M2 - Information Systems Controls Overview

Types of Processing Controls

• Input Controls: Ensure data integrity at entry, meeting predefined parameters.
• Output Controls: Provide additional processing integrity checks, including reconciliation and user review.
• Processing Controls: Guarantee accurate and complete processing.
• Access Controls: Restrict user access to the system.

General Controls in an Information System

• Software Acquisition: Managing the procurement of software.
• IT Infrastructure: Maintaining the hardware and networking components.
• Security Management: Implementing and enforcing security policies.
• Development, Operations, and Maintenance Controls: Guiding and monitoring application development, operation, and upkeep.

Enterprise Resource Planning (ERP)

• Cross-functional Systems: Support various business functions.
• Centralized Data Repository: Facilitates easier data input.

Accounting Information System (AIS)

• Primary Tool: Facilitates interactions for accountants and financial managers.
• Component of ERP: Could be part of a larger ERP system.
• Reasonableness Test: Alerts when transaction offset totals exceed original amounts.

AIS - Three Subsystems

• Transaction Processing System (TPS): Converts economic events into financial transactions (sales, conversion, expenditure, payroll cycles).
• Financial Reporting System (FRS): Aggregates daily financial information with infrequent events (mergers, lawsuits).
• Management Reporting System (MRS): Presents internal financial information for operational decision-making (budgeting, variance analysis, cost-volume profit analysis).

Goals of AIS Subsystems

• Record Valid Transactions: Ensure only accurate events are documented.
• Classify Transactions: Group transactions into appropriate categories.
• Record Transactions at Correct Value: Ensure accurate financial value.
• Record Transactions in Correct Accounting Period: Match transaction timing with accounting periods.

AIS Process

1. Input by End User
2. Filing of Source Documents
3. Journal Entry of Transactions
4. Posting to General Ledger and Subsidiary Ledgers
5. Trial Balance Preparation
6. Adjustments, Accruals, and Corrections
7. Financial Report Generation

Cycles within AIS

• Purchasing and Disbursements Cycle: Managing vendor payments and inventory/asset tracking.
• Treasury Cycle: Managing cash, investments, and working capital.
• Payroll Cycle: Calculating and paying employee wages.
• Revenue and Collections Cycle: Handling customer orders, billing, and payments.

Key AIS Functions (by Cycle)

• Revenue & Collections: Credit approval, invoice recording, inventory release, shipping, sales update, invoice closing, ledger posting, customer payment updates.
• Purchasing & Disbursements: Vendor approval, purchase order preparation, receipt recording, invoice processing, payment authorization, check distribution, inventory/asset updates.
• HR & Payroll: Employment data updates, labor cost allocation, payroll calculation, payroll register.
• Production: Tracking labor, material, and manufacturing overhead costs, production run monitoring.
• Fixed Asset: Asset record creation, depreciation calculation, disposal accounting.
• Treasury: Investment tracking, dividend/interest updates, cash management.
• General Ledger & Reporting: Continuous ledger updates, trial balance generation, adjusting journal entries, financial statement generation, account closing.

Application Software Provider (ASP) for ERP

• Lower Costs: Reduces upfront investment and maintenance costs .
• Flexibility: Adaptability to varying business needs.
• Suitable for Smaller Companies: Pay-as-you-go pricing model.

Processes Driven by IT Systems

• Automation: Computer programs automate repetitive tasks.
• Shared Services: Pooling resources for redundant processes.
• Outsourcing: Contracting work to external providers.
• Offshore Operations: Relocating operations to a different country.

Offshore Operations - Areas

• IT: Infrastructure and networks
• Knowledge: Specialized skill sets (e.g., medical imaging).
• Business Processes: Customer service, accounting.
• Software R&D: Supporting innovation in software creation.

Risks in Outsourcing

• Quality Risks: Defective products/services.
• Service Quality: Poorly designed service contracts.
• Productivity: Efficiency concerns and slow response times.
• Staff Turnover: Skilled worker loss.
• Language Barriers: Communication issues.
• Security Concerns: Data breaches.
• Outsourcer Qualifications: Insufficient skillsets/knowledge.
• Labor Insecurity: Worker exploitation concerns.

Technology-Driven Forms

• Robotic Process Automation (RPA): AI/ML-powered software for repetitive tasks.
• Natural Language Processing (NLP): Encoding, decoding, and interpreting human language (e.g., Siri, Alexa).
• Neural Networks: Modeling human brain function for complex tasks.

COSO Principles (related to technology)

• Principle 11: General control over technology to achieve organizational goals.
• Principle 13: Acquisition and utilization of quality information for internal controls.
• Principle 14: Effective communication of information to aid internal controls.

Blockchain

• Control System: Originally designed for Bitcoin management.
• Decentralized: Reduced accountability concerns.
• Resistant to Alteration: Secure from tampering.
• Multiple Transaction Validation: Ensures transaction accuracy.

Applying COSO to Blockchain

• Preventative and Detective Controls: Focus on inherent blockchain features and security measures.