ACCT 432 Week 3 Individual Project 3 Example

Program Change Controls at a Credit Union: A Mini-Case on Systems Development, Emergency Fixes and the Audit Tests That Prove Control

Case Summary

Lakeview Community Credit Union, a composite institution with $640 million of assets, runs a loan servicing system maintained by two in-house developers. Business units request changes by email. The developers write the code, test it against a copy of the live database on the production server and move it into production when they are satisfied. About once a month, a developer fixes an urgent problem at night, such as an interest accrual error, directly in the production program, and these emergency changes are not written up afterward. The IT manager, who supervises both developers, also has authority to approve changes but rarely reviews them. The credit union's external auditors and its regulator both rely on the system's reports, and last year the system produced the figures for $38 million of interest income.

Control Weaknesses

Hall (2016) describes the systems development and program change controls an organization needs to ensure that only authorized, tested programs run in production. Measured against that framework, Lakeview has four weaknesses. First, change requests arrive by email without formal authorization, so there is no record that a business owner approved each change. Second, testing takes place on the production server rather than in a separate test environment, which risks live data and leaves no independent evidence of testing. Third, developers move their own code into production, so no one other than the author confirms the change before it runs. Fourth, emergency changes are made directly in production and never documented, which means the program library can drift away from any approved version without anyone knowing. Taken together, the four weaknesses mean that the credit union cannot show, for any given day, that the program running in production is the one management approved.

Financial Reporting Risks

The loan servicing system calculates interest income, posts payments and ages delinquent loans, which drives the allowance for credit losses. An unauthorized or untested change to the accrual logic could misstate interest income across thousands of loans. An undocumented emergency fix to the aging routine could understate delinquency and therefore the allowance. Because the same program runs every loan, a single bad change is not one error but thousands of identical ones. Canada et al. (2009) found that IT-related control weaknesses were associated with higher audit costs, reflecting the additional work auditors must do when they cannot rely on automated controls, and Stoel and Muhanna (2011) linked IT control weaknesses to weaker firm performance. For a credit union, the consequences reach beyond the audit fee: regulators examine IT controls directly, and a finding on change management can lead to a formal requirement to remediate. Members also depend on accurate statements of interest and payments, so an error in the servicing program becomes a customer problem as well as an accounting one.

Audit Tests

Because the controls are likely to fail these tests, the auditor would also plan substantive procedures, such as recalculating interest on a sample of loans across the year and testing the delinquency aging independently. The auditor would document the deficiencies and communicate them in writing to the supervisory committee, since the weaknesses affect systems that produce material account balances. If management fixes the process during the year, the auditor could test the new controls for the remaining months and reduce substantive work in the following audit.

Recommendations

Lakeview can address the weaknesses without new staff. Change requests should move into a ticketing system that requires business-owner approval. A separate test environment with masked data should be created, and the requesting department should sign off on test results. The IT manager, or an operations employee, should perform all production migrations. Emergency changes should be allowed only under a logged emergency account, with documentation and retroactive approval within one business day. The undocumented emergency changes are the most urgent, because they leave no trail at all. The next priority is moving migrations out of the developers' hands, since that single change gives the credit union an independent check on every release. The separate test environment, which requires some hardware and setup, can follow within a quarter. Once the process is in place, the IT manager should review the change log monthly and sign it, so that the review itself becomes evidence an auditor can test.

References

Canada, J., Sutton, S. G., & Kuhn, J. R., Jr. (2009). The pervasive nature of IT controls: An examination of material weaknesses in IT controls and audit fees. International Journal of Accounting and Information Management, 17(1), 106-119. https://doi.org/10.1108/18347640910967753

Hall, J. A. (2016). Information technology auditing (4th ed.). Cengage Learning.

Stoel, M. D., & Muhanna, W. A. (2011). IT internal control weaknesses and firm performance: An organizational liability lens. International Journal of Accounting Information Systems, 12(4), 280-304. https://doi.org/10.1016/j.accinf.2011.06.001