Control Procedures and Audit Procedures for Computer Fraud.

Required:

For each of the following situations involving computer fraud, briefly describe:

A. A control procedure that would have been effective in preventing or detecting the fraud.

B. An audit procedure that would have detected the fraud.

Computer Frauds:

1 A computer programmer added a module to the payroll program that started with an

“IF” statement to identify his employee number. If the payroll calculation applies to his record, the program was instructed to multiply computed pay by 1.5, thus increasing the programmer’s pay by 50 percent.

2 A state health and social services department made support payments to needy residents. A resident could be input into the system only on the recommendation of a supervising caseworker. Some caseworkers entered fictitious residents on the system and had support payments sent to authorized addresses. The caseworkers then cashed the support payments and eventually transferred the cash to their own accounts.

3 A student posed as a newspaper reporter doing a story on a phone company’s data processing center. After leaving the center, the student noticed a data processing manual that had been discarded. He took the manual home and learned the access code to the company’s parts repair system. He could then log on and have repair parts delivered to a specific location. Later he picked up the parts, which he sold back to the company and to other customers.

4 A manufacturing company required all its hourly workers to sign in by passing their personal identification cards across an automated time clock that captured and transmitted data to the computer for subsequent processing. An employee who worked the first shift arranged with her brother who worked the second shift to use her card to sign out when her brother completed his work shift. The employee thus generated pay for 16 hours per day, one-half at overtime rates. The employee and her brother split the additional pay.

5 A disgruntled programmer often came to the office in the evenings to copy confidential client data such as customer lists, discounts, and so forth onto magnetic tapes, which he sold to competitors.

[Adapted from Rittenberg and Schweiger (1997) Auditing Concepts for a Changing Environment, 2nd edn, Dryden Press, Fort Worth, Texas.]