IT Systems in Accounting

Nature of IT Based Systems

• Computerized accounting systems complexity and functionality varies depending on business' size and needs.
• Systems are generally categorized as either Small Business Systems or Large Business Systems

Small Business Accounting Systems

• Suited for simple, affordable, and user-friendly software.
• They facilitate tasks like bookkeeping, invoicing, and payroll management.
• An example of such a system is Quicken that is used by freelancers and small businesses to track personal and business expenses.
• Quicken helps with check writing, bill payments, and financial planning.
• QuickBooks is also an example, used for invoicing, payroll, tax calculations, and financial reporting as a basic general ledger system.

Large Business Accounting Systems

• Larger businesses need more advanced and scalable accounting solutions.
• These handle complex financial operations, integrate departments, and provide financial analysis.
• Systems can be client/server-based, storing data on a centralized server for multi-user access.
• Enterprise Resource Planning (ERP) systems integrate accounting, finance, supply chain management, and HR functions.
• Cloud Computing Accounting Systems are web-based, offering scalability, accessibility, and security for large enterprises with multiple locations.

Major Components of an IT System

• Hardware: physical components, like computers, servers, storage, and networking equipment.
• Software: programs enabling hardware tasks, are divided into system software and application software.
• System software: programs that control and coordinate hardware components and includes operating systems like Windows.
• Application software: programs designed for end-users like Java, to perform specific data processing tasks.
• Data: raw facts and figures processed into information and deemed a critical asset.
• People: users, IT administrators, system analysts, managing IT systems.
• Procedures: policies defining IT use and maintenance.
• Networks: systems enabling data transfer between devices and systems.

System Characteristics

• Companies use various computer systems like office automation, transaction processing, management information, decision support, expert, and enterprise-wide systems.
• Transaction processing systems are a focus in auditing and accounting and they support daily business activities like sales and purchasing.
• They range from simple general ledger packages to company-wide ERP systems.
• These systems record and process financial transactions, ensure accuracy, completeness, and timeliness in financial reporting.

IT Systems Characteristics

• Batch Processing: groups of transactions processed at scheduled times, such as payroll.
• Real-Time Processing: instant transaction processing, ex: ATM withdrawals.
• Database Storage: Businesses keep important data in central databases that improve organization and security.
• End-User Computing: employees use software like spreadsheets to create, edit, and analyze data.
• Electronic Commerce: secure and require systems for online payments and customer information.
• Client/Server Environments: computers connect to powerful central servers, sharing data and resources.

Batch Processing

• Input data is periodically gathered and processed in groups.
• An example is accumulating a day’s sales transactions to process them at the end of the day.
• It is often more efficient unlike other systems as it does not provide up-to-minute information

Database Storage/System

• Old IT systems meant the same data was saved in different places that caused unnecessary duplication and inconsistencies.
• A database system eliminates duplications by storing all data in one central place.
• Due to the centralization a Database Administrator (DBA) is needed to manage security, prevent unauthorized access, and keep data accurate.
• Security and control risks are introduced by centralized databases that improve efficiency.

Database Storage/System Audit Risks

• Data Integrity Risks consist of unauthorized database changes that leads to inaccurate or incomplete financial records.
• Access Control Risks include inadequate user access controls where unauthorized users can modify or delete critical data.
• Data Redundancy and Inconsistency involves how poor database design can lead to duplicate or inconsistent records.
• Audit Trail Weaknesses are when databases allow mass data updates, this makes it difficult to track individual transactions.
• Segregation of Duties Risks involves a single individual with extensive database privileges is able to manipulate financial records without detection.
• System Downtime and Data Loss occurs when failure in database backups or disaster recovery mechanisms that can result in permanent loss of financial data.
• Cybersecurity Threats are when databases are targets for hacking, which may lead to manipulation and data breaches.
• Compliance Risks are with non-compliance with data protection regulations (e.g., GDPR, HIPAA) which can result in legal penalties.

End User Computing

• Different user departments develop and run their own IT applications instead of relying on a central IT department.
• Due to the IT department isn't directly involved, this leads to more efficiency and flexibility.
• The lack of oversight can bring out risks associated with the security protocols and programming errors.

End User Computing - Special Audit Risks

• Data Accuracy and Integrity Issues: Manually managed spreadsheets or databases that increases errors and inconsistencies.
• Lack of Formal IT Controls: limited access controls, increasing the risk of unauthorized changes.
• Version Control Issues: different spreadsheets can lead to discrepancies in reports.
• Audit Trail Limitations: many EUC applications do not have the correct logging features, making it difficult to track changes.
• Risk of Fraud: Lack of separate duties in EUC applications that increases the risk of fraudulent modifications.
• Data Backup and Recovery Risks: lacking backup procedures, risking data loss.
• Non-Compliance with IT Policies: Employees may use unauthorized software that does not comply with the organizations IT policies.
• Scalability and Reliability Issues: EUC solutions may not be designed to handle large-scale financial data, leading to performance problems.

End User Computing - Reducing Risks

• Access Controls – Limit who can view or edit data.
• Error-Checking – Use validation tools to catch mistakes.
• Backups - Regularly save copies of important data.
• Security Measures – Use passwords and encryption to protect data.
• IT Oversight – The central IT team should still monitor and provide guidance.
• Flexibility can be balanced with security with the help of implementing controls.

IT and the Audit Trail

• A system may be either on or off-premises.
• With manual transactions sales orders are manually recorded on paper forms, authorizing credit, preparing shipping reports/invoices, recording sales, and maintaining accounts receivable records.
• With automated transations records may all be electronic. IT may be able to create, update, and delete data without evidence of change.

Internal Control in IT

• Internal control importance is not lessened in computerized environments.
• Aspects that are important would be: separation of duties, clearly defined responsibilities, physical controls, access controls, alongside control written into computer programs.
• Internal control importance is not lessened in computerized environments.
• Separation of duties ensures that no one person has complete control over all aspects of a financial or operational transaction.
• This type of system helps prevent fraud by requiring multiple individuals that are involved in critical processes.
• In a computerized environment a role-based access control (RBAC) is used within an ERP system to help maintain separation of duties.
• An accounts payable clerk can enter payment information but cannot approve transactions while a manager can approve transactions but cannot modify payment records.
• An IT administrator can manage the system but does not have access to modify financial data.
• Each employee should have a well-defined role with responsibilities that is outlined to avoid overlap and conflicts.
• Accountability is ensured and risks are minimized related to fraud, negligence, and automated workflows ensure that members can’t modify inventory records without authorization.
• Physical security measures are essential to protect hardware, software, and sensitive information from unauthorized access, theft, or damage in a computerized environment.
• An example of this would be using keycard access can only be used by authorized personnel to enter ensuring there is no unauthorized access to critical hardware and data.
• Access control ensures that users can only access information and systems relevant to their job roles.
• Modern access control systems use multi-factor authentication (MFA) and encryption to enhance security.
• MFA makes it so that one has to have extra proof to log in.
• Encryption scrambles data into a secret code is where authorized users can read it.
• Modern access control systems also keeps data safe from cyber threats with the help of MFA and Encryption.
• With computerized controls its meant to help detect and prevent errors, fraud, or unauthorized actions.
• Automated Transaction Verification - limits can automatically be flagged an additional approval before processing.
• Password Policies & Login Monitoring: An enterprise system forces users to change passwords every 90 days and locks accounts after multiple failed login attempts.
• Audit trails are able to maintain log of every transaction.
• Exception are when an inventory management system generates alerts if stock levels drop below a predefined threshold, ensuring timely restocking.

Internal Control in IT- ACCA Example

• An employee can approve their own expense reimbursements, without independent approval and this is fraud.
• Employees use the same password for both personal and company accounts, there is risk of data breaches if one account is compromised.
• There is no approval process for large financial transactions, and oversight is not provided leading to unauthorized actions going unnoticed.
• Employees are allowed to install any software on their work computers, there is regulated software which increases the risk of malware infections.
• Servers containing confidential customer information are stored in an unlocked room accessible to all employees meaning they have restricted physical access and is possible to cause data breaches.