Accounting Info Systems: Ethics, Fraud, and Control

• Accounting Information Systems, 6th edition, Chapter 3 covers ethics, fraud, and internal control

Business Ethics

• Ethics are needed when conflicts arise that require a choice
• In business, such conflicts frequently involve employees, management, and stakeholders
• Litigation can also lead to business conflicts
• Business ethics ultimately seeks to answer two key questions: How do managers decide what is right when conducting business?
• How do managers achieve what is right, once identified?

Four Main Areas of Business Ethics

• Equity:
  • Executive salaries
  • Comparable worth standards
  • Product pricing
• Rights:
  • Corporate due process
  • Employee health screening
  • Employee privacy
  • Instances of sexual harassment
  • Diversity and equal employment opportunity
  • Whistle-blowing protections
• Honesty:
  • Management and employee conflicts of interest
  • Security of organizational data and records
  • Honesty in advertising
  • Business practices questionable in foreign countries
  • Accurate reporting of shareholder interests
• Exercise of corporate power:
  • Involvement in Political Action Committees
  • Workplace and product safety
  • Addressing environmental issues
  • Divestment of interests
  • Corporate political contributions
  • Handling downsizing and plant closures

Computer Ethics

• Computer ethics concerns social impact of technology like hardware, software, and telecommunications
• Key issues:
  • Privacy
  • Security: accuracy and confidentiality
  • Ownership of property
  • Equity in access
  • Environmental issues
  • Artificial intelligence
  • Unemployment and displacement due to automation
  • Misuse of computers

Legal Definition of Fraud

• Fraud involves:
  • False representation via false statement or disclosure
  • A material fact substantial enough to induce action
  • Intent to deceive
  • Justifiable reliance on the misinformation, leading someone to act
  • Injury or loss resulting from the misrepresentation

Factors That Contribute to Fraud

• Situational pressures (high)
• Opportunities (high)
• Personal characteristics (ethics - low)

2004 ACFE Study of Fraud

• Fraud resulted in a revenue loss equal to 6%, or approximately $660 billion
• Losses by position in company:
  • Owner/Executive: 12% of frauds, $900,000 loss
  • Manager: 34% of frauds, $140,000 loss
  • Employee: 68% of frauds, $62,000 loss
• Other findings showed higher losses due to men, employees acting in collusion, and employees with advanced degrees

Enron, WorldCom, Adelphia Underlying Problems

• Lack of auditor independence; auditing firms also performed nonaccounting activities for their audit clients
• Lack of director independence; directors had business or financial relationships rather than independence
• Short-term stock options led to questionable executive compensation schemes focused on short-term gains over long-term health
• Use of inappropriate accounting practices, a common fraud trait
  • Enron used special purpose entities
  • WorldCom moved transmission line costs from expense to capital accounts

Sarbanes-Oxley Act of 2002

• Primary reforms:
  • Established the Public Company Accounting Oversight Board (PCAOB)
  • Increased auditor independence by separating attestation from non-auditing activities
  • Enhanced corporate governance and responsibility; audit committee members must be independent and oversee external auditors
  • Increased disclosure requirements for issuers and management
  • Introduced new federal crimes for document destruction and fraud

Employee Fraud

• Committed by non-management personnel
• Involves theft of cash/assets through internal control circumvention

Management Fraud

• Perpetrated at levels of management that circumvents internal control
• Frequently using financial statements to present the entity as healthier and more prosperous than reality
• Often involves misappropriation of assets shrouded in complex transactions

Fraud Schemes

• According to the Association of Certified Fraud Examiners, three categories are:
  • Fraudulent statements
  • Corruption
  • Asset misappropriation

Fraudulent Statements

• Involves misstating financial statements to make them appear better
• Typically management fraud, focused on short-term financial gains
• Motivations include management bonus packages tied to financial statements

Corruption

• Examples include:
  • Bribery
  • Illegal gratuities
  • Conflicts of interest
  • Economic extortion
• The Foreign Corrupt Practices Act of 1977 indicates that a response is required to fight corruption in the business world
• This has impacted accounting by requiring maintaining accurate records and enforcing internal controls

Asset Misappropriation

• Common fraud type often committed by employees
• Examples:
  • Charging expenses to accounts to conceal asset theft
  • Lapping of customer payments to hide theft
  • Transaction fraud altering/adding false transactions to steal assets

Computer Fraud Schemes

• Misuse, theft, or misappropriation of assets by:
  • Altering computer-readable records/files
  • Altering the logic of computer software
  • Illegal use of computer-readable information
  • Corruption or destruction of software
  • Theft of computer hardware

Data Collection Fraud

• This system aspect is the most vulnerable because of how easy the data changes when entered in the system
• The GIGO principle means that inaccurate input data leads to inaccurate output

Data Processing Fraud

• Program frauds: altering programs to allow illegal access to/or manipulation of files
• Includes destruction via virus
• Operations frauds related to misuse of company computer assets such as for personal business

Database Management Fraud

• Involves altering, deleting, corrupting, or stealing data
• Oftentimes done by disgruntled former employees

Information Generation Fraud

• Includes stealing, redirecting, or misusing computer output
• Involves scavenging when searching through the trash for computer output

Internal Control Objectives According to AICPA SAS

• Must safeguard assets of any firm
• Ensure accuracy and reliability of accounting records and information
• Promote efficiency of the firm's operations
• Measure compliance with management's prescribed policies and procedures

Modifying Assumptions to the Internal Control Objectives

• Management has the responsibility for the establishment and maintenance of internal controls
• Reasonable assurance is in place such that the benefits outweigh the costs
• Methods of data processing techniques will vary with the types of technology

Limitations of Internal Controls

• Possibility of honest errors
• Circumvention via collusion
• Management override
• Changing conditions especially in companies with high growth

Exposures of Weak Internal Control (Risk)

• Destruction
• Theft of asset
• Corruption
• Disruption

SAS 78 / COSO

• It describes the relationship between:
  • Internal control structure
  • Auditor's assessment of risk
  • Planning of audit procedures
• The weaker the internal control structure, the higher the assessed risk level is
• The higher the risk, the more auditor procedures applied in the audit

Five Internal Control Components: SAS 78 / COSO:

• Control environment
• Risk assessment
• Information and communication
• Monitoring
• Control activities

The Control Environment

• Integrity and ethics of management
• Organizational structure
• Role of the board of directors and audit committee
• Management's policies and philosophy
• Delegation of responsibility and authority
• Performance evaluation measures
• External influences
• Policies and practices managing human resources

Risk Assessment

• Involves identifying, analyzing, and managing risks relevant to financial reporting
• This includes:
  • Changes in the external environment
  • Risky foreign markets
  • Significant and rapid growth that strain internal controls
  • New product lines
  • Corporate restructuring and downsizing
  • Changes in accounting policies

Information and Communication

• The AIS should produce high quality information that:
  • Identifies and records all valid transactions
  • Provides information in the time to permit proper classification
  • Accurately measures financial value of transactions
  • Accurately records transactions in the time frame in which they occurred
• Auditors need to understand classes of transactions that are material, how transactions are initiated (input), and associated accounting records (input)
• This encompasses processing steps from initiation to inclusion in financial statements (process) and financial reporting used to compile financial statements (output)

Monitoring

• Monitoring assesses internal control quality
• Separate procedures which can be initiated by the internal auditors -Ongoing monitoring with computer modules integrated into routine operations -Ongoing monitoring with management reports highlighting trends

Control Activities

• Establishing policies and procedures so the steps are in place to counter any risks
• Two broad categories:
  • IT (computer environment) controls
  • Physical (human activities) controls

Two Types of IT Controls

• General controls pertain to controls of a company's computer environment:
  • Data center
  • Organization databases
  • System development
  • Program maintenance
• Application ensures the integrity of certain steps of the process.
• Sales order processing
• Accounts payable
• Payroll application

Six Types of Physical Controls

• Transaction authorization
• Segregation of duties
• Supervision
• Accounting records
• Access control
• Independent verification

Transaction Authorization

• used to ensure only authorized transactions are being carried out by employees
• Includes general (everyday procedure and special)

Segregation of Duties

• Manual and computerized systems require separating who can:
  • Authorize and process
  • Custody and recordkeeping
  • Programs, processing and coding

Supervision

• A compensation for lack of segregation which may exist in some computer systems

Accounting Records

• Audit Trail

Access Control

• Help to ensure against unauthorized physical access

Independent Verification

• Batch totals need to often be reviewed or subsidiary accounts reconciled

This lesson covers ethics, fraud, and internal control, as presented in Chapter 3 of Accounting Information Systems, 6th edition. It discusses conflicts in business involving employees, management, and stakeholders. It also highlights four main areas of business ethics.