Computer-Based Information Systems Controls

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Pendahuluan Jason Scott dipekerjakan sebagai Auditor internal oleh Northwest Industries, sebuah perusahaan kehutanan yang memiliki berbagai jenis produk Dia ditugaskan untuk mengaudit Springer’s Lumbers & Supply, sebuah toko bahan bangunan milik Northwest di Bozeman, Montana.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Pendahuluan Supervisornya, Maria Pilier, telah meminta Jason untuk melacak contoh transaksi – transaksi pembelian dari permintaan pembelian hingga kepembayaran tunai, untuk memverifikasi bahwa prosedur pengendalian yang sesuai, telah diikuti. Pada tengah hari Jason merasa Frustasi dengan tugas ini. Mengapa Jason Frustasi ? – Sistem pembelian tidak didokumentasikan dengan baik. – Jason kerap menemukan transaksi yang belum diproses Padahal menurut Ed Yates, Manajer bagian Hutang, seharusnya diproses.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Pendahuluan Jason’s frustrations, continued – Beberapa faktur penjualan dari Vendor telah dibayar tanpa adanya dokumen pendukung, seperti pesanan pembelian dan laporan penerimaan. – Beberapa permintaan pembelian untuk beberapa jenis barang yang secara pribadi di otorisasi oleh Bill Springer, Wakil presiden bagian pembelian, telah hilang. – Harga yang dibebankan ke beberapa barang terlalu tinggi. – Springer’s adalah pemasok terbesar di wilayah tersebut dan hampir dapat dikatakan merupakan usaha monopoly. – Otoritas manajemen dipegang oleh Presiden perusahaan, Joe Springer, beserta kedua anaknya, yaitu Bill (wakil presiden bag. Pembelian) dan Ted (Controller), serta beberapa saudaranya dan teman mereka yang bekerja di bagian penggajian. Springer memiliki 10 % saham perusahaan. – Maria yakin Bahwa Ted Springer tampaknya terlibat dalam praktek “creative accounting.” untuk membuat Springer’s menjadi salah satu toko Northwest dengan kinerja terbaik.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Pendahuluan Jason mempertimbangkan isu – isu berikut: – Haruskan Jason mendeskripsikan transaksi tersebut dalam Laporannya? – Apakah pelanggaran atas prosedur pengendalian yang sesuai dapat diterima apabila hal tersebut telah diotorisasi oleh pihak management? – Berdasarkan tugas mengenai prosedur pengendalian yang diberikan ke Jason, apakah dia memiliki tanggung jawab Profesi atau Etika untuk ikut campur dalam hal tersebut ?

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Ancaman – Ancaman atas SIA Kehancuran karena bencana Alam dan Politik? – Kebakaran atau panas berlebih (fire or excessive heat) – Banjir (floods) – Gempa bumi (earthquakes) – Badai Angin (high winds) – Peperangan (war)

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Ancaman – Ancaman atas SIA Error pada Software dan tidak berfungsinya peralatan? – Kegagalan Hadrware – Kesalahan atau kerusakan pada software – Kegagalan sistem Operasi – Gangguan dan Fluktuasi Listrik – Kesalahan pengiriman data yg tidak terdeteksi

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Ancaman – Ancaman atas SIA Tindakan yang tidak disengaja? – Kecelakaan yang disebabkan oleh kesalahan manusia – Kesalahan atau penghapusan karena ketidaktahuan – Hilangnya atau salah letaknya data – Kesalahan pada logika sistem – System yang tidak memenuhi kebutuhan perusahaan atau tidak mampu menangani tugas yang diberikan.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Ancaman – Ancaman atas SIA Tindakan sengaja (Kejahatan Komputer) – Sabotase – Penipuan melalui komputer – Pencurian

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Mengapa Ancaman – ancaman SIA Meningkat ? Peningkatan Jumlah of client/server systems berarti bahwa Informasi yang tersedia untuk Jumlah yang tidak terprediksi bagi para pekerja. Karena LANs and client/server systems mendistribusikan data kebanyak pemakai, mereka lebih sulit dikendalikan daripada sistem komputer utama yang terpusat. WAN memberikan pelanggan dan Pemasok akses ke sistem dan data mereka satu sama lain, yang menimbulkan kekhawatiran dalam hal kerahasian.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Mengapa Pengendalian dan Keamanan Komputer Penting Sebagai seorang yang mengerti Akuntansi dan Teknologi Informasi Anda harus memahami bagaimana cara melindungi sistem dari ancaman- ancaman yang dihadapi. Sehingga dapat menggunakan Teknologi informasi dalam mencapai tujuan pengendalian Perusahaan.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Tinjauan Menyeluruh Konsep – konsep pengendalian Apakah Internal Control? Internal Control adalah rencana organisasi dan metode bisnis yang digunakan untuk menjaga aset, memberikan informasi yang akurat dan handal, mendorong dan memperbaiki efisiensi jalannya organisasi, serta mendorong kesesuaian dengan kebijakan yang telah ditetapkan.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Overview of Control Concepts What is management control? Management control encompasses the following three features: 1It is an integral part of management responsibilities. 2It is designed to reduce errors, irregularities, and achieve organizational goals. 3It is personnel-oriented and seeks to help employees attain company goals.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Internal Control Classifications The specific control procedures used in the internal control and management control systems may be classified using the following four internal control classifications: 1Preventive, detective, and corrective controls 2General and application controls 3Administrative and accounting controls 4Input, processing, and output controls

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Information Systems Audit and Control Foundation The Information Systems Audit and Control Foundation (ISACF) recently developed the Control Objectives for Information and related Technology (COBIT). COBIT consolidates standards from 36 different sources into a single framework. The framework addresses the issue of control from three vantage points, or dimensions:

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Information Systems Audit and Control Foundation 1Information: needs to conform to certain criteria that COBIT refers to as business requirements for information 2IT resources: people, application systems, technology, facilities, and data 3IT processes: planning and organization, acquisition and implementation, delivery and support, and monitoring

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) The Control Environment The first component of COSO’s internal control model is the control environment. The control environment consists of many factors, including the following: 1Commitment to integrity and ethical values 2Management’s philosophy and operating style 3Organizational structure

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) The Control Environment 4The audit committee of the board of directors 5Methods of assigning authority and responsibility 6Human resources policies and practices 7External influences

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Control Activities The second component of COSO’s internal control model is control activities. Generally, control procedures fall into one of five categories: 1Proper authorization of transactions and activities 2Segregation of duties

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Control Activities 3Design and use of adequate documents and records 4Adequate safeguards of assets and records 5Independent checks on performance

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Proper Authorization of Transactions and Activities Authorization is the empowerment management gives employees to perform activities and make decisions. Digital signature or fingerprint is a means of signing a document with a piece of data that cannot be forged. Specific authorization is the granting of authorization by management for certain activities or transactions.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Segregation of Duties Good internal control demands that no single employee be given too much responsibility. An employee should not be in a position to perpetrate and conceal fraud or unintentional errors.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Segregation of Duties Recording Functions Preparing source documents Maintaining journals Preparing reconciliations Preparing performance reports Custodial Functions Handling cash Handling assets Writing checks Receiving checks in mail Authorization Functions Authorization of transactions

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Segregation of Duties If two of these three functions are the responsibility of a single person, problems can arise. Segregation of duties prevents employees from falsifying records in order to conceal theft of assets entrusted to them. Prevent authorization of a fictitious or inaccurate transaction as a means of concealing asset thefts.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Segregation of Duties Segregation of duties prevents an employee from falsifying records to cover up an inaccurate or false transaction that was inappropriately authorized.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Design and Use of Adequate Documents and Records The proper design and use of documents and records helps ensure the accurate and complete recording of all relevant transaction data. Documents that initiate a transaction should contain a space for authorization.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Design and Use of Adequate Documents and Records The following procedures safeguard assets from theft, unauthorized use, and vandalism: – effectively supervising and segregating duties – maintaining accurate records of assets, including information – restricting physical access to cash and paper assets – having restricted storage areas

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Adequate Safeguards of Assets and Records What can be used to safeguard assets? – cash registers – safes, lockboxes – safety deposit boxes – restricted and fireproof storage areas – controlling the environment – restricted access to computer rooms, computer files, and information

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Independent Checks on Performance Independent checks ensure that transactions are processed accurately are another important control element.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Independent Checks on Performance What are various types of independent checks? – reconciliation of two independently maintained sets of records – comparison of actual quantities with recorded amounts – double-entry accounting – batch totals

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Independent Checks on Performance Five batch totals are used in computer systems: 1A financial total is the sum of a dollar field. 2A hash total is the sum of a field that would usually not be added.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Independent Checks on Performance 3A record count is the number of documents processed. 4A line count is the number of lines of data entered. 5A cross-footing balance test compares the grand total of all the rows with the grand total of all the columns to check that they are equal.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Learning Objective 5 Evaluate a system of internal accounting control, identify its deficiencies, and prescribe modifications to remedy those deficiencies.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Risk Assessment The third component of COSO’s internal control model is risk assessment. Companies must identify the threats they face: – strategic — doing the wrong thing – financial — having financial resources lost, wasted, or stolen – information — faulty or irrelevant information, or unreliable systems

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Risk Assessment Companies that implement electronic data interchange (EDI) must identify the threats the system will face, such as: 1Choosing an inappropriate technology 2Unauthorized system access 3Tapping into data transmissions 4Loss of data integrity

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Risk Assessment 5Incomplete transactions 6System failures 7Incompatible systems

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Risk Assessment Some threats pose a greater risk because the probability of their occurrence is more likely. For example: A company is more likely to be the victim of a computer fraud rather than a terrorist attack. Risk and exposure must be considered together.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Learning Objective 6 Conduct a cost-benefit analysis for particular threats, exposures, risks, and controls.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Estimate Cost and Benefits No internal control system can provide foolproof protection against all internal control threats. The cost of a foolproof system would be prohibitively high. One way to calculate benefits involves calculating expected loss.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Expected loss = risk × exposure Estimate Cost and Benefits The benefit of a control procedure is the difference between the expected loss with the control procedure(s) and the expected loss without it.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Information and Communication The fourth component of COSO’s internal control model is information and communication.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Information and Communication Accountants must understand the following: 1How transactions are initiated 2How data are captured in machine-readable form or converted from source documents 3How computer files are accessed and updated 4How data are processed to prepare information 5How information is reported 6How transactions are initiated

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Information and Communication All of these items make it possible for the system to have an audit trail. An audit trail exists when individual company transactions can be traced through the system.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Monitoring Performance The fifth component of COSO’s internal control model is monitoring. What are the key methods of monitoring performance? – effective supervision – responsibility accounting – internal auditing

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Case Conclusion What happened to Jason’s report? A high-level internal audit team was dispatched to Montana. The team discovered that the problems identified by Jason occurred almost exclusively in transactions with three large vendors from whom Springer’s had purchased several million dollars of inventory.

GASAL 2007/2008SISTEM INFORMASI AKUNTANSI (AK069) Case Conclusion One of the Springers held a significant ownership interest in each of these three companies. They also found evidence that several of Springer’s employees were paid for more hours than documented by timekeeping, and that inventories were overstated. Northwest settled the case with the Springers.