632598256894

Controls
Because the initial software applications that were developed in the 1960s and 1970s were accounting
oriented, data processing (which is what the use of information technology was called at that time)
typically reported to the chief financial officer, creating a control atmosphere consistent with
accounting controls. A central group of trained data-entry operators was responsible for entering and
verifying data. Access to the “glass house” was restricted, and, in some cases, access to the data entry
and report distribution areas was also restricted. Because everything was self-contained, control was
not a major issue.
In the late 1970s and early 1980s, online terminals began appearing on users‟ desks outside of the
glass house, allowing them access to data. Initially, these terminals were used for information inquiry.
Yet, even this limited function was tightly controlled by strict software access control and password
protection. While workers were getting additional capabilities, they were also creating opportunities
for lapses in control. This was just the beginning of the Trojan horse. Eventually, data entry moved out
of the glass house to the warehouse receiving dock to be used for inventory receipts, to the order-entry
desk to be used for new orders, to the purchasing department to be used for purchase orders, and, in
the case of retailing, onto the sales floor for point-of-sale processing. No longer were trained dataentry
operators responsible for the quality of the data; others were responsible for entering data, and it
was just an ancillary part of their jobs, for which they were not necessarily even trained.
The control environment was breaking down, and the introduction of the personal computer only
complicated the issue. No longer was control centralized. Although access to data could be controlled,
control over the use of data and the content of reports was lost. For example, two people could each
issue a report on sales, and the numbers could easily be different. Yet both reports could be accurate.
How is this possible? It‟s simple. One of the reports may have been about gross sales and the other
about net sales, or one may have been based on data through Friday and the other on data through
Saturday.
When all programming was controlled by a small professional group, control was much easier.
However, because today‟s spreadsheet programs are user friendly, and software does not require
programming knowledge, everybody is his or her own programmer. Thus, it is difficult to control the
consistency of the information that is being distributed.
The problems only become more complicated. Now companies allow their business partners,
vendors, and even outsiders to access their internal computers, using the Internet. Data is
interchanged, and moneys are exchanged electronically, often without paper backup. What was
relatively simple to control before 1990 is now a nightmare. Accountants, systems professionals, and
auditors must remain forever vigilant against both inadvertent and intentional unauthorized use and
abuse of company data.
Information Technology Strategy
How do companies decide how to invest their IT budgets? What projects get funded? Which projects
are of higher priority? Information technology strategy is not created in a vacuum. Rather, like all of