You are an information systems auditor in a public accounting firm that has just taken over the audit of a medium-sized manufacturing company from another firm. The hardware/software platform used by the company is quite old. Two microcomputers are connected to a server via a local area network (all the same type of machine). The manufacturing and accounting application software used was written specifically for the company by a firm of external consultants. Apart from minor modifications, the software has been relatively stable for some seven years. Each machine has multiple users. For example, a warehousing clerk and the production manager both use the same machine to record raw material receipts, releases of raw materials into production, and completions of finished goods. Similarly, several accounting clerks use the same machine to carry out various accounting functions.

When you question the general manager about the age of the hardware and software, he explains that he does not see information systems as being central to the strategic success of the company. For the past 10 years, the size and operations of the company have remained about the same. As a result, he argues that the need to upgrade software during this period has been minor, and the hardware has been replaced only once or twice as best he can recollect. In his opinion, the hardware/software platform used by the company has been an excellent workhorse.

As you collect evidence on the reliability of controls in the hardware/ software platform, you obtain the following findings in relation to the hardware used by the company:

a. The central processing unit in the three machines uses a single parity bit to detect errors in its registers.

b. The central processing unit recognizes a supervisor state and a problem state, but this capability is not used by the operating system; the hardware effectively acts as a single-state machine.

c. There are no timing controls to recognize application system loops, nor are there replicated components to provide fault tolerance.

d. Memory errors are detected via a single parity bit.

e. Memory is allocated to programs on a non-contiguous basis. No access controls are exercised, however, to ensure that programs reference a memory cell only within their allocated memory areas.

Required: What are the implications of these findings for the conduct of the remainder of the audit? Be sure to discuss how they will affect the tests of controls you might undertake and the substantive tests you might undertake.