ACCT 660 Week 3 Discussion Board Forum 2 Thread Example

Discussion Board Forum 2 Thread: Information Technology Controls and the Opportunity for Fraud

ACCT 660 Information Technology and Fraud, Discussion Board Forum 2 Thread

Thread by [Student Name]

The thread answers a composite prompt on IT controls and fraud; the studies and book cited are real.

When people think about information technology and fraud, they tend to picture outside attackers breaking through a firewall. For most frauds against an organization, the more important question is simpler: who inside the organization can create, change and approve records in the accounting system? The controls that answer that question, access rights, change management and the separation of incompatible duties within the system, matter more to fraud prevention than any defense against outsiders.

These controls belong to the group known as IT general controls, which govern the computing environment as a whole rather than a single application. They include who is granted access to systems and data, how program changes are requested, tested and approved before they go live, and how computer operations are run. Application controls, such as an edit check that rejects an invoice without a purchase order, depend on them. If a user can change the program or switch off the edit check, the application control no longer means much.

Research on public companies shows that IT control weaknesses rarely stay contained. Klamm and Watson (2009) examined the control problems that companies disclosed in their first years of Sarbanes-Oxley reporting, sorting each problem into one of COSO's five components and noting whether technology was involved. Companies with IT-related weaknesses reported more weaknesses in other areas as well, which the authors interpreted as IT problems spilling over into the controls that depend on information systems. A weakness in who can change the system is a weakness in every control the system performs.

The consequences reach management's own decisions. Li et al. (2012) examined companies that disclosed IT control weaknesses and found that their managers issued less accurate earnings forecasts than managers at companies without such weaknesses. In other words, poor IT controls corrupt the numbers executives use to run the business, and the published statements suffer along with them. A company that cannot trust its own data is also a company less likely to notice when someone has altered it.

The evidence on who commits fraud through systems points in the same direction. Drawing on hundreds of insider cases collected by the CERT program at Carnegie Mellon University, Cappelli et al. (2012) report that insiders who committed fraud were usually not technical experts. They were often lower-level employees, such as clerks and customer service staff, who used access they had been granted for their jobs to add, modify or delete records, frequently during normal working hours. Many of them were selling or altering information about customers or creating false records for personal gain. A typical pattern was a clerk who discovered that a system allowed a change without a second approval and then repeated that change for months, often in small amounts that drew no attention. The weakness in such cases is not technical sophistication on the part of the fraudster but the absence of anyone reviewing what users with ordinary access actually do. For an accountant, that means the review of access rights cannot stop at whether a user should have access; it has to extend to how the access is being used. Those patterns mean that the most common insider fraud does not require defeating any security at all; it requires only that no one notices how legitimate access is being used.

The forensic analytics methods in Nigrini (2011) offer part of the remedy. The same tests that look for unusual amounts can be applied to who posted what and when. An examiner can profile entries by user identifier, flag users who post to accounts outside their normal duties, and look for records created and approved by the same person or posted at unusual hours. Access logs and change logs become data sets to analyze, not just records to keep.

In practice, I would ask three questions about any accounting system. First, is there a current list of who can create vendors, change pay rates and post journal entries, and has someone outside IT reviewed it this year? Second, can any single user both create and approve the same kind of transaction? Third, are program changes and changes to master data logged, and does anyone look at the logs? A company that cannot answer these questions has an opportunity for fraud built into its systems, regardless of how strong its firewall is.

I would welcome disagreement on one point. Small companies often cannot separate duties fully because they have only a few accounting staff. Do classmates think analytics on user activity can substitute for segregation of duties in a small business, or is it only a partial safeguard?

References

Cappelli, D. M., Moore, A. P., & Trzeciak, R. F. (2012). The CERT guide to insider threats: How to prevent, detect, and respond to information technology crimes (theft, sabotage, fraud). Addison-Wesley.

Klamm, B. K., & Watson, M. W. (2009). SOX 404 reported internal control weaknesses: A test of COSO framework components and information technology. Journal of Information Systems, 23(2), 1-23. https://doi.org/10.2308/jis.2009.23.2.1

Li, C., Peters, G. F., Richardson, V. J., & Watson, M. W. (2012). The consequences of information technology control weaknesses on management information systems: The case of Sarbanes-Oxley internal control reports. MIS Quarterly, 36(1), 179-203. https://doi.org/10.2307/41410413

Nigrini, M. J. (2011). Forensic analytics: Methods and techniques for forensic accounting investigations. Wiley.