A glance at Table 8.1 reveals that the first three control goals of the information process deal with entering event-related data into a system. Recall from Chapter 1 that data input includes capturing data (for example, completing a source document such as a sales order, or, in the case of a cash receipts system, writing the check number and amount on the RA). Data input also includes, if necessary, converting the data to machine-readable form (for example, keying in the remittance advices to add events to the cash receipts events data). Therefore, events data are the subjects of the inputcontrol goals shown in Table 8.1.
These three control goals trigger the following questions: “Did the event occur?” (input validity); “Is there a record of each event?” (input completeness); and “Is the record correct?” (input accuracy). Thinking about these control categories in this way may help you to identify controls that provide adequate coverage across all the categories.
To illustrate the importance of achieving the first goal, ensure input validity, assume that our accounts receivable clerk processes a batch of 50 cash receipts (including their payment stubs, or RAs). Further assume that two of the 50 RAs represent fictitious cash receipts (for example, a mailroom employee fabricates phony remittance advices for relatives who are customers). What is the effect of processing the 50 RAs including the 2 fictitious remittances? First, the cash receipts event data and the accounts receivable master data each have been corrupted by the addition of two bogus RAs. Second, if not detected and corrected, the pollution of these data will result in unreliable financial statements—overstated cash and understated accounts receivable—and other erroneous system outputs (e.g., cash receipts listings, customer monthly statements).
To discuss the second information process goal, ensure input completeness, let’s return to the previous example and suppose that, while the 48 valid RAs are being key entered (we’ll ignore the two fictitious receipts in this example), the accounts receivable clerk decides to get a cup of coffee. As the clerk walks past the batch of 48 RAs, 10 are blown to the floor and are not entered into the system. What is the effect of processing 38 RAs, rather than the original 48? First, the cash receipts transaction data will be incomplete; that is, it will fail to reflect the true number of remittance events. Second, the incompleteness of the data will cause the resulting financial statements and other reports to be unreliable (i.e., understated cash balance and overstated accounts receivable). In this example, the omission was unintentional. Likewise, fraudulent, intentional misstatements of organizational data can be accomplished by omitting some events.
When dealing with input completeness, we are concerned with the existence of documents or records representing an event or object, not the correctness or accuracyof the document or record. Accuracy issues are addressed by the third information process goal, ensure input accuracy. This goal relates to the various data fields that usually constitute a record of an event, such as a source document. To achieve this goal, we must minimize discrepancies between data items entered into a system and the economic events or objects they represent. Mathematical mistakes and the inaccurate transcription of data from one document or medium to another may cause accuracy errors. Again, let’s return to our example. Suppose that one of the valid RAs is from Acme Company, customer 159, in the amount of $125. The accounts receivable clerk mistakenly enters the customer number as 195, resulting in Ajax, Inc.’s account (rather than Acme’s) being credited with the $125.
Missing data fields on a source document or computer screen represent another type of accuracy error. For example, the absence of a customer number on a remittance advice would result in “unapplied” cash receipts (that is, receipts that can’t be credited to a particular customer). We consider this type of system malfunction to be an accuracy error rather than a completeness error, because the mere presence of the source document suggests that the event itself has been captured and that the input data are, by our definition, therefore complete.
Now let’s examine the last two information process control goals shown in Table 8.1. These goals deal with updating master data. As we learned in Chapter 1, master data update is an information processing activity whose function is to incorporate new data into existing master data. We also learned that there are two types of updates that can be made to master data: information processing and data maintenance. In this textbook, we emphasize information processing; therefore, our analysis of the internal controls related to data updates is restricted to data updates from information processing.
In our cash receipts system, the goal of update completeness relates to crediting customer balances in the accounts receivable master data for all cash collections recorded in the cash receipts event data. The goal of ensure update accuracy relates to correctly crediting (e.g., correct customer, correct amount) customer balances in the accounts receivable master data.
Once valid data have been completely and accurately entered into a computer (i.e., added to event data such as our cash receipts event data), the data usually go through a series of processing steps. Several things can go wrong with the data once they have been entered into a computer for processing. Accordingly, the goals of update completeness and accuracy are aimed at minimizing processing errors. We should note, however, that if the events are processed using an online real-time processing system such as the one depicted in Figure 4.3, the input and update will occur nearly simultaneously. This will minimize the possibility that the update will be incomplete or inaccurate.
Explain the difference between the following pairs of control goals: (1) ensure effectiveness of operations and ensure efficient employment of resources; (2) ensure efficient employment of resources and ensure security of resources; (3) ensure input validity and ensure input accuracy; (4) ensure input completeness and ensure input accuracy; (5) ensure input completeness and ensure update completeness; and (6) ensure input accuracy and ensure update accuracy.