CHAPTER ? PREFERRED PRACTICES IN ORGANIZATION AND MANAGEMENT OF THE EDP FUNCTION [ADATA PROCESSING installation should be organized and managed by the same methods that have proved effective in other seg- ments of the organization. There should be a plan of organiza- tion and clear assignments of responsibilities. This plan should, when feasible, include separation of duties to provide internal control, For management of operations there should be written procedures and standards of performance against which accom- plishment may be measured. ‘This chapter assumes a general knowledge of management principles so that the discussion can concentrate primarily on organizational features and operating procedures that are more or less unique to computer data proc- essing. The explanation is divided into three major sections: plan of organization, typical organization charts and manage- ment of a computer installation. Plan of organization In data processing, as in other business operations, it is necessary Assignment of lish responsibility, job descriptions should be prepared for all data processing personnel. These descriptions should identify all job titles and clearly describe all job functions. Each employee ividual responsibilities for all functions. To estab- Responsibilities Scarred. with CamScaner10 Separation of Duties should be given a copy of his job description and instructed in all factors related to his work assignment. Although titles vary among installations, the following abbreviated job descriptions cover the most common data processing positions: TITLE DESCRIPTION ‘Systems Analyst Analyzes the requirements for information. Evaluates the existing system and designs new or improved data processing procedures. Outlines the system and prepares specifications which guide the programmé Programmer Flowcharts the logic of the computer programs required by the overall system designed by the systems analyst. Codes the logic in the computer program language. Debugs the resulting program. Prepares documentation. (See Chapter 3 for documentation requirements.) Computer Operator Also called a console operator. Operates the computer according to the operating procedures for the installation and the detailed procedures for each program found in the Computer Operator Instructions. (See Chapter 3 for description of this manual.) Unit Record Equipment _—_Also called a tabulating equipment operator. Operator Operates punched card equipment such as sorter, collator, reproducer, accounting machine, etc. Keypunch Operator Prepares data for machine processing by keypunching cards. Operates a card punch (also called a keypunch). As will be seen from the sample organization charts, the func- tions of these positions may be combined or divided. In general, the systems analyst position requires the broadest background and highest qualifications. The programmer follows next in this hierarchy of qualifications with the computer operator re- quiring still less training and experience. The position of unit record equipment operator requires roughly the same level of training as that of computer operator in a relatively uncompli- cated computer installation. | When a company establishes.a data processing organization, proper recognition should be given to internal control. This section deals with that element of internal control obtained Scarred. with CamScanerthrough the separation of duties. ‘The same principle that calls for a separation of the functions of record kecping, operations or asset custody and internal auditing also applies to the separa- tion of basic data processing functions. DATA PROCESSING FUNCTION POSITION System analysis and desih wnnmmanSystems analyst PrograMMiNG, nneeewnnnnsnniennnnnePFOBFAMMEF Machine operation .... Computer operator CONtIOL nnn -ovnewnnsnnannneCOMttOl Clerk OF control grOUP, internal auditer, etc. “Internal control is strengthened if these four functions are separate and distinct. ‘This separation may also result in oper- ational efficiencies because the four functions require differing levels of training and skill. It is usually satisfactory to combine the development activities of systems analysis and programming. ‘These may be kept as separate jobs but combined organization- ally under a single supervisor, ot, in small installations, a single job may include both activities. In most cases it is not desirable to overlap development activities with machine operation, al- though this does occur in the very small installations. A suitable plan of organization and the resulting division of duties is important because of the concentration of the data processing activity in a smaller number of people than would be required for a manual system, The small number of people and the high degree of mechanization expose the system to manipulation and fraud if a single person has both operational knowledge and easy access to procedures and programs at all levels. In one instance, for example, a former timekeeper was involved in both programming and machine operation. He was able to draw on his varied skills to manipulate payroll data in his favor without affecting the payroll control totals. Another recent example of possible dangers from lack of divi- sion of duties occurred when a programmer for a company servic- ing a bank sometimes acted as an operator. One of the applica- tions he had programmed was a listing of accounts which were overdrawn, While serving as computer operator he inserted a “patch” in the program to cause it to ignore overdrafts in his account when printing the overdraft report. He then proceeded to overdraw his account at the bank. The fraud was discovered Scarred. with CamScaner Il12 The Control Function 7] when, because of a computer breakdown, the report was prepared manually. The plan of organization and operating procedures should pro- vide for a control function, ‘The control function is divided into two types: 1. Processing control internal to data processing 2. Outside control Internal processing control (data control, quality control, etc.) is a function of the data processing department and is concerned with monitoring the accuracy of processing and with ensuring that no data is lost or mishandled within the department during Processin; Wor instance, if a detail transaction file is processed with a master file to produce an updated master file, the sum of the transaction file and the master should equal the total of the updated master. The person charged with the processing control is responsible for making or reviewing such a comparison, Con- trol at the processing level is usually the responsibility of the data processing manager. A subordinate may be assigned control activities as a part-time or full-time assignment, depending on the volume of activity. If the assignment is not full-time, it is desirable to preserve a separation of duties and to avoid using a person who has systems, programming, or operator responsibil- ities (especially the latter). Outside control can take several forms, but is basically con- cerned with an independent check of the functioning of the data processing department. This independent check can be per- formed by a user department. |If the general ledger, for instance, is maintained through the computer, the accounting department may keep a control total of the debits and credits to be posted by the computer to the general ledger. The updated general ledger from the computer should show a total change equal to the ac- counting department debit and credit posting totals. Another form of outside control is an independent quality control evalu- ation of data processing's production, A separate group may be established for this purpose in a user department where the vol- ume of data to be controlled is large. For example, one large corporation has a payroll processing control group responsible for evaluating the payroll data produced by the computer. This is done by performing various tests on the data totals and by Scarred. with CamScanerusing control amounts (explained in Chapter 5). ‘The outside control function, as typificd by the evaluation group, should be under the direction of accounting, finance, or some other func- tion in a position to perform an independent and critical review of performance. Typical organization charts Three organization charts are presented here as illustrations of typical organization charts for small, medium and large computer installations. ‘This classification corresponds roughly to the following monthly rental figures: CLASSIFICATION MONTHLY RENTAL Smalt Less than $5,000 Medium $5,000 to $15,000 Large Over $15,000 ‘These organization charts do not show the location of computer data processing in the overall organization plan. Data processing can be under the control of one of several sections of a company, depending on the company. |In most smaller organizations, data processing is the responsibility of the chief financial or account- ing officer, such as the financial vice-president, the treasurer, or the controller. In many large organizations, the data processing system has been separated from the financial or accounting te- sponsibility and the manager given a title such as Vice-President of Corporate Information Systems. ‘The trend is to have a computer-based information system organized as a service center for the data processing needs of the entire organization. Acting in this service capacity and maintaining files used by many de- partments, data processing makes decisions which cross existing divisional or departmental lines of authority. Data processing personnel should, in such case, report to an executive who has authority to resolve conflicts that may arise among these divi- sions. This means that the executive in charge of data processing should be of the same rank as the heads of departments being served. Figure 2-1 (page 14) shows an organization chart for a small Scarred. with CamScaner 1314 tata processing Sarat ‘Systems ; ma Keyouneh Equipment broarenar oonratore | spurns raune 2-1. Organization chart for a small data processing installation {equipment rental fess than $5,000 per month) installation, Note that the systems analysis and programming functions have been combined, Whether or not the installation will require separate unit record equipment operators will depend on the type of configuration. ‘There is a tendency in smaller installations to combine many card processing functions with the operation of the computer equipment. Figure 2-2 (below) illustrates 2 medium-scale installation. Of interest is the separation of systems analysis from pro- gramming and the addition of an internal control clerk. In the expanded organization, there may also be opportunities for a hierarchy of supervision; for example, senior programmer and programmer, Figure 23 (page 15) shows an organization chart for a fairly large installation, with a monthly equipment rental of over Data processing, manager — Senior Senior unit S oysters Control Keypunch record pee programmer clerk Supervisor | | equipment | | computer analyst scuiproe opertne systems | Keynunch Unit record | | Computer analysts 0 equipment = iy ‘operators jeuiooen operator aune 22. Organization chart for a medium-sized dat ing i i i rraune 52 Organization chart for a medium sized data processing instalation (equipment rental Scarred. with CamScaner$25,000. ‘There is further specialization with systems analysts separated completely from programming. Programming includes a separate documentation librarian; there are separate data com- munications specialists; and operations has a separate position for a tape librarian responsible for custody of the magnetic tapes. Management of a computer installation The same management principles that apply to general busi- ness management also apply to data processing. However, since data processing is a relatively new discipline, the techniques for effective management control are still being developed. As so often happens in new fields, the personnel tend to feel that their work is creative and cannot be subjected to measurement or evaluation. |For many years this feeling has prevailed in data processing, and management, not generally knowledgeable about EDP, has frequently failed to exercise adequate supervision. ‘As management and the other members of the business com- Director of information processing sO Manager of Manager of Manager of data pregrenrning systems an processing operations SS c r r ; Decoration Eaulpment Project Keypunc i storm Project | | ivanan Proje | | Kevpunen || Processing || Gperations || Tape a rolect ] | Superior ||conot group || SPE=tON= || Teen x Documentation 7 Programmers] | Dos Kepinch shit || Assistant ce score | Supervisors librarians Keypunch operators J Data Unit recor Systems ‘communications ‘equipment ‘Computer analysts specialists operators operators rioure 23. Organization chart for a large data processing installation (equipment rental more than ‘$25,000 per month) Scarred. with CamScaner isStandard Programming Conventions and Procedures 16 munity have become more knowledgeable in the computer field, eficctive control techniques have gradually begun to evolve. Various quantitative techniques have been used in performance evaluation of data processing activities. By using historical rating techniques, for example, yardsticks have been applied to the per- formances of analysts, programmers, operators and keypunchers. The application of management principles to computer data processing operations typically results in the preparation and use of a systems and procedures manual which describes standard operating procedures. ‘The contents of this manual cover the following topics: 1. Standard programming conventions and procedures 2. Standard operating procedures 3. Control procedures 4. Organization and personnel \\ As with systems and procedures manuals used in other areas, the manual is useful in training, supervision and evaluation of performance. The multitude of differing conventions in pro- gramming, documentation, operating, etc., leads to considerable confusion. The use of a manual setting forth standard pro- cedures and conventions for the particular installation has proved to be an extremely valuable aid to management] The major purpose of this section of a computer installation systems and procedures manual is to establish standard vocab- ulary, standard programming conventions, standard debugging procedures and standard documentation methods. The follow- ing brief summary of possible topics suggests the scope and pur- pose of the section: TOPIC EXPLANATION Flowcharting conventions _These are the forms, symbols and conventions to be used in flowcharting. Generally, itis desirable for these conventions to agree with the standards defined by the United States of America Standards Institute (see Appendix B). Decision table conventions These conventions are used when preparing decision tables. This topic should include standard abbreviations for allowable con entries, Scarred. with CamScaner |TOPIC Coding conventions Standard glossary and standard abbreviations Standard programming techniques: Debugging Documentation EXPLANATION Standard names used by the installation, standard abbreviations and such conventions as the method to use in differentiating letters from look-alike numbers are included in this topic. Abbreviations are especially valuable for flowcharting. A standard list should be prepared and the use of non-standard alternatives should be prohibited. Any word without a standard abbreviation should be spelled out in full. The glossary should specify ‘the meaning of special terms commonly used’ in the installation. Where there is confusion in the industry with respect toa term, the definition to be used by the installation should be included, Within an installation, itis a normal practice to develop standard techniques for performing particular computer operations common to ‘many computer programs. For example, routines to clear storage, to print standard headings, or to calculate square roots may be used in hundreds of different programs. ‘These routines can be inserted in a program as an independent package, thus avoiding the need to rewrite the same set of instructions every time they are required for a new program, ‘These routines should be fully documented and subject to rigid rules in regard to their use within a program. The installation may set tp special macro-instructions which are to be used for common operations such as accessing a record ona disk file. The “macro” is used toavoid the need for each programmer to rewrite the few program steps each time the ‘operation is called for. ‘The procedures to be followed in debugging include specifications for desk checking, program assembly, patching and approval procedures to be followed before a program is released. Desk checking (the process of reviewing the documentation and manually tracing the path of data through the program tose if the logic is sound) is a good practice before program assembly is attempted. Patching conventions specify the method of using and documenting patches (minor changes made directly in machine language and inserted in the machine language program). Since itis difficult for one pro- grammer to understand patches made by another, an installation may specify that after a certain number of patches (say 3) the program must be re-assembled from a corrected symbolic deck. Documentation standards should be specified in full detail to avoid any possible misunder- 7 Scarred. with CamScanerToPIc Program changes Standard Operating Procedures EXPLANATION standing, These standards are discussed in detail in Chapter 3. Every time a program is changed, the revised program should be tested and the revision should be reviewed. The procedures to be followed and the review and test functions to be performed should be clearly described. A change log should be maintained for each program. An entry should be made to record the nature, effective date and supervisory approval of the change. This section of the systems and procedures manual describes practices and procedures to be followed in the running of the processing equipment. The topics include specifications for machine operation, machine performance, scheduling, file re- tention, housekeeping, record keeping and emergency procedures. ToPIC Machine operation Machine performance ‘Scheduling File retention Housekeeping 18 EXPLANATION, ‘Standard operating procedures for all computer and tabulating equipment are used to ensure that uniform techniques are employed. Such standards help to eliminate the poor operating techniques which individuals often develop on their own. ‘Timing standards for all computer and tabulating equipment should be specified. These standards are often based upon the equipment manufacturers’ recommended allowances but modified to fit unusual circumstances or conditions within a particu. lar installation or application. Operating Procedural standards such as tape drive cleaning methods, program loading and other ‘common operations should be outlined as operating instructions for personnel. All computer operations should be scheduled ton the basis of rules approved by management. ‘Schedules should provide time required for reruns, assembly runs, program debugging and preventive maintenance, File control and retention techniques as ‘outlined in Chapter 7 are included here. This topic includes handling of files, use of supplies, storage of programs and procedures tokeep the center neat and avoid loss or destruction of programs or data. Scarred. with CamScanerToPIC EXPLANATION Record keeping ‘This involves procedures for recording utilization of equipment and personnel. Per- sonnel should be required to record time on and time off the equipment for each job. These records should, if possible, be reconciled with elapsed-time clocks on the machine. The information provided by utilization records assists in evaluating personnel and equipment performance. An example of a simple ti and record form is given in Figure 2-4, this. page. Emergency procedures The manual should spel! out plans and pro- cedures for emergencies such as flood, fire, power failure, failure of communications, ete. DAILY LOG SHEET Nompradvctive uve should’ be indicated in te ‘fighchend column. mie DATE. Application | Program TIME Operator's ‘orjob | Number |~on | of |Duration| initials Notes Ly \\ LOG SHEET INSPECTED BY DATE ——— Fioune 24. Daily computer log sheet Scarred. with CamScaner 1920 Control Procedures Organization and Personnel ‘The activities of the control clerk or control group are specified through both the systems and procedures manual and the description of control activities found in the documentation of each computer application. In general, the control function will include the following duties: 1, Logging of input data and recording of control information 2. Recording of progress of work through the department 3. Reconciliation of computer controls with other control in- formation 4. Supervision of distribution of output 5. Scrutiny of console logs and printed control information in accordance with control instructions : 6. Liaison with users regarding errors and logging of correction, requests and recording of corrections made 7. Scrutiny of error listings and maintenance of error log or error report ‘The work of the control section is evidenced by the maintenance of the logs, the signing or initialing of control documents and control reports. ‘The quality of the data processing is usually directly related to the quality of the personnel. Several of the equipment manu- facturers as well as independent organizations have developed standard aptitude tests which can be used to evaluate prospective employees. Some companies ask programming and systems analysis candidates to solve a practice problem or write a short program. This can be a very effective and positive form of evaluation. Personnel practices and methods of evaluation should be formalized and spelled out in detail in the systems and pro- cedures manual. Every employee should know what is expected of him, what his own role is in the overall data processing func- tion and how his performance will be measured. [bse processing operations are generally based on separate jobs or tasks. Personnel should be scheduled in all phases of their work. Programmers and analysts should be assigned to specific jobs, given job budgets and required to render periodic progress reports, Operators should be assigned to specific runs with spe- Scarred. with CamScanercific equipment and required to report reasons for schedule devi- ation or slippage to the shift supervisor. Of course, the pro- cedures will vary depending on the size and structure of the organization but the concept of scheduling is applicable for even a small organization. The scheduling of personnel should in- clude accepted practices such as the rotation of operator duties so that responsibility for running a program is not continuously in the hands of one person and the requirement that personnel take vacations. Scarred. with CamScaner 21