Savers-Surety is a large, Brisbane-based credit union. Twelve months ago it purchased and implemented an automated operations facility (AOF) to control its mainframe operations. Prior to the purchase and implementation of the AOF, operators worked during three eight-hour shifts, seven days a week to support the mainframe. Savers-Surety had experienced several problems with this arrangement, however. First, operators often made costly mistakes in the jobs they performed. For some time, Savers-Surety had been unable to retain its operators, and inevitably critical jobs had to be performed by newly hired, inexperienced operators. Second, to reduce costs, only one operator had been working the graveyard shift (midnight to 8:00 AM). Management suspected that a previously employed operator who worked this shift had been making copies of critical data and selling the data to other financial institutions who were competitors. Third, management believed the mainframe was being used inefficiently because operators took little time to balance workloads on the machine.

You are an information systems auditor with a firm of chartered accountants that has just been appointed to take over the audit of Savers-Surety. During your evaluation of operations management controls, you question the information systems manager about the AOF. She explains that SaversSurety has been delighted with the AOF. The credit union now operates a lights-out facility that the information systems manager believes has enhanced the security of information systems. In addition, the credit union no longer employs operators. As a result, she argues, all the previous problems associated with the operators have gone.

When you ask how the AOF parameters were prepared, she explains that Savers-Surety hired a new programmer who already had experience with the AOF that was purchased. He developed and implemented the parameters. In addition, the programmer had previously been an operator, so he had a good understanding of operations procedures. Indeed, his operations experience was useful because he could provide manual backup support when the AOF failed. On a few occasions he had operated the machine when the credit union had encountered problems with the AOF.

When you ask for documentation on the AOF parameters and the tests carried out on them before they were released into production, the information systems manager explains that you will have to interview the programmer. No one else within the credit union has knowledge of the AOF nor the nature of the parameters used to run the AOF.

Required. On the basis of the information you have collected so far, what are your conclusions about the reliability of controls over computer operations in Savers-Surety? Are there any exposures that concern you from the viewpoint of the opinion your firm must ultimately give on the financial statements? How would you now proceed with the audit?