Accounting Information Systems and Technology
Accounting Information Systems and Technology tests transaction cycles, internal controls, data integrity, and the control implications of ERP and cloud systems. Candidates should identify where a control fails and what risk follows.
Cycles and controls
- Revenue cycle: order entry, credit approval, shipping, billing, cash receipts, and receivables. Expenditure cycle: requisition, purchase order, receiving, supplier invoice, and payment.
- A three-way match compares purchase order, receiving report, and invoice before payment. It prevents payment for goods not ordered or received.
- Segregate authorization, custody, recording, and reconciliation. In IT, also separate access administration, change management, and production operations.
- IT general controls cover access, change management, backups, and operations. Application controls cover input, processing, and output, such as edit checks, batch totals, sequence checks, and exception reports.
- An audit trail should let an auditor trace a transaction from source document to ledger and back.
Worked example
A clerk can both create a new vendor in the master file and approve payments. The clerk creates a fictitious vendor, submits an invoice, and approves payment to a personal bank account. This is an incompatible-duties deficiency: custody of the payment approval and authorization of the vendor master are combined, and no independent review exists. The risk is misappropriation of assets and materially overstated expenses. Remediation separates vendor maintenance from payment approval, restricts system roles, requires independent review of master-file changes, reconciles vendor additions to supporting documents, and runs a periodic duplicate-bank-account report. Preventive controls stop the setup; detective controls catch a failure.
Traps
Treating a backup as an archive ignores retention and recovery objectives. Relying on IT general controls without testing application controls leaves transaction-level errors undetected. Assuming a report is reliable because it comes from the ERP ignores report logic and parameter changes. Shared login IDs destroy accountability. A control that exists on paper but is not operating is a deficiency, not comfort.