How To Uncover The Holes In Your Accounting
Join Sherlock Holmes as he investigates a typical company's controls.
The computers were silent, the hum of air conditioning a gentle background in the brightly lit room. "Watson," said Holmes from behind the stem of his pipe, "I do believe I've stumbled onto something important." The president of S. Holmes C.P.A. Inc. held up a pair of tweezers with apparently nothing clamped between its jaws.
Watson looked closely. "By Jove!" he exclaimed, adjusting his glasses. "What it it?"
"A hair, my dear Watson, a blond hair. In fact, there are several just like it throughout the room. And no others. What does that tell you?"
Watson was silent, shaking his head. Holmes continued: "It tells me that this fine, upstanding firm of Finewound Spring & Sprocket may have a problem with internal accounting control."
"You mean...?" said Watson.
"I'm afraid so," said Holmes, dropping the hair into an envelope. "Separation-of-duties principle, I believe.Mr. Finewould will be displeased."
A week before, Herbert Finewound had hired Holmes to make a thorough audit and present his opinion of the company's financial statements. Finewound Spring & Sprocket was looking for a major loan to finance its planned expansion program, and the bank recommended that Finewound bring in a C.P.A. to look over the company's finances.
Even without that prodding, Finewound believed it was time for an audit. His company had grown rapidly, and he wanted to make sure its accounting procedures were reasonably safe from tampering.
"Adequate justification for an audit," Holmes had said when Herbert Finewound first approached him. "Quite," agreed Watson.
In the computer room with Finewound on the day the audit began, Holmes started by explaining the "separation-of-duties" principle. "Regardless of the size of a company," he said, "the most effective way to assure a selfchecking financial structure is to design the work flow so no one person handles a transaction from beginning to end." He emphasized the point by puffing furiously on his pipe, then continued. "In such a system, record keeping, asset custody transaction authorization, and the responsibility for putting a decision into practice are all separate. For example, your treasurer may be authorized to buy and sell stock investments. Your accounting department will record the transaction. The actual stock certificates might be in the bank's custody. As independent auditors, we'll compare your records with the physical certificates."
Holmes paused to refill his pipe. "We'll also check on how your cash is handled. Those who take cash from customers, or open mail payments, should not be making the bookkeeping entries or reconciling the bank statement.
"When a small company like Finewound Spring & Sprocket is audited," Holmes went on to say, "we naturally realize that a complete separation is more difficult to achieve. But we do try to make certain the owner is well acquainted with all procedures and is involved in most accounting activities."
With another puff of smoke, Holmes returned to his investigation of the Finewound computer room. "Look here, Watson," he said, "next week's duty schedule. What's amiss, in your view?"
"I say," said Watson, "the same person is doing the programming and the operating; J. Diskette is the name."
"She's also blond," said Holmes, "wears Eau de Vie perfume and has a weakness for pipe-smoking auditors. While Ms. Diskette may be perfectly honest, this is certainly a weak link in Finewound's accounting controls.
"You see, Mr. Finewound," he said, "the computer has greatly increased speed and accuracy of record keeping for your company and many others. But it has also combined many functions which would normally be separated in a manual-entry system. Therefore, you must realize, there should be other compensating controls -- such as the separation of programming and operating functions, at the least." Holmes bit down sharply on the stem of his pipe. "Programmers should not be allowed to enter data into the system, and operators should see only the operating functions -- not the entire run manual.
"In addition, the computer's output should be reviewed by an independent person or department if possible. This way, we as auditors will try to reduce the change that one person can both commit and conceal errors or fraud. Tomorrow, we'll also evaluate Finewound's computer input, output, and processing controls to be sure that all entered transactions are authorized, that none are omitted, and that processing in accurate."
Holmes walked over and stood in front of the printer. "Watson," he said, "would you look at this."
In the printer, Watson noticed, was a run of company checks. "Oh, my," he said. "We can't have that."
Holmes shook his head. "Since a company that uses a computer usually keeps all accounting records in the data processing department," he said, "we're a bit concerned when that same department prints checks. There are ways to compensate for this weakness, however. If we discover that computer personnel are not authorized to make disbursements, and that another person or department must verify all checks, then Finewound will clear this hurdle nicely."
Before leaving the computer room, Holmes explained that he would also check the physical security of the area. "Your files should be protected with a formal checkout system," he told Finewound. "Can somebody get in easily to sabotage the system or make illegal entries? Has the company duplicated vital files?We'll look for limited access through other terminals, access controlled by code numbers, passwords, limited hours, and terminal logs."
Holmes puffed meditatively on his pipe for a moment. "You know," he said, "computer fraud is gaining in popularity these days. It's too easy for a talented person to commit, and very difficult to uncover. So far, though, I'd say Finewound is in pretty good shape."
"Quite," said Watson, locking the door as they left the computer room.
The second area of control Holmes examined was Finewound's organizational structure. "A well-planned organization contributes to a healthy accounting system," said Holmes. "In a small company, the owner usually controls through personal supervision. As a company grows, lines of authority begin to develop. We'll study these lines of authority to determine whether your department heads are held accountable for the results of their operations."
