INTERNAL ACCOUNTING CONTROL DESIGN, EVALUATION AND IMPLEMENTATION IN AUTOMATED OFFICE INFORMATION SYSTEMS

Satisfactory accountability, that is, a control structure which protects corporate assets from theft, misuse, and fraud and ensures that accurate and reliable accounting information is recorded, is an important aspect of Office Information System (OIS) design. The OIS design goals of flexibility, efficiency, and modularity must not preclude the accountability needs of managers, stockholders, and auditors. This dissertation reviews an OIS from an auditing perspective and outlines auditing requirements for an OIS. A new computer-based approach to internal accounting control analysis suitable for OIS design and implementation is presented in partial fulfillment of these requirements. An essential component of this methodology is a formal structure for the modeling and evaluation of internal controls in an accounting OIS. The model depicts the accounting system from an organizational perspective. Organizational units are modeled as information processors that interact via formal communications. The processing capabilities of each organizational unit are defined by operators that manipulate and examine available information. The organizational units operate concurrently and function asynchronously in accordance with information flows. Analytic procedures are defined to aid auditors in evaluating the adequacy of the modeled internal accounting controls. Precondition analysis establishes a condition for entering a given state that permits analysis of the strength of safeguards in the system. Postcondition analysis establishes a condition that is necessarily true when the state is achieved that identifies what to examine in regards to identifying the perpetrator when a control circumvention is suspected. The basic components of this methodology are integrated into a computer-assisted tool called TICOM-II. These components are: (1) a computer-acceptable modeling language called the Internal Control Description Language (ICDL); (2) a precedence-oriented model; (3) analytic procedures; and (4) a query language that controls the analytic procedures and permits auditors to pose questions concerning the model\u27s internal control behavior. Further development and integration of the TICOM-II system and proposed extensions in an OIS environment would virtually result in a continuous audit