Computer-Based Information Systems
This chapter contains the following sections:
1. the information society
2. elements of computer-based accounting information systems
The Information Society
This section covers the following topics:
· information technology trends
· impact of information technology on business
competitive advantage through IT
data warehousing and data mining
accounting information systems
decision support and expert systems
executive information systems
electronic meeting systems
obtaining a competitive advantage from IT requires effective management
· roles for accountants in the information society
information systems control and audit: a multi-disciplinary field
information systems management
key dimensions of practice by information systems control and audit practitioners
transaction processing reliability
auditability of information systems
compliance with laws and corporate policies
security over information system facilities and privacy of data
system development process
value of information system services and facilities
multiple objectives and conflict
Information Technology Trends
As Naisbitt predicted in his best-seller Megatrends1, we truly are living in an Information Society. Knowledge is doubling every seven to eight years. The changes taking place all around us are transforming the world in ways which we cannot even imagine.
The explosion of small computers was described by Business Week as a gut wrenching change away from the monolithic back office mainframe to inexpensive small computers scattered throughout an organization and providing computing power to individuals and small groups.2 There are hundreds of millions of computers in use around the world and more than 50% of North-American homes have a micro-computer.
As illustrated in Figure 1.1, the fastest growing part of the computer industry is in the use of micro computers. Todays commonly available micro computers have the power once reserved for the largest mainframes.
Even small computers are capable of extremely sophisticated operations. They generally use pre-programmed software packages and usually require minimal programming or other computing expertise on the part of their users. Whats more, the portable micro computers, or laptops, notebooks, and personal digital assistants can be carried to wherever they are needed. The mobility of such devices is creating the latest trend in computing technologies.
The trend towards ever smaller yet more powerful computers is mainly the result of technological advances in the electronics industry which, as illustrated in Figure 1.2, have tremendously reduced the cost of computer power while increasing their capabilities at an exponential rate. A dramatic illustration of the advances in computing technologies goes as follows:
Had the cost of automobiles kept pace with the cost of computers, the next time you went to a movie, you would discard your car upon arrival and buy a new one on the way home rather than pay the parking."
At the same time as the microcomputer explosion is taking place, in another sector of the industry, supercomputers with greater and greater power are being developed power unimaginable until recent times. Yet for all their power, Time wrote that:
The real definition of a supercomputer is a machine that is just one generation behind the problems it is asked to solve. 3
In other words, we are finding ways to apply information technology faster than we can create it. The engine thats driving information technology development is our increasing capability of putting it to use in a creative way.
In addition to the dramatic improvements in the cost-performance features of computer hardware, there have been similar dramatic improvements in the availability of software. Heavy reliance on custom programming, once a formidable barrier to the adoption of computer processing, has been swept away by easy-to-use pre-programmed software and new system development methods based on pre-programmed building blocks.
Networking via the information superhighway (Internet, World Wide Web, etc.) is the current focus of attention and we see the convergence of many computer-based or computer-assisted facilities; for example, voice/data communications, image processing, logic processing, word processing, and so on.
Computers are no longer the tools of only the large corporations and governments; the availability of low-priced, user-oriented computers enables all organizations to take advantage of the capabilities of computers. Today, information technology plays a vital role in supporting the activities of most profit-oriented and not-for-profit organizations.
The following IT trends are particularly noteworthy:4
· wide availability of powerful yet inexpensive computer hardware, including the widespread incorporation, through miniaturization, of powerful computing capabilities in numerous devices designed for personal and professional use (e.g., personal digital assistants or PDAs, mobile telephones, etc.)
· wide availability of powerful, inexpensive and relatively user-friendly software with graphical user interfaces
· shift from custom-tailored systems to pre-packaged software. Pre-programmed software has played a major role in the empowerment of users, particularly the following:
· word processors
· database management systems
· data communications systems such as electronic mail systems and web browsers
· accounting software
Indeed, surveys indicate that more than 70% of all computing involves the use of one of the first three types of pre-programmed packages. One of the side effects of the proliferation of micros and pre-programmed software packages is that accountants who didnt need to worry about computer matters are now forced to do so because even their smallest clients are using computer systems for a variety of business purposes.
· shift from mainframes to small computers used alone, or increasingly, as part of networks devoted to information sharing and co-operative computing with corresponding changes in the nature, organization and location of key information system activity, such as the shift to end user computing
· increasing availability of computerized data for access in real or delayed time both locally and through remote access facilities, including via the Internet. Entities are developing data warehouses to enable them to identify patterns in data that can be used to continuously improve key business processes.
· new data capture and mass storage technologies leading to increasing computerization of data/information in text, graphic, audio and video formats and emphasis on managing, presenting and communicating information using multi-media approaches
· convergence of information and communication technologies, affecting how people work and shop
· increasing use of networks to link individuals, intra-organizational units and inter-organizational units through systems such as electronic mail (e-mail) and the Internet, including the World Wide Web
· increasing use of the Internet for conducting commerce between organizations and individuals and between organizations and other organizations through electronic commerce systems incorporating features such as electronic data interchange (EDI) , electronic funds transfer systems (EFTS) and electronic markets
· mass marketing and distribution of IT products and services such as computers, pre-packaged software, on-line data retrieval services, electronic mail, and financial services
· reduction of barriers to systems use, encouraging wider penetration of information systems into profit-oriented and not-for-profit organizations of all sizes for accounting and broader management and strategic purposes and increasing the role of end-user computing
· wider penetration of information technologies such as computer-assisted design and computer-assisted manufacturing (CAD/CAM), computer imaging systems, executive information systems (EIS), and electronic meeting systems (EMS)
· new system development techniques based around information technologies such as computer-assisted software engineering (CASE), object-oriented programming, and workflow technologies
· continuing development of intelligent support systems incorporating expert systems, neural networks, intelligent agents, and other problem solving aids
· new business re-engineering approaches based on effective integration of information technologies and business processes. Particularly significant are Enterprise Resource Planning systems such as SAP, Oracle, Baan, Peoplesoft and J. D. Edwards that are being used to shape business processes.
Impact of Information Technology
As used in this publication, the term information technology or IT, is more than technology. It encompasses hardware and software products, information system operations and management processes, and the skills required to apply those products and processes to the task of information production and information system development, management and control.
Competitive Advantage Through IT
In the early days of business data processing, computer systems were primarily devoted to transaction processing to ease the clerical burden involved in maintaining business records. Today, computers are increasingly being used for supporting critical enterprise functions. The phrase competitive advantage is widely used to describe the use of computers as part of an enterprises competitive strategy. Most enterprises of significant size depend on their computer systems for their economic success, or even, their survival. In fact, many enterprises would not be able to operate manually in the event of a failure of their computer-based operational systems. Consequently, they require their systems to be running virtually all the time.
One of the oldest uses of information technology for competitive advantage was in the reservation systems developed by the major airlines.
The reservations systems of American Airlines and the United Airlines have helped make these carriers major forces in the air travel distribution chain. These systems have become popular examples of the use of information technology for competitive advantage. Less well known is precisely how these carriers came to pre-empt their competitors.
The dominant positions of American and United can be understood as the outcome of an evolutionary process that parallels developments in information technology and the air transport industry. Since the late 1940s, the goals for reservation systems have changed and expanded. At first, the primary incentive was to reduce clerical costs. It soon became apparent that an accurate count of the number and names of passengers for each flight was fundamental to controlling airline operations. Information captured through the reservation process was used to manage passenger service levels and aircraft capacity and to plan for ancillary requirements such as baggage handling, food, and fuel. Eventually, the marketing potential inherent in the systems came to dominate the airline industrys retail distribution channels. Starting from an electromechanical base, the airline reservations systems evolved along with the computer and air transport industries. Their expanding scale and scope influenced developments in both software and hardware and were affected by the regulation and deregulation of the domestic airline market. In the process, these systems went from being useful, to being essential assets, equal in importance to an airlines fleet. 5
Reservation systems evolved from being manually maintained inventories of seat availability to become strategically valuable information-technology based resources, described by some as anti-competitive weapons used unlawfully to obtain and exercise monopolistic power. According to Copeland and McKenney:
The lesson gained from the airlines is that technical competence is a necessary requirement for gaining competitive advantage from information technology. Many prescriptions for identifying and developing strategic information systems focus exclusively on market opportunities, and thus imply that management vision is a sufficient condition.
Intelligent persistence leads to invaluable experience not easily imitated by rivals. Firms that begin to ride an experience curve ahead of their competitors realize a head start that will endure as long as new opportunities continue to be revealed. Technology can always be purchased, but the same can rarely be said for knowledge.6
The competitive advantages flowing from innovative uses of information technology are not in doubt. The question is whether the latest advances in technology can deliver on the promises they have made and are increasingly making. After all, many predicted advances in the field of information technology have failed to materialize. One observer has commented:7
People say we are in the information age. I dont think so. We are in an age of data babble. We are in danger of becoming a data society, not an information society, operating at a frenetic pace, trying to make sense out of a mass of uninterpreted, jumbled, raw material."
It is easy to be skeptical about the sometimes shameless self-promotion by some technologists. For example, one prominent IS researcher referred to expert systems as the snake oil of the 80s.8 On the other hand, others see us embarking upon the intelligent age, the ability to slip intelligence into the most minute processes. Their advice: Instead of thinking about information technology in trivial ways as something dropped into an organization we need to see that new and dominant forms of organization are evolving by incorporating information technology into their problem solving infrastructure.9
Lets review the use of information technology for competitive advantage under four main headings: sales, service, production, and management.10
There are several ways in which computers are being used to enhance the sales potential of an enterprise. Micro-computers are used by sales personnel as a way of dealing more precisely and more effectively with customer needs. Financial advisors, for example, armed with micro-computers, can use custom software to help clients build investment strategies, simulate various what-if scenarios, make modifications at will, place orders for various instruments on the spot, etc.
Channel marketing or inter-organizational systems can be used to provide direct links between a distributor and customers, thereby providing faster service and at the same time, locking-in a prized customer. American Hospital Supply Corporation and American Airlines are often cited as examples of enterprises using information technology in this way.
Telemarketing services are increasingly being used as a way of marketing products and services to residential customers.
The existence of computer databases has permitted the development of new products and services such as the widely-cited cash management account introduced by Merryl Lynch & Company.
Data Warehousing and Data Mining
Data warehousing and data mining are two of the premier trends in business use of IT today. A data warehouse is a database designed to support analysis and decision-making. This data may be based in part on the data used for day-to-day transaction processing, but may be supplemented by other data sources. A data warehouse, like any warehouse, is not simply a haphazard collection of data. The data must be organized in a way that serves the purpose of the warehouse and must provide tools for the users to carry out a variety of analyses in support of their business intelligence activities.
One of the most significant uses for data warehouses is to support an entitys marketing organization. Thus, entities which process large volumes of transactions with customers, such as telephone companies, retailers and bankers, are particularly keen on using data warehousing and data mining to better understand customer behaviour, purchasing patterns, and so on. For example, the Bank of Americas data warehouse provides managers with detailed information on the holdings and banking behaviours of various categories of customers. This enables the bank to send tailored promotional mailings to targeted categories of the banks customers.
A retail chain can use the warehouse to track the demand for its products store by store. For example, Victorias Secret, a retail chain that distributes various types of lingerie, discovered that certain colours are more popular in some cities than in others, and that discounts that worked to increase sales in some stores had much less impact on others.11
Wal-Mart redesigned its business process around a data warehouse as part of its business strategy. It collects sales data at its 2,800 stores and makes it available to its 4,000 suppliers who are jointly responsible for managing Wal-Marts inventory and shel-stock.12
One reason why data warehousing is becoming so important today is that the data that is used to support transaction processing activities and day-to-day operations of an entity may not be organized in a suitable way to support business intelligence activities. At the same time, organizations are able to gather large volumes of information and there is sufficient computing power and inexpensive storage to make it practical to maintain large amounts of information for such business intelligence activities.
It is important to recognize that a data warehouse is not a solution that can be purchased off the shelf. It requires a significant development effort to identify the information that is required, organize that information and identify and acquire or develop tools to enable users to access that information to support their specific decision needs.
Data warehousing implementations involve complex hardware, software, multi-dimensional databases and data extraction and cleansing tools. The data is often drawn from both internal and external sources containing non-standard data. Because of these complexities, 50% of data warehouse projects fail and most organizations rely on consultants to implement data warehouses for them. A typical warehouse implementation costs about $1 million.13
Typically, the database includes not just the information itself gathered from a variety of sources, but also information about the information, or metadata. For example, information about data that could be important in decision-making might be how frequently the information changes, the last time the information was changed, the source of the information, and so on. Each of these attributes can have important implications for specific decisions.
The tools that non-technical people can use to get the information they need from data warehouses are considered the most critical component of a data warehouse facility. However, because this whole field is not yet very well developed, there are a variety of tools with their own strengths and weaknesses which require a systematic evaluation of the tools: the capabilities provided by the tools, the costs of implementing and using the tools, and the stability and capability of the entity that produces them.
Because data warehouse projects can be quite costly and risky, a systematic evaluation of the project is essential prior to embarking on this venture and ongoing monitoring and control must be exercised.
Data mining is the extraction from data implicit, useful information that was previously not known. This is done by finding patterns in the data.
Data mining has been used for a variety of purposes such as detecting credit card fraud, identifying target customers for direct marketing campaigns, and so on. Data mining has some similarities to executive information systems (discussed in the next subsection) because it enables users to drill down through layers of information, from more aggregated, less detailed information to more detailed, specific information required to support a particular decision.
Computer-based systems permit enterprises to provide better delivery and distribution of goods and services. Bar codes are used for tracking shipments and providing status reports to customers at any point in the process. Federal Express is often cited as an example of this use of information technology.
Information technology can also be sold in the form of training services. This is a common and very profitable line of business, not only for computer hardware and software manufacturers, but also for a variety of other entities specializing in IT training.
Computer-based systems are widely used in product design and development. Computer-aided design and computer-aided manufacturing (CAD/CAM) systems are making it possible to experiment with product ideas extensively prior to introducing them into the marketplace.
Computer-assisted software engineering (CASE) permits the automatic production of software from system specifications prepared using high-level specification tools and graphic user interfaces. Once the system requirements are recorded, programs are automatically generated for the target equipment configuration.
Another use of computer technology in the production process is in production scheduling and control.
Managers are increasingly using computers when making decisions; indeed, a study of top corporate executives in Fortune 500 companies found that already by the mid 1980s, one-third of them personally used computers when making critical decisions. In our information age the impact of information technology is not merely increasing, but accelerating, as we learn first to adapt to it, then to seize the opportunities made evident by information technology.
Accounting Information Systems
Accounting information Systems have always been an important source of management information. They continue to be a key ingredient of information system development, especially in smaller organizations, which find that they are now able to purchase micro-computer-based accounting systems every bit as sophisticated as the multi-million dollar systems that were once the preserve of large government agencies and business enterprises.
Computer-based systems are also increasingly used in the treasury function to permit sophisticated management of enterprise resources through the use of communication networks, electronic data interchange and electronic funds transfer systems. Furthermore, the existence of information services and databases with increasingly diverse and extensive collections of important information contributes to a possibility of doing increasingly sophisticated strategic planning combining both internal and external information.
The interaction and co-operation between people and machines is covering more and more aspects of enterprise activities. From the initial use of technology for routine data processing, there has been an evolution of information technology to the point where it is influencing decision-making in ever more complex areas. Decision support systems, expert systems, executive information systems, electronic meeting systems and knowledge systems are the latest IT tools designed to improve management through better access to information.
Decision Support and Expert Systems
The concept of the decision support system is replacing the concept of the management information system, which had earlier replaced the concept of the data processing system as the main focus of attention in the field of information technology. An emerging trend in the field of decision support is the emphasis on knowledge-based decision support systems which incorporate recent advances in expert systems to significantly magnify the degree of problem-solving support provided to decision makers.
Decision support systems are interactive computer-based systems used by managers as an aid to decision making in semi-structured decision tasks. Expert systems are support systems that incorporate specialized knowledge about a particular problem area and use reasoning rather than numerical computation to support problem solving. Expert systems represent the application of artificial intelligence techniques to practical problem-solving domains.
The potential impact of this latest approach to harnessing information technology is dramatically described in books and journal articles. For example, in their 1984 best seller The Fifth Generation, Feigenbaum and McCorduck portray a revolution in the making, powered by these systems. In a follow-up 1988 book entitled The Rise of the Expert Company, Feigenbaum, McCorduck and Nii report:14
Almost everywhere, expert systems were speeding up professional work by at least a factor of ten. Speedup factors of twenty, thirty or forty were common. And todays expert systems, powerful as they are, are still Model-Ts!"
Feigenbaum and his colleagues identify and dramatize, with case examples, several key competitive uses of knowledge-based decision support systems. These systems have contributed enormous financial returns (ROI figures in the thousands of percentage points) to enterprises that have applied expert systems technology to solving business problems. Indeed, Tom Peters, co-author of In Search of Excellence, writes:15
Any senior manager in any business of almost any size who isnt at least learning about artificial intelligence (AI), and sticking a tentative toe or two into AIs waters, is simply out of step, dangerously so.
How much of this promotion is mere hype and hyperbole and how much is vision is open to debate.
Expert systems are spreading rapidly. A 1987 Coopers & Lybrand survey of expert systems in the insurance industry concluded that about two-thirds of the largest U.S. insurers either had, or were developing, applications that utilize expert systems technology. A 1989 survey of the Canadian Financial Services Industry reported that 16% of the surveyed companies had systems in use and nearly half of the institutions surveyed were either using, developing or actively researching expert systems applications. Virtually all of this activity was initiated in the mid-1980s, and has been growing at an exponential rate. This activity is primarily driven by a desire for competitive advantage almost 75% believe expert systems are crucial for their companies.
There is a growing number of examples of significant productivity gains made possible by inserting intelligence into computer-based information technology. For example, Du Pont reportedly has over 2,000 expert systems running or under development. American Express reports a $27 million per annum gain from its credit Authorizers Assistant. Digital Equipment Corporations net return from its expert system-based configuration systems XCON/XSEL is estimated to be in excess of $40 million per year. Particularly telling is the finding that in 1981, 23 staff members at Digital created about 19,000 system configurations manually, with an accuracy rate of 90%. In 1986, using XCON, 17 staff members created 60,000 configurations, more complex than the earlier ones, with an accuracy rate of 95-98%.16
Executive Information Systems
Executive Information Systems (EIS) are systems designed to provide information to top level managers. During the golden years of MIS, which continued to the early 1970s, some people envisioned a computer terminal used by every top executive. At a minimum, the executive could instantly make enquiries about the status of various aspects of the company, such as sales trends for a particular product or the productivity of a particular manufacturing plant.
The latest such facility, dubbed the Executive Information System, promises an executive the ability to drill down through the information layers of the organization, or outside it, to access key, custom-tailored, strategic and operational information in an easy-to-use format. For example, faced with a problem, an executive could describe the problem via a natural language or graphic user interface and the system would, in turn, present information, and even possible solutions to the executive who would evaluate this information and then take action.
EIS represent a technology that is perceived as having achieved a more advanced interface than other management support systems. According to one study, 10% of senior-level executives are presently using these systems, and they are able to do so because their interfaces enable non-technical executives to interact with the systems easily and effectively. It is predicted that in the next 10 years virtually all senior-level executives will be using EISs to support their decision making.17
An EIS typically provides information represented in summary form, using colour- coded graphics to highlight problem areas. Once a manager identifies an area to be investigated further, he or she can use the system to drill down through successive layers of detail to determine the scope of the problem and its potential causes. A well-designed EIS can serve as an early warning system, helping top level managers keep track of both their own and competitors moves. Most of these systems are linked to on-line database services and electronic mail networks to permit analyses based on external data.
EISs are expensive and time-consuming to build. Du Ponts system reportedly cost more than $200,000. It took Quaker Oats Company three years to develop a useful database for such a system. Implementation of such systems can also be politically sensitive, since they are sometimes viewed as managements surveillance devices.
Despite the time and expense involved in developing them, the number of EIS installed throughout North America is climbing steadily because these systems eliminate much of the effort involved in getting to the point with conventional information systems, which have too many reports produced in a confusing array of different layouts. EISs circumvent the problems associated with getting decision-relevant information in traditional systems by providing easy access to information on an ad hoc basis, generally custom-tailored to the needs of a companys executives.18
One consultant claims that an EIS can increase an executives span of control from less than 10 to more than 20 people, suggesting the potential for dramatic savings through reduced administrative costs in a flatter, more responsive organization. For example, Phillips 66 Company reportedly eliminated 40% of its management positions and implemented an EIS to compensate.19
Like other advances in the decision support area, this latest tool for enhancing decision making by executives has many pitfalls, not the least of which is the risk of poorly conceived layering of a sophisticated EIS on top of a poor or outdated existing information system.
Electronic Meeting Systems
Many managers and technical advisers spend a significant portion of their time working in groups. Group problem solving represents a critical dimension of problem solving activity, and can yield significantly different outcomes than individual problem solving.
According to some authorities in the information systems field, cooperative organizational structure will be the norm in the future. Collaboration will be required both within an organization and across organizational boundaries. Considering the transformation of our society from its industrial basis to one based on information technology, and the importance of collaboration among knowledge workers, this seems to be a likely scenario.
Electronic Meeting Systems (EMS) represent the conjunction of two other technologies group decision support systems and electronic communication systems to break the barriers of time and space and to enable problem-solvers to work in a cooperative setting even though separated from other group members by distance or time zones. Decision makers use PCs linked to a local area network set up in a conference room designed for this purpose; or, linked together by a wide area network. The system tracks and sorts by topic and order of response every sentence typed by participants and displays them on a projection screen if the meeting is in one room, or in a separate window on the computer screen if the meeting is held via remote networks.20
Electronic meetings have been used to bring people together with conflicting values and goals, but who often have been unable to engage in open communication. One companys experience was that:21
People become brutally honest. The anonymity of talking through computers turns even shy people powerful.
Not only do electronic meetings provide a communication channel, they can assist problem solving by bringing structure to communication, recording communications, enhancing problem structuring, idea generation and organization, developing an understanding of the issues underlying a decision and building commitment to agreed upon courses of action. Of course, none of these benefits are guaranteed. They will depend on the design of the EMS and other aspects of the problem-solving environment, such as the nature of the task, the organizational context, and so on.
Research findings about the benefits of this emerging technology are mixed. Nevertheless, the ability to harness information technology to serve the unquestioned fact that much of problem solving occurs in groups, often requiring numerous meetings and extensive communications, represents a significant development.
In the past, decision support tools have been viewed as individual support systems; however, the provision of tools to support group and even organizational problem solving appears to be an emerging area of interest. For example, techniques such as the Analytic Hierarchy Process are designed to support group problem solving. When embedded in interactive, network-based systems, such as those used in electronic meetings, heterogeneous points of view can be brought to bear on an important problem, while at the same time seeking to help group members develop a consensus, and help ensure consistency in decision making.22
Obtaining a Competitive Advantage from IT
Requires Effective Management
The use of information technology as a springboard to competitive advantage is, no doubt, exciting for many enterprises and can represent significant opportunities. However, the increasing reliance on information technology for competitive advantage places enterprises in an awkward position. To actually benefit from the information systems, entities must be aware of the pitfalls involved in mismanaging computer-based information systems.23
To take advantage of the competitive possibilities of information technology requires that systems be put in place, usually at considerable expense, to get the right information to the right person at the right time to make the right decision and take the right action(s) to implement it.
Employees must be computer literate, which means more training and higher salaries in sum, higher personnel-related costs.
Systems for competitive advantage may require the use of system development methods which differ from those used for conventional accounting systems. They may involve heavy end-user participation, prototyping and compressed development schedules.
These systems may require different management styles and new ways of dealing with customers.
In many enterprises, strategic decisions are made on the basis of information supplied and analyzed using computer-assisted tools. While providing a competitive advantage, information systems can lead to increased reliance on computer-based systems for the continued performance, or even survival, of the enterprise. In the absence of proper management and control of computer-based information systems, the effectiveness of ongoing enterprise operations can be significantly affected. In extreme cases, the survival of the enterprise may be put in jeopardy. This, in turn, behooves managers and auditors to carefully consider the adequacy of management control over information processing and the reliability of their system.
Roles for Accountants
in the Information Society
The world was simpler for accountants before there were computers. In the olden days, accountants needed to understand the bookkeeping systems that processed the transactions and maintained the accounting files, but that was rarely a problem: the bookkeeping files were visible, the procedures were observable from start to finish (and, in any case, there was a person there to explain what they did), and there tended to be very little change from one period to the next. 24
Of course, the world has changed. Computer technology for information processing is changing at such a pace that it requires significant ongoing effort, education, training, and expenditure to maintain expertise and capability in the field.
System development methods rely on techniques that are new or are significantly changed from the way in which accounting systems were developed in the past. Todays management information systems provide a richer supply of information than was ever feasible in the past. There are large numbers of databases (both internal and external) from which data may be extracted for analysis and interpretation.
Each year sees some new breakthrough in information technology that creates new jobs, spawns new companies, and changes the way the world does business. According to an article by Robert K. Elliott entitled The Third Wave Breaks on the Shores of Accounting::"25
Information technology (IT) is changing everything. IT represents a new, post-industrial paradigm of wealth creation that is replacing the industrial paradigm and is profoundly changing the way business is done. Because of these changes in business, the decisions that management must make are very different from former decisions. If the purpose of accounting information is to support business decision-making, and managements decision types are changing, then it is natural to expect accounting to change - both internal and external accounting.
Fifteen years ago, accounting systems tended to be characterized by heavy use of punched cards, magnetic tape, and batch processing. Today, these relatively simple methods of transaction processing are being replaced by on-line systems, database management systems, widespread use of mini- and micro-computers, distributed data processing networks, point-of-sale systems, electronic commerce systems.
The growth and change that have come about as a result of these trends have created a number of important challenges which the accountancy profession must address:
· Information technologies are affecting the way in which organizations are structured, managed and operated. In some cases the changes are dramatic. While there is a continuing need for sound business system design practices and effective financial and management controls, the business planning and design processes and internal control requirements will, of necessity, change with changes in information technologies. Traditionally, professional accountants have been entrusted with the tasks of evaluating investments in business systems, evaluating business system designs and reporting on potential weaknesses. Increasingly, information technology deployments are supported by extensive organizational restructuring around such technologies. To maintain the accountancy professions credibility and capability in supporting new information technology initiatives, the competence of professional accountants must be maintained and enhanced so that public trust and confidence in professional accountancy bodies is maintained.
· Information technologies are changing the nature and economics of accounting activity. The career plans of professional accountants and related training systems must be based on a realistic view of the changing nature of accounting, the accountancy professions changing role in providing services to business, government and the community at large, and the knowledge and skills required for future success as a professional accountant. Some IT skills, such as the ability to use an electronic spreadsheet, are now indispensable and professional accounting bodies must ensure that candidates possess core IT skills before they qualify as members of those bodies. In addition, since an increasing number of professional accountants are engaged in providing IT-related advisory and evaluative services, it is important that professional accountancy bodies maintain the quality and credibility of these services through both prequalification and postqualification education requirements.
· Information technologies are changing the competitive environment in which professional accountants participate. Information technologies are eliminating some areas of practice which were once the exclusive domain of professional accountants or are reducing their economic attractiveness. For example:
Accounting and accounting system development were once the virtually exclusive domain of professional accountants. Today, inexpensive, easy-to-use and powerful pre-packaged accounting software is reducing the demand for those activities or enabling non-accountants to offer those services. At the same time there is an increasing demand for professionals with a combination of business and IT skills to help organizations structure their systems to provide effective and efficient support for their primary objectives and activities.
Tax planning and tax return preparation have traditionally represented important activities for many professional accountants. Today, inexpensive, easy-to-use and powerful pre-packaged software is reducing the demand for tax return preparation services. The professional tax planning expertise that was once the private domain of individual practitioners is increasingly being embedded within these same tax packages, reducing the demand for such services as well.
In the past, accountants engaged in internal and external auditing activities were needed in great numbers in order to vouch and trace documents, to perform a variety of analyses, and to document audit work. Today, due to the computerization of business records and the availability of computer-assisted auditing tools, these activities can be performed faster and more thoroughly with the assistance of computer-based tools, reducing the demand for such activities.
IT changes have created many new opportunities for professional accountants in areas such as information development and information system design, information system management and control, and information system evaluation. For example:
· information development and information system design: professional accountants have a tradition of producing information to enhance management decision-making. With the advent of new information technologies and expanded sources and means of access to information, professional accountants can help bring richer sets of information to bear on specific managerial decisions or help screen out essential information from the potentially overwhelming proliferation of information that is now available. One of the implications of the growth of such services is the need to expand professional accountants perspectives beyond their traditional focus on accounting information to other important types of information and performance indicators, including non-financial information.
Information systems are increasingly viewed as a potential means to achieve competitive advantage. Professional accountants, by virtue of their broad business backgrounds, financial skills and objectivity, can provide valuable advisory services related to assessing investments in strategic information technologies and advising about control systems required to meet the needs of management and, in some cases, the requirements of legislators and regulators.
Multiple objectives exist within most information systems installations. They will invariably lead to cost vs. quality vs. control trade-offs; i.e., information systems personnel may resist implementing additional controls if they perceive them to detract from the ease-of-use or efficiency of a system, since these criteria may be important in their performance evaluations. Professional accountants can provide a valuable advisory service by bridging communications gaps, adding a sound business perspective to the consideration of IT control issues and vice versa.
· information system management and control: Information system management skills are not primarily technological, but rather, include an understanding of strategic and operational business planning and associated IT issues, the ability to perform appropriate analyses of IT investments, an understanding of IT related benefits and risks, the ability to stimulate and manage organizational change, and the ability to communicate effectively about IT topics.
Information system management has been characterized by a communication gap between top management or functional managers lacking IT skills and technologists lacking in business backgrounds. Professional accountants can provide a valuable service by bridging such communications gaps, adding a sound business perspective to the consideration of IT issues and vice versa.
· information system evaluation: professional accountants have traditionally provided evaluative services in their roles as internal and external auditors. As information technologies proliferate, there are increasing demands for objective assessments of information system controls such as controls over information privacy and integrity, and controls over system changes. In addition, there are concerns about information system failure and the reliability of information processing continuity provisions in the event of system failure. Other areas of concern are the proliferation of incompatible subsystems and inefficient use of systems resources.
All of the areas identified above represent important work domains in which significant numbers of professional accountants participate. Some of these areas are not the exclusive domain of professional accountants and are not commonly associated with the accountancy profession. However, they all represent important opportunities for professional accountants.
Professional accountants, in addition to extensively using various types of information technologies, often play important managerial, advisory, and evaluative roles in connection with the adoption and use of various information technologies by organizations of all types and sizes.
Society expects that professional accountants who accept an engagement or occupation have the required level of knowledge and can apply it to practical problems. The accountancy profession as a whole has the obligation to ensure that candidates for membership possess the required breadth and depth of knowledge and skill and the credibility of the accountancy profession depends on its success in fulfilling this obligation. In addition, the accountancy profession has an obligation to ensure that, after qualifying, members keep abreast of relevant developments through continuing professional education.
The body of knowledge and skill required of professional accountants includes a variety of important areas. IT is one of the core competencies of professional accountants and requires special attention due to its explosive growth and its rapid rate of change.
Professional and academic accountancy bodies throughout the world are grappling with the need to define the body of knowledge and skill that must be possessed by their members. Attempts at defining a common body of knowledge and skill are complicated by several important factors which must be recognized, including the fact that the accountancy profession is a diverse profession whose members operate in several domains (e.g., industry, public sector and public accounting), that within each of these domains professional accountants may be engaged in a variety of roles (e.g., user of IT, advisor on IT, manager of IS) and evaluator/auditor of IS), and that the spread of IT and related accounting services is not uniform throughout the world.
As organizations adopt progressively more advanced processing methods for their accounting systems, there arises the need for accountants and auditors to develop new effective accounting and auditing procedures and techniques, including the use of the computer as an accounting and auditing tool. Given such pressures, does every accountant need to be a computer expert? Is it reasonable to expect that a normal person can be a good accountant and a computer expert as well? For most people, the answer is, Surely not!"; however, while a good accountant may not need to be a computer expert, there is significant need for the accountant to have a fairly sound understanding of computers and information systems to provide fundamental services and carry out standard accounting and auditing engagements.
In the past, accountants and information systems personnel lived in separate worlds. Today, accountants can use computers directly, either working on stand alone-personal computers, or by means of terminals or microcomputers connected to a central computer.
The professional role of accountants increasingly requires them to understand computer-based systems that are used to process and store an entitys data. When accountants prepare reports containing important financial information, or when they attest to the assertions contained therein, they need to understand the processing systems that produced those reports and the controls included in them.
When accountants use database systems to retrieve information, or when they attest to the data retrieved from database systems, they need to have a reasonable understanding of such systems, database integrity controls and database retrieval capabilities and limitations.
When accountants use microcomputers, or when they attest to the results produced by others using such microcomputers, they need to understand the risks inherent in such end user processing so that they can appropriately assess the quality of the information produced.26
The USER Role
Users of various information technologies employ information systems tools and techniques to help them meet their objectives or to help others meet their objectives. These objectives, and hence the types and uses made of IT tools and techniques, can be infinite in their variety. Some typical tasks that users carry out with the help of IT include gathering and summarizing data, choosing alternative courses of action on the basis of analyses applied to data, devising strategies and tactics, planning and scheduling operational activities in an organizational unit, directing the allocation of resources, implementing operations, evaluating performance, documenting observations, judgments and decisions, and communicating with others.
The MANAGER Role
Many professional accountants are involved in financial management roles which bring them into contact with information systems. Although the growth of IT has spawned many new groups of professionals, including professional information system managers, many accountants in small and medium organizations fulfill information system management functions, in partnership with other managers, or as part of their overall responsibilities.
In this capacity, the professional accountants responsibilities may include participation in strategic planning for use of information systems to support entity objectives, membership on an information systems steering committee, evaluating potential investments in information technologies, developing operational priorities, exercising control over information system productivity, service quality, and economy of information system use.
The DESIGNER Role
Professional accountants, as employees or external advisors, have been involved in the design of financial systems for decades. In the past, such design roles have been in the context of manual record-keeping systems. Today, accountants are expected to continue to provide similar services, albeit in an IT context. This may be as a member of an in-house team or task force working to establish business system requirements, as a member of an in-house system development team for an employer, or as an external advisor helping to design a business system for a client.
Professional accountants design activities will often emphasize the identification of user needs, consideration of costs and benefits of proposed solutions, the appropriate selection and combination of hardware, pre-packaged software, essential control features, and other system components, and the effective implementation and integration of acquired or developed systems with business processes. In this capacity, professional accountants need a sound understanding of business systems and the capabilities of various information technologies to support an organizations objectives, whether it is a profit-oriented, not-for-profit or public sector organization.
The EVALUATOR/AUDITOR Role
The role of the accountant as evaluator encompasses the functions of internal audit, external audit and other evaluative roles filled by accountants, whether or not formally identified as audit roles. In these capacities, professional accountants may be engaged for a variety of purposes, including determining the degree of information system effectiveness in achieving organizational objectives, determining the degree of information system efficiency in achieving organizational objectives, determining the fairness of financial representations and the accuracy and completeness of related accounting records, determining the degree of compliance with management policy, statutes or other relevant authoritative regulations, and evaluating internal control strengths and weaknesses, in particular with respect to financial reporting processes, asset safeguarding, data integrity, information security and privacy, and continuity provisions for information system processing.
These roles or activities provide the rationale for topics to include in the professional education of all accountants and for the design of a program of continuing education to maintain and enhance their ability to perform these roles and to keep abreast of new developments affecting the roles.27
Information Systems Control and Audit:
A Multi-Disciplinary Field
The information systems control and audit discipline lies at the intersection of several other academic and professional domains: accounting, auditing, management information systems, organizational behaviour, psychology, etc.
Ron Weber, the author of a leading text in the field of EDP Auditing28 has this to say about some of the core disciplines from which information systems auditing draws much of its theory and methodology:
EDP Auditing borrows much of its theory and practical methodologies from traditional auditing, information systems management, behavioural science, and computer science.
Traditional Auditing brought to EDP Auditing a wealth of knowledge and experience concerning internal control techniques. A computer has both manual and machine components. There are clerical activities such as data preparation activities supporting a computer system. These activities should be subject to internal control principles such as separation of duties, having competent and trustworthy personnel and establishing clear definitions of duties, just as a manual system should be subject to these principles. Applying these principles attempts to ensure the integrity of data before it reaches the computer facility, and in the subsequent distribution of the computer output.
Traditional Auditing also impacts the computer component of a data processing system. Concepts such as control totals are relevant to the update and maintenance of files by computer programs. Computer programs must ensure all transaction data is processed, and that it is processed correctly, in the same way a manual system must ensure these things. Many of the controls used in traditional auditing can be carried over directly into computer data processing activities. The general methodologies for evidence collection and evidence evaluation used by EDP auditors are rooted in traditional auditing. The long evolution and extensive experience of traditional auditing highlights the critical importance of objective, verifiable evidence and independent evaluation of systems.
Perhaps most important, traditional auditing brings to EDP auditing a control philosophy. It is difficult to articulate the nature of this philosophy. However, one can glean elements by reading auditing literature or examining the work of auditors. The philosophy involves examining data processing with a critical mind, questioning a systems ability to safeguard assets, maintain data integrity, and achieve its objectives effectively and efficiently.
Information Systems Management
The early history of computer data processing shows some spectacular disasters when implementing computer systems. There were massive cost overruns and failures to achieve stated objectives. Recently, many researchers have been concerned with better ways of developing and implementing information systems. As a result, several advances have occurred. Techniques of project management have been carried across into the information systems area. Documentation, standards, budgets, and variance investigation are now emphasized. Better ways of developing and implementing systems have been developed. For example, the structured programming and chief programmer team approaches to software development seem to result in software being developed faster, with fewer errors, and easier maintenance in the future. These advances impact EDP Auditing because they ultimately affect asset safeguarding, data integrity, system effectiveness, and system efficiency.
Henry Lucas, a well known consultant and academician in the Management Information Systems field concluded, after a study of 2,000 users in 16 different organizations,29 that the major reasons computer systems fail is due to ignoring organizational behaviour problems in the design and implementation of information systems. The failure of an information system can impact asset safeguarding, data integrity, system effectiveness, and system efficiency. Thus, the EDP auditor must know those conditions that lead to behavioural problems and possible system failure.
Behavioural scientists, especially organization theorists, have contributed much to our understanding of people problems within organizations. Some researchers are now applying the findings of organization theory to information system development and implementation. They emphasize the need for system designers to consider concurrently the impact of a computer system on task accomplishment, the technical system, and the quality of work life of individuals within the organization, the social system.
Computer scientists have also been concerned with asset safeguarding, data integrity, system effectiveness, and system efficiency. For example, research has been carried out on how to develop error free software and ways to maintain overall hardware/software system integrity. The theoretical basis for structured programming developed in computer science. Reliability theory and control theory have been the basis for designing secure operating systems, secure systems software, and error free hardware.
The high level technical knowledge of computer science provides both benefits and problems for EDP auditing. On the one hand, it allows the auditor to be less concerned about the reliability of certain components in the information processing system. On the other hand, if the knowledge is abused, it may be very difficult for the auditor to detect the abuse. Fraud perpetrated by a skilled systems programmer may be almost impossible to detect by an auditor who does not have a corresponding level of technical knowledge.
Subject areas that lie at intersections are interesting because they span several disciplines; however, as a result, they also have a built-in difficulty, because they draw on diverse fields, require broad expertise which spans several domains, and have an inherent difficulty in establishing an unique identity. People in the area tend to be torn between the underlying fields that make up the new field. In summary, the field of information system auditing is characterized by both interesting and frustrating features of a subject formed from existing, established fields.30
Key Dimensions of Practice by
IS Control and Audit Practitioners
The information system control and audit discipline, which lies at the intersection of several disciplines, is concerned with identifying weaknesses in systems development, management and operations practices in computer-based information systems relative to specific audit objectives such as:
· transaction processing reliability.
· information system auditability.
· compliance with laws and corporate policies.
· security over information system facilities and privacy of data.
· systems development process.
· value of information system services and facilities.
economy of information system services and facilities.
efficiency of information system services and facilities.
effectiveness of information system services and facilities (i.e., information timeliness, system availability, user satisfaction, competitive advantage).
Of course, weakness identification is only part of the Information System Auditors job. Recommending improvements in system development, management and operation practices, so as to improve their ability to achieve the objectives listed above, is another key part of an Information System Auditors responsibility.
A third key activity of Information System auditors involves developing effective, efficient and economical audit tools and techniques to take advantage of computer system facilities to support auditing activities.
Lets briefly review the major audit objectives as a basis for understanding the types of services that information system auditors provide, and the types of activities they engage in.
Transaction Processing Reliability
Data accuracy, completeness and authorization is a fundamental objective of all accounting systems. While the methods of processing transactions may change in computer-based systems, these objectives nevertheless remain prominent. Indeed, in database systems these objectives may increase in importance, since errors in shared data can affect all of the users of that data.
Auditability of Information Systems
Auditability can be viewed from several perspectives: auditability of information system management/operations processes, auditability of the system development and acquisition process, and auditability of data.
This type of auditability depends on the existence of sufficient historical data to permit an assessment of the decisions made in connection with resource planning, personnel management, and selection, development and/or acquisition of system facilities, and sufficient procedural documentation to permit an evaluation of on-going information system processing operations.
This type of auditability depends on the existence of sufficient documentation, in the form of a statement of information requirements, software design specifications, and source code written in an understandable and well- structured style to permit an evaluation of both the software development process and the product of the process (i.e., the degree to which the software operates reliably and fulfils the users needs).
This type of auditability depends on the existence of sufficient historical data to support the entries in the accounting records and an adequate audit trail to permit reconstruction of the economic events summarized in the accounting records. An audit trail is a set of cross-references or logic documentation which enable management or audit personnel to trace any summary figure back to the sources or origins of the detailed items which comprise it; or, conversely, to trace a transaction from its source or initiation point to its ultimate disposition (e.g., inclusion in summary accounting figures).
Auditability considerations are especially important in computer-based accounting systems since the use of invisible magnetic media for data processing and storage can lead to significant gaps in the audit trail. Poor system development practices can result in the inclusion of insufficient reference items, data, or logic documentation to permit managers or auditors to develop an adequate understanding of the flow of transactions. In addition, inadequate file retention policies can lead to permanent losses of audit trails, with significant impairment of the auditors ability to audit the entitys accounting records.
Compliance with Laws and Corporate Policies
Some enterprise information may be governed by statutes and regulations; for example, payroll information is subject to Revenue Canada regulations, sales tax is subject to various provincial statutes, some government data is subject to privacy legislation, etc. Enterprises must be able to enforce and demonstrate their adherence to such regulations.
Security over Information System Facilities
and Privacy of Data
The assets of a computer installation include hardware, software, data, documentation, supplies, and people. These assets can be damaged, stolen, or misused. Like any other assets, information system assets must be protected by a system of controls.
System Development Process
An important aspect of most IS auditing activity is the review of systems under development. Sometimes assurance providers are not involved in information system development until the system has already been implemented and has become operational, or an outsourcing agreement has been signed. In most cases this due to a general lack of awareness by management, as well as by some IS professionals, of an assurance providers potential role in assuring the quality of systems development efforts by being involved throughout the stages of system development and acquisition; i.e., investigation, requirements analysis and initial design, development, implementation, and maintenance.
From an assurance point of view, some stages are more promising than others; nonetheless, even in these situations, assurance providers can fulfill an important independent advisory function in every phase of system development and acquisition. Their degree of success will, of course, depend on many factors, including their expertise. The most critical areas for practitioner involvement in the system development and acquisition process are:
· assessing the quality of the investigation phase/feasibility study
· assessing the quality of the requirements analysis and initial design phase, including:
an assessment of the adequacy of the role played by potential users of systems under development;
assessing the appropriateness of accounting principles to be applied;
assessing the adequacy of internal controls in planned new systems;
assessing the adequacy of auditability provisions such as management and audit trails, record and file retention policies, and system change records and controls;
assessing the adequacy of maintainability/flexibility/scaleability provisions;
· assessing the quality of system development efforts, particularly,
assessing the quality of products and vendors
· assessing the quality of system implementation efforts, particularly,
monitoring conversions from old or previous versions of systems to new or revised versions of systems;
assessing the performance of systems after their implementation;
· assessing the quality of system maintenance procedures and controls;
· assessing the degree of compliance with preferred project management practices and systems development standards.
Value of Information System Services and Facilities
An information processing system should deliver more benefits than it costs to operate. Benefits and costs may be both quantitative and qualitative, both short run and long run, and some may be obvious, while others are more subtle and hidden. The cost justification for the use of information technology to mechanize manual clerical functions is able to be somewhat quantitative. However, the cost benefit justifications surrounding the use of information technology for competitive advantage tend to be more qualitative and judgment-based.
An economic information processing system provides services at the lowest cost possible, other things such as quality, capacity, and so on, held constant.
An efficient information processing system provides the maximum amount of service given its level of resources.
An effective information processing system achieves its objectives. This can be viewed in terms of criteria such as information relevance, quality, and timeliness, system availability and reliability, user satisfaction, etc. Another way of looking at effectiveness is by considering the degree to which information system processing contributes to enterprise success, competitive advantage, etc.
These services will be discussed in greater detail later in this book.
Multiple Objectives and Conflict
Multiple objectives exist within most Information Systems installations. They will invariably lead to cost vs. quality vs. control trade-offs. These trade-offs, in turn, will lead auditors to come into conflict with information systems personnel. Controls recommended by auditors usually affect the operational efficiency of information systems. Thus, information systems personnel may resist implementing additional controls if they perceive them to detract from the ease-of-use or efficiency of a system, since these criteria may be important in the performance evaluation of information systems personnel.31
Computer-Based Accounting Information Systems
This section covers the following topics:
· information systems
general system concepts
· role of information in business
data vs. information
nature and types of information
attributes of information
accounting information system
· organization of data into files
file labels, header and trailer records
records, fields, characters, bytes and bits
fixed and variable length records
logical and physical records
representation of human readable data in computer systems
master and transaction files
· access methods and file maintenance
direct/random access files
indexed sequential access
database management systems
· file design considerations
· transaction processing phases
error correction and reprocessing
· transaction processing modes
on-line, realtime and interactive processing
interactive transaction processing
preprogrammed accounting systems
batch vs. transaction oriented
enquiry vs. update
combinations of processing modes
centralized vs. decentralized processing
distributed data processing systems
network components, configurations and designs
local area networks
examples of network based systems
remote banking systems
retail point of sale systems
direct deposit and preauthorized payment systems
electronic data interchange
· processing design considerations
· data control considerations
General Systems Concepts
Information processing activities are a cornerstone of all organizations because the information produced by information processing activities such as data gathering, recording, summarizing and reporting forms the basis for effective decision-making, financial reporting and control.
Information is produced by an information processing system. What is a system? A system is an organized set of activities. As Figure 1.3 illustrates, when we speak of an information system we generally mean that there is some sort of input, a processing activity which acts on the input, some method of storing raw data or semi-processed data, and an output produced by the processing activity. This output is then used either as an input by another processing activity or in some other way within the organization.
Information processing activities may be manual (e.g., involving clerks and journals), mechanical (e.g., involving adding machines, posting machines, and so on), or electronic (e.g., involving terminals, computers, data files, and programs).
Computer-based business information systems, often called Electronic Data Processing (EDP) systems, perform their functions through a combination of functions enabled by the following system components:
The information produced by information systems is used for various types of financial and non-financial performance measures. One example of a business information system is a financial system used by an entity to process its accounting transactions and, ultimately, to produce general purpose financial statements for external users such as investors and creditors. Another example of a business system is a system used for maintaining personnel records, tracking personnel activities, recording contacts between employees and suppliers and customers, and recording fee-generating events such as time spent on various projects, services rendered, and so on. Yet another example is a control system used to monitor other information systems to provide feedback and enable an entity to take actions to ensure that its systems continue to operate effectively and efficiently.
Compared with manual data processing, electronic data processing makes the information gathering and summarizing activity much more rapid and enables the more timely generation of important information, which management uses in decision-making, financial reporting and control. The following quote (attributed to S. A. Coons) makes the point very effectively:
The computer is almost exactly what man is not. It is capable of paying undivided attention to unlimited detail; it is immune to distraction, precise and reliable; it can carry out the most intricate and lengthy calculation with ease, without a flaw and in much less than a millionth of the time that would be required by its human counterpart. It is emotionless, or so we suppose. It suffers from neither boredom nor fatigue. It needs to be told only once; thereafter it remembers perfectly until it is told to forget, whereupon it forgets instantly and absolutely. When man and machine work together, the shortcomings of each are compensated by the other ... The potential of such a combination is greater than the sum of its parts.
Systems may be large or small and their boundaries may be hard to define. In fact, it is common to subdivide systems into smaller units or sub-systems to enhance analysis and understanding of those systems.
For example, Figure 1.4 illustrates a system made up of four sub-systems which interact in a variety of ways; e.g., by sharing storage devices, by sharing documents, by transfers of data files and by means of electronic data transfers.
Role of Information in Business
Data vs. Information
What is the difference between data and information? As Fig15 illustrates, data are the facts, the raw materials from which information is created. The Accounting Information System (AIS) transforms data into information. Note that the amorphous shape of the AIS in this diagram is used to emphasize its need to be flexible to accommodate the information needs of users. Information is the finished product in a form immediately usable for managerial decision-making, financial reporting or control.
Nature and Types of Information
There are four main types of information:
· ad hoc
In the past, the main focus of accounting systems was on producing routine reports to suit pre-defined needs and specific scheduled uses; however, as a function of changes in the competitive environment and the parallel development of information technologies, the trend is increasingly away from routine reporting towards the other uses.
Exception reporting is a response to the overwhelming volume of routine paper reports generated by many information systems and the information overload that can result. Advances in storage technologies have permitted saving most information in electronic form, with only summary or exceptional information being produced as regular visible output.
Ad hoc reporting is facilitated by the advances in storage technologies combined with easy-to-use 4th generation languages and database management systems which permit delay of information production to the time when it is most needed to support management decisions.
Predictive uses of information are enabled by in-house database systems and commercial on-line information services with their expanded scope of information.
Attributes of Information
Information is often evaluated by considering attributes such as completeness, accuracy, authorization and timeliness. One study recently analyzed various attributes of data quality. Over a hundred such attributes were identified through a survey. These were ultimately grouped into the following four broad categories:32
· intrinsic: accuracy, objectivity, believability, reputation
· accessibility: access, security.
· contextual: relevance, value-added, timeliness, completeness, amount of data
· representational: interpretability, ease of understanding, conciseness, consistency
Data quality, or its absence, can have important and far-reaching implications for organizations, as will be discussed in the next section of this chapter.
Accounting Information System
There are three key features in all computer-based accounting information s ystems:
Organization of data into files stored on electrontic media for rapid access:
· master files
· transaction files
Transaction processing activities for maintaining those files and providing useful information:
Controls to provide reasonable assurance that:
· only valid/authorized data is collected and recorded,
· all such data is accurately recorded,
· errors are detected and promptly corrected, and
· results or summary figures can be traced to the original source data.
These activities, in turn, require effective management and effective information system acquisition and/or development processes to be in place.
Accounting information systems are part of a broader set of information processing activities in organizations. For example, Figure 1.6 portrays the organizational pyramid consisting of transaction processing, operations, middle management, and top management.
Figure 1.7 superimposes the major accounting systems and subsystems on the pyramid to illustrate that accounting information systems are interwoven into all levels of management and affect information processing and decision-making in a pervasive way. In addition, highlights the concept of transaction processing cycles and their component sub-systems.33
Appendix 1.A contains additional information (see Appendix 1.A) about the typical functions, common journal entries, critical forms and documents, key databasees and common interfaces and output reports.
In this chapter, we will consider the key elements of computer based accounting information systems and their vulnerabilities.
In Part II of this book, we will be focusing on management control systems and managements, internal auditors and external auditors roles in contributing to control over computer-based information systems (Chapter 3) and controls over system development and acquisition (Chapter 4). In addition, we will be focusing on information processing security and transaction processing controls (Chapters 5-8).
Organization of Data Into Files
In a business environment, it is common to deal with files. In fact, files are the heart of an accounting information system because they contain the stored working data and processed information to be used for decision-making, financial reporting, and control. Consider a drawer in a filing cabinet containing sales invoices. If the drawer contains only sales invoices and contains all of the invoices for the year, this drawer could be considered to be a file of all the sales of the company for the year. Personnel files, contain the background history, employment history, and salary records, of every individual employee. Accounts receivable files contain the customer profiles, account balances, and history, and perhaps transaction details for each individual customer.
In a typical organization with a large number of files, there must be some way of organizing them; consequently, files are kept in filing cabinets, either by number or by alphabetical order, or some other logical arrangement. When applied consistently to all of the files, logical ordering makes all files easily accessible to the people who wish to use them. Computer systems also use files. But rather than data being recorded on paper, data is recorded on some type of storage medium such as tape or disk.
The simplest data structure is a list, as illustrated in Figure 1.8. Obviously, to get meaning from this list we would also need a description of its content and method of organization. What do the numbers represent? And are they in date/time order, random order, or some other sequence?
More complex structures, called arrays are often needed to organize data. Figure 1.9 illustrates an array with 5 rows and 5 columns. The individual cell locations are the joint row/column position indicated in the upper left hand corner of each cell. Of course, in an actual array, the cell locations are implicit, being defined by the definition of the dimensions of the array. As you can see, any item in the array can be accessed by reference to the array position of the cell in which it is located. For example, position 1, 3 contains the value 29.
Figure 1.10 extends the concept of an array to a name and address file. Note that to process this file requires a template for understanding the structure of the file. The template is not stored with the file. It is encoded in the program(s) which use(s) the file.
When a program requires a file, it passes the file name to the operating system and asks the operating system to locate and open the file at the first record. The operating system uses directories and its input/output control systems to carry out such requests. The program then uses its template to decode the contents of each record. File layouts and data dictionaries are used to provide a human readable template for programmers and other users (such as auditors) to use to determine the layout and contents of a file.
File Labels, Header and Trailer Records
As was mentioned earlier, a program must have a description of the file it intends to work with. All files must be described to the computer in terms of the size of a standard logical record; i.e., how many bytes make up a logical record, how many logical records make up a physical block, and where the beginning and ending points are. For example, in tape files, tape marks are used, which the computer operating system understands to be beginning and ending indicators.
Both external and internal labels are used with magnetic tapes and disks. External labels are used by computer operators to ensure that the right files are used for processing. Internal labels are used by the computer system for the same purpose.
Internal header labels might indicate the file name, identification number, creation/expiry date, and trailer labels might indicate the number of records, possibly a control total for one or more fields, an end-of-file code, etc. (see Figure 1.11).
Records, Fields, Characters, Bytes and Bits
When referring to files in computer systems, the terms records, fields and characters or bytes are often used. Lets define these terms by way of analogy. Consider the previous example of the drawer containing sales invoices.
Each invoice within the drawer is analogous to a record. This invoice or record contains all of the information pertaining to a particular sale.
If we look at the invoice itself, it can be broken down into several parts, referred to as fields. For example, the customer name is a field, the customer number is a field, the item shipped and the extended price are also fields. When all of the fields necessary to describe this particular sales transaction are put together, they represent a record of the sale.
Lets now examine one particular field (refer to Figure 1.12): the customer number, A12457. The field is made up of the characters A, 1, 2, 4, 5, and 7. Each character, or byte, is a coded combination of information units called binary digits or simply bits. Coding systems (described later) are used to convert human readable characters into machine processable bit patterns, and vice versa.
In summary, as Figure 1.13 illustrates, the relationships among file components are:
· a logical collection of records makes up a file,
· a logical collection of fields makes up a record,
· a logical collection of characters or bytes makes up a field, and
· a logical collection of bits makes up a byte.
Fixed and Variable Length Records
Let us now consider another aspect of file structure, fixed and variable length records. Fixed length records are the easiest and simplest to use, from a processing and programming standpoint. In a fixed length record the size of every field and the number of fields in the record are defined in advance.
In a variable length record the size of fields is defined in advance, but not the number of fields, except for a maximum number allowed.
In a fixed length record, room must be provided for all the data that are currently of interest as well as data that may be of interest in the future, to avoid costly changes to the entire file. If there is no particular data to fill a specific field, it is left blank, but still takes up the same amount of space as a filled field. Of course, if there were many blanks in a record, a great deal of space would be wasted. Figure 1.14 illustrates this situation for a file containing monthly sales statistics by customer. Because some customers may make several purchases in one month, if fixed length records are used, several amount fields must be created for each and every customer, even though many may remain blank; however, if variable length records are used, only the exact number of fields required is created for each customer.
If many blanks are expected to result from using fixed length records, then variable length records may be preferred. However, variable length records add complexity to a program because the program has to contain instructions for identifying the beginning and end of each record.
Logical and Physical Records
In computer-based information systems, files are usually stored on media such as tapes or disks. Storage devices which read and write to these media are generally unaware of the logical structures of their files; but, merely view the files as physical blocks of coded data items. To be processed, a file must first be read into the computer. This reading process takes time. Time and space are two scarce resources in computer systems. If each logical record (e.g., each invoice) in a file were to be read separately, the computer would send a signal to the storage device to send the record, and wait for the transmission. The storage device would locate the required block of data and transmit it to the computer, and wait for the next request for data. The more often this routine is performed, the more idle or waiting time results. If, however, logical records were grouped into larger physical records (containing say 10 logical records) the process could be speeded up, since an entire block of 10 invoices would be read at on time. In addition, storage space could be saved through the elimination of excessive inter-record gaps. (In the actual recording of the data, physical records are separated by a standard distance called the inter-record gap. Inter-record gaps are very big compared to the size of data blocks. Therefore, the fewer such gaps there are, the less wasted space.)
Blocking: Physical records are often referred to as blocks. There are several considerations when determining the desirable block size; among them, the size of the computer and type of storage media (i.e., disk or tape). Inter-record gaps and blocking will be further discussed in connection with hardware components in Appendix A.
of Human Readable Data
in Computer Systems
Weve seen that files are organizations of stored data, composed of records, fields and bytes. As we have just seen, a byte represents a single character (see Figure 1.15) such as the letter A, the number 4, etc. But how are these bytes represented to the computer?
In a computerized system, data is recorded or represented as electronic signals. The electronic circuitry of digital computers operates only in a binary state. That is, there are only two possible valuesthe presence of a signal, or the absence of a signal. This is analogous to an electric light bulb which can be either on or off. The notation generally used to represent the binary state is zero (which is an absence of a signal) and one (the presence of a signal), each of these being called a bit, which stands for binary digit.
One bit can only represent one of two values, a zero or a one, but by putting a number of these bits together in coded combinations, it becomes possible to represent all 26 letters, 10 numbers and numerous special characters.
Several standard codes have been developed for translating recognizable characters into bit combinations, and vice versa. The three main codes in use are:
BCD (Binary Coded Decimal), a 6 bit code,
ASCII (American Standard Code for Information Interchange), a 7 bit code, and
EBCDIC (Extended Binary Coded Decimal Interchange Code), an 8 bit code.
For example, if 5 bits are put together to form a character, then 25 or 32 characters are possible, if 6 bits are put together to form a character, then 26 or 64 characters are possible; however, if 8 bits are used, 28 or 256 combinations are possible.
A 5 bit code with 32 character codes has too few codes to represent 26 letters and 10 numbers. A 6 bit code can represent the upper case alphabet, 10 numbers and special characters, but not the lower case letters. That is why 7 or 8 bit codes are used.
In computer codes used to represent numbers, each bit position has a value assigned to it. If a 1 appears in that position, then it represents the positional value. If a 0 appears in that position, then that represents a value of zero. Lets look at the EBCDIC code which uses 8 bits. The rightmost bit always has a value of 20 or 1. The next position has a value of 21 or 2 if turned on. The next position is 22 or 4, and so on. For example, the number 6 is represented by 0110 being the sum of the positional values 0, 4, 2 and 0 (see Figure 1.16).
In computer codes used to represent strings of characters (or simply, strings), as opposed to numbers, it is the bit pattern in its entirety that is a coded representation of each letter or other character. Thus, computers must be told (via a computer program) whether the coded pattern they are processing are numbers or strings.
To summarize, in computer systems, binary data is represented by means of electronic signals such as magnetized spots. Each of these spots represents a bit which can be interpreted electronically as being on or off, represented in coded form as 1 or 0, respectively. By putting several of these bits together in pre-specified combinations using a given code to encipher and decipher the patterns, human data (A, B, C, etc.) can be represented to the computer or converted from binary codes used by computers to character formats readable by humans. By defining all combinations of these bits and telling the computer which code it is using, say EBCDIC, a specific bit configuration, say 1100 0111, will be understood to be the letter G.
Binary numbers, which consist of long strings of zeroes and ones, are difficult for humans to use. An intermediate code, called hexadecimal notation or hex, uses base 16 for representing these long strings of zeroes and ones in a more compact and easier-to-use format for communicating with the computer. Thus, hex is simply a shorthand notation used to express the binary bit patterns within a computer (refer to Figure 1.17). Instead of typing the binary code 1101 0001, we can type D1 to represent the letter J (in the EBCIDC coding system).
Master Files and Transaction Files
We have considered file structures and taken a brief detour to consider data representation techniques for recording human readable data in a computer readable format. Now, lets consider the types of files commonly used in computer-based accounting information systems.
Perhaps the two most important kinds of files in accounting information systems are master files and transaction files. Consider the sales invoices file discussed previously. Each of the sales invoices represents a record in the file created by a sales transaction. Some of the data pertaining to a sale transaction is of a transient or non-recurring nature; for example, the item purchased, its selling price, and invoice number will change from sales order to sales order, even for the same customer. However, some of the information is of a more permanent nature; for example, the customer number and the name and address are not likely to change frequently for a given customer. This information will be required each time an invoice is prepared for the customer.
All of the information necessary to prepare and record this invoice could be maintained on a transaction basis. That is, each time an invoice was to be prepared, all data on the invoice would be recorded - a clerk would have to code the customer number, customer name, address, invoice number, item purchased, price, etc. so that it could be keyed on to a form or a screen, and the invoice prepared, and the data put into the file. The file would also contain a lot of unnecessary and redundant information; for example, the entire name and address would be repeated every time a customer purchased anything.
This is not very efficient. Since much of the information is semi-permanent in nature, a separate file, a master file, could be prepared to contain such information and that file could then be used to prepare the invoice (see Figure 1.18).
The master file would contain the customer number, customer name, address, perhaps credit limit, and sales history. In addition, it could contain the accounts receivable balance for that customer so that, at any given time, it would be easy to determine what each customer owes. Thus, for each transaction, only the customer number and amount would be recorded at the time of the transaction. Then, when needed, that number could be used to look up all the other information stored on the master file such as customer name, address, etc. On the master file, the accounts receivable balance field would be updated by the transaction data, in this case, the sales invoice transaction and the cash receipt transaction (see Figure 1.19).
The basic difference, between a master file and a transaction file, is the permanence of the data contained on the file transaction files essentially contain non-recurring data, whereas master files contain semi-permanent or recurring data which will be required repeatedly.
Weve discussed file components and file structure. Now lets look at how files are organized to permit efficient access to the data they contain. There are basically four methods of organizing files to provide users with access to data stored within files: sequential, direct, indexed, and through the use of database management systems.
The simplest kind of file is one in which all the records are in ascending or descending sequence, according to some key or identifier. In a telephone book, for example, last names are the primary key for the sequential organization of that particular file. Other examples of frequently-used keys are customer number, inventory part number, employee number, or date. Sequential files are in order and must be kept in order. As a result, much of sequential file processing involves the sorting of data on some key.
Sequential files are the most common type of file in use today. They are most commonly associated with magnetic tape, but they are supported by most other file storage media as well. Figure 1.20 illustrates a procedure for updating (i.e., adding data to or modifying) a sequential file. Note that three files are required for this procedure, the old master file, the transaction file, and the new master file.
Since the master file is in a particular order, transactions must first be sorted into the same order as the master file. The first record from each file will be read. If there are no transactions for the master record, the master record will be written on the new master file and the next master record will be read. If there is a transaction, it will be processed against the master record and the next transaction will be read. When there are no more transactions for that master record, the modified record will be written on the new master file. Transaction and master records will continue to be read as needed. If there is no master record for a transaction record, then depending on the design of the system, either a new master record will be created or the transaction will be rejected as invalid.
In a sequential file, updating a record by writing the new information on top of the old directly is generally not feasible. Instead, a new file is created and updating is carried out by copying the records from the old files to the new file. A new master record can be added simply by writing it on the new file in proper sequence. It can be deleted simply by not writing it on the new file. The entire master file must be read and re-created to process any updates, even if only a few records are to be changed.
In a sequential file, individual records can only be retrieved by searching the records in the file in sequence from the beginning until the correct record is located. Thus, you can see that accessing one particular record may be a fairly time consuming task. Nevertheless, despite their limitations, sequential files are widely used because they are easy to work with, they may be placed on relatively low cost storage media such as magnetic tape, and the capacity of such media is virtually unlimited. Another advantage of this process is that backup files, in the form of the old master and transaction files, result as a by-product of the process. These files can be used to re-create the new master file if it is damaged.
Direct/Random Access Files
To overcome some of the problems of sequential file organization, and to permit more rapid retrieval of data, direct or random access files may be used. With direct access files it is not necessary to search through an entire file in order to read, add, modify, or delete a particular record. Each record is accessed independently of all other records. Therefore, in contrast with sequential access, direct access time is very fast.
Direct access files are normally stored on magnetic disks. Updating of records stored on disk files is done in-place. That is, an altered record is written over the old record. A new record is added in a free storage location on the disk. This is in contrast with tape files which require the entire master file to be completely read and rewritten to a new file to add or change any record (see Figure 1.21).
Each storage location on the disk has an address and records are accessed by referring to the physical address of the record on the disk. The assignment of a record to a specific address is based on the application of an arithmetic formula to a specified key field in the record, a process called address conversion.
For example (see Figure 1.22), a company may have employee numbers falling in the range from 10,001 to 20,000. If 10,000 storage locations numbered 1 to 10,000 were available on the disk for the employee payroll file, the employee records could be assigned to physical storage locations by deducting 10,000 from every employee number. Thus employee number 10,001 would be assigned to address 1, employee number 10,002 to address 2, and so on. This is a very simple example of an arithmetic formula used to assign address locations by converting a key field in the record, in this case employee #, to a physical address. In practice, the formulae can be very complex.
Programming for such a system is difficult, since it is necessary to create and program the storage address conversion algorithm. Also, care must be taken to avoid synonyms; that is, using an algorithm which causes doubling up on a storage address. The presence of synonyms will lead to loss of data as one record is written on top of another due to the two different key fields being converted to the same physical address.
As a result of using address conversion formulae, data will not normally be stored sequentially on the disk. This constitutes a limitation of direct access files. Gaps may appear between records which may result in inefficient use of the disk storage capacity. In addition, it is also difficult to determine which areas of storage are available for use for new records, and which records are no longer active, since records may be scattered over an entire disk with empty spaces in between. Periodically, it will be necessary to carry out housekeeping on the disk to reclaim wasted space by copying data, reformatting the disk, and then restoring the data to the disk.
Indexed Sequential Access
The indexed sequential access method (ISAM) combines the benefits of direct access with the organization of the sequential file.
An ISAM file consists of two partsthe data records and an index which contains the record keys and the physical disk storage addresses for the records. Thus, data can be accessed sequentially by reading through the index since it is in sequence, or accessed directly by reading the index, finding the physical address of the record, and accessing that address directly (see Figure 1.23).
The computer operating system maintains the index and assigns data to alternate addresses or overflow areas when the file runs out of space.
Using the example of a telephone book, lets compare the three methods of file organization that have been mentioned so far, sequential files, direct access files, and indexed sequential files.
If one were looking for a particular telephone number, say that of a Mr. Bruce Thompson, in a sequential file, this would be analogous to reading through the telephone book from beginning to end, omitting nothing, checking each and every entry until, finally, the particular name (and the telephone number associated with that name) were found.
In a direct access file, Bruce Thompson, the key field, would have to go through an address conversion formula which would give the page, column, and line number, and one could turn to that particular spot in the telephone book. Note that a direct access telephone book would not be in any order, hence, useless without the address conversion formula.
In an indexed sequential file, one would look up the index table which might indicate that THs started on page 1730, and that THOMPSON started six pages later in the first column. Thus, one could flip easily to the Thompson location and find the name and number for Bruce Thompson. If many numbers had to be looked up, or reports printed, for example in alphabetical order, then the sequencing of the indexed sequential file would be very convenient and one could simply go to the beginning of, say the Bs, through the index, and start processing sequentially.
Database Management Systems
Database management systems are based on the concept of data being independent from the program accessing it (see Figure 1.24). This approach has tended to highlight the importance of data as a resource which has to be carefully managed.
In traditional systems, whether sequential, direct or indexed sequential file organization methods are used, every program contains a description of the file it uses and its physical characteristics. This is termed program/data dependence. And often, each program maintains its own file, resulting in duplication (redundancy) of data and inconsistency among different versions of data; e.g., sales data in the sales file may differ in format from sales data in the commission payroll file. When several programs use the same file, the slightest change in the file structure (e.g., expanding the postal code field) would require changes to all the programs.
With database management systems, the physical management of data is taken away from the individual application programs. All the data is put into a pool called the database, which is shareable by many different programs. A database management system is used to perform all physical data manipulation, such as retrieving, adding and deleting physical records.
Individual application programs never access the physical records directly, but deal only with logical data; for example, customer name and address, which are obtained via requests to the database management system (see Figure 1.24). The job of the database management system is essentially to translate the requests by application programs for logical data, into the physical location of such data, request the operating system to retrieve the physical data, then format it appropriately, and provide it to the application program for processing. Using database management techniques, application programs are no longer dependent on the physical characteristics of the data. That is, a change in the physical characteristics of the data may not have any effect on the application programs. This is termed program/data independence.
In addition, using database file organization methods, the data is stored only once, and the database management system enables several different applications to use the same physical data, thus reducing the redundancy and wasted space due to duplicating information on various files. This minimizes storage and data manipulation costs. For example, the accounts receivable application, the sales reporting application, and the general ledger application will all require access to sales data. Using a database management system, sales transactions will be recorded only once in the database, and all application programs would share the same data. Another advantage of eliminating redundancy is the elimination of inconsistencies which are bound to appear when there are different versions of the same data in a system.
A database management system is a collection of programs. Some of these programs are used for the creation of files and file structures, relieving the programmer of the problems of setting up complicated files. Data can be inter-related in many different ways, unlike the other methods of file organization that we have reviewed, enhancing information processing capabilities within organizations. For example, various analyses and reports can be provided on an ad hoc basis using the database search and enquiry capabilities that database management systems often provide.
When a database system is used for corporate-wide information processing, it is usually necessary to have a database administrator to analyze information uses, design the database, manage the database management system, and act as a liaison between the IS department and the many users sharing the data in the database.
File Design Considerations
The most basic file design considerations involve questions about what data is to be stored in the files. As a design for a new information system is developed, the requirements for data to be stored for subsequent retrieval, will be specified. Related data is then grouped into records.
The analyst must determine what different types of records are required, their contents (i.e., the fields that will make up each record), their size and characteristics, and whether these records require separate files. If the analyst decides to have separate master and transaction files, then s/he must define the transactions which will change the contents of specific fields in a master file record.
Referring back to the example of the sales system, the analyst must determine the contents of the master file; for example, customer name and address, receivable balance, credit limit, sales history, and perhaps, the salesperson number. S/he must define the types of transactions that will change the receivable balance field; that is, invoices will increase the receivable balance, while credit notes, and cash receipts will decrease the receivable balance. In addition the analyst must define the other transactions that will change the master file; e.g., to add a new customer to the file, change an existing customers credit limit, address, and so on.
A key additional consideration in designing files is the management and audit trail. File contents must be organized to ensure that sufficient reference information is maintained to permit management and auditors to trace the contents of a master file back to the originating transactions, or to trace transactions to their final disposition.
ABC Ltd. is currently designing an accounts receivable system. The company wishes to specifically identify outstanding invoices, credits, and payments. Past experience has shown the company never has in excess of 15 transactions per customer outstanding at one time.
Three possible record layouts, using both fixed length and variable length records, are illustrated in Figure 1.25. Having defined the basic content and format of the files, the designer then examines the nature, volume, frequency and response time requirements for record retrievals and updates involving the files.
Response time requirements must be balanced against the cost of:
· creating the data files, including programming costs;
· storing the data;
· retrieving data;
· updating the data; and,
· maintaining the files on an ongoing basis.
The next section summarizes key concepts of transaction procesd to maintain files and pros.
Record layouts are used to describe the contents and characteristics of files. A form such as the one in Figure 1.26 might be used to document the file design.
Programmers would subsequently use the record layout in writing programs to perform specific processing activities such as reading the file, adding records to it, or deleting records from it. Auditors would use the record layout to help them establish what data is contained in a file and to define the record structure to softwarepackages used for selecting data for audit purposes.
In more complex information processing environments the use of a record layout alone is not adequate to document the usage of data elements throughout the sub-systems that compose the overall system and the inter-relationships among various data elements.
Data dictionaries are used for this purpose. Figure 1.27 illustrates this.
Transaction Processing Phases
Although the main stages of transaction processing in all systems involve input, processing, storage, and output, we typically focus on the stages of transaction flow in accounting systems in greater detail, subdividing some of these broad phases of processing into distinct steps of importance to accountants. Figure 1.28 is a flowchart summarizing the key phases of transaction processing.
In accounting, the initiation of a transaction is a significant event governed by a variety of rules, conventions and procedural guidelines which are used to tie transaction processing activities to economic events. Consequently, accounting information systems must be concerned with the circumstances of transaction initiation, the transaction authorization process, the linkage between transaction initiation and an economic event such as a sale, a shipment, a purchase, or a receipt.
There are three classes of transactions of concern:
· Transactions which create, modify or delete semi-permanent data such as master files, tables and database entries for recurring use during processing; for example, transactions which are used to maintain customer, vendor, employee, product and shareholder records.
· Transactions processed in the normal course of business to record economic activities such as purchases, sales, receipts, disbursements, etc. Some of these transactions are initiated by the systems themselves based on logic embedded within the systems. For example, orders are automatically generated based on prespecified reorder points tied to inventory levels.
· Error correction transactions used to correct errors detected during processing.
Some writers refer to the transaction initiation phase as the data capture phase of transaction processing, conveying the image of a proactive effort aimed at reeling in elusive transactions. Humour aside, the thrust of this terminology is to underline the importance of this phase; errors and omissions committed here will flow through in a cascading effect, causing pervasive errors in all subsequent phases of processing. Of particular concern are system-generated transactions because they are not subject to the same degree of review and scrutiny prior to their initiation as other transactions.
Subsequent to transaction initiation, in many systems there is a separate phase which involves the preparation of a transaction for processing by computer. The data is often first coded onto paper documents and then keyed in for further processing by computer. The keying process is typically controlled in some way by the computer, which can perform accuracy checks to help screen out keying errors.
In more sophisticated data entry systems, the data preparation process is carried out reliably by a variety of mechanical devices such as bar code readers and other optical character recognition devices, magnetic ink character recognition devices, or even voice recognition systems.
Subsequent to data entry, the information is input into the processing stream or, in the case of remote locations, it must first be transmitted to the processing site, then combined with data from other remote sites, and subsequently entered into the processing stream.
In a given system, data may be input, processed and output completely at the central computer site. Or, some part of this process may be performed remotely, perhaps at a local area network or LAN. For example, data may be input at a warehouse several thousand miles from the warehouse micro computer, transmitted to the central or headoffice computer, processed, and the output transmitted back to the warehouse for printing local reports. This is made possible by remote processing.
There are many ways of transmitting data. Perhaps the simplest way is sending source documents by mail to a data conversion centre. Another way is to key the documents at the input source, and then to send the media, such as diskettes, etc., to the computer centre for processing. Yet another way is for data to be keyed on a terminal and then to be transmitted over telephone lines (or via satellite) from one remote location to another.
In its most basic form, electronic data transmission involves four components: a sender or data source, a message or data, a communications channel or carrier, and a receiver of the transmitted data (see Figure 1.29).
Data is sent from a terminal, of which there are numerous types. This data is then converted into a coded signal suitable for transmission by a modulator-demodulator (or modem) which impresses the signal on the communication channel, for example a telephone line, to relay the message to its destination. Before reaching the computer, the message is intercepted by another modem which converts the signal into a form acceptable for computer input. The validity of the message may be checked at any of several points before it reaches its destination, and feedback to acknowledge successful or unsuccessful reception of the message may be provided.
Whenever data is transmitted, be it by mail or over telephone lines, it is necessary to ensure that no data is lost between the source of transmission and the ultimate destination and that it is not changed or garbled. For sensitive data, encryption is used to maintain its confidentiality in the event the data transmission is intercepted by unauthorized parties.
Generic processing steps include adding, changing or deleting data in the data files, performing various calculations, and sorting data into useful formats. These processing steps are carried out by software, either developed by the enterprise or purchased or leased from software developers. The software may be rudimentary or sophisticated. It may use conventional formats for reading and updating data files or sophisticated database management techniques. Typically, these techniques involve updating semi-permanent data sets such as master files, tables, or databases by transactions data.
Subsequent to processing, some, but usually not all, of the information processed is printed in the form of reports for use by various enterprise personnel for monitoring, control and decision making-purposes.
Error Correction and Reprocessing
Of course, as Figure 1.30 shows, errors and/or omissions may occur at any of these stages of transaction processing.
Rejected transactions are usually sent for correction to the initiation source which is considered to be the best and most reliable means of correcting them. This phase of error correction and reprocessing completes the transaction processing cycle described above.
Errors can be very consequential to an entity, its customers and other parties more consequential than merely the cost of error correction and reprocessing which are themselves very costly activities. Thus, an important aspect of the computer control and audit discipline is a focus on error prevention.
In summary, almost any data processing system can be broken down into a series of activities such as the above. By stringing a number of these functions and data manipulation activities together, a coherent data processing system may be created. The objective of such a system is to provide an efficient and organized means of transforming data into information for use in management decision-making, financial reporting and control.
The results of processing can take many forms, including such output media as printed reports, visual displays, punched turnaround cards, microfilm/microfiche, etc. Regardless of their physical form, such outputs represent the information for use by enterprise personnel which we have described as the raison dêtre of information processing systems.
There are many elements involved in producing management information, including people, equipment, programs, networks, and a variety of input, output and storage media, combined in such a way as to best serve the needs of the ultimate users of the information.
In Part II of this book we will be reviewing the principles of system analysis and design and the way in which information requirements are established and incorporated into an information processing system. As mentioned earlier, Appendix A of this book reviews the main types of electronic data processing media and devices, including input, processing, output and auxiliary storage media and devices. Appendix B of this book reviews the principles of computer programming.
Transaction Processing Modes
Processing modes can be divided into several basic groups according to the:
· Way in which a user interacts with the computer (i.e., off-line, or on-line);
· Method of handling transactions (i.e., in a batch, or transaction by transaction);
· Functions that users can carry out on data (i.e., enquiry or update); and
· Degree of decentralization of information system processing services and facilities.
On-line, Realtime and Interactive Processing
In on-line processing, the user interacts directly with the computer. Data is input through a terminal. The whole process is controlled by the computer which may prompt or instruct the user in how to input the data.
In contrast, there is no direct interface between the user and the computer in off-line mode. For example, a user might prepare source documents, and send them for keying. The data on disk or tape would then be sent to the computer operator for processing. This whole process is outside the control of the computer, and is referred to as off-line.
Different applications require different response times. In some cases, overnight may be a reasonable time to wait for details about a program or data file. In other cases, response time in micro-seconds is required. Response time capabilities are due to many factors, including speed of the central processing unit, the size and complexity of the programs, and the frequency and type of access to computer files. A realtime system is one in which output is available quickly enough to control real life activity. The concept of realtime is closely related to immediacy. Files are always available for instant update or immediate answers to an enquiry. Some examples of realtime systems are airline reservation systems, savings account processing at banks, and credit authorization at retail stores.
Interactive processing involves user interaction with the computer. The following illustrations describe interactive transaction processing and interactive programming.
Interactive Transaction Processing
Joan is a clerk with Widget Manufacturing Company. Every morning, Joan arrives at work and turns the system on. She logs onto the system by typing in her user number and password (which only she and the manager know) on the keyboard attached to the visual display unit.
The computer responds by displaying a menu of transactions which she is permitted to enter into the system; for example, sales order transactions, purchase transactions, and journal vouchers.
She selects whichever transaction she has waiting in her tray, say sales order entries, and an image of the transaction form is displayed. Joan proceeds to fill in the screen image with the information from the sales orders. As she does this, a program in the computer checks (edits) the data that she is entering to make sure that it is according to the format defined for that transaction type. As well, the program checks to see whether the customer number entered represents a valid customer, whether the credit limit is being exceeded by the sales order, whether there is enough inventory to ship, and so on. When Joan finishes entering the sales order data, she presses a key which signals the end of the transaction. A new blank image of the transaction is displayed on the screen and Joan continues to enter additional sales orders.
In the meantime, a program in the computer adjusts inventory levels, prints a combined sales order/shipping memo form, and updates an order register file. When Joan completes entering the sales orders, she calls back the menu and selects a new transaction type, say purchases transactions, and proceeds to enter these in the same way (see also the example in Figure 1.31).
At the end of the day, Joan requests a back-up copy of the files to be produced on a diskette, locks the diskette in a vault, turns the computer off and leaves.34
Pre-programmed Accounting Systems
In recent years, pre-programmed accounting software packages have become available, making computerization of accounting transaction processing widely available. In Chapter 4 we will discuss the factors that should be considered when acquiring such a package. At this point, suffice it to say that there are packages available to suit most small businesses and at prices unheard of a decade ago. For example, one small but powerful system retails at less than $100. Typically such systems come with a pre-set chart of accounts (which can be modified), a facility for recording customer information together with an accounts receivable sub ledger, vendor information together with an accounts payable sub ledger, product information including price lists to facilitate invoice preparation, and general ledger for processing other types of transactions. These systems can automatically produce trial balances, ageings, customer statements and financial reports, including financial statements.
Jack is a programmer with AJAX Finance Corporation. He uses the interactive mode for program development purposes.
When he begins work in the morning, he signs on to the system via a terminal at his desk, enters his personal user identification code and password and begins programming. The system enables him to edit his programs, set up test files, run tests to check out his programs logic, and so on. All of his programs and files are only accessible to him through his user number and password.
As he develops his programs, the computer assists by diagnosing errors, explaining instructions in detail on the terminal screen as required, and keeping track of his entries until they are called for, at which time they are displayed on the screen.
It is important to recognize that in both examples the users interaction is governed by a set of programs in the computer which would have been designed expressly for that purpose. If the programs are designed well, with the users needs and capabilities in mind, interactive processing removes many obstructive barriers between user and computer. If, however, care is not taken in the initial development of these programs, the users will often be frustrated by the seemingly inflexible computer.
In addition, since interactive processing opens up the computer to many users, special controls over access to files and programs must be designed and implemented in the system to protect the data and programs from unauthorized users. Whenever interactive processing is used, a rigorous definition of access control requirements must be made and appropriate access controls must be implemented.
Batch vs. Transaction Oriented
In batch-oriented systems (see Figure 1.32), transactions are collected and grouped according to some efficient or logical organization, perhaps according to transaction types, and processed together at one point in time.
For example (see Figure 1.33), all inventory transactions receipts, shipments, and so forth might be grouped together into batches, edited, sorted into sequence, and then processed to update the inventory file. Similar procedures would be carried out for accounts receivable, accounts payable, and so on.
This type of system is very economical and many error checks can be included to be certain that the data is correct and that the system performs properly. Batch systems, however, have the disadvantage of slow turnaround time as compared to other modes. Information is often out of date because transactions must be submitted days prior to the actual run so that they can be prepared for processing. Nonetheless, batch processing is a common processing mode.
In transaction-oriented systems, source data is processed as it is generated, transaction by transaction. There is no grouping of similar transaction types prior to processing; thus, an inventory transaction could be received, processed to update the inventory file and then an accounts receivable transaction processed, then another inventory transaction, and then perhaps an accounts payable transaction (see Figure 1.34).
Transaction-oriented systems are found where there is a need to have files continuously reflect the most current and up-to-date information.
In summary, transactions are grouped together and processed as a group or batch in a batch-oriented system, in contrast with a transaction-oriented system in which each transaction is processed separately.
Enquiry vs. Update
In computer-based systems reading data is non-destructive, whereas writing data is destructive of previous file contents. Enquiry is simply the process of reading information from the computer files. Enquiry procedures may be direct, involving the examination of the contents of specific data file records; or, they may be indirect, involving inferences drawn from the application of statistical procedures for summarizing groups of data records with certain attributes. The result of the enquiry may be printed out on paper or on a visual display screen. However there is no alteration to the records within the computer.
The main purpose of enquiry is to obtain the status of some information item. However, obtaining such information can also be the first step to unauthorized use of the information. Consequently, despite the fact that enquiry is non-destructive, it is a function which needs to be controlled. Organizations are often concerned about who can access or read sensitive or confidential information. One problem with controlling reading or enquiry is that it is possible to access information indirectly as well as directly. By using logical inference a person who cannot access an item in a data file might still be able to deduce what the item is.
The update function alters the contents of the records in the computer files. The recording of an inventory receipt in an inventory file is an example of updating. While the result of this transaction may be printed out as in the enquiry function, the key thing to remember is that files have been altered. It is worth noting that the term update actually represents a variety of specific functions, including:
· create a record,
· add a record
· change a record, and
· delete a record.
Each of these functions can have different security implications. It is possible to separate the capabilities to read and update; for example, a person with update capabilities may not be permitted to read the contents of a data field being updated; conversely, a person with read privilege may not be able to update the data.
Combinations of Processing Modes
Let us look now at how various processing modes can be combined. Systems might operate completely in batch-oriented, off-line mode for both enquiry and update (see Figure 1.35). In an inventory system, shipments and receipts might be batched and processed to update the master file. A stock status report might be prepared daily showing quantities on hand, back-ordered, etc. Any enquiry as to stock on hand would be made from the report.
Or, (see Figure 1.36) the system might operate in batch mode for updating the master file (that is recording shipments and receipts), but have the capability for on-line enquiry. The user could request the stock-on-hand for aparticular item through a terminal. This would reduce the number of reports to be distributed and, if there were a large number of items, would reduce look up time. However, the information would be no more up-to-date than the previous system.
A slightly more sophisticated system (see Figure 1.37) might consist of collecting data on-line and then posting it off-line; that is, a user could enquire as to stock-on-hand and submit data (shipments and receipts) from a terminal. The transaction data could be checked for errors and immediate feedback given to the user.
Data would then be held in a file for update processing. There would be a batch run, possibly overnight, which would update the inventory master file with the transaction data file. This type of system offers the advantage of more flexible input and output, while keeping the error checks that are associated with batch updating.
A full on-line/realtime update and enquiry system is the most expensive and sophisticated of the on-line systems (see Figure 1.38).
In our example, shipments and receipts would be input as made and the inventory master file updated immediately. Thus information would be always up to date.
Many of the previously discussed processing characteristics can be combined with remote processing. The system may be batch-oriented or transaction-oriented. Data may be collected in an off-line mode and transmitted on-line. Many combinations are possible; for example, in batch mode, a remote terminal sends the data to the computer centre where it is accumulated on tape or disk for later processing by application programs. In on-line mode, enquiries and/or updates are performed by programs as the data is transmitted.
There are many alternatives available for the selection of suitable processing modes for a particular application. Choices must be made. The key factors in choosing processing modes are: the data access time requirements or constraints, the desired degree of centralization of data processing, and the degree of control desired over data files. For example, an on-line remote processing system provides the capacity for fast access to files, tends to decentralize data processing, and decreases the control over data files since they are on-line (not locked up in a file library) and thus are accessible from many remote terminals.
Of course, cost must also be considered. There are usually significant costs attached to increased processing speed, flexibility and data currency.
Centralized vs. Decentralized Processing
Large organizations with a great deal of data processing activity and a wide range of users and applications are typically geographically dispersed. Such organizations have to grapple with the question of whether to centralize information system processing facilities to realize economies of scale and optimize utilization of information system resources, or whether to be decentralized to maximize user flexibility and service. Clearly, there is no universal best solution to this problem since so much depends on the nature of the organization, its goals, resources, and its environment.
Distributed Data Processing Systems
Many organizations today are considering distributed data processing as ideal for their purposes. In many cases, this move towards distributed processing is a response to user dissatisfaction with poorly managed or under-funded centralized IS departments which cannot provide an adequate level of service to the user sites.
Distributed data processing is characterized by data processing carried out by micro/mini-computers and terminals located in the geographical or functional locations. Most of the data for that area will be captured on the micro/mini-computer, edited and perhaps local files updated. Periodically, the micro/mini-computer may transmit some of the data to a centralized computer, or retrieve data from a central, or host, computer.
Due to decreasing equipment and data transmission costs, and because there is no need to affect anything already happening in the central computer site, new applications can be added to the local computer. Thus the system is flexible.
Users are much more intimately involved with the computer system, since the processing takes place within their functional or geographical areas. They are better able to influence and monitor the data processing activity. Thus, they tend to take the best advantage of the IS resources available. They are also able to understand and control IS costs, since these costs are their responsibility.
There is sometimes a confusion between decentralized and distributed processing. The main distinction between them is that whereas decentralized data processing may involve the use of multiple processing installations and/or system development activities carried out at multiple sites, distributed data processing involves sharing of data and processing resources connected by data communication facilities.
One of the most prevalent forms of distributed processing today is the widespread proliferation of micro-computers, representing extremely powerful data processing capabilities. Their users typically program them using easy-to-use spreadsheet packages or database management systems, but sometimes rely on more conventional languages, such as Basic, to create systems outside the control of the central information system processing organization. In many cases, the micro-computers are standalone; i.e., they are not linked to the central computer of the organization. Increasingly, however, micro-computer users within large organizations are requesting to be linked to the central computer and its data stores.35
Network Components, Configurations and Designs
Two or more computers linked by communications lines form a network. Figure 1.39 illustrates three common network configurations. In the simplest type of distributed network, remote mini or micro computers are linked to a central host computer, as in on-line systems. However, whereas on-line systems merely have terminals hooked up to the central processor and utilize the central files or databases, in distributed networks the remote sites (nodes) often have their own data files, programs, and computer equipment, including auxiliary storage devices and printers. In more advanced distributed networks, remote sites can communicate with each other as well as with the central site (there may not even be a central site).
Network nodes (sites) may share programs, data, and processing equipment. For example, one node may have a particularly powerful computer for scientific computations, while another node may have sophisticated printers capable of printing high quality documents at extremely fast speed, while yet a third site might have mass storage devices for storing volumes of statistical data. Each site can access every other site by means of telephone or satellite communications systems, and each site can use the resources of other sites as if they were its own. In advanced distributed networks, databases may be subdivided into (i) portions which are replicated at several sites because they are accessed frequently, and this replication minimizes the costs and delays associated with data communications, and (ii) portions which are unique to each site or which are infrequently required by other sites, and thus are not replicated.
Sophisticated software and extensive directories may be used to control the routing of transactions and the processing steps performed at the various locations. Such software may incorporate algorithms for deciding whether to retrieve data from a remote site and deliver it to the site of the program which requires it, whether to send the program to the site of the data, or whether to send both the program and the data to yet a third site for processing.
The use of distributed processing is growing because it provides processing capabilities at user sites. This has several advantages, as well as raising a number of concerns. The advantages are that users gain access to, and some control over processing facilities. They can better monitor and control processing costs, and may obtain faster turnaround times. Through sharing of costly equipment and software, costs of such facilities may be minimized; however, this may be offset by the costs of the processing equipment required at each site and the communication facilities required to link the sites together.
The disadvantages lie in the administrative and financial control areas. In the absence of standards, or if standards are not adequately enforced, the sites may pursue different directions, develop incompatible data files and software, purchase incompatible (i.e., unshareable) equipment, reinvent solutions already developed elsewhere within the organization, and incur excessive costs by duplicating personnel, equipment, software, and by relying excessively on outside consultants. In addition, the proliferation of sites with access to central databases increases the risk of unauthorized access to sensitive information or the introduction of errors into central, shared databases by remote users.
Local Area Networks
Local area networks (LANs) typically have one computer acting as a server providing various network facilities to other computers linked to it, such as a central repository for software, data, and access to high quality printing facilities.
Figure 1.40 illustrates a typical Local Area Network or LAN. In such networks, all computers are linked to the server by means of special cables and plug-in boards which plug in to slots in each computer. Some common network configurations are the star, ring, and bus. Each of these types has advantages and disadvantages.
Wide area networks (WANs) are similar to LANs except that whereas LANs typically operate within a restricted area such as a building, WANs my be distributed over large geographic distances. While LANs typically use special dedicated cables to link the computers in the networks, WANs often use a combination of dedicated, leased and public telephone lines to connect the computers in the network.
Company A which has its head office in Halifax has major operations in five other Canadian cities, Vancouver, Calgary, Toronto, Ottawa, and Montreal. Operating control is decentralized. The company is considering a major upgrading of its computer facilities. At present all data is forwarded to the head office for processing. The new system must be capable of handling data input from the branches.
Figure 1.41 illustrates several possible equipment configurations. Panels 3 and 4 illustrate centralized systems with either the head office data processing centre or an outside service organization at the hub, controlling the processing activity. The branches are not linked with each other, only with the central processing site. Panels 2 and 3 illustrate processing networks in which the branches are linked with one another by means of data communication lines. Although the central site still exercises a degree of control, the branches also have independent processing capabilities.
Examples of Network-Based Systems
Network-based systems are increasing in number and their impact is being felt throughout the business community and society at large. They involve systems that use electronic impulses rather than paper (e.g., money, checks, etc.) to represent economic transactions, including initiation, authorization and recording of transactions. Such networks can be grouped into four general categories.36
· Remote banking systems.
· Retail point-of-sale (POS) systems.
· Direct deposit and preauthorized payment systems.
· Electronic data interchange (EDI).
Each is discussed in more detail below.
Remote Banking Systems
These systems allow deposits, withdrawals, transfers between accounts, bill-paying and account status enquiries through the use of remote-banking terminals or telephones.
In a terminal system, the customer can accomplish these transactions by:
· Inserting a plastic card into the terminal.
· Entering a personal identification number (PIN) or password.
· Pressing the function key (e.g., deposit") for the transaction s/he wishes to perform and, if appropriate, the amount of the transaction.
· Accepting from the terminal the receipt, cash (if applicable) and her/his plastic card.
The remote-banking systems that use telephones rather than terminals are normally limited to bill-paying transfers between accounts and account status enquiries. Some telephone payment systems require discussion with a teller at the financial institution, but others are accomplished using only a touch-tone telephone to enter the transaction information. For example, a customer could pay a bill by:
· Dialing the phone number of the system.
· Entering the account number and password.
· Entering the merchants identification number and the amount of the payment.
· After listening to the computers voice response (using prerecorded phrases) that repeats the information entered, pressing a button to confirm that the transaction is correct.
Retail Point of Sale (POS) Systems
Supermarkets and other retail outlets use terminals for performing three types of functions:
· Cheque verification/guarantee: Often this function can be performed more quickly and effectively by a POS system than by the store personnel (e.g., the clerk checking the customers drivers license).
· Funds transfer: These functions are similar to remote banking services. Instead of obtaining credit by use of a plastic card, the customer uses a debit card to authorize a transfer of funds from his/her depository account to that of the merchant.
· Data capture: Some electronic cash registers of POS terminals record data to monitor inventory quantities and aid management in pricing and other decisions.
Some POS systems also perform remote-banking functions.37
Direct Deposit and Preauthorized Payment Systems
These systems allow recurring payments to be made electronically rather than by using post-dated cheques or periodic mail.
Direct deposits are direct payments into the recipients account. The most common of these are direct payroll deposits. An example of the steps in a direct payroll deposit system follows:
· The employees who want their payroll cheques deposited directly sign an authorization form.
· Before each pay day, the employers computer system produces a magnetic tape with the machine-sensible payroll cheques for the appropriate employees. The employees that do not participate in the direct deposit system get ordinary paper cheques.
· The magnetic tape is sent to the employers bank, which debits its account for the entire direct deposit payroll and credits the accounts of each employee with an account at that bank. The remaining credits on the magnetic tape are transmitted to a clearing-house for distribution to the other employees financial institutions.
· Each employee participating in the system receives a statement showing the deposit.
Preauthorized payments are regular electronic payments of periodic bills such as mortgages, utility bills, car payments, etc. An example of the steps in this process follows:
· The bill-payer signs an authorization form for a specific recurring bill, such as payments for life insurance. The authorization information is stored on an electronic file that contains all the preauthorizations that are in effect for the banks customers.
· When the bank receives the insurance companys bill, it checks the authorization master file. If the bill is proper, the bill payers account is charged for the amount and a machine-sensible credit is forwarded to the clearinghouse for settlement with the insurance companys bank.
· A memorandum bill is usually sent to the bill-payer. If sent in advance, it allows him or her to make sure enough funds are in the account, to check the amount of the payment and to prevent payment if a question arises. The bill-payers bank statement serves as a receipt of payment.38
Electronic Data Interchange or EDI is an on-line communication network that links the computer system of an entity with that of its customers and/or suppliers. An example of the steps in this process follows:
· The entity becomes a member in a network.
· The entity logs on and passes through various access controls.
· The entity transmits a message or business document following a prescribed format directly to its customer/supplier or to a mailbox operated by the network administrator for this purpose.
· The customer/supplier receives the electronic message or document and uses translating software to convert it into that entitys own transaction processing format for processing by the entitys internal data processing system.39
During the systems design phase, choices are made from the various alternatives available to achieve the most cost effective solution. Given user information requirements, it is the designers job to then determine the appropriate mix of processing modes and file access/organization methods (see Figure 1.42) based on the following guidelines:
When a file requires regular cyclical processing, has regular activity in a high percentage of the items, and there is no need for immediate enquiry or on-line updating, batch processing on sequential files is the cheapest access method to develop and maintain for most applications. For example, payroll processing requires regular cyclical processing and generally does not require immediate on-line enquiry, so sequential access would be suitable. In addition, this offers good error checking and back-up features.
Direct access is useful when constant access for the updating or enquiry of specific records is necessary and complete cyclical processing requirements are minimal. For example, inventory control might require daily updating plus enquiry capability by sales personnel so that random access would be desirable.
Indexed sequential file organization and access is useful when regular batch processing is required and a high proportion of the items are affected, and enquiry or update capability is also necessary between cyclical processing dates; for example, the organization might wish to update accounts receivable daily and then age and trial balance the accounts each month-end, producing a listing for management use.
A database management system may be warranted if systems currently being designed and ones planned in the future, incorporate very complex file structures for any of the purposes described previously; or, there is a high degree of integration between systems; or, there is a high degree of data redundancy causing excessive storage costs. This would require a substantial initial investment in capital and labour; however, subsequent applications are more easily designed and implemented.
In a typical batch processing environment, source documents are initiated from a number of user departments such as personnel, sales, or accounting (see Figure 1.43). The computer output generated from these source documents is often produced in great volumes, thus there is a need to co-ordinate the flow of paper. Once output is generated, there must be a means of distributing this output. The right users must receive their output and users should only receive output they are authorized to handle. You can imagine the uproar if cheques produced for an executive payroll were accidentally distributed to the factory employees. Problems such as these can be avoided by establishing an effective data control function.
Data control provides a liaison between the various user departments, where source documents are initiated, and the EDP department that processes the data (see Figure 1.44). In a well-controlled system, all source documents and other media (e.g., diskettes, tapes, etc.) are passed on to data control where they are organized in preparation for data entry and/or processing by the computer. When processing is complete, all generated output is fed to data control where it is organized for distribution to the appropriate user departments.
In performing the co-ordination function, data control carries out procedures designed to ensure that: only authorized data is submitted for processing, all data submitted is processed, and only authorized recipients receive output.
In an on-line system, the objectives of data control do not change; however, different techniques are used to meet these objectives. Whereas in batch systems, data control is usually a human function, in on-line systems it is usually a software function carried out by special programs resident in the computer to control the use of terminals for data input, to control the distribution of output, and so on. Usually, these programs use passwords, user identification codes, etc., to check on who has the right to perform which function and to receive which information.
Checking on completeness of processing in on-line systems is not as simple as balancing input and output control totals in batch-oriented systems. In on-line systems there are usually built-in hardware features to ensure that data transmitted from terminals to computers, and vice versa, is complete and accurate. However, since on-line systems are transaction-oriented, only the users at the source of data input can really check to ensure that all the data they input was completely processed. Consequently, much reliance is placed on effective control procedures being performed diligently by users. This requires that users be properly trained and motivated to perform these duties.