What are the main computer ethicsissues?

Chapter 5 ▪ Privacy
▪
Ethics, Fraud,and ▪
Security—accuracy andconfidentiality
Ownership of property
▪ Equity in access
Internal Control ▪
▪
Environmental issues
Artificial intelligence
▪ Unemployment and displacement
ETHICALISSUESINBUSINESS ▪ Misuse of computer
Business Ethics
Why should we be concerned about ethics in the FRAUDANDACCOUNTANTS
business world?
Legal Definition of Fraud
▪ Ethics are needed when conflicts arise—the ▪ False representation - false statement or
need to choose disclosure
▪ In business, conflicts may arise between: ▪ Material fact - a factmust be substantial in
o employees inducing someone to act
o management ▪ Intent to deceive must exist
o stakeholders ▪ The misrepresentation must have resultedin
▪ Litigation justifiable reliance upon information, which
caused someone to act
Business ethics involves finding the answers totwo
▪ The misrepresentation must have caused injury
questions:
or loss
▪ How do managers decide on what is rightin
conducting their business? Financial Losses from Fraud
▪ Once managers have recognized what isright, 2008 ACFEStudy of Fraud
how do they achieveit? ▪ Loss due to fraud equal to 7%ofrevenues—

Four Main Areas of Business Ethics Position %of Frauds Loss$

Owner/Executive 23% $834,000

Manager 37% 150,000

Employee 40% 70,000

approximately $994 billion

▪ Loss by position within the company:
▪ Other results: higher losses due to men,
employees acting in collusion, andemployees
with advance degrees

Enron, WorldCom, Adelphia

Underlying Problems
▪ Lack of Auditor Independence: auditing firms
Computer Ethics… also engaged by their clients to perform
nonaccounting activities

Computer ethics concerns the social impact of computer ▪ Lack of Director Independence: directors who
technology (hardware, software, and also serve on the boards of other companies,
telecommunications). have abusiness trading relationship, have a
 financial relationship as stockholders or have ▪ Involves misappropriation of assets, it frequently
received personal loans, or have an operational is shrouded in a maze of complex business
relationship asemployees transactions

▪ Questionable Executive Compensation Schemes: Fraud Schemes

short-term stock options as compensation result Three categories of fraud schemes according to the
in short-term strategies aimed at drivingup Association of Certified FraudExaminers:
stock prices at the expense of the firm’s long- A. fraudulent statements
term health B. corruption
C. asset misappropriation
▪ Inappropriate Accounting Practices: a
characteristic common to manyfinancial A. Fraudulent Statements
statement fraud schemes ▪ Misstating the financial statements to make the
o Enron made elaborate use of special copy appear better than it is
purpose entities. ▪ Usually occurs as management fraud
o WorldCom transferred transmission line ▪ May be tied to focus on short-termfinancial
costs from current expense accounts to measures for success
capital accounts. ▪ May also be related to management bonus
packages being tied to financialstatements
Sarbanes-Oxley Act of 2002
Its principal reforms pertainto: B. Corruption
▪ Examples:
▪ Creation of thePublic Company Accounting
o bribery
Oversight Board (PCAOB)
o illegal gratuities
▪ Auditor independence—more separation o conflicts of interest
between a firm’s attestation andnon-auditing
o economicextortion
activities
▪ Foreign Corrupt Practice Act of 1977:
▪ Corporate governance and responsibility—audit
o indicative of corruption inbusiness
committee members must be independent and
world
the audit committee must oversee the external
o impacted accounting by requiring
auditors
accurate records and internal controls
▪ Disclosure requirements—increase issuer and
management disclosure C.Asset Misappropriation
▪ New federal crimes for the destruction of or ▪ Most common type of fraud and oftenoccurs as
tampering with documents, securities fraud,and employee fraud
actions against whistleblowers ▪ Examples:
o making charges to expense accountsto
The Perpetrators of Frauds cover theft of asset (especiallycash)
Employee Fraud o lapping: using customer’s check from
▪ Committed by non-managementpersonnel one account to cover theftfrom a
▪ Usually consists of: an employee taking cashor different account
other assets for personal gain bycircumventing o transaction fraud: deleting, altering, or
a company’s system of internal controls adding false transactions to stealassets

Management Fraud
▪ Perpetrated at levels of managementabove the
one towhich internal control structure relates
▪ Frequently involves using financial statementsto
create an illusion that an entity is healthier and
more prosperous than it actually is
INTERNALCONTROLCONCEPTSAND The Internal Controls Shield
TECHNIQUES
Internal Control Objectives According to AICPA
SAS
1. Safeguard assets of the firm
2. Ensure accuracy and reliability of accounting
records and information
3. Promote efficiency of thefirm’s operations
4. Measure compliance with management’s
prescribed policies and procedures

Modifying Assumptions to the Internal Control

Objectives
▪ Management Responsibility
The establishment and maintenance of a system of
internal control is the responsibility ofmanagement.
Preventive, Detective, and Corrective Controls
▪ Reasonable Assurance
The cost of achieving the objectives of internal control
should not outweigh itsbenefits.

▪ Methods of DataProcessing
The techniques of achieving the objectives will vary with
different types of technology.

Limitations of Internal Controls

▪ Possibility of honest errors
▪ Circumvention via collusion
▪ Management override
▪ Changing conditions--especially in companies
with high growth SAS78 / COSO
Describes the relationship between the firm’s…
Exposures of Weak Internal Controls (Risk)
• internal control structure,
▪ Destruction of anasset
▪ Theft of anasset • auditor’s assessment of risk,and
▪ Corruption of information • the planning ofaudit procedures
▪ Disruption ofthe information system How do these threeinterrelate?
The weaker the internal control structure, thehigher the
assessed level of risk; the higher the risk, the more
auditor procedures applied in theaudit.

Five Internal Control Components: SAS 78 / COSO

1. Control environment
2. Risk assessment
3. Information and communication
4. Monitoring
5. Control activities
1: The Control Environment 4: Monitoring
▪ Integrity and ethics of management The process for assessing the quality ofinternal control
▪ Organizational structure design and operation
▪ Role of the board of directors and the audit
committee [This is feedback in the general AISmodel.]
▪ Management’s policies and philosophy ▪ Separate procedures—test of controls by
▪ Delegation of responsibility andauthority internal auditors
▪ Performance evaluation measures ▪ Ongoingmonitoring:
▪ External influences—regulatory agencies o computer modules integrated into
▪ Policies and practices managing human routine operations
resources o management reports which highlight
trends and exceptions from normal
2: RiskAssessment performance
▪ Identify, analyze and manage risks relevant to
financial reporting: 5: ControlActivities
o changes in external environment ▪ Policies and procedures to ensure that the
o risky foreign markets appropriate actions are taken in responseto
o significant and rapid growth thatstrain identified risks
internal controls ▪ Fall into two distinctcategories:
o new product lines o IT controls—relate specifically to the
o restructuring, downsizing computer environment
o changes in accounting policies o Physical controls—primarily pertain to
human activities
3: Information and Communication
▪ The AISshould produce high quality information Two Types of ITControls
which: ▪ General controls—pertain to the entitywide
o identifies and records all valid computer environment
transactions o Examples: controls over the datacenter,
o provides timely information in organization databases, systems
appropriate detail to permit proper development, and program
classification and financial reporting maintenance
o accurately measures the financialvalue ▪ Application controls—ensure the integrity of
of transactions specific systems
o accurately records transactions in the o Examples: controls over sales order
time period in which they occurred processing, accounts payable, and
▪ Auditors must obtain sufficient knowledge of the payroll applications
ISto understand:
o the classes of transactions thatare Physical Controls
Six Types of Physical Controls
material
o how these transactions areinitiated ▪ Transaction Authorization
[input] ▪ Segregation of Duties
o the associated accounting recordsand ▪ Supervision
accounts used in processing[input] ▪ Accounting Records
o the transaction processingsteps ▪ Access Control
involved from the initiation of a ▪ Independent Verification
transaction to its inclusion inthe
financial statements [process] Transaction Authorization
▪ used to ensure that employees arecarrying
o the financial reporting process usedto
compile financial statements, out only authorizedtransactions
disclosures, and estimates[output]
 ▪ general (everyday procedures) or specific AccessControl
(non-routine transactions) authorizations ▪ Data consolidation exposes the organization to
computer fraud and excessive losses from
Segregation of Duties disaster.
▪ In manual systems, separation between:
o authorizing and processing a transaction Independent Verification
o custody and recordkeeping of theasset ▪ When tasks are performed by the computer
o subtasks rather than manually, the need for an
▪ In computerized systems, separationbetween: independent check is not necessary.
o program coding ▪ However, the programs themselves arechecked.
o program processing
o program maintenance

Supervision
▪ a compensation for lack of segregation;some
may be built into computersystems

Accounting Records
▪ provide an audit trail

Access Controls
▪ help to safeguard assets by restricting physical
access to them

Independent Verification
▪ reviewing batch totals or reconciling subsidiary
accounts with control accounts

Physical Controls in ITContexts

Transaction Authorization
▪ The rules are often embedded within computer
programs.
o EDI/JIT: automated re-ordering of
inventory without humanintervention

Segregation of Duties
▪ A computer program may perform many tasks
that are deemedincompatible.
▪ Thus the crucial need to separateprogram
development, program operations, andprogram
maintenance.

Supervision
▪ The ability to assess competent employees
becomes more challenging due to thegreater
technical knowledge required.

Accounting Records
▪ ledger accounts and sometimes source
documents are kept magnetically
o no audit trail is readilyapparent