent of the E.D.P. department ensuring the proper processing of authorized data. 11. P r i c e Waterhouse & Co., The Auditor Encounters E l e c t r o n i c Data Processing, New York: I.B.M., Technical P u b l i c a t i o n s Department, p. 3 . 11 a.  I n t e r n a t i o n a l E.D.P. Research Subcommittee, I n s t i t u t e of I n t e r n a l A u d i t o r s , I n t e r n a l Auditing of E l e c t r o n i c Data Processing Systems, New York: 1967, p. I I - 4.  -13The t h i r d element of o r g a n i z a t i o n a l c o n t r o l i s the matter of organization w i t h i n the E.D.P. i t s e l f .  Tasks.that were formerly done  by many people are now done by one machine, reducing the degree of human involvement.  "The reduction of human e f f o r t through a high degree  of mechanization g r e a t l y increases the importance of the human elements  12  remaining."  A p o r t i o n of the "remaining human element" i s the c o n t r o l  group discussed above.  The other p o r t i o n i s the E.D.P. personnel namely  systems analysts and programmers and computer operators. The advent of changeable computer i n s t r u c t i o n s has given r i s e t o a unique c o n t r o l problem.  The programmer, having w r i t t e n a program, i s ,  of course, completely f a m i l i a r with t h i s set of computer i n s t r u c t i o n s . I f t h i s programmer i s allowed t o operate the computer while t h i s program i s i n use, i t may be p o s s i b l e f o r him t o a l t e r the i n s t r u c t i o n s t o h i s advantage using the console or operating switches as the means of a l t e r i n g the program i n use.  Both the o r g a n i z a t i o n a l and p h y s i c a l separation of  systems work and programming from computer operations therefore becomes an important part of the c o n t r o l of the E.D.P. f u n c t i o n . In a m u l t i - d i v i s i o n a l corporation there i s an a d d i t i o n a l organizat i o n a l problem.  Should there be one computer system which a l l d i v i s i o n a l  managements are t o use, or should each d i v i s i o n a l management be allowed to make decisions i n t h i s area and have t h e i r own computer system?  Ob-  v i o u s l y , the main consideration here i s the s i z e of the company and i t s . divisions.  A very l a r g e company w i l l have d i f f i c u l t y obtaining a computer  large enough t o make a c e n t r a l i z e d i n s t a l l a t i o n p o s s i b l e . A small d i v i s i o n , 12.  Leo C. Simmons, "Executive Problems and Opportunities A r i s i n g Out of Automatic Systems", Hattery & Bush, eds., op. c i t . , p. l6h.  -14on the other hand, w i l l have d i f f i c u l t y i n a t t a i n i n g f u l l u t i l i z a t i o n 12 a of even a small i n s t a l l a t i o n , making d e c e n t r a l i z a t i o n i n f e a s i b l e . There w i l l , of course, he numerous intermediate s i t u a t i o n s and decisions "based on i n d i v i d u a l f e a s i b i l i t y studies w i l l need t o be made.  This,  however, becomes an element of cost c o n t r o l , which as mentioned p r e v i o u s l y , i s beyond the scope of t h i s paper. A d m i n i s t r a t i v e Control I t was pointed out above that good o r g a n i z a t i o n a l c o n t r o l requires the  separation of programming and computer operating personnel.  This  analysis of a d m i n i s t r a t i v e c o n t r o l w i l l therefore be s i m i l a r l y divided. Systems A n a l y s i s and Programming A f t e r a d e c i s i o n has been made t o computerize a system, the f i r s t important i n t e r n a l c o n t r o l consideration i s t o ensure that the computer programs w i l l i n f a c t perform i n accordance w i t h the system prescribed. . I t i s therefore very important that the system i s c l o s e l y examined, c l e a r l y defined, completely charted and documented before programming begins. System a l t e r a t i o n s become more expensive, more d i f f i c u l t -13.  as programming progresses towards completion.  and more dangerous  Documentation should be  i n the hands o f , not only the programmers, but also the user department and should e x p l i c i t l y o u t l i n e procedures and include samples of input and 14 output documents Secondly, i n the i n t e r e s t s of programming e f f i c i e n c y , i n t e r - p r o 12 a. Perlman, J . A., " C e n t r a l i z a t i o n Versus D e c e n t r a l i z a t i o n , " Datamation, September, 1965. 13.  H.N. Laden and T.R. G i l d e r s l e e v e , Systems Design f o r Computer A p p l i c a t i o n s , New York: John Wiley & Sons, Inc., 1963, pp. 272-273.  14.  David D. McCracken, Harold Weiss and Tsai-Hwa Lee, Programming Business Computers, New York: John Wiley & Sons, Inc., 1959, p. 390.  -15grammer communication, programmer t r a i n i n g , program a c c e s s a b i l i t y and review, a set of programming standards and techniques should be p r e s c r i b e d . Documentation of these standards should be i n the possession of and adhered t o by a l l programmers.  This documentation should s p e c i f y requirements i n the  areas of coding, compiling, t e s t i n g , flow c h a r t i n g , recording, symbols, 15  nomenclature,  f i l e i n d i c e s and other techniques  T h i r d l y , there are s e v e r a l reasons why the programs themselves should be w e l l documented.  Documentation i s very valuable as a reference  i n l o c a t i n g e r r o r s and implementing serves as a means of inter-programmer  c o r r e c t i v e and other a l t e r a t i o n s . I t communication and becomes e s p e c i a l l y  important when there i s s t a f f turnover.  In cases where the corporation  concerned i s d i v i d e d i n t o geographical d i v i s i o n s , i t can become very valuable as a reference i n i n t e r - d i v i s i o n a l use of programs.  I t has been s a i d that 16  "a system i s next t o worthless i f i t i s not adequately documented."  Each  program should therefore have a "run book" which should include the f o l l o w i n g : - Narrative description  - Output samples  - High. L e v e l Flow Chart  - Log of program m o d i f i c a t i o n s  - D e t a i l Flow Chart  - Testing procedure and data l i s t i n g  - F i l e layout d e s c r i p t i o n  - Operating i n s t r u c t i o n s  - Memory A l l o c a t i o n 17  - Documentation of a l l relevant procedures. 15. C o n t r o l l e r ' s I n s t i t u t e , op. c i t . , p. I l 6 . 16.  McCracken, et. a l . , op. c i t . , p. 387.  17.  Ronald F. Denz, "Auditing the Data Processing Department". P.P.M.A. Quarterly. A p r i l I967, p. 4 4 .  -16-  F o u r t h l y , i t goes without saying that there must he some c o n t r o l to ensure that the computer system does i n f a c t do what i t i s intended t o do.  Such c o n t r o l i s achieved by an adequate degree of program t e s t i n g and  documentation of such t e s t i n g f o r both the o r i g i n a l programs and a l l subsequent program a l t e r a t i o n s .  Testing of the o r i g i n a l programs should  g e n e r a l l y take the form of a volume t e s t and p a r a l l e l i n g of the manual and the computerized systems j u s t p r i o r t o the complte conversion t o the mechanized system. This aspect of t e s t i n g w i l l be t r e a t e d i n greater d e t a i l i n the f i r s t p o r t i o n of part I I I which w i l l analyse c o n t r o l cons i d e r a t i o n s during the conversion of the system. A f t e r the o r i g i n a l programs have been w r i t t e n and "de-bugged" and the  computerized system i s i n operation, the necessity f o r changes and  the  r e s u l t i n g program maintenance w i l l i n v a r i a b l y a r i s e f o r two main reasons.  I t i s not uncommon t o f i n d programming errors even a f t e r programs may have been i n use f o r months.  These e r r o r s , of course, need t o be corrected.  A l s o , a l t e r a t i o n s i n company p o l i c y , r e p o r t i n g procedures, laws, union contracts and general improvements, w i l l necessitate corresponding a l t e r a t i o n s i n the programs.  To ensure that the computer system continues t o do  what i t i s intended t o do i t i s important that a l l program a l t e r a t i o n s are properly authorized and t e s t e d w i t h adequate user department involvement and that these a u t h o r i z a t i o n and t e s t i n g procedures are w e l l documented 18  for future reference. Computer Operations and Data Processing Most of the data t o be processed by a computer has been, and t o a l a r g e extent s t i l l i s , documented i n a form not readable by computer. 18.  McCracken, e t . a l . ,  op. c i t . , pp. 3 9 0 - 3 9 1 .  -17-  The f i r s t prime c o n t r o l feature i n trie processing of data therefore i s to ensure the accurate conversion of data t o computer-readable  form.  Two aspects are involved: a l l data must be converted and t h i s data must be converted c o r r e c t l y .  The c o n t r o l s necessary t o ensure the  conversion of a l l data are g e n e r a l l y handled by a c o n t r o l group outside the data processing department and w i l l therefore be dealt w i t h i n the second s e c t i o n of Part Ty^ on input c o n t r o l s . With some exceptions, the conversion of data t o machine readable form to date.has g e n e r a l l y involved the keypunching of information taken from the source document onto cards or tape.  The important c o n t r o l using  cards, i s to have a l l , or at l e a s t a l l s t r a t e g i c , information k e y - v e r i f i e d by a second operator.  This acts as a check f o r inadvertent e r r o r s and a l s o  makes c o l l u s i o n necessary f o r fraud t o be s u c c e s s f u l .  In the case of  punched tape the same c o n t r o l can be achieved by having the key-punch machine p r i n t a batch c o n t r o l t o t a l which should then be agreed t o a predetermined t o t a l by a person other than the key-punch machine operator. More r e c e n t l y a v a i l a b l e machinery makes i t p o s s i b l e to key i n f o r mation d i r e c t l y onto magnetic tape.  Here a l s o key v e r i f i c a t i o n i s p o s s i b l e  and should be used as a data conversion c o n t r o l . In some other cases source documents may be w r i t t e n or p r i n t e d i n machine-readable  form.  Bank cheques, f o r example, may have the name and  account number p r e - p r i n t e d w i t h magnetic ink l e a v i n g only the d o l l a r amount to be converted t o machine readable form.  V e r i f i c a t i o n of t h i s conversion  Is best achieved by agreeing the d o l l a r amounts p r i n t e d i n magnetic ink to the d o l l a r amounts hand w r i t t e n i n t o the cheque by the payer.  Data  -18-  to be processed may a l s o be i n the form of a punched tape or a tape using magnetic ink produced by a cash r e g i s t e r .  To v e r i f y t h i s data, r e g i s t e r  t o t a l s should be agreed t o the t o t a l of sales i n v o i c e s or s i m i l a r documents.  I n the case where data i s i n the form of machine-readable,  hand-  w r i t t e n characters t h i s type of c o n t r o l should also be used, but there i s the a d d i t i o n a l problem of the education of personnel o r i g i n a t i n g the documents so that they are i n f a c t  machine-readable.  While the methods of c o n t r o l l i n g the p h y s i c a l movement of data w i l l vary w i t h the o r g a n i z a t i o n and the p h y s i c a l environment, some standard aspects o f c o n t r o l i n t h i s f i e l d can be formulated. punching  E s p e c i a l l y i f key-  (or other type of data conversion.) i s not done i n the user depart-  ment, i t i s advisable t o record r e c e i p t of data i n the keypunch department. This record should, of course, be updated when conversion i s completed and source documents returned t o user department.  A s i m i l a r c o n t r o l of data  returned t o the user department f o r c o r r e c t i o n of coding e r r o r s i s a l s o desirable. The converted data must, of course, be f e d i n t o the computer.  While  operating systems are f a s t becoming more s o p h i s t i c a t e d , there s t i l l e x i s t s the n e c e s s i t y f o r a computer operator.  Since a l l data t o be processed  must be channelled i n t o the computer, the operator w i l l have access t o a great deal of information and proper c o n t r o l i n t h i s area i s therefore imperative.  This c o n t r o l can be d i v i d e d i n t o two aspects namely the pre-  vention of inadvertent e r r o r and the prevention of fraud by the operator. Prevention of fraud by the operator presents a unique dilemma. I f the operator i s reasonably w e l l versed i n programming, he w i l l be able t o perform h i s duties and cope with, emergencies b e t t e r . However, he w i l l  -19-  then a l s o be able t o b e t t e r understand the program i n use by the computer and t h i s knowledge combined w i t h the a v a i l a b i l i t y of data would make fraudulent manipulation much easier.  Good c o n t r o l therefore requires that  the operator should not be very f a m i l i a r w i t h programming techniques but have adequate a n a l y t i c a l a b i l i t y , good education i n computer operations 19  and e x p l i c i t operating i n s t r u c t i o n s f o r each program Wherever i t i s economically f e a s i b l e , the computer i n s t a l l a t i o n should be equipped w i t h a console t y p e w r i t e r such that attempts at fraud w i l l be recorded on the p r i n t - o u t .  The p r i n t - o u t should be i n pre-numbered  form so that removal of portions thereof would be detected.  Other checks  against attempts at fraud include adequate s u p e r v i s i o n , r o t a t i o n of s h i f t s , and the use of more than one operator wherever economically f e a s i b l e . Since i t i s d e s i r a b l e that the operator i s not too f a m i l i a r w i t h programming, operating i n s t r u c t i o n s become an important f a c t o r i n the prevention of non-fraudulent e r r o r s . able f o r every program i n the system.  These should be e x p l i c i t and a v a i l The operator should a l s o be ade-  quately t r a i n e d and educated so he i s thoroughly f a m i l i a r with the machinery and keeps informed of changes and developments i n computer and p e r i p h e r a l machinery. Computer usage f o r the various a p p l i c a t i o n s should, of course, be w e l l scheduled t o obtain maximum u t i l i z a t i o n and t o ensure that user departments receive r e p o r t s , and other output on time. 19.  An accurate record  E. Wainwright M a r t i n J r . , E l e c t r o n i c Data Processing, Homewood, 111.: Richard D. I r w i n , Inc., 1965, pp. 463-467.  -20-  of time spent on each a p p l i c a t i o n should be kept t o f a c i l i t a t e  proper  a l l o c a t i o n of costs and analysis of l o s t time. One of the important features of a l l mechanized systems i s the f a c t that a great deal of important information i s stored on magnetic tapes and disks.  This information i s not readable by the human eye and i s h i g h l y  vulnerable t o d e s t r u c t i o n .  Information  on magnetic tape i s destroyed when  new information i s w r i t t e n onto the tape and a c o n t r o l t o prevent the use of the wrong tape i s therefore necessary. form of a l i b r a r i a n . persons.  This c o n t r o l generally takes the  Access t o the l i b r a r y should be l i m i t e d t o authorized  Tapes should be c l e a r l y l a b e l l e d and f i l e d and a record kept  showing the p h y s i c a l l o c a t i o n and content of each tape.  These records  should also show which, tapes are a v a i l a b l e f o r use at any one time and include a usage h i s t o r y so that o l d tapes are r e t i r e d when necessary. Control of tapes should also include adequate back-up r e t e n t i o n of important tapes, e s p e c i a l l y master f i l e s .  For p r o t e c t i o n i n case of d i s a s t e r  l i k e f i r e , i t i s desirable f o r some of t h i s back-up t o be kept o f f the 20  premises i n f i r e proof f a c i l i t i e s Summary A d e c i s i o n t o use a computer gives r i s e t o a new group of personnel who look, a f t e r the t e c h n i c a l aspects of operating the machinery.  This,  i n t u r n , generates some new o r g a n i z a t i o n a l and administrative problems. There are two main o r g a n i z a t i o n a l c o n t r o l problems.  F i r s t l y , the  l o c a t i o n of the E.D.P. f u n c t i o n w i t h i n the o v e r a l l organization needs t o 20.  W. T. P o r t e r , J r . , "Auditing and the Computer", The I n t e r n a l A u d i t o r , F a l l , 1 9 6 7 , pp. 3 5 - 3 6 .  -21-  be determined.  I t was suggested that E.D.P. should operate as a separate  department s e r v i c i n g user departments, and that the l a t t e r should have adequate control over work done f o r them by the E.D.P. department. Secondly, i t was pointed out that good control requires that the E.D.P. department i t s e l f be divided into two sections:  computer operations and  programming. Discussion of the administrative control of the department was simil a r l y divided.  The systems analysis and programming section should have  i n effect the mechanics necessary t o ensure that computer programs do what they are intended t o do, that they are well documented, well tested and that only desirable a l t e r a t i o n s are made.  With regard to computer opera-  tions , controls should be i n s t a l l e d to ensure correct conversion of data to machine-readable form, t o detect operator fraud or error and to prevent loss of important information due to mishandling of storage devices or breakdown of machinery. Having examined the organization and administration of the E.D.P. department, attention w i l l now be directed to the process of converting a system from a manual basis to one using a computer i n s t a l l a t i o n .  -22-  PAET I I I THE CONVERSION PROCESS Introduction In Part I I we examined the c o n t r o l problems involved i n organizing and administering an E.D.P. department.  I t was pointed out that the  department does not e x i s t f o r i t s e l f but acts as a service department t o user departments.  In order f o r t h i s user department t o a c t u a l l y become  a user o f the computer s e r v i c e s , i t must, o f course, d i s c a r d the manual system and adopt a new system u t i l i z i n g the computer.  This changeover  or conversion brings with, i t a v a r i e t y of problems, which can be s a i d t o revolve around two main issues: i.)  developing and t e s t i n g the computer system t o a point where i t i s considered trustworthy',  ii.}  employee education, r e - t r a i n i n g and morale.  Part I I I w i l l examine these two issues and t h e i r p e r i p h e r a l problems. The conversion process might be defined as "the changeover from 21  tbe previous data processing methods t o the computer systems."  Ob-  v i o u s l y , such, a changeover must not be f i n a l i z e d and the previous methods discontinued u n t i l the p a r t i e s concerned are confident that the computer system does i n f a c t produce a l l the required r e s u l t s c o r r e c t l y . While no responsible party w i l l argue w i t h t h i s basic premise, there has been some disagreement as t o how t h i s confidence i n the new system i s t o be achieved.  I t might seem l o g i c a l , indeed e s s e n t i a l , t o some that the only  way i n which the desired degree of confidence i n the new system can be a t t a i n e d i s t o operate the new system concurrently with the o l d system f o r a period long enough t o allow adequate v e r i f i c a t i o n of the computer 21.  McCracken, e t . al.-, op. c i t . , p. 3 8 6 .  -23system's r e s u l t s by comparison with those of the previous system.  On  the other hand, there are those who argue t h a t : users of automatic equipment f i n d that output from a l o g i c a l l y correct and de-bugged program i s extremely accurate, so that l i t t l e or no p a r a l l e l operation i s needed t o v e r i f y the accuracy of the new system r e s u l t s . 2 2 The p a r a l l e l operation i s s a i d merely t o uncover the errors of the previous 23 system instead of those of the new one.  There i s some merit i n the  argument since programs are undoubtedly very accurate i f they are l o g i c a l l y correct and completely de-bugged.  However, i t can be very d i f f i c u l t , and  f r e q u e n t l y i s , t o determine d e f i n i t e l y whether or not the program i s ent i r e l y c o r r e c t . i n i t s l o g i c and has been completely de-bugged.  In the  f i r s t p l a c e , i n a large and complicated system i t i s l i t e r a l l y impossible f o r a t e s t deck t o be r e a l l y comprehensive of p o s s i b i l i t i e s involved.  by v i r t u e of the large number  Secondly, i n such complex systems i t i s un^-  l i k e l y that the t e s t deck i s r e a l l y adequate unless'the programmer has "In-depth" experience i n the a c t u a l implementation of the p o l i c i e s , procedures and i n t r a c a c i e s of the system. case.  Frequently t h i s w i l l not be the  T h i r d l y , f o r t e s t i n g t o be adequate, a considerable amount of user  department involvement w i l l be necessary, and t h i s involvement can be meaningful and genuine only i f user department personnel have a reasonable knowledge of computers and t e s t i n g techniques.  Moreover, an  independent  a p p r a i s a l of t e s t i n g procedures i s h i g h l y d e s i r a b l e e s p e c i a l l y i n cases where the system i s of a f i n a n c i a l nature or where i t involves complex r e c o r d keeping and r e p o r t i n g of assets. While i n t e r n a l and e x t e r n a l audit a c t i v i t y i n computerized systems has undoubtedly increased i n recent years, i t has generally taken the form of c o n t r o l e v a l u a t i o n and the use of audit 22. Eobert H. Gregory and Richard L. Van Horn, Automatic Data-Processing Systems, San F r a n c i s c o , Wadsworth P u b l i s h i n g Co., Inc., 196®, p. 571. 23. I b i d . , p. 427 .  -24programs a f t e r the implementation of the system. Current and recent news i n d i c a t e s that the number of cases where conversion d i f f i c u l t i e s have been encountered and reported has been relatively significant.  I t would not be unreasonable to assume that the  number of such cases that have gone u n p u b l i c i z e d would be even greater. The r e s u l t s of such conversion problems can be s u b s t a n t i a l f i n a n c i a l l o s s e s , s t r a i n e d employer-employee r e l a t i o n s , accounting problems and i n some cases d e t e r i o r a t i o n of customer g o o d w i l l . Therefore, i t i s suggested here that t o r e l y e n t i r e l y on simulat i o n i n t e s t i n g a system i s inadequate.  The importance of a p a r a l l e l  operation should not be minimized; the r i s k i s too great.  The  authors  of Programming Business Computers go as f a r as t o say that a d e c i s i o n against the use of a p a r a l l e l operation i s a " f a l s e economy", i n s p i t e of the f a c t that an a t t i t u d e minimizing i t s importance has been prevelant 24 f o r some time. Assuming, t h e r e f o r e , that a p a r a l l e l operation i s n e c e s s a r y , ' i t can be viewed as having a dual purpose: i.)  i t makes i t p o s s i b l e f o r us to gain confidence i n the new system,  Ii.)  i t gives user department personnel a period of adjustment, 25  thereby  helping to prevent morale problems. Gaining Confidence i n the System The f i r s t step i n a s u c c e s s f u l conversion process i s t o make e a r l y p l a n s . f o r the o r d e r l y and scheduled execution of each of the steps i n the process.  "One  time" conversion programs w i l l need to be w r i t t e n ,  24.  McCracken, e t . a l . , op. c i t . p. 380.  25.  E. Waingrlght M a r t i n J r . , E l e c t r o n i c Data.Processing An I n t r o d u c t i o n , Revised E d i t i o n , Homewood, 1 1 1 . : R i c h a r d I r w i n , Inc., 1 9 6 5 . , pp.  273-274.  -25imich key punch a c t i v i t y may be necessary t o create new master f i l e s , user department personnel w i l l need t o be educated i n the new c l e r i c a l r o u t i n e s , a d d i t i o n a l temporary personnel may be necessary and errors i n the o l d 26  system records w i l l be l o c a t e d and w i l l need c o r r e c t i o n .  A great deal  of time w i l l be necessary i n some of t h i s preparatory a c t i v i t y and unless t h i s i s planned w e l l i n advance, the r e s u l t i n g confusion w i l l p r e c i p i t a t e serious and expensive d i f f i c u l t i e s or c o s t l y postponements. When the planning and necessary preparation has been completed, the equipment should be i n s t a l l e d .  To have the equipment i n s t a l l e d  e a r l i e r can be unnecessarily c o s t l y e s p e c i a l l y i f i t i s a f i r s t attempt 27  at computerization. To begin the a c t u a l conversion process, i t may be advisable t o create a "skeleton" master f i l e .  This w i l l reduce the work load consider28  ably when the p a r a l l e l o p e r a t i o n - i s t o begin.  For example, i f the system  being mechanized i s an inventory c o n t r o l system, permanent information l i k e stock number, name, minimum and maximum q u a n t i t i e s , primary and a l t e r n a t e s u p p l i e r s , order q u a n t i t y , terms, year-to-date f i g u r e s , warehouse l o c a t i o n and perhaps cost and s e l l i n g p r i c e s might be placed on t h i s "skeleton" master f i l e .  When the p a r a l l e l operation i s ready t o proceed, a l l that  w i l l be necessary t o complte the master f i l e i s t o i n s e r t v a r i a b l e informat i o n l i k e quantity and d o l l a r value of goods on hand.  Thus the work load  at t h i s c r u c i a l time i s reduced considerably. At the time when the new master f i l e i s completed and before i t i s updated w i t h any current t r a n s a c t i o n s , an important aspect of i n t e r n a l c o n t r o l should be exercised. I t i s important that new master c o n t r o l t o t a l s 27. Oscar S. Nelson and Richard S. Woods, Accounting Systems and Data P r o c e s s i n g , • C i n c i n n a t i : South-Western P u b l i s h i n g Co., 1 9 6 l , ' p. 634. 28. ' McCracken:, e t . a l . , op. c i t . , pp. 386-387.  -26-  are v e r i f i e d t o the c o n t r o l t o t a l s of the o l d system before the new master i s updated with any current a c t i v i t y .  In an accounts receivable system,  f o r example, the sum of balances owing according to the new system should be checked to that of the o l d system.  Errors i n the c r e a t i o n of the  new  master f i l e can, i n t h i s way, be i s o l a t e d , l o c a t e d and corrected much more e a s i l y than i f the new master f i l e were allowed to be " c l u t t e r e d " with, a large volume of current t r a n s a c t i o n data.  Once c o n t r o l t o t a l s  have been agreed, c o r r e c t i o n s , i f any, have been made and c o n t r o l t o t a l s have subsequently been found to be i n agreement, t h i s v e r i f i c a t i o n serves as a v a l u a b l e "check p o i n t " i n the proceedings.  I t i s of value i n that i t  provides assurance that the conversion procedure i s correct to that point and that i f errors are found l a t e r they must be i n areas of the procedure subsequent t o t h i s p o i n t .  Subsequent errors are therefore more e a s i l y  located. I t i s also advisable at t h i s point to obtain a copy of the system master i n p r i n t e d form f o r two reasons.  new  F i r s t l y , i t w i l l be nec-  essary f o r the l o c a t i o n of differences i f c o n t r o l t o t a l s do not agree. Secondly, i t .makes p o s s i b l e the v e r i f i c a t i o n of information other than q u a n t i t i e s or d o l l a r amounts used i n the c o n t r o l t o t a l s .  This i s h i g h l y  d e s i r a b l e , at l e a s t on a sample b a s i s . I t should be stressed at t h i s point that i f the p a r a l l e l operation i s to be performed with l i v e data to be used concurrently by the o l d system, then the v e r i f i c a t i o n of the new master f i l e s must not be allowed to become too time consuming.  I f i t becomes too time consuming, i t w i l l cause a  delay i n the regular processing of current transactions and the r e s u l t a n t problems and costs.  I t may  therefore be necessary to have temporary addi-  -27t i o n a l s t a f f a v a i l a b l e and/or to make trie necessary provisions f o r overtime work by user department personnel. When the new master f i l e i s complete and c o r r e c t , the emphasis must, of course, s h i f t to the v e r i f i c a t i o n and c o n t r o l of input (current' t r a n s a c t i o n s ) to the two systems which begin a c t u a l p a r a l l e l at t h i s p o i n t .  operations  There i s a very r e a l danger that the emphasis p r i o r to  and during the conversion w i l l have been placed too h e a v i l y on the c r e a t i o n of master f i l e s and programs at the expense of f a m i l i a r i z a t i o n with 29  peripheral c l e r i c a l routines.  To ensure that a l l required input reaches  the computer, i t i s e s s e n t i a l that these routines are w e l l planned and that the personnel involved are w e l l informed i n t h i s regard.  I t i s im-  p e r a t i v e that a l l input to the o l d system i s also input to the new  system.  To ensure that this- i s the case, current transactions should be batched and these hatches l i s t e d as they enter i n t o the system that f i r s t uses them.  A copy of t h i s l i s t i n g should then be used as a "check l i s t "  the input enters the other system.  as  I f inputs to the two systems are iden-  t i c a l , then subsequent differences must be errors of commission and cannot be errors of omission.  I s o l a t i o n , l o c a t i o n and c o r r e c t i o n of errors w i l l  therefore be l e s s d i f f i c u l t . The conversion process i s now at a stage where the computer programs w i l l f o r the f i r s t time update master f i l e s and produce p r i n t e d output. The key aspect of the e n t i r e p a r a l l e l operation i s to ensure that these programs process the data c o r r e c t l y and produce the required output.  To  v e r i f y the F i l e Maintenance (updating of master f i l e ) , the program should accumulate q u a n t i t i e s arid/or d o l l a r amounts of items processed and p r i n t 29.  C o n t r o l l e r ' s I n s t i t u t e Research Foundation, Conway e t . a l . , op. c i t . , p. 1 3 3 . (Now the F i n a n c i a l Executive's I n s t i t u t e ) .  - 2 8 -  t h e s e r e s u l t s a t t h e end o f t h e r u n . to  input t o t a l s .  The r e s u l t s s h o u l d then he v e r i f i e d  The computer s h o u l d a l s o p r i n t t h e new c o n t r o l t o t a l s  and t h e s e s h o u l d be v e r i f i e d i n two ways.  F i r s t l y , t h e y s h o u l d be v e r i -  f i e d t o t h e p r e v i o u s c o n t r o l t o t a l s a d j u s t e d by c u r r e n t i n p u t t o t a l s . an accounts  r e c e i v a b l e system, f o r example, t h e o l d c o n t r o l t o t a l , p l u s  current c r e d i t total.  In  s a l e s l e s s c u r r e n t c o l l e c t i o n s s h o u l d e q u a l t h e new c o n t r o l  Secondly, t h e new system c o n t r o l t o t a l s s h o u l d be v e r i f i e d t o  those o f t h e o l d system. Most systems w i l l have s u b s i d i a r y programs and these s h o u l d be v e r i f i e d i n a s i m i l a r manner. be checked,  Each o f t h e programs' outputs s h o u l d a l s o  a t l e a s t on a sample b a s i s , t o those o f t h e o l d system.  D u r i n g t h e p r o c e s s o f v e r i f i c a t i o n , ' d i f f e r e n c e s between t h e r e s u l t s of  t h e two systems w i l l be l o c a t e d .  One o f t h e major problems o f t h e  c o n v e r s i o n p r o c e s s i s t h e f a c t t h a t t h e s e d i f f e r e n c e s a r e f r e q u e n t l y due to,  not t h e m a l f u n c t i o n i n g o f t h e new system, b u t e r r o r s i n t h e o l d system.  30 The programs used i n t h e new system cannot  detect these e r r o r s .  There-  f o r e i t i s p o s s i b l e f o r t h e new master f i l e t o be a l t e r e d from c o r r e c t t o I n c o r r e c t f i g u r e s u n l e s s t h e n e c e s s a r y p r e c a u t i o n s a r e t a k e n t o prevent this.  I t i s suggested t h a t a l l d i f f e r e n c e s s h o u l d be l i s t e d and t h e  master f i l e  o f t h e o l d system v e r y c a r e f u l l y examined f o r e r r o r s b e f o r e  any c o r r e c t i o n s t o t h e new master f i l e  a r e made.  Corrected input t o t a l s  s h o u l d , o f c o u r s e , be used t o v e r i f y c o r r e c t e d output t o t a l s and c o n t r o l t o t a l s o f t h e new system s h o u l d be agreed t o those o f t h e o l d system a f t e r c o r r e c t i o n s have been made.  30. ' Nelson & Woods, op. c i t . , pp. 632-633 •  -29-  I t should be pointed out that where the system being converted i s a large and complicated one, i t may be advisable t o perform the p a r a l l e l 31 operation on a c y c l i c a l b a s i s .  In the case of any inventory c o n t r o l  system, f o r example, the procedure might-begin w i t h the c r e a t i o n of a new master f i l e f o r one department (or one group of departments) only.  After  operating t h i s department(s) i n p a r a l l e l f o r a few days, the new master' f o r a second department (or group of departments) might be created.  This  process would be thus repeated u n t i l a l l departments are on p a r a l l e l operation.  When the l a s t department i s thus placed on p a r a l l e l operation,  the new system r e s u l t s of the f i r s t department may have been t e s t e d and v e r i f i e d enough t o permit discontinuance of the o l d system f o r that department. Quite aside from avoiding the "shock" of s t a r t i n g and stopping the huge p a r a l l e l operation at one point i n time, there are some d i s t i n c t advantages of performing the p a r a l l e l operation i n t h i s way.  Firstly, i t  allows much more time f o r the c r e a t i o n of the new master f i l e s than would be a v a i l a b l e i f they a l l had t o be ready by the same deadline.  Secondly,  the amount of v e r i f i c a t i o n work"begins w i t h a minimum and does not reach a maximum u n t i l a l l departments are on p a r a l l e l operation.- Moreover, t h i s maximum w i l l g e n e r a l l y not have t o be maintained f o r a long time because departments converted e a r l y i n the process may no longer require the p a r a l l e l operation of the o l d system.  T h i r d l y , errors are more e a s i l y  located and corrected because volume i s at a minimum i n the e a r l y stages of the process. 31.  McCracken, e t . a l . , op. c i t . , pp. 386-387•  -30-  A P e r i o d of Adjustment f o r User Personnel I t i s common knowledge that the a c q u i s i t i o n of a computer as w e l l as the mechanization of any one system can give r i s e t o serious problems i n the morale of the personnel involved.  At f i r s t glance, t h i s might  seem t o be beyond the scope of an examination of i n t e r n a l c o n t r o l of computer a p p l i c a t i o n s .  However, i f a conversion process were t o be un-  successful f o r any reason, there would be no computer a p p l i c a t i o n and hence no need f o r a discussion of i n t e r n a l c o n t r o l i n such a p p l i c a t i o n s .  An  examination of the process of converting a manual system t o a computer a p p l i c a t i o n must, t h e r e f o r e , consider the personnel problems involved because i t involves people.  In other words, i f there i s no c o n t r o l over  the people involved and the tasks they perform, there w i l l be no computer application.  Some of the morale problems involved and methods which  experience has proven h e l p f u l i n a l l e v i a t i n g these problems w i l l , theref o r e , b r i e f l y be discussed here. The computer gives r i s e t o personnel morale problems mainly because i t s appearance creates c e r t a i n fears i n user, department personnel.  People  are a f r a i d t h a t they may be displaced and hence unemployed once the system i s computerized.  Even a f t e r having been assured that they w i l l not be  unemployed, they may be a f r a i d t h a t , since, the jj.ob they are now.doing i s t o be computerized, they may be l e f t w i t h a menial and boring job.  Some are  a f r a i d that they w i l l become subordinate t o the machine - mere robots 32  forced t o obey t h i s mechanical "master of men."  I n a d d i t i o n t o these fears  (which i n some instances may w e l l be j u s t i f i e d ) the conversion process i t s e l f 32.  C. L. L i t t l e f i e l d and R. L. Peterson, Modern O f f i c e Management, Englewood C l i f f s , Prentice H a l l , Inc., 1956, p. 229.  - 3 1 -  may "be very demoralizing i n that i t h i g h l i g h t s the errors of both the o l d 33  and the new system.  I f many problems are encountered and the errors i n  the new system are numerous, personnel may get the f e e l i n g that nothing i s t o be gained by the change.  The support of personnel f o r the system  may thus be l o s t p r e c i s e l y at the time when i t i s needed most. I t i s suggested here that the most important f a c t o r i n overcoming, or p r e f e r a b l y preventing, the demoralization caused by fear i s the educat i o n of the personnel involved.  I f t h i s personnel i s knowledgeable  about  what a computer can do and how the new system w i l l work, u n j u s t i f i e d fears w i l l be removed.  Moreover, keeping them informed, w e l l i n advance, of  what i s about t o happen and what part they w i l l play i n the new procedures, w i l l give them a f e e l i n g of involvement. In cases where fears are j u s t i f i e d , that i s , where the o l d job as such w i l l no longer e x i s t i n the new system, r e - t r a i n i n g the people i n volved should be used wherever p o s s i b l e .  This statement may sound l i k e  a g e n e r a l i z a t i o n or part of the p l a t f o r m of a vanguard of the working class.  However, i n an accounting a p p l i c a t i o n i t i s more than that and  therefore warrants c l o s e r examination.  F i r s t l y , i t w i l l be necessary t o  r e t a i n t h i s personnel as long as the o l d system i s being operated which w i l l include at l e a s t the major p o r t i o n of the p a r a l l e l operation. Thus, at a c r u c i a l p e r i o d when t h e i r co-operation i s needed most, t h e i r d i s s a t i s f a c t i o n would be at i t s peak i f they knew they were t o be displaced and unemployed i n a short time.  Secondly, i f some people are d i s p l a c e d ,  i t w i l l be very d i f f i c u l t t o convince the others that they never w i l l be. 33.  M a r t i n , op. c i t . p. 2 7 5 .  -32Remaining personnel may f e e l that i t i s just a matter of time u n t i l they are also displaced.  And even i f t h i s were not the case, there would he  a tendency f o r them to he very unhappy about the.::, displacement fellow-employees.  of t h e i r  Thus morale would be low f o r p r a c t i c a l l y a l l personnel  involved p r e c i s e l y at a c r u c i a l time when co-operation i s needed most. T h i r d l y , there i s some question as to whether displacement necessarily always needs t o generate unemployment.  While personnel requirements may  decrease i n one area, they may increase i n others.  In some cases, ex-  perience i n the l a t t e r i s not e s s e n t i a l and a b r i e f period of on the job t r a i n i n g may be adequate.  In other cases, of course, r e - t r a i n i n g w i l l be  necessary and t h i s w i l l involve some a d d i t i o n a l expense.  An early exam-  i n a t i o n as to which areas' requirements w i l l decrease or increase and caref u l planning as to how these are to be handled w i l l pay s i g n i f i c a n t  divi-  dends i n the form of better employee .morale during and after the period of conversion. The p a r a l l e l operation gives r i s e to another personnel problem i n that i t usually must have both the old and new system operating concurrently.  T h i s , and the fact that huge new master f i l e s need to be  created, temporarily increases the work load immensely and a considerable amount of temporary a d d i t i o n a l s t a f f may be required.  This problem i s  further, amplified by the fact that many of the jobs i n t h e old system may be non-existant when the p a r a l l e l operation is• comp3e'tecL. Thus, at a time when i t may seem l i k e a reduction i n s t a f f might be i n order, a temporary increase i n s t a f f w i l l i n fact be necessary. W.  Ibid. , p.275.  Moreover, since  -33the purpose of the p a r a l l e l operation i s t o v e r i f y and.gain confidence i n the new system, i t w i l l . h e necessary t o have personnel a v a i l a b l e to compare the r e s u l t s of the two systems and i n i t i a t e corrections where required. An attempt t o remove displacement fears by r e - t r a i n i n g and educat i o n and also t o meet the above-mentioned personnel requirements' generates another problem.  I f personnel i n jobs i n the o l d system are t o be r e t r a i n -  ed t o do jobs i n the new system, they w i l l not be a v a i l a b l e t o operate the old system, n e i t h e r during the r e - t r a i n i n g p e r i o d nor the p a r a l l e l operation.  Before r e - t r a i n i n g of permanent s t a f f can begin i t w i l l therefore  be necessary t o t r a i n temporary s t a f f t o perform the o l d jobs i n the o l d system.  F a i l i n g t h i s , the o l d system may not be r e l i a b l e before and  during the p a r a l l e l operation. Needless t o say, i f these requirements are t o be met, both the planning and the a c t u a l t r a i n i n g and r e - t r a i n i n g w i l l have to commence long before the p a r a l l e l operation i s t o begin. I t should also be pointed out that the r e - t r a i n i n g may r e s u l t i n numerous inter-departmental t r a n s f e r s of personnel from the user department t o the Data Processing department.  Moreover, the d e f i n i n g of the  systems, the w r i t i n g of the programs and the a c t u a l conversion process w i l l r e q u i r e exhaustive communications between the two departments. communications can become d i f f i c u l t at times because the two  Such  departments  may not always have a c l e a r understanding of the functions and d e t a i l s of each other. Therefore, i t i s suggested that when a d e c i s i o n to mechanize a system i s made, a co-ordinator to head the complete project should be appointed as soon as possible... This co-ordinator whould be  knowledgeable  -34-  i n both computer technology and the f u n c t i o n of the user department.  It  would be the job of the co-ordinator t o act as a l i a i s o n between the two departments and t o plan and carry out the conversion procedure. An I l l u s t r a t i o n To i l l u s t r a t e more e x p l i c i t l y the conversion and p a r a l l e l operat i o n and the i n t e r n a l c o n t r o l i n v o l v e d , an example w i l l be described at t h i s point.  The example used i s that of an Accounts Receivable system.  I t i s not suggested that the procedure described i s the only approach t o the problem; d i f f e r e n t procedures may supply the required confidence i n the system equally w e l l .  However, the v e r i f i c a t i o n of the new system's  r e s u l t s to those of the o l d system must be included e i t h e r i n the manner suggested or i n some.other s i m i l a r manner. I t i s a l s o suggested that f o r i n t e r n a l c o n t r o l t o be adequate, the procedure should be subject t o independent review p r e f e r a b l y by an i n t e r n a l audit department.  E a r l y audit involvement can be separated  i n t o two areas. F i r s t l y , there should be audit department p a r t i c i p a t i o n i n the i n i t i a l planning of the system i t s e l f and the computer programs to ensure that i n t e r n a l c o n t r o l w i t h i n the system i s adequate.  This  aspect w i l l be f u r t h e r discussed i n a subsequent section on the i n t e r n a l audit department.  Secondly, the i n t e r n a l audit department should become  involved i n the conversion process to ensure that the v e r i f i c a t i o n of the new system i s i n f a c t c a r r i e d out as planned.  To achieve t h i s the  i n t e r n a l audit department should make p e r i o d i c i n v e s t i g a t i o n s t o ensure that the checks and v e r i f i c a t i o n s as o u t l i n e d above and i n the f o l l o w i n g i l l u s t r a t i o n are i n f a c t c a r r i e d out.  -35The f i r s t step, as p r e v i o u s l y suggested, i n the successful conversion procedure i s the appointment of a co-ordinator. He should then commence l i a i s o n , planning and supervisory duties as'shown below.  These  may not n e c e s s a r i l y be performed i n the order l i s t e d and some aspects may be i n progress simultaneously. 1. )  Ensure that the system and a l l procedures are adequately  analysed and documented. 2. )  Ensure that the w r i t i n g of the new system's computer programs  commences and progresses on schedule. 3. )  Ensure that a l l p e r i p h e r a l c l e r i c a l routines are duly es-  t a b l i s h e d and the p e r t i n e n t personnel educated as necessary. 4. )  Ensure that the w r i t i n g of "one time" programs commences and  progresses as r e q u i r e d . 5. )  Inform and educate a l l user department key personnel on de-  velopment s. 6. )  Plan and schedule the conversion procedure and advise per-  sonnel i n v o l v e d accordingly.7. )  A s c e r t a i n what jobs w i l l be displaced and what permanent new  jobs w i l l be created and plan t r a n s f e r s and r e - t r a i n i n g accordingly. 8. )  A s c e r t a i n what temporary help may .be necessary, what t r a i n -  ing they w i l l need- and where they w i l l be obtained. 9. )  E s t a b l i s h and document the comparison, v e r i f i c a t i o n and error  c o r r e c t i o n procedures. 10.).  Make arrangements t o get a c t u a l r e - t r a i n i n g underway.  -36-  11. )  When both the old. system w i t h temporary help and the new system w i t h  r e - t r a i n e d permanent s t a f f are completely o p e r a t i o n a l and a l l v e r i f i c a t i o n routines e s t a b l i s h e d and learned, decide p r e c i s e l y when p a r a l l e l operations are t o begin and inform a l l personnel involved. 12. )  Carry out p a r a l l e l operations as shown on the chart ( e x h i b i t l ) .  13. )  When p a r a l l e l operation has proven the new system t o be r e l i a b l e ,  make a d e c i s i o n as t o when p a r a l l e l operations are t o cease and the o l d system can be discarded. Comments on Chart (See Figure I , page 36 a) General i.) cards.  The chart shows source media as being converted onto punched  This could, of course, take a d i f f e r e n t form l i k e punched tape or  other machine readable forms. ii.)  The chart shows master f i l e s as being on tape.  These Jiiight,  of course, be on disk or durm. iii.)  The chart i l l u s t r a t e s the v e r i f i c a t i o n of the two most im-  portant outputs o f the new system, but other parts o f the system (e.g. c r e d i t r e p o r t i n g , w r i t e - o f f s , aging reports etc.) would need t o be t e s t e d i n a s i m i l a r manner. iv.) fashion.  The conversion procedure might be c a r r i e d out i n a c y c l i c a l  The Accounts Receivable might, f o r example, be d i v i d e d i n t o  10 parts t o be converted i n one month o r , say, 20 working days.  The master  f o r part one would then be completed on day one and part one updated w i t h current t r a n s a c t i o n s f o r two days before the p a r a l l e l operation i s begun w i t h part two. On day three, the new system master f o r part two would  F i g u r e I - C o n t r o l o f the Conversion P r o c e s s . I CREATION OF SKELETON MASTER  COMPLETION OF  -36a-  -36 aIII  II NEW  PARALLEL OPERATION AND VERIFICATION OF NEW  FINAL CORRECTION OF NEW  SYSTEM OUTPUT  MASTER  MASTER  Performed, by "one t i m e " computer programs used only during the conversion process.  • y e r i f y new c o n t r o l t o t a l s o f o l d system. 1. I f c o n t r o l t o t a l s are not equal check newsystem's i n d i v i d u a l " ^ amounts t o o l d system's. Check new system non^ f i n a n c i a l information to old- system at l e a s t on a sample b a s i s . Error corrections to become p a r t of input f o r updated runs d u r i n g p a r a l l e l operation. (E, Column I I I )  y e r i f y new system c o n t r o l t o t a l s system c o n t r o l t o t a l s ( c ) .  (Bl) to old  V e r i f y t r a n s a c t i o n t o t a l s (B2) t o input t o t a l s (A).  Performed by t h e computer programs o f t h e new system i . e . t h e programs whose r e l i a b i l i t y t h e p a r a l l e l operation i s t e s t i n g .  V e r i f y new system cont r o l t o t a l s to o l d system c o n t r o l t o t a l s .  V e r i f y c o r r e c t e d new system c o n t r o l t o t a l s t o o l d system control totals.  V e r i f y new system b i l l i n g totals to old system b i l l i n g t o t a l s .  T e s t check new master t o o l d master.  Compare new system and. o l d system customer statements a t l e a s t on a sample b a s i s .  I f both agree, then a complete c y c l e o f o p e r a t i o n by the new system has been s u c c e s s f u l and p a r a l l e l o p e r a t i o n may no l o n g e r be necessary.  -37-  then be created and f o r the next two days both of the f i r s t two parts would be on p a r a l l e l operation.  S i m i l a r l y part three would go on p a r a l l e l  on day f i v e , part four on day seven, part f i v e on day nine and so on.  The  p o r t i o n of the Accounts Receivable on p a r a l l e l would thus increase gradually u n t i l a l l r e c e i v a b l e s would be on p a r a l l e l at the month end.  At t h i s  p o i n t , part one would have a f u l l month of p a r a l l e l operation.and, depending on r e s u l t s , the o l d system might be discarded f o r part one.  Similarly  part two would then have a f u l l month's p a r a l l e l operation two days l a t e r , part three another two days l a t e r and so on.  These might then also be  discarded on the old'system as they reach a f u l l month's p a r a l l e l operation. This c y c l i c a l operation reduces f u l l d u p l i c a t i o n t o only two days and the volume of e r r o r corrections w i l l be small i f they are detected early. Column I Creating a skeleton master i n advance of the date when the complete master i s r e q u i r e d w i l l decrease the key punching work load i n the rush when the complete master i s required.  I t could include information l i k e  name, address, account number, c r e d i t l i m i t , occupation, employer, previous payment h i s t o r y and other information of a general, h i s t o r i c a l " qr permanent nature. Column I I Just p r i o r t o commencement of p a r a l l e l operation, but a f t e r the o l d system master has been brought completely up to date, a l l a d d i t i o n a l i n f o r - ' mation should be put on the skeleton master to create a complete new master. Before'the master f i l e s of e i t h e r systems are updated w i t h any current t r a n s a c t i o n s , the new master should be v e r i f i e d t o the o l d master as o u t l i n e d  -38-  at the bottom of column I I . Column I I I The operation shown i n column three w i l l be performed.daily, i . e. both masters w i l l be updated w i t h current transactions d a i l y .  To  ensure proper processing by the system and to ensure that a l l items to be processed have i n f a c t been processed, computer output f o r each run should be v e r i f i e d t o input. e.g.  This should be done by type of t r a n s a c t i o n ,  Assume t r a n s a c t i o n t o t a l s f o r the day are as f o l l o w s : - Sales on account  -  $ 10,000  - C o l l e c t i o n s on account  -  8,000  -• Negative adjustments  -  1,000  - P o s i t i v e adjustments  -  2,000  These t o t a l s should be e s t a b l i s h e d and recorded p r i o r to entry i n t o the computer system.  The computer program should then accumulate d o l l a r amounts  of t r a n s a c t i o n s by type (as categorized above) as each t r a n s a c t i o n i s processed.  These accumulated f i g u r e s should then be p r i n t e d at the end of the  computer run and manually v e r i f i e d to the pre-established input f i g u r e s . To ensure that the computer program updates c o n t r o l t o t a l s c o r r e c t l y , the new system's updated c o n t r o l t o t a l s should also be v e r i f i e d t o a pre-determined manually c a l c u l a t e d f i g u r e . e.g.  using the input f i g u r e s mentioned above and assuming, that the t o t a l  Accounts Receivable c o n t r o l f i g u r e was $ 100,000. p r i o r to the run, the new c o n t r o l t o t a l should be: 100,000 +10,000 - 8,000 - 1,000 + 2,000 = 103,000.  The c o n t r o l t o t a l pro-  duced by the computer should be v e r i f i e d t o t h i s f i g u r e .  -39-  Column IV V e r i f i c a t i o n of the new system up t o t h i s point has placed heavy emphasis on input and c o n t r o l t o t a l s w i t h very l i t t l e v e r i f y i n g of i n d i v i d u a l amounts.  T h i s , of course, leaves open the p o s s i b i l i t y of an i n d i v i d u a l  amount being posted t o the wrong customer's account i n e r r o r .  Verifica-  t i o n of new system customer statements to those of the o l d system i s therefore necessary, at l e a s t on a sample b a s i s .  To ensure that a statement i s  p r i n t e d f o r each account, the new system b i l l i n g t o t a l s should be v e r i f i e d to those of the o l d system. Column V Since the process of comparing customer's statements may r e v e a l e r r o r s , corrections may be necessary. This might be done by a "one time" program which corrects the new system master f i l e .  A p r i n t e d new system  master w i l l be necessary t o check that error corrections have been made. A n o t h e r - v e r i f i c a t i o n of new system c o n t r o l t o t a l s w i l l ensure that they have a l s o been corrected i f necessary or that they are s t i l l the same i f they d i d not require c o r r e c t i o n . An a l t e r n a t e to t h i s method might be to use the regular program ( i . e . master f i l e maintenance - column I I I ) t o process these corrections i n the same manner that i t processes adjustments. A p r i n t e d corrected new master would, -however, be necessary t o ensure c o r r e c t i o n of e r r o r s . Discussion of the conversion process to t h i s point has been focused mainly on c o n t r o l of the p a r a l l e l operation of the two systems.  There may,  however, be procedures i n the new system which were not performed by the old system. not  A p a r a l l e l operation, as described above, w i l l , t h e r e f o r e ,  t e s t or v e r i f y such portions of the new system.  -40-  In a system of an accounting nature some of the basic elements of c o n t r o l w i l l , of course, be prevalent whether the system i s computerized or manual.  An Accounts Receivable system, f o r example, should have a  running c o n t r o l f i g u r e t o which the s u b s i d i a r y ledger must balance.  Simi-  l a r l y , an inventory c o n t r o l system should have a t o t a l inventory on hand f i g u r e which should equal the sum of the i n d i v i d u a l items on hand.  The  existence of these very important basic c o n t r o l s i n the new system can be v e r i f i e d - u s i n g the p a r a l l e l procedure described above.  Nevertheless,  new procedures adopted w i l l have t o be v e r i f i e d i n some other  way.  The number of a d d i t i o n a l or new tasks and procedures t o be i n t r o duced at computerization i s very l a r g e and to develop a stereotyped v e r i f i c a t i o n procedure would be  difficult.  I t i s suggested that i f the new procedure i s an important  one,  that i t should be done on a manual b a s i s during the p a r a l l e l operation. This would, i n f a c t , create a p a r a l l e l operation f o r the newly adopted procedure, even though i t was not p r e v i o u s l y part of the o l d system. doubt, i t could be argued that t h i s i s a c o s t l y suggestion.  No  However, i t  could be used f o r a short period of time or done on a s t a t i s t i c a l sample b a s i s , w i t h the length of time or the s i z e of the sample dependent on the importance of the procedure. I t should a l s o be pointed out t h a t , while the conversion procedure described has emphasized a manual t o computerized system, i t can, g e n e r a l l y speaking, be applied i n a computer t o computer conversion.  The major  d i f f e r e n c e that should be taken i n t o consideration i s the f a c t that i t may not be necessary t o key punch master f i l e information t o create the system master f i l e .  new  Since the o l d master i s already i n machine readable  -41form (on tape or d i s k ) i t may "be p o s s i b l e t o use a "one-time" program to create the new master f i l e .  The new master f i l e can then be checked  using a combination of two techniques: i.)  v e r i f y f i n a n c i a l accuracy by checking new c o n t r o l t o t a l s t o o l d  control totals. ii.)  obtain a s t a t i s t i c a l sample of p r i n t e d records from each master  f i l e t o compare n o n - f i n a n c i a l data. Summary The conversion process i s the process of changing from the o l d system t o a new system using a computer,  A period of p a r a l l e l operation  of the two systems i s important because i t generates confidence i n the new system and helps maintain morale of user department personnel. The most important aspect of the conversion process i s e a r l y planning so that the steps of w r i t i n g conversion programs, c r e a t i n g and v e r i f y i n g new master f i l e s , commencement of p a r a l l e l operations, v e r i f i c a t i o n of new system output, c o r r e c t i o n of errors and discontinuance of p a r a l l e l operations w i l l be performed on schedule. To prevent serious d e t e r i o r a t i o n of user department personnel morale, they should be kept informed of developments and given opportunity to become as. knowledgeable of the new system as p o s s i b l e . In cases where jobs w i l l become e x t i n c t , personnel should be r e - t r a i n e d f o r new jobs wherever p o s s i b l e ; There should a l s o be adequate p r o v i s i o n f o r temporary a d d i t i o n a l s t a f f t o meet the p a r a l l e l operation work load. Since planning i s such, a v i t a l part of the conversion process, a project co-ordinator should be appointed as e a r l y as p o s s i b l e . This co-  -42-  ordinator should act as a l i a i s o n between the E.D.P. and user departments and be responsible f o r the complete conversion process. When the new system has been adequately t e s t e d and v e r i f i e d , the old system w i l l be discontinued. s a i d t o become o p e r a t i o n a l . i t s own set of c o n t r o l s .  At t h i s p o i n t , the new system can be  This- new system w i l l , of course, have t o have  While i t was necessary here t o postpone exami-  nation of these controls u n t i l a f t e r a d i s c u s s i o n of the conversion process, i t should be stressed that t h i s should not be the case i n p r a c t i c e .  They  should be given due consideration during the planning of the system and be incorporated i n t o the system when i t i s devised. Part IV w i l l examine the c o n t r o l requirements of a computerized system.  -43-  PART IV CONTROL OF COMPUTER APPLICATIONS (COMPUTERIZED SYSTEMS) Introduction Like any other system, a system using a computer must have a set of c o n t r o l s .  While the purpose of these controls i s not n e c e s s a r i l y  a l t e r e d , the techniques used t o achieve adequate c o n t r o l " w i l l , of necess i t y , he d i f f e r e n t from those of a manual system. A computerized system can he conveniently divided i n t o three areas: i.) ii.) iii.)  preparation, of input data and entry i n t o the computer, processing' of data by the computer, preparation and d i s t r i b u t i o n of output. In a d d i t i o n t o examining the c o n t r o l problems i n these three areas,  Part i y w i l l b r i e f l y - discuss the r o l e of the i n t e r n a l audit department as an element of c o n t r o l . Input'Controls • In many computerized systems, the o r i g i n a l data t o be processed' i s not i n machine -readable form and must be converted.  Key punching of  data i n t o cards or paper tape ( o r , more r e c e n t l y , keying of data d i r e c t l y onto magnetic tape) w i l l , t h e r e f o r e , be an Important and expensive aspect of the o v e r a l l system. . This being the case, i t becomes important that source documents be i n such form as t o maximize key punching e f f i c i e n c y and.minimize c l e r i c a l e r r o r .  P o s i t i o n i n g of data on the source docu-  ment should be as close to that of the card as possible and data should 35 be e a s i l y i d e n t i f i e d . 35.  Since human involvement i s considerably reduced  McCracken e t . a l . , op. c i t . p.  380.  -44-  with computerization, i t i s suggested that some source documents should also be authorized by a person other than the person o r i g i n a t i n g the source document.  For example, adjustments to Accounts Receivable would  be an easy means to fraud i f . such a u t h o r i z a t i o n were not required. In large systems, and e s p e c i a l l y where p h y s i c a l , i n t e r - d e p a r t mental movement of documents takes place, some controls and mechanics to enable t r a c i n g should be used.  For example, source documents may have to  be moved from the user department to the key punching area and punched cards from here to the computer room, with a l l three of these i n d i f f e r ent p h y s i c a l l o c a t i o n s .  I f t h i s i s the case, i t i s suggested that data  should be logged and receipted as i t i s received and subsequently sent to the next department.  While t h i s might be considered a rather moot point  i n some cases, i t becomes s i g n i f i c a n t i n others.  Logging and r e c e i p t i n g  would, f o r example, be very valuable i f the c r e d i t sales input to an Accounts Receivable system were l o s t . With regard to ensuring correct conversion to machine-readable form, the use of the key v e r i f i e r i s common knowledge and general practice.  I t acts as a check f o r errors and makes c o l l u s i o n necessary f o r  fraud to be s u c c e s s f u l . A f t e r conversion to machine-readable form, two further input controls are necessary. i.)  There must be checks to ensure that:  a l l items gain entry to the computer system. 36  ii.)  36.  and that a l l items do so only once.  C. O r v i l l e E l l i o t t and Robert S. Wasley, Business Information Processing Systems, Homewood: Richard D. I r w i n , Inc. 1965. p.268.  -45To achieve t h i s , a r a t h e r simple r o u t i n e , using the f o l l o w i n g steps, might he used: i.)  batch source documents and manually obtain and attach batch  t o t a l ( d o l l a r amount or a count). ii.)  manually c a l c u l a t e a t o t a l of batches t o t a l s .  Iii.)  key punch data i n batches i n c l u d i n g a c o n t r o l card w i t h the batch  total. iv.)  P r i o r t o the processing of any data, have a computer e d i t  program: a. ) Add i n d i v i d u a l items i n each batch and check t h i s sum t o the t o t a l on the c o n t r o l card.  I f they do not agree, an item(s) i s e i t h e r missing or  duplicated and the batch, should be discarded. b. ) accumulate balanced batch t o t a l s and p r i n t the t o t a l ( i . e . the sum of the t o t a l s ) on the console t y p e w r i t e r . This t o t a l plus the t o t a l s of batches discarded should equal the manually c a l c u l a t e d t o t a l of batch totals.  I f i t does not, then a. batch i s e i t h e r missing or d u p l i c a t e d . Batches accepted w i l l then become t o t a l input f o r that computer  run.  D o l l a r amount (or record count) of t o t a l input should be kept on hand  f o r v e r i f i c a t i o n of f u t u r e computer runs.  I f , f o r example, the program i s  updating inventory master records w i t h current purchases  ( i . e . additions t o  s t o c k ) , the computer should accumulate the d o l l a r amount each time a master record i s updated.  This t o t a l should be p r i n t e d at the end of the  run and v e r i f i e d t o the t o t a l input f i g u r e . Rejected batches w i l l , of course, need t o be corrected and subsequently processed.  -46-  Processing  Controls  Processing  controls w i l l be defined here as those controls that  are i n e f f e c t while the computer and i t s p e r i p h e r a l equipment are w r i t i n g , t r a n s f e r r i n g , c a l c u l a t i n g and p r i n t i n g data. i n t o two  reading,  They can be divided  categories:  i.)  controls b u i l t i n t o the machinery by the manufacturer, r e f e r r e d  to as " b u i l t - i n " c o n t r o l s , machine controls or hardware c o n t r o l s , and ii.)  controls w r i t t e n i n t o the program, r e f e r r e d to as programmed  36 a  controls. For purposes of t h i s a n a l y s i s , c o n t r o l of the programs themselves, that i s , t h e i r handling, t e s t i n g and a l t e r i n g i s considered to be part of the a d m i n i s t r a t i o n of the E.D.P.- department and'was, t h e r e f o r e , examined i n Part I I . . There i s a considerable v a r i e t y of processing used.  controls that can be  The manner i n which, and the places, where they are used, w i l l vary  w i t b the type of system.  This discussion of processing  t h e r e f o r e , be presented i n two p a r t s .  controls w i l l ,  F i r s t l y , the various types of  " b u i l t - i n " and programmed controls w i l l be o u t l i n e d .  Secondly, an example  of where and how programmed controls might be used w i l l be presented. " B u i l t - i n " controls w i l l not be used i n t h i s example because they are g e n e r a l l y part of the "one-time" d e c i s i o n of computer a c q u i s i t i o n .  In  other words, they are not a v a r i a b l e that the programmer can work with as be i s - p r e p a r i n g - h i s program. " B u i l t - i n " Controls  •- '  Probably the most widely used " b u i l t - i n " c o n t r o l i s the p a r i t y 36 a.  I b i d . pp. 270-271.  check.  I t i s a check that uses a redundant character to detect the loss  of data on magnetic tape.  For i l l u s t r a t i o n purposes, l e t us assume a  computer system uses even p a r i t y . the  When information i s being w r i t t e n on  tape, each column i s checked t o see whether the number of b i t s i s odd  or even.  I f i t i s odd, then an a d d i t i o n a l b i t , c a l l e d a check b i t or  p a r i t y b i t , i s added to that column. even number of b i t s . the  A l l columns w i l l , therefore, have an  When the computer subsequently reads the data from  tape, i t w i l l check the number of b i t s i n each column.  I f i t i s not  even, then a b i t has been l o s t . A l e s s widely used form of redundancy f o r checking magnetic tape i s the double track recording and reading of data on tape. Data i s w r i t t e n and read twice and the two compared to ensure they are equal.  I f they a r e , 37  then the l i k e l i h o o d of information having been l o s t i s very small. D u p l i c a t i o n can also be used i n the arithmetic u n i t c i r c u i t r y . Some Univac computers, f o r example, use such d u p l i c a t i o n to have a l l c a l c u l a t i o n s done i n d u p l i c a t e and the r e s u l t s are compared.  I f they disagree,  an alarm goes o f f . There are also some computers using t r i p l i c a t e c a l c u 38 l a t i o n s w i t h an alarm going o f f i f a l l three disagree. D u p l i c a t i o n i s also used as a check i n some card input/output devices.  The check i s performed by using two reading s t a t i o n s and have  data agreed before i t goes i n t o computer storage.  The reverse i s used  for card output. 37.  Benjamin Conway, " E l e c t r o n i c s i n Business," Systems and Procedures, V i c t o r Lazzaro, ed., Englwood C l i f f s : P r e n t i c e - H a l l , Inc., 1959, pp. 356-357.  38.  Gotlieb & Hume, op. c i t . , pp. 148-149.  -48With regard t o p r i n t e d output, a c o n t r o l c a l l e d an Echo check i s available.  The mechanical operation of the p r i n t e r causes an e l e c t r i c a l  impulse which i s compared t o the s i g n a l from the c e n t r a l processing u n i t . This i s t o ensure that the p r i n t e r i s , i n f a c t , p r i n t i n g the data as sent from the c e n t r a l processing u n i t . Proper preventive 'maintenance should, of course, be part of the buy or lease contract.  This might include a "maintenance check" which 39  i s a t e s t problem that a c t i v a t e s and t e s t s a l l portions of the c i r c u i t r y . This could take the form of "marginal checking" where various parts are t e s t e d under conditions more extreme than usual.  I f any components are 40  close t o f a i l u r e , they w i l l frequently f a i l during such a t e s t . Tape r i n g s are g e n e r a l l y provided w i t h r e e l s of magnetic tape. These r i n g s , which are fastened t o the r e e l s , act as a c o n t r o l i n that 41  they prevent the w r i t i n g of new information on the tape. Programmed Controls Perhaps the most important and most widely used programmed c o n t r o l i s the v a l i d i t y or redundancy check.  This check can be used very e f f e c -  t i v e l y i n t e s t i n g the v a l i d i t y of items l i k e account numbers, order numb e r s , employee numbers and inventory numbers.  There i s a considerable  v a r i e t y of ways i n which t h i s check can be performed and i t w i l l not be p o s s i b l e t o make a d e t a i l e d examination  of the subject here.  39-  Conway, op. c i t . , pp. 356-358.  40.  G a t l i e b and Hume, op. c i t . , pp. 147-148.  41.  E l l i o t and Wasley, op. c i t . , pp. 271-272  An example  -49-  w i l l i l l u s t r a t e how the check might he used. Assume t h a t , p r i o r t o computerization, an account had the number 12345.  Let us assume f u r t h e r t h a t , when computerizing the system, we  wish t o i n s t i t u t e a check that w i l l ensure that input f o r t h i s account has the correct number and that posting w i l l be made t o the correct account. To e f f e c t such a v a l i d i t y t e s t a "check d i g i t " would be added t o the account number.  The v a l u e , or number, t o be used i n t h i s check d i g i t  p o s i t i o n might be determined as f o l l o w s : Give the f i r s t . d i g i t  i n the regular account number a weighting  of 1. Give the second d i g i t a weighting of three, the t h i r d . a weighting of one, the f o u r t h a weighting of three and the f i f t h a weighting of one. The account number and the d i g i t weightings would then be: account number -  12345  (l)  weighting  13131  (2)  -  M u l t i p l y i n g each d i g i t i n ( l ) by the corresponding d i g i t i n ( 2 ) and adding, we get 1x1  = 1  2x3  = 6  3x1  = 3  4 x 3 =12 Total  5 x 1 =_5 27  -50-  Discard the f i r s t d i g i t of the t o t a l (27), i n t h i s case two, and the r e maining number, i n t h i s case seven, should he the value of the check d i g i t . The new account number would thus he 123457. A part of a computer program would go through the l o g i c o u t l i n e d above.  I f i t a r r i v e d at an answer other than seven, i t would d i s c a r d that 42  input item as i n v a l i d . I t should be noted that t h i s check w i l l detect, not only omissions of numbers and most i n s e r t i o n s of i n c o r r e c t numbers, but also t r a n s p o s i tions.  The l a t t e r i s not detected i f d i g i t s are merely added and the l a s t ^3  d i g i t of the sum used as a check d i g i t . Another method that can be used i s the Hash T o t a l , sometimes c a l l e d the  "Nonsense Sum Method."  In an inventory c o n t r o l system, f o r example,  i t might be used t o ensure that current transactions update the correct records on the master f i l e .  The item numbers of transactions are added  manually t o obtain one "nonsense sum".  As the computer updates the master  f i l e , the program w i l l accumulate the item numbers and p r i n t a t o t a l when 44 i t i s f i n i s h e d . The two t o t a l s should, of course, agree. 42. Eichard G. Canning, E l e c t r o n i c Data Processing f o r Business and Industry, New York: John Wiley and Sons, I n c . , 1 9 5 6 , pp. 1 8 9 - 1 9 0 . 43.  For example, see J . Sanford Smith, The Management Approach to E l e c t r o n i c D i g i t a l Computers, London: MacDonald and Evans L t d . , 1957,  44.  PP.  92-93  Sanford L. Optner, Systems A n a l y s i s f o r Business Management, Englewood C l i f f s : P r e n t i c e - H a l l , ' Inc. I 9 6 0 , pp. 6 7 - 6 8 .  -51W i t h r e g a r d t o the c h e c k i n g o f c a l c u l a t i o n s , s e v e r a l methods are a l s o a v a i l a b l e and the examples g i v e n here a r e n o t a t r e a t m e n t o f the  comprehensive  subject.  Assume, f o r example, t h a t a program i s d o i n g a s e r i e s of c a l c u l a t i o n s i n v o l v i n g the m u l t i p l y i n g p r i c e t i m e s q u a n t i t y .  As a check  on t h e c a l c u l a t i o n s , each r e s u l t might be m u l t i p l i e d by an a r b i t r a r y number ( t h e same one f o r each c a l c u l a t i o n ) and the r e s u l t i n g amounts accumulated.  At the end o f the r u n , t h i s accumulated t o t a l would then  be compared t o t h e t o t a l q u a n t i t y m u l t i p l i e d by t o t a l c o s t m u l t i p l i e d by the number p r e v i o u s l y  chosen.  I f t h e two a r e n o t e q u a l , an e r r o r i n  c a l c u l a t i o n has been m a d e . ^ Another method t h a t might be used i s the Zero B a l a n c e check, the c a l c u l a t i o n c a l l s f o r X t o be m u l t i p l i e d by Y, as a check, a l s o t i p l y Y times X and s u b t r a c t  the r e s u l t from the f i r s t answer.  mul  I f the  answer i s n o t z e r o , an e r r o r has been m a d e . ^ A t h i r d check t h a t s h o u l d be mentioned i s the " c a s t i n g out o f nines." sult.  Assume we want the computer t o add 67 and 28 and check the r e The answer, o f c o u r s e , s h o u l d be 95.  To v e r i f y the c a l c u l a t i o n ,  d i v i d e 67 by n i n e and r e t a i n the remainder of f o u r . and r e t a i n the remainder o f one. r e t a i n the f i v e .  Now  Divide  28 by n i n e  Add the f o u r and the one t o o b t a i n  5;  d i v i d e the c a l c u l a t e d answer ( i n t h i s case 95) by  45.  Conway, op. c i t . , pp. 358-360.  46.  O p t n e r , op. c i t . , pp. 67-68.  -52-  nine and r e t a i n the answer ( i n t h i s case f i v e ) . the  Since i t agrees w i t h  other f i v e , the o r i g i n a l c a l c u l a t i o n of 67 plus 28 must he c o r r e c t . 1*7.  I f they were not equal, an error should be reported. Cross f o o t i n g balance checks can be very e f f e c t i v e i n some cases. In a p a y r o l l system, f o r example, t o t a l net wages plus t o t a l deductions should equal t o t a l gross wages.  Another check that i s very a p p l i c a b l e  i n a p a y r o l l system i s the l i m i t check sometimes c a l l e d the "reasonableness check."  This check provides f o r the p r i n t i n g of a message i f net  pay exceeds a s p e c i f i e d amount.  To ensure that a l l input items are pro-  cessed and that there has been no duplicate processing, record counts or accumulations of d o l l a r amounts can be used t o check t o manually c a l culated record counts or d o l l a r t o t a l s . Where the volume of data i s l a r g e , i t i s advisable to use check points.  At such points a l l output w i l l be w r i t t e n on tape or disk.  If  there i s an e r r o r subsequent to the check p o i n t , the volume of input processed p r i o r t o the check point w i l l not need t o be processed again. Tapes should have i d e n t i f y i n g l a b e l s .  On master f i l e tapes, information  on t h i s l a b e l should include the date before which the tape must not be written.  This w i l l ensure master f i l e back-up f o r the correct number of  generations.  With master f i l e s on tape, a sequence check should also be  used to ensure t r a n s a c t i o n s and master records are i n ascending or descending order as required. 47. 48.  48  Gotlleb and Hume, op. c i t . , pp. 148-150 Conway, op. c i t . , pp. 358-360.  -53-  An I l l u s t r a t i o n To i l l u s t r a t e where and how some of the programmed controls might be used, a s i m p l i f i e d accounts r e c e i v a b l e computer system w i l l be presented. The chart on page 54 shows the s e r i e s of programs used i n the system and b r i e f d e s c r i p t i o n s of the f u n c t i o n of each program.  The  system presented i s not meant t o be r e a l i s t i c , but has been s i m p l i f i e d f o r the sake of c l a r i t y .  Following i s a resume of the programmed con-  t r o l s that might be used i n each of the programs. Program 1 - EDIT: This program w i l l have three main c o n t r o l s , i.)  A redundancy check w i l l check the v a l i d i t y of the account  numbers on a l l input. ii.)  Other important f i e l d s i n the input w i l l be checked f o r correct  l e n g t h , whether alphabetic or numeric and, i n some cases, whether the value i s w i t h i n a predetermined l i m i t (e.g. t r a n s a c t i o n code between one and f o u r ) . iii.)  The program i t s e l f i s an input c o n t r o l i n that i t : a. )  adds a l l batch items and checks sum t o batch t o t a l .  This  ensures no omission or d u p l i c a t i o n of items. b. )  p r i n t s t o t a l of batches accepted ( i n balance as i n a.) and t o t a l of batches r e j e c t e d (not i n balance) - the t o t a l of these two i s then checked t o the t o t a l of batch t o t a l s ( c a l c u l a t e d .manually) t o ensure that no batches are omitted or duplicated.  SIMPLIFIED ACCOUNTS,. RECEIVABLE COMPUTER SYSTEM •TABLE II Program 1 Edit -Edits a l l input and checks f o r account number validity. -Checks a l l input batches f o r balance. I f i n balance ( i . e . cont r o l t o t a l = sum of amounts):,accepts. I f not,. rejects. -Prints t o t a l of batches accepted & of batches r e jected. Operator checks t h i s t o manually c a l c u l a t ed t o t a l of input " batch t o t a l s .  Program 2 Sort - Sorts input (batches accepted during edit run) into account aumber sequence.  1  i  Program 3 File Maintenance  - Updates Account s Receivable master f i l e with t r a n s actions edited and sorted by programs 1 and 2 respectively.  I  Program 4 Statement Print - At month end, prints a statement of account f o r each customer.  Program 5 Collection Letters & Reports  Program 6 Accounting  - P r i n t s the - Calculates and various types of p r i n t s bad debt collection letters write-off figure f o r accounts 15, f o r the month. 30, 45, 6 0 , 75, 90 e t c . days over- - Adds up a l l account balances due . and p r i n t s t o t a l f - P r i n t s l e t t e r s . o r balancing t o General Ledger f o r accounts t o be passed on t o a Control Account. C o l l e c t i o n Agency. - P r i n t s working papers necessary f o r follow-up of overdue accounts. - P r i n t s Accounts Receivable. Aging A n a l y s i s .  -55-  Program 2 - SORT: The important c o n t r o l necessary here i s t o ensure that no items are  l o s t during the s o r t .  This can be achieved by having the program  do e i t h e r a record count or a t o t a l l i n g of d o l l a r amounts a f t e r s o r t i n g i s completed.  This would then be p r i n t e d and checked t o the d o l l a r value  of batches accepted i n run one ( o r , i f a record count i s used, check t h i s to a manually predetermined count). Program 3 - MASTER FILE MAINTENANCE: Since t h i s i s the program that updates the master f i l e ( i . e . the accounts r e c e i v a b l e subsidiary l e d g e r ) , i t i s important that i t i s w e l l controlled. i.)  This should include the f o l l o w i n g :  To ensure the posting of the correct amount, the program should  accumulate amounts as they are posted and p r i n t the t o t a l at the end of the  run.  This t o t a l should be equal t o the t o t a l of batches accepted i n  program 1. ii.)  To ensure posting t o the correct account, two checks should be  considered: a. )  A sequence check should d e f i n i t e l y be used at points where transactions and the master f i l e records are read f o r processing.  b. )  A hash t o t a l , or "nonsense sum" might be used.  In t h i s  case the program would accumulate a t o t a l of the account numbers of a l l input and also accumulate the account numbers.of a l l jnaster records being updated.  The two  should, of course, be equal i f no i n c o r r e c t postings were made.  -56iii.)  There should be a check on the a r i t h m e t i c ( i . e . the a d d i t i o n to  or the s u b t r a c t i o n from the o l d balance of the current t r a n s a c t i o n amount) to ensure that the new balance owing.as shown on the master record i s correct.  This could take the form of one of the programmed controls  described above, or i t might be considered unnecessary i f the manufact u r e r provided the " b u i l t - i n " c o n t r o l of d u p l i c a t e c a l c u l a t i o n . iv.)  I t would be advisable to subject both the amount of the trans-  a c t i o n and the balance owing on the master record to a l i m i t check or "reasonableness" check.  That i s , i f they exceed s p e c i f i e d amounts, de-  t a i l s w i l l be p r i n t e d and can subsequently be examined as to whether c o r r e c t i v e a c t i o n i s necessary. v.) fication.  Master f i l e tapes should have l a b e l s to ensure proper i d e n t i These l a b e l s should i n d i c a t e the date p r i o r to which no  w r i t i n g on the tape i s permitted. This w i l l ensure proper master f i l e r e t e n t i o n and back-up. vi.)  I f input volume i s considerable, a s e r i e s of check points would  help avoid r e p e t i t i o n of a l l the processing p r i o r to an e r r o r when one occurs. Program 4 - STATEMENT PRINT: The important c o n t r o l consideration i n t h i s program i s to ensure that a l l accounts receivable have a statement p r i n t e d .  The computer pro-  gram should accumulate balances u n c o l l e c t e d , as these are p r i n t e d , and the t o t a l should equal the accounts receivable c o n t r o l f i g u r e . Program 5 - COLLECTION LETTERS & REPORTS: In t h i s program the s i g n i f i c a n t aspect of c o n t r o l i s to ensure correct c a l c u l a t i o n of the number of days that amounts are overdue.  -57This could be accomplished by the use of a programmed c a l c u l a t i o n check and/or a " b u i l t - i n " d u p l i c a t e c a l c u l a t i o n f a c i l i t y . Program 6 - ACCOUNTING: Checking of c a l c u l a t i o n s i s also the most important aspect of c o n t r o l i n t h i s program.  The c a l c u l a t i o n s involved are that of deter-  mining the s i z e of the bad debt w r i t e - o f f and of obtaining a t o t a l of the accounts receivable subsidiary ledger f o r r e c o n c i l i a t i o n with the cont r o l account. As i n program 5, e i t h e r a programmed check or " b u i l t - i n " d u p l i c a t e c i r c u i t r y , or both, might be used. Output Controls As mentioned i n the s e c t i o n on the administration of the computer operating department, the c a r e f u l handling of tapes and disks i s an important part of c o n t r o l .  I t was a l s o mentioned that master f i l e tapes  should have a l a b e l using a programmed check to prevent w r i t i n g on them p r i o r to a s p e c i f i e d day.  This ensures r e t e n t i o n of master f i l e i n f o r -  mation as back-up f o r an adequate period of time.  I t i s suggested that  off-premises, f i r e p r o o f storage of back-up master f i l e s be used as a f u r t h e r precaution.  For example, the most recent master might be stored  i n a v a u l t on the premises with several generations of back-up master f i l e s kept i n one or more bank vaults.49 With regard to p r i n t e d output to be sent to a user department (or a s p e c i a l c o n t r o l group) three elements are of importance. F i r s t of a l l , i t i s suggested that an employer, other than the computer operator  49.  E l l i o t t and Wasley, op. c i t . , p. 277.  -58-  check that a l l required output has been produced and i s sent t o the correct personnel i n the user department.  Logging and r e c e i p t i n g of  output may be advisable i n some cases. Secondly, there should be some v e r i f i c a t i o n  of the output by  50  the user department.  I n the accounts receivable i l l u s t r a t i o n used  above, the user department i.)  should re-check the f o l l o w i n g :  t h a t , a f t e r the e d i t program, the sum of batches accepted and  r e j e c t e d i s equal t o the pre-determined input t o t a l . ii.)  that the t o t a l ' of transactions processed by the f i l e main-  tenance run i s equal t o the t o t a l batches accepted by the e d i t run. iii.)  t h a t , a f t e r the f i l e maintenance run, the o l d accounts r e -  ceivable t o t a l , adjusted by the t o t a l d o l l a r value of t h i s run's t r a n s a c t i o n s , i s equal t o the new accounts receivable t o t a l . Iv.)  that the sum of balances due on statements i s equal t o the  t o t a l accounts receivable as at month end. T h i r d l y , i t i s suggested here that the user department  period-  i c a l l y review the necessity of a l l output and discontinue reports or other output that are no longer used due t o changes i n conditions. The I n t e r n a l Audit Department The i n t e r n a l audit department i s , of course, not an element of c o n t r o l w i t h i n a computerized system i t s e l f . I t i s , however, one of the main functions of the department t o see that i n t e r n a l c o n t r o l i s adequate 51  i n a l l areas.  Computer a p p l i c a t i o n s should not be exceptions t o t h i s  50.  I b i d . , pp. 2 7 6 - 2 7 7 .  51.  R. T. Culey and Royal D. W. Bauer, A u d i t i n g , C i n c i n n a t i , Southwestern P u b l i s h i n g Co., 1 9 5 3 , p. 5 3 1 .  -59rule.  For t h i s r e a l l y to be the case, therefore, the i n t e r n a l audit de-  partment w i l l need to be knowledgeable of e l e c t r o n i c data processing i f proper assessment of i n t e r n a l c o n t r o l i s to be made. With the a r r i v a l of computerization, the i n t e r n a l audit department w i l l , t h e r e f o r e , need to adopt some new techniques and i n i t i a t e some changes.  I t should be  stressed, however, that while a u d i t i n g methods w i l l change, the object i v e s of the a u d i t procedures w i l l remain unchanged. There are, on the other hand, those who argue that the appearance of a computer should have a n e g l i g i b l e e f f e c t on a u d i t i n g techniques. What i s important, i s that the end r e s u l t i s adequately checked and, i f i t i s c o r r e c t , then the means by which i t i s determined, w i t h i n reasonable c o s t - b e n e f i t l i m i t s , are i r r e l e v a n t .  I t has been pointed out, however, that  the most important f a c t o r i n determining the s i z e of the sample of the end r e s u l t to be checked, i s the r e l i a b i l i t y of the means by which the end i s 53 obtained.  Moreover, when the a u d i t o r i s faced with r e a l time processing,  he may have n e i t h e r an output (end r e s u l t ) to v e r i f y to input nor the audit t r a i l that was a v a i l a b l e i n the batch processing s i t u a t i o n . ^ 4  This being  the case, the a u d i t o r w i l l have to examine the "means" because the "end" i s not r e a d i l y a v a i l a b l e f o r i n s p e c t i o n . This leads us to two important changes that computerization forces on the i n t e r n a l a u d i t o r . F i r s t l y , he must become knowledgeable of e l e c t r o n i c data processing because he w i l l have to examine the means by 52.  Jennie M. Palen, ed., Encyclopedia of A u d i t i n g Techniques, Volume 1, Englewood C l i f f s : P r e n t i c e - H a l l , Inc., p. 80.  53.  McCracken, e t . a l . , op. c i t . , pp. 417-418.  54.  Franz E. Ross, " I n t e r n a l Control and Audit of Real-Time D i g i t a l Systems," Journal of Accounting, A p r i l , 1965. p. 46.  \  -60-  which data i s processed.  Secondly, he w i l l need t o become involved i n  the e a r l y planning of systems and the w r i t i n g of programs so he w i l l know whether i n t e r n a l c o n t r o l i s adequate when the system becomes operational. Having taken thse f i r s t two steps, the i n t e r n a l auditor w i l l need t o make a t h i r d change and that i s the planning and implementing of a s p e c i f i c audit procedure f o r the computerized system when i t i s operational.  There i s a wide v a r i e t y of s p e c i f i c techniques that can be used  and a d e t a i l e d examination of t h i s area i s beyond the scope of t h i s paper. A b r i e f a n a l y s i s of general methodology should, however, be made. I n keeping with the two c o n f l i c t i n g points of view presented above, there are two basic approaches t o the problem. i.)  A u d i t i n g "around the computer" i s based on the premise t h a t ,  i f an adequate sample of output i s v e r i f i e d t o i n p u t , then c o n t r o l can be assumed t o be adequate without an examination and t e s t i n g of the programs . ii.)  A u d i t i n g "through the computer" r e l i e s on the t e s t i n g of pro-  grams by having them process a v a r i e t y of t e s t transactions with the auditor checking these r e s u l t s t o h i s own manually c a l c u l a t e d r e s u l t s . I f a l l major combinations of p o s s i b l e 'types of transactions are t e s t e d and found c o r r e c t , then i t can be s a f e l y assumed that the programs w i l l process a l l input c o r r e c t l y because they process i d e n t i c a l items i n an ident i c a l manner. 55.  In some cases, examination of programs i s advocated.  55  W. Thomas P o r t e r , "Evaluating I n t e r n a l Controls i n E.D.P. Systems," Journal of Accounting, August, 1964, pp. .34-40.  -61I t i s suggested that a combination of the two methods be adopted, keeping i n mind the unique features of the system being audited. A fourth important consideration that should be mentioned i s  the  fact a progressive i n t e r n a l auditor w i l l l e a r n , not only how to audit a computerized system, but also how to use the computer for auditing purposes.  In a very big business,  the manual auditing of an adequate sample  of m i l l i o n s of records i s a very tedious and boring task.  I f he can get  this auditing done by the computer, then the machine that might formerly have been considered an obstacle and d i f f i c u l t y , w i l l become an aid towards better and faster auditing.-'^  For example, a program might be  written to decide, by s t a t i s t i c a l methods, which records are to be examined and subsequently examine these records. It should be mentioned again that, while audit techniques w i l l change, computerization does not change the objectives activity.  of i n t e r n a l audit  The major objective of this a c t i v i t y i s the maintenance of  adequate i n t e r n a l c o n t r o l . It should also be pointed out that, i f the changes i n audit techniques are not made, then the objective of maintaining adequate i n ternal control w i l l not be achieved.  A progressive i n t e r n a l audit de-  partment that i s knowledgeable of electronic data processing and w i l l i n g  56.  James A. Cashin and Garland C. Owens, Auditing, New York: Ronald Press C o . , 1963, p. 594.  The  57.  Herbert A r k i n , "Computers and the Audit Test," Journal of Accounting, October, 1965, pp. 45-48  -62-  to make changes as necessary i s , t h e r e f o r e , an important  element of the  i n t e r n a l c o n t r o l of a computer a p p l i c a t i o n . Summary A computer a p p l i c a t i o n or computerized system can be d i v i d e d i n t o three phases: i.)  preparation of input and entry i n t o computer,  ii.)  processing of data by the computer,  iii.)  preparation and d i s t r i b u t i o n of output. The preparation and entry of input involves four main c o n t r o l  problems.  F i r s t l y , t o minimize errors and maximize e f f i c i e n c y , source  documents should be w e l l formulated and c l e a r .  Secondly, where p h y s i c a l  movement takes p l a c e , some t r a c i n g mechanics are necessary.  Thirdly, •  key v e r i f i c a t i o n should be used t o ensure correct conversion t o machine readable form.  L a s t l y , an e d i t run can be used t o ensure that a l l input  gains entry i n t o the machine and that no items are duplicated. The controls i n e f f e c t while the computer i s processing data can be d i v i d e d i n t o two types:  those controls that are part of the ma-  chinery as supplied by the manufacturer and those controls i n s t a l l e d i n the program by the programmer.  These are c a l l e d " b u i l t - i n " controls and  programmed controls r e s p e c t i v e l y .  " B u i l t - i n " controls include items l i k e  the p a r i t y check, double t r a c k recording on tape, duplicate a r i t h m e t i c , the echo check, maintenance and marginal checking and r i n g s on magnetic tape r e e l s .  There i s a v a r i e t y of programmed checks i n c l u d i n g redundancy  checking, the "hasb" t o t a l , c a l c u l a t i o n checks, record counts, d o l l a r value accumulations,  check points and l i m i t checks.  Where and how they are  used v a r i e s w i t b each system and cannot be stereotyped.  -63Adequate c o n t r o l o f output i n c l u d e s t h e p r o p e r h a n d i n g o f t a p e s and d i s k s , as w e l l as t h e v e r i f i c a t i o n o f p r i n t e d output "by t h e u s e r department. W h i l e t h e i n t e r n a l a u d i t department i s not a p a r t o f a computer a p p l i c a t i o n i t s e l f , i t p l a y s an i m p o r t a n t r o l e w i t h r e g a r d t o i n t e r n a l c o n t r o l i n t h e system.  C o m p u t e r i z a t i o n n e c e s s i t a t e s changes i n a u d i t  t e c h n i q u e s and t h e i n t e r n a l a u d i t o b j e c t i v e o f e n s u r i n g  adequate i n t e r n a l  c o n t r o l w i l l n o t he met i f t h e s e changes a r e not made.  An i n t e r n a l a u d i t  department t h a t i s f a m i l i a r w i t h E.D.P. and r e a d y t o make t h e changes t h a t i t n e c e s s i t a t e s i s , t h e r e f o r e , an i m p o r t a n t a s p e c t o f i n t e r n a l cont r o l i n a computer a p p l i c a t i o n .  -64PART V CONCLUSION This examination of the control problems generated by computeri z a t i o n has concerned i t s e l f mainly with the more established developments i n computer technology. rapidly.  This technology, however, i s changing  A b r i e f analysis of more recent developments and some of the  r e s u l t i n g control problems w i l l ,  therefore, be made here.  An obvious recent development i s that of r e a l time processing. In this s i t u a t i o n , input w i l l not be batched and grouped for processing. With neither batch totals nor run totals a v a i l a b l e , the important control of v e r i f y i n g output to input w i l l be l o s t .  This w i l l generate two r e -  quirements : i.)  a greater reliance w i l l need to be placed on processing controls,  and ii.)  early p a r t i c i p a t i o n i n systems planning by a control conscious CO  group (e.g.  the i n t e r n a l audit department) w i l l become very important.  Another development that w i l l cause some new control problems i s the remote access feature. ted to continue to increase.  Remote input-output devices can be expecMany of them are, and w i l l be, a consider-  able, distance from the central computer l o c a t i o n . access to remote input-output devices be prevented?  How can unauthorized Should authorized  remote access users have access to a l l information on f i l e ? information should be accessible?  I f not, what  Who w i l l decide this and how?  What  controls are available to ensure enforcement when the decisions have been  58.  Ross, op. c i t . , pp. 46-47.  -65made?  These a r e some o f t h e c o n t r o l , problems t h a t w i l l need s o l u t i o n s  i f p r o p e r c o n t r o l i s t o be  maintained.  W i t h numerous remote a c c e s s d e v i c e s r e q u e s t i n g i n f o r m a t i o n i t may be n e c e s s a r y t o remove, from w o r k i n g s t o r a g e , t h e program i n o p e r a t i o n a t t h e time o f a r e q u e s t  and r e a d i n t o s t o r a g e  required to f u l f i l l the request.  t h e program and f i l e s  F a i l i n g t h i s , optimum computer u t i l i z -  a t i o n w i l l be d i f f i c u l t t o a c h i e v e .  The o p e r a t i n g system r e q u i r e d t o  p e r f o r m t h i s w i l l need c o n t r o l s t o ensure t h a t no i n f o r m a t i o n i s l o s t and t h a t p r o c e s s i n g c o n t i n u e s where i t l e f t o f f p r i o r t o t h e remote a c c e s s information  request.  As t h e l e n g t h o f time d u r i n g w h i c h computers have been i n use i n c r e a s e s , t h e degree o f systems i n t e g r a t i o n w i l l a l s o i n c r e a s e . I n creased  i n t e g r a t i o n w i l l , i n t u r n , cause new problems o f c o n t r o l .  An  e r r o r on a master f i l e , f o r example, may now cause e r r o r s i n a v a r i e t y of o u t p u t s , p r i n t e d o r o t h e r w i s e .  As i n t e g r a t i o n i n c r e a s e s , t h e amount  of i n f o r m a t i o n on master f i l e s c a n a l s o be expected t o i n c r e a s e .  Control  of t h e m i s u s e o r abuse o f t h i s i n f o r m a t i o n by p e r s o n n e l who have a c c e s s t o t h e s e f i l e s c a n , t h e r e f o r e , be e x p e c t e d t o become a problem o f i n c r e a s i n g magnitude.  Moreover, when i n t e g r a t i o n goes beyond t h e " i n t r a -  f i r m " s t a g e and becomes " i n t e r - f i r m " , t h e problem o f c o n t r o l l i n g a c c e s s t o c o n f i d e n t i a l i n f o r m a t i o n w i l l a l s o need t o be s o l v e d . Computer t e c h n o l o g y  has been changing r a p i d l y i n r e c e n t y e a r s and  t h e r e i s n o t much doubt t h a t t h e r e w i l l be o t h e r developments t h a t w i l l cause new c o n t r o l problems.  I t s h o u l d , however, be remembered t h a t t h e  computer has a l s o made improved i n t e r n a l c o n t r o l p o s s i b l e i n some r e s p e c t s .  -66In closing, l e t us b r i e f l y outline these factors. i.)  Increased speed makes possible an increased amount of detailed  checking. ii.)  A l l l i k e transactions are treated the same way.  Thus, i f we  can determine d e f i n i t e l y that one was processed correctly, i t i s safe to assume that they w i l l a l l be processed c o r r e c t l y . iii.)  Since the computer has decision making a b i l i t y , controls can  be i n s t a l l e d as part of the program (programmed controls). iv.)  I f a p o l i c y or procedure change needs to be made, a l l that i s  required i s to a l t e r the program.  Before computerization, the re-educa-  tion of a large number of clerks was necessary. v.)  Since programs are changeable and have decision making a b i l i t y ,  i t i s possible to pre-plan for any circumstances and prevent undesirable future events. Advances i n computer technology w i l l continue to present a d i s t i n c t challenge to those concerned with i n t e r n a l control.  Clearly, the  emphasis on controls within the computer system i t s e l f w i l l increase s i g n i f i c a n t l y , necessitating increased involvement of control conscious personnel i n the planning and implementation stages of systems development. They w i l l , therefore, need to maintain an adequate knowledge of computer systems and their c a p a b i l i t i e s .  This being the case, they w i l l be able to  not only use present f a c i l i t i e s to maintain control, but also be a l e r t to the p o s s i b i l i t i e s of improved  59.  control generated by technological changes.  Robert F. Garland, "Five Ways i n Which Computer Systems Strengthen Internal Control," N.A.A. B u l l e t i n , July, 1962, pp. 21-28.  PART VIBIBLIOGRAPHY  Books Anthony, R o b e r t N., Deardon, J o h n , and V a n c i l , R i c h a r d F., Management C o n t r o l Systems, Homewood: R i c h a r d D. I r w i n , Inc., 1968. Bout e l l , Wayne, S., Au'diting w i t h t h e Computer, B e r k e l e y , C a l i f o r n i a : University of C a l i f o r n i a , 1965. B r i n k , V i c t o r Z. and C a s h i n , J . A., I n t e r n a l A u d i t i n g , New York: R o n a l d P r e s s , 1 9 5 8 . B u r c k , G i l b e r t , and t h e e d i t o r s o f F o r t u n e , The Computer Age, New York: Harper and Row. B u r t o n , A. J . and M i l l s , R. G., E l e c t r o n i c Computers and T h e i r B u s i n e s s A p p l i c a t i o n s , London:E. Benn, i 9 6 0 . Canadian I n s t i t u t e o f C h a r t e r e d A c c o u n t a n t s , A P r a c t i c a l I n t r o d u c t i o n t o Computer Systems, 1 9 6 5 . C a n n i n g , R i c h a r d G. , E l e c t r o n i c D a t a P r o c e s s i n g f o r B u s s i n e s s and I n d u s t r y . , New York: John T. W i l e y & Sons, 1 9 5 7 . C a s h i n , James A., and Owens, G a r l a n d C , A u d i t i n g , New York: The R o n a l d P r e s s Co., 1 9 o 3 . Conway, B., B u s i n e s s E x p e r i e n c e w i t h E l e c t r o n i c Computers, New York: C o n t r o l l e r s I n s t i t u t e Research. F o u n d a t i o n , 1 9 5 9 . C u l y , R. T., and B a u e r , D. N. R o y a l , A u d i t i n g , C i n c i n n a t i : South-Western P u b l i s i n g Co., 1 9 5 3 . Edge, C. G. Roy, and S a n d f o r d , P. J . , The Impact o f Systems ' and Computers on Management and on t h e A c c o u n t a n t , H a m i l t o n : The S o c i e t y o f I n d u s t r i a l and Cost A c c o u n t a n t s o f Canada, 1 9 6 6 . E l l i o t t , C. O r v i l l e , and Wasley, R o b e r t S., B u s i n e s s I n f o r m a t i o n P r o c e s s i n g Systems, Homewood: R i c h a r d D. I r w i n , I n c . , 1 9 6 5 . G i l l e s p i e , C e c i l , A c c o u n t i n g Systems, Englewood C l i f f s . - P r e n t i c e Hall , Inc., 1 9 6 l .  -68G o t l l e b , C. C , and Hume, J . N. D., High. Speed Data Processing, New: York.: McGraw-Hill Book Co., Inc., 1958. h  Gregory, Robert H., and Van Horn, Richard L., Automatic Data Processing Systems, San Francisco: Wadsworth P u b l i s i n g Co., Inc., 1963. Johnson, E l d r e d A., Accounting Systems i n Modern Business, New York: McGraw-Hill Book Co., Inc., 1959Jones, Gardner M., E l e c t r o n i c s i n Business, East Lansing: College of Business and P u b l i c S e r v i c e , Michigan State U n i v e r s i t y , 1958. Kaufman, F e l i x , E l e c t r o n i c Data Processing and A u d i t i n g , New York: The Ronald Press Co., 1961. Kozmetsky, George-and K i r c h e r , P., E l e c t r o n i c Computers and Management C o n t r o l , New York: McGraw-Hill Book Co., Inc., 1956. Laden, H. N. and G i l d e r s l e e v e , T. R., Systems Design f o r Computer A p p l i c a t i o n s , New York: John Wiley & Sons, Inc., 1963. Lazzaro, V i c t o r , Ed., Systems and Procedures, Englewood C l i f f s : P r e n t i c e - H a l l , Inc., 1959. L i t t l e f i e l d , C. L. and Peterson, R. L., Modern O f f i c e Management, Englewood C l i f f s : P r e n t i c e - H a l l , Inc., 1956. M a r t i n , E. Wainwright, J r . , E l e c t r o n i c Data Processing - An Introduction j Homewood: Richard D. I r w i n , Inc., 196l. McCraken, D a n i e l D., Weiss, H. and Lee, Tsai-Hwa, Programming Business Computers, New York: John Wiley & Sons Inc., 1959. Meigsj Walter B. , P r i n c i p l e s of A u d i t i n g , Homewood: Richard D..Irwin, Inc., 1962. :  Moore, Frances E., and S t e t t l e r , Howard F., Accounting Systems f o r Management C o n t r o l , Homewood: Richard D, I r w i n , I N c , 1963. Murphy, Mary E., Managerial Accounting, P r i n c e t o n , N. J . : D. Van Nostrand Co., I n c . , 1963.  -69-  Nelson, Oscar S., and Woods, R i c h a r d S., A c c o u n t i n g Systems arid Data Processing, Cincinnati: South-Western P u b l i s h i n g Co., 1961. Optner, Sanford L., Systems A n a l y s i s . f o r B u s i n e s s Management, Englewood Cliffs: P r e n t i c e - H a l l , I n c . , 1960. P a l e n , J e n n i e M., Ed., E n c y c l o p e d i a o f A u d i t i n g T e c h n i q u e s , Englewood Cliffs: Prentice-Hall, Inc. P o r t e r , W. Thomas, J r . , A u d i t i n g E l e c t r o n i c Systems, Belmont, California: Wadsworth P u b l i s h i n g Co., I n c . , 1966. P r i c e Waterhouse & Co., Use o f Computers i n A u d i t i n g , New York: Waterhouse & Co.  Price  P r i n c e , Thomas R., I n f o r m a t i o n Systems f o r Management and C o n t r o l , Homewood: R i c h a r d D. I r w i n , I n c . , 1966. Smith, J . S a n f o r d , E l e c t r o n i c D i g i t a l Computers, London: Evans L t d . , 1957.  Macdonald and  Smith, J . S a n f o r d , The Management Approach t o E l e c t r o n i c D i g i t a l Comp u t e r s , Macdonald and Evans L t d . , 1957. Sprague, R.E., E l e c t r o n i c B u s i n e s s Systems - Management- Use o f On-Line Real-Time Computers, New Y o r k : The Ronald P r e s s Co., 1962. Systems, and P r o c e d u r e s A s s o c i a t i o n , B u s i n e s s Systems. Systems and P r o c e d u r e s A s s o c i a t i o n , 1966.  Cleveland:  Reports Cadematori, Kenneth G., "The Impact o f E.D.P. on A u d i t i n g " , E.D.P. and the A u d i t o r , American Management A s s o c i a t i o n , B u l l e t i n 81, 1966. Canadian I n s t i t u t e o f C h a r t e r e d A c c o u n t a n t s , S p e c i a l Committee t o a s s e s s the Impact o f E l e c t r o n i c Data P r o c e s s i n g on the P r o f e s s i o n , S p e c i a l I s s u e , Canadian C h a r t e r e d A c c o u n t a n t , August, 1967.  -70C o n t r o l l e r s I n s t i t u t e Research Foundation, Inc., Business Experience with E l e c t r o n i c Computers, New York: 1959. (Controllers Institute i s now the F i n a n c i a l Executives I n s t i t u t e ) . Department of the A i r Force, Guide f o r A u d i t i n g Automatic Data Processing Systems, 1966. I n t e r n a t i o n a l Business Machines, Management Control of E l e c t r o n i c Data Processing, Form F20-0006-0. Message Control System Concepts, Form C20-1609-0. I n s t i t u t e of I n t e r n a l A u d i t o r s , I n t e r n a t i o n a l E.D.P. Research Subcommittee, I n t e r n a l A u d i t i n g of E l e c t r o n i c Data Processing, New York: 1967. P r i c e Waterhouse & Co., The Auditor Encounters E l e c t r o n i c Data Processing, New York: IBM Technical P u b l i c a t i o n s Department. Articles Anderson, R. J . , "Training of Audit Personnel," E l e c t r o n i c Data Processing i n Canada. Toronto: Canadian I n s t i t u t e of Chartered Accountants, 1963. A r k i n , Herbert, "Computers and the Audit Test," Journal of Accounting, October, 1965. Baurle, F. C. "Case Study of a Computer Audit Program," The Review, Spring, 1963. B e l l , W i l l i a m R., "Program Maintenance (The Key to Progress)," Journal of Data Management, A p r i l , 1965. Blank, V i r g i l F., "Auditing i n the Age of EDP," Accounting, J u l y , 1961.  Journal of Machine  Boni, Gregory M., "Impact of EDP on A u d i t i n g , " The Journal of Accountancy, September, 1963. B o u t e l l , W. S., "Auditing though the Computer," The Journal of Accountancy, November, 1965. Brown, R. Gene, "Data Processing, Accounting and Business A d m i n i s t r a t i o n , " The Journal of Accountancy, November, 1962. Cadematori, Kenneth G., "An Auditor's Experience with E l e c t r o n i c s , " The I n t e r n a l A u d i t o r , Winter, 1961. Denz, Ronald F., "Auditing the Data Processing Department," P.P.M.A. Quarterly, A p r i l , 1967.  -71Conway, Benjamin, " E l e c t r o n i c s i n Business", Systems and Procedures, V i c t o r Lazzaro, Ed., Englewood C l i f f s : P r e n t i c e H a l l , Inc., 1959. CRuttenden, P h i l l i p S., "How Much Data Screening t o Minimize Computer-Detected E r r o r s ? " , NAA B u l l e t i n , A p r i l , i 9 6 0 . Curka, Frank J . , "The E f f e c t of E l e c t r o n i c Data Processing on A u d i t i n g , " NAA B u l l e t i n , A p r i l , 1 9 6 l l Dearden, John, "How t o Organize Information Systems," Harvard Business Review, M a r c h - A p r i l , 1965. D i l l , S. L. and Adams, D. L., "Automated A u d i t i n g , " The J o u r n a l of Accountancy, May, 1964. Dudley, C a r l t o n L., J r . , "Management Audits of EDP I n s t a l l a t i o n s Banking, March, 1965. E i t z p a t r i c k , Robert J . , "The Influence of EDP on I n t e r n a l C o n t r o l , " The F i a n a n c i a l Executive, Marvh, 1 9 6 l . F r e s e , Walter F., "Organization E f f e c t s , " E l e c t r o n i c s i n Management, Lowell H. Hattery and Gregory P. Bush, eds., Washington: U n i v e r s i t y Press of Washington D.C., 1956. Garland, R. F., "Five Ways i n which Computer Systems Strengthen I n t e r n a l C o n t r o l , " NAA B u l l e t i n , J u l y , 1962. G a r r i t y , John T. "The Management Information Dream; The End of a New Beginning," The F i n a n c i a l Executive, Deptember, 1964 Guidrey, J . J . , "Auditor's C o n t r i b u t i o n t o Organization and Control i n a Data-Processing Program," The Federal Accountant September, 1961. Jones, Richard P., " P r a c t i c a l Control of Preparatory Programming Time f o r a Computer I n s t a l a t i o n , " NAA B u l l e t i n , A p r i l , 1962. J o p l i n , H. V., "An I n t e r n a l Control C h e c k l i s t f o r EDP," Management S e r v i c e s , July-August, 196U. Kaufman, F e l i x , "EDP Control Problems," The F i a n c i a l Executive, J u l y , 1962. Keenoy, C. L., "The Impact of Automation on the F i e l d of Accounting." Accounting Review.  -72-  Moore, M i c h a e l R., "E.D.P. A u d i t s - A Systems Approach," The I n t e r n a l A u d i t o r , May/June, 1969. N a t i o n a l R e t a i l M e r c h a n t s ' A s s o c i a t i o n , " S e c u r i t y - Can I t Keep Up W i t h Crime?", S t o r e s , J a n u a r y , 1968. Perlman, J . A., " C e n t r a l i z a t i o n v e r s u s D e c e n t r a l i z a t i o n , " Datamation, September, 1965. P o r t e r , W. Thomas, J r . , " E v a l u a t i n g I n t e r n a l C o n t r o l s i n EDP The J o u r n a l o f Accountancy, A u g u s t , 1964.  Systems,"  P o r t e r , W. Thomas, J r . , " A u d i t i n g and the Computer," The I n t e r n a l A u d i t o r , F a l l , 1967. P o r t e r , W. Thomas, J r . , "A C o n t r o l Framework f o r E l e c t r o n i c Systems," The J o u r n a l of Accountancy, O c t o b e r , 1965. Ross, F r a n z E., " I n t e r n a l C o n t r o l and A u d i t of Real-Time D i g i t a l J o u r n a l of A c c o u n t i n g , A p r i l , 1965.  Systems,"  Simmons, Leo E., " E x e c u t i v e Problems and O p p o r t u n i t i e s A r i s i n g Out of A u t o m a t i c Systems," E l e c t r o n i c s i n Management, L o w e l l H. H a t t e r y and Georgy P. Bush, Eds., Washington: U n i v e r s i t y o f Washington P r e s s , 1956. Trombly, Robert N., " A u d i t i n g Through EDP Equipment," NAA B u l l e t i n , 1961.  May,  V a l l e e , R a l p h J . and Reece, J . C , "Guidance C o n t r o l f o r B u s i n e s s Systems," B u s i n e s s A u t o m a t i o n , November, 1965. W h i s l e r , T. H., "The Manager and t h e Computer," The J o u r n a l o f Accountancy, J a n u a r y , 1965.  

Cite

Citation Scheme:

        

Citations by CSL (citeproc-js)

Usage Statistics

Share

Embed

Customize your widget with the following options, then copy and paste the code below into the HTML of your page to embed this item in your website.
                        
                            <div id="ubcOpenCollectionsWidgetDisplay">
                            <script id="ubcOpenCollectionsWidget"
                            src="{[{embed.src}]}"
                            data-item="{[{embed.item}]}"
                            data-collection="{[{embed.collection}]}"
                            data-metadata="{[{embed.showMetadata}]}"
                            data-width="{[{embed.width}]}"
                            async >
                            </script>
                            </div>
                        
                    
IIIF logo Our image viewer uses the IIIF 2.0 standard. To load this item in other compatible viewers, use this url:
http://iiif.library.ubc.ca/presentation/dsp.831.1-0102337/manifest

Comment

Related Items