CASE 13-1 Research Project: Impact of
Information Technology on Expenditure Cycle Activities, Threats, and Controls
Search popular business and technology magazines (Business
Week, Forbes, Fortune, CIO, etc.) to find an article about an innovative
use of IT that can be used to improve one or more activities in the expenditure
cycle. Write a report that:
- a.
Explains how IT can be used to change expenditure cycle activities.
- b.
Discusses the control implications. Refer toTable 13-2, and explain how the new procedure changes the
threats and appropriate control procedures for mitigating those threats.
TABLE 13-2 Threats and Controls in the Expenditure Cycle
|
ACTIVITY
|
THREAT
|
CONTROLS (FIRST
NUMBER REFERS TO THE CORRESPONDING THREAT)
|
|
General issues throughout entire
expenditure cycle
|
- 1. Inaccurate or invalid
master data
- 2. Unauthorized disclosure of
sensitive information
- 3. Loss or destruction of
data
- 4. Poor performance
|
- 1.1 Data processing integrity
controls
- 1.2 Restriction of access to
master data
- 1.3 Review of all changes to
master data
- 2.1 Access controls
- 2.2 Encryption
- 3.1 Backup and disaster
recovery procedures
- 4.1 Managerial reports
|
|
Ordering
|
- 5. Stockouts and excess
inventory
- 6. Purchasing items not
needed
- 7. Purchasing at inflated
prices
- 8. Purchasing goods of
inferior quality
- 9. Unreliable suppliers
- 10. Purchasing from
unauthorized suppliers
- 11. Kickbacks
|
- 5.1 Perpetual inventory
system
- 5.2 Bar coding or RFID tags
- 5.3 Periodic physical counts
of inventory
- 6.1 Perpetual inventory
system
- 6.2 Review and approval of
purchase requisitions
- 6.3 Centralized purchasing
function
- 7.1 Price lists
- 7.2 Competitive bidding
- 7.3 Review of purchase orders
- 7.4 Budgets
- 8.1 Purchasing only from
approved suppliers
- 8.2 Review and approval of
purchases from new suppliers
- 8.4 Tracking and monitoring
product quality by supplier
- 8.3 Holding purchasing
managers responsible for rework and scrap costs
- 9.1 Requiring suppliers to
possess quality certification (e.g., ISO 9000)
- 9.2 Collecting and monitoring
supplier delivery performance data
- 10.1 Maintaining a list of approved
suppliers and configuring the system to permit purchase orders only to
approved suppliers
- 10.2 Review and approval of
purchases from new suppliers
- 10.3 EDI-specific controls
(access, review of orders, encryption, policy)
- 11.1 Prohibit acceptance of
gifts from suppliers
- 11.2 Job rotation and
mandatory vacations
- 11.3 Requiring purchasing
agents to disclose financial and personal interests in suppliers
- 11.4 Supplier audits
|
