The information technology (IT) department at Jacobsons, Inc., consists of eight employees, including the IT Manager, Melinda Cullen. Cullen is responsible for the day-to-day oversight of the IT function and reports to Jacobsons' chief operating officer (COO). The COO is a senior vice president responsible for the overall retail operations who reports directly to the president and chief executive officer. The COO attends board of director meetings to provide an update of key operating performance issues. Because Cullen takes an active role in managing the IT department, the COO rarely discusses IT issues with the board or CEO. Cullen and the COO identify hardware and software needs and are authorized to approve those purchases.
In addition to Cullen, the IT department is composed of seven other individuals: three programmers, three operators, and one data control clerk. Cullen has been employed by jacobsons for 12 years, working her way up through various positions in the department. Fortunately, she has been able to retain a fairly stable staff and has experienced minimal turnover. All IT personnel have been employed in their current positions since mid-2009.
When hiring personnel, Cullen does extensive background checks on prospective employees, including reference, credit, and criminal checks. Cullen has developed a trust with each employee and, as a result, delegates extensively to each individual. This is especially beneficial because Cullen spends most of her time working with user departments in a systems analyst role, identifying changes needed to existing applications. She conducts weekly IT departmental meetings on Tuesday mornings. Each staff member attends, including night operators, to discuss issues affecting the performance of the department.
The three programmers are responsible for maintaining and updating systems and application software. The lead programmer is responsible for assigning duties among the programming staff. All three programmers have extensive experience with the operating, utility, security, and library software as well as all of Jacobsons' application software packages. Programming assignments are made based on who is least busy among the programming staff at the time. This method of management keeps all programmers familiar with most software packages in use at Jacobsons and keeps programmers excited about the job tasks because of the variety of assignments they receive. Cullen encourages each programmer to take continuing education courses to keep current with the latest technical developments. In addition to programming responsibilities, the programming staff maintains the library of programs and data tapes, which is located in a locked room nearby. The programming staff maintains extensive logs of tape use and of changes made to program files.
The three operators consist of a day operator and two night operators. Most of the applications are based on online inputting from various user departments for batch processing overnight. Thus, the heaviest volume of processing occurs during the night shift, although there is some daytime processing of payroll and general ledger applications. All operators are responsible for monitoring the operation of the equipment and correcting system-caused errors. In addition, they do routine monthly backup procedures. The computer operators have programming experience with the program language used in application programs. Occasionally, when a small change is identified for an application program, Cullen asks the day shift operator to implement that change to avoid overburdening the programming staff.
Operators follow the production schedule prepared by Cullen, who consults with user departments to develop the schedule. The day shift operator reviews the job processed log (which chronologically details the jobs processed) generated at the end of the previous night shift for deviations from the schedule, and the lead night shift operator reviews the job processed log generated at the end of the previous day shift for deviations from the schedule. If jobs processed reconcile to the job schedule, the job processed log is discarded. When there are deviations, the operator doing the review leaves a copy for Cullen, highlighting the deviation. Before doing batch processing jobs, the operators generate an input listing report that summarizes the number of online input entries submitted during the day for processing. This number is recorded and then later compared by the operators with the computer output generated after batch processing and file updating occur. This provides a check figure of the number of transactions processed. When the numbers agree, the output is submitted to the data control clerk. When the numbers disagree, the operators identify the error and resubmit the application for processing.
The data control clerk collates all computer output, including output reports and exception listings. The data control clerk reviews exception reports and prepares correction forms for reprocessing. Examples of changes that the data control clerk might make include correcting inputting errors (for example, amounts accidentally transposed) and preparing change request forms for changes to existing master files (examples include revising sales price lists and inventory product numbers in the sales master file and adding new employee names, addresses, and Social Security numbers to the payroll master file). After all corrections are made, the data control clerk distributes all computer output to the various user departments. User departments have high regard for the IT staff. Output reports are reconciled to input reports by users on a test basis quarterly.
Required
You are the senior auditor assigned to the audit of Jacobsons. The audit partner has asked you to assist in doing the IT general controls review. The partner has asked you to review this narrative information and respond to the following questions:
1. What controls and deficiencies exist in the lines of reporting from IT to senior management? If you note any deficiencies, provide recommendations that can be included in the management letter.
2. What is your assessment of how Melinda Cullen fulfills her IT management responsibilities? Identify tasks that she does that strengthen the department. Which of her tasks cause you concern? What changes in her day-to-day responsibilities would you make?
3. What is your assessment of the programming function at Jacobsons? What are the strengths? What are the deficiencies? Make recommendations for improvement.
4. What is your assessment of the IT operations function at Jacobsons? What are the strengths? What are the deficiencies? Make recommendations for improvement.
5. What is your assessment of the data control function at Jacobsons? What are the strengths? What are the deficiencies? Make recommendations for improvement.
6. Make recommendations for improving controls over the involvement of users.