During your audit of Wilcoxon Sports, Inc., a retail chain of stores, you learn that a programmer made an unauthorized change to the sales application pro- gram even though no work on that application had been approved by IT management. In order for the sales application program to work, the programmer had to make modifications to the operating software security features. The unauthorized change forced the sales program to calculate an automatic discount for a customer who happens to be the brother-in-law of the programmer. The customer and programmer split the savings from the unauthorized discount. The programmer modified the program and returned it to the librarian, who placed it into the files for live production use. No other information was forwarded to the librarian.
1. What recommendation do you have for management of Wilcoxon Sports, Inc., to prevent this from recurring?
2. Explain why you believe the suggested internal control improvements will prevent problems in the future.
Your new audit client, Hardwood Lumber Company, has a computerized accounting system for all financial statement cycles. During planning, you visited with the information systems vice president and learned that personnel in information systems are assigned to one of four departments: systems programming, applications programming, operations, or data control. Job tasks are specific to the individual and no responsibilities overlap with other departments. Hardwood Lumber relies on the operating system software to restrict online access to individuals. The operating system allows an employee with “READ” capabilities to only view the contents of the program or file. “CHANGE” allows the employee to update the contents of the program or file. “RUN” allows the employee to use a program to process data. Programmers, both systems and applications, are restricted to a READ-only access to all live application software program files but have READ and CHANGE capabilities for test copies of those software program files. Operators have READ and RUN capabilities for live application programs. Data control clerks have CHANGE access to data files only and no access to software program files. The person in charge of operations maintains access to the operating software security features and is responsible for assigning access rights to individuals. The computer room is locked and requires a card-key to access the room. Only operations staff have a card-key to access the room, and security cameras monitor access. A TV screen is in the information systems vice president’s office to allow periodic monitoring of access. The TV presents the live picture and no record is maintained. The librarian, who is in the operations department, is responsible for maintaining the library of program files. The librarian has READ and CHANGE access rights to program files. Backup copies of program files are stored on an external drive, and data files are maintained on a backup server. The external drive and backup server are located in a room adjacent to the computer room.
a. Identify the strengths of Hardwood Lumber Company’s computerized accounting
system.
b. What recommendations for change can you suggest to improve Hardwood’s information systems function?
