The computers were silent, the hum of air conditioning a gentle background in the brightly lit room. "Watson," said Holmes from behind the stem of his pipe, "I do believe I've stumbled onto something important." The president of S. Holmes C.P.A. Inc. held up a pair of tweezers with apparently nothing clamped between its jaws.
Watson looked closely. "By Jove!" he exclaimed, adjusting his glasses. "What it it?"
"A hair, my dear Watson, a blond hair. In fact, there are several just like it throughout the room. And no others. What does that tell you?"
Watson was silent, shaking his head. Holmes continued: "It tells me that this fine, upstanding firm of Finewound Spring & Sprocket may have a problem with internal accounting control."
"You mean...?" said Watson.
"I'm afraid so," said Holmes, dropping the hair into an envelope. "Separation-of-duties principle, I believe.Mr. Finewould will be displeased."
A week before, Herbert Finewound had hired Holmes to make a thorough audit and present his opinion of the company's financial statements. Finewound Spring & Sprocket was looking for a major loan to finance its planned expansion program, and the bank recommended that Finewound bring in a C.P.A. to look over the company's finances.
Even without that prodding, Finewound believed it was time for an audit. His company had grown rapidly, and he wanted to make sure its accounting procedures were reasonably safe from tampering.
"Adequate justification for an audit," Holmes had said when Herbert Finewound first approached him. "Quite," agreed Watson.
In the computer room with Finewound on the day the audit began, Holmes started by explaining the "separation-of-duties" principle. "Regardless of the size of a company," he said, "the most effective way to assure a selfchecking financial structure is to design the work flow so no one person handles a transaction from beginning to end." He emphasized the point by puffing furiously on his pipe, then continued. "In such a system, record keeping, asset custody transaction authorization, and the responsibility for putting a decision into practice are all separate. For example, your treasurer may be authorized to buy and sell stock investments. Your accounting department will record the transaction. The actual stock certificates might be in the bank's custody. As independent auditors, we'll compare your records with the physical certificates."
Holmes paused to refill his pipe. "We'll also check on how your cash is handled. Those who take cash from customers, or open mail payments, should not be making the bookkeeping entries or reconciling the bank statement.
"When a small company like Finewound Spring & Sprocket is audited," Holmes went on to say, "we naturally realize that a complete separation is more difficult to achieve. But we do try to make certain the owner is well acquainted with all procedures and is involved in most accounting activities."
With another puff of smoke, Holmes returned to his investigation of the Finewound computer room. "Look here, Watson," he said, "next week's duty schedule. What's amiss, in your view?"
"I say," said Watson, "the same person is doing the programming and the operating; J. Diskette is the name."
"She's also blond," said Holmes, "wears Eau de Vie perfume and has a weakness for pipe-smoking auditors. While Ms. Diskette may be perfectly honest, this is certainly a weak link in Finewound's accounting controls.
"You see, Mr. Finewound," he said, "the computer has greatly increased speed and accuracy of record keeping for your company and many others. But it has also combined many functions which would normally be separated in a manual-entry system. Therefore, you must realize, there should be other compensating controls -- such as the separation of programming and operating functions, at the least." Holmes bit down sharply on the stem of his pipe. "Programmers should not be allowed to enter data into the system, and operators should see only the operating functions -- not the entire run manual.
"In addition, the computer's output should be reviewed by an independent person or department if possible. This way, we as auditors will try to reduce the change that one person can both commit and conceal errors or fraud. Tomorrow, we'll also evaluate Finewound's computer input, output, and processing controls to be sure that all entered transactions are authorized, that none are omitted, and that processing in accurate."
Holmes walked over and stood in front of the printer. "Watson," he said, "would you look at this."
In the printer, Watson noticed, was a run of company checks. "Oh, my," he said. "We can't have that."
Holmes shook his head. "Since a company that uses a computer usually keeps all accounting records in the data processing department," he said, "we're a bit concerned when that same department prints checks. There are ways to compensate for this weakness, however. If we discover that computer personnel are not authorized to make disbursements, and that another person or department must verify all checks, then Finewound will clear this hurdle nicely."
Before leaving the computer room, Holmes explained that he would also check the physical security of the area. "Your files should be protected with a formal checkout system," he told Finewound. "Can somebody get in easily to sabotage the system or make illegal entries? Has the company duplicated vital files?We'll look for limited access through other terminals, access controlled by code numbers, passwords, limited hours, and terminal logs."
Holmes puffed meditatively on his pipe for a moment. "You know," he said, "computer fraud is gaining in popularity these days. It's too easy for a talented person to commit, and very difficult to uncover. So far, though, I'd say Finewound is in pretty good shape."
"Quite," said Watson, locking the door as they left the computer room.
The second area of control Holmes examined was Finewound's organizational structure. "A well-planned organization contributes to a healthy accounting system," said Holmes. "In a small company, the owner usually controls through personal supervision. As a company grows, lines of authority begin to develop. We'll study these lines of authority to determine whether your department heads are held accountable for the results of their operations."
At Finewound, Holmes was pleased to see a formal statement of forecasts and goals for both the Springs and the Sprockets divisions. When the reports showed a difference between expected performance and actual performance, there was a written summary of the causes drawn up by the department head.
"Excellent," Holmes commented. "And here's another example of accountability control, Watson." The stockroom had issued 250 springs to the sprocket production line on a requisition. But the sprocket department head came back with a shortage report of 30 springs. The record showed that the missing springs surfaced in a mismarked box after a search by both departments. "In a case like this," said Holmes, "I've always found that both departments will keep more accurate records if they know the other department is doing the same. Human nature, you know.
"Now," said Holmes, "we do on to the best part of the audit: accounting systems. Ask Mr. Finewound for his manual of accounting policies and procedures."
Manual in hand, Holmes examined the chart of accounts to make sure responsibilities and standard procedures were clearly defined. He was pleased to see that the accounting department was a separate entity from production, and that it had no physical custody of cash, securities, or other assets.
The system was good, able to document individual transactions as represented on the financial statements. Holmes explained that he would come back and trace a great many individual transactions on Finewound's books, both as a test of internal control procedures, and to substantiate the actual amounts in the records. Waving his big magnifying glass, Holmes said, "There is no substitute for painstaking attention to detail, whether you are a detective looking at footprints, or an auditor tracing the steps of a financial transaction."
In digging through disbursement records, however, Holmes raised his bushy eyebrows. "What's this?" he asked no one in particular.
"An invoice, Holmes," said Watson proudly.
"Astute observation," said Holmes. "What seems wrong, or missing?"
"It is marked paid, which is good. The purchase order is properly attached. I don't see... Ah! The duplicate of the check is missing. Goodness. That check could have gone anywhere."
"Precisely," said Holmes. "Anywhere. We'll have to bring this matter to Finewound's attention."
Finewound immediately recognized what concerned Holmes: the possibility of unauthorized payments when all supporting documents are not attached to canceled checks. "From now on," said Holmes, "you should check to see that all unissued company forms, particularly blank invoices, are numbered sequentially and are in a protected location to prevent unauthorized use."
While examining accounting systems at Finewound, Holmes ascertained that Finewound had the cash that was listed on its financial statement, and reviewed the company's control over cash. Cash receipts were recorded immediately. Deposits were made daily.
But then he frowned, with another billow of smoke from his pipe. "Finewound's bookkeeper hasn't taken a vacation in two years," observed Holmes.
"Neither have I," said Watson.
"You don't handle may cash, my dear fellow. I believe an annual vacation for a bookkeeper is a must. Not only to refresh the spirit, but to reveal any irregularities with the accounts. I also think that Ms. Diskette should take a vacation, since she also is overdue. We're not here to question the integrity of Finewound's trusted employees, but an occasional vacation helps keep temptation at bay," Holmes concluded.
Other areas of asset protection that Holmes explained he would study during his audit included inventory, plant equipment, and investments. Regardless of the asset, Holmes pointed out that he would expect to find detailed records of accountability, acquisition and retirement procedures, and that the assets were kept in a safe place with some control over access. He'd also check to see if there were regular inventory reviews.
"Now let's trace some more transactions," said Holmes.
"Good show," said Watson, sharpening his pencil.
The two auditors began checking to see that transactions were recorded in the right amounts, in the proper accounting periods, and to correct accounts. They made sure credit sales were approved by the credit department before goods were shipped. They checked to see that shipping forms were matched up with customer orders, sales orders, and invoices to uncover the possibility of unrecorded or inaccurate sales entries.
Holmes called Mr. Finewound on the intercom after an unusual entry caught his attention. "What is 'liquid sprocket?" he asked. "You purchased two cases in December, and the authorization is signed 'Santa Claus."
Mr. Finewound cleared his throat. "Well," he said, "I guess that was for our Christmas office party. We drank a lot of liquid sprocket that evening. It's all right, isn't it?Morale, and all that?"
"Proper event," said Holmes, "but improper accounting." He chuckled. "Perhaps an adjusting entry might be in order here to record a justifiable employee benefit expense rather than liquid sprocket."
After ten days of hard work, Holmes and Watson met with Finewound in his office. The audit had gone well, and the auditors presented their report.
"Finewound Spring & Sprocket has quite appropriate and accurate accounting procedures," said Holmes."You'll find a short list of recommendations attached. I believe your bank and stockholders will be pleased," he added," and if you have good internal control, it's likely that future audits will be less expensive."
Holmes and Watson walked to the door, off to another assignment. "By the way," said Watson, "do I detect a few of Miss Diskette's blonde hairs on your jacket, and a faint scent of Eau de Vie perfume in the air?"
Holmes puffed furiously on his pipe. "There are times, Watson, when you see entirely too much for your own good," he said.
"Quite so," said Watson.