Question

While reviewing Fashion Designers payroll computer system you note the following weaknesses in internal control:
i) When the weekly timesheets are received the details are keypunched into a transaction file. An edit report is then generated and the details are agreed back to the timesheets. Once all the timesheets have been input the employees’ master file is then updated by a batch program. There is no output from the batch update program.
ii) A special password and user ID is required to be entered by payroll staff before they can input changes to employee pay rates. This special password and user ID is the same for all of the payroll staff members who input pay rate details.

Describe the potential impact each of the above weaknesses could have and suggest control procedures which would overcome them.

Answer 1

1. There is no output from the batch update program is a weakness in the IT controls of the firm since the codes are created by the IT department of the business and if the application does not work as it was intended to , it shows a deficiency in the IT systems. Not updating time sheets of the employees properly can lead to underpayment or overpayment of salaries and wages and consequently have an impact on the profitability of the company. The company must make the systems and the policies compatible and only incorporate the IT controls when the system is fully developed and there must not any technical glitches. The system has to be robust and serve its intended purpose while providing the right output. In the mean while the business must opt for manual update of attendance if the size and scale of operations permit it to.

2.Having the same special password and user ID is a deficiency is the IT internal controls. Same id's and password  will lead to password sharing activities, guessing of ids and passwords and unauthorized access to the systems since the access codes are same. Also, any employee can change the pay rates in the guise of another payroll personnel and the unauthorized user may never be identified. The user id and password to change employee pay rates must be given to select payroll personnel and the id's and password must be unique.