MERCHANDISE HARDWARE CASE

The educational Case that follows is intended to help teach you general concepts about Generalized Audit Software (GAS) and specific technical knowledge on how you can use Microsoft Access to perform GAS procedures. In this Case, you are asked to assume the roles of general ledger accountant, procurement manager, accounts payable manager, and internal auditor working for a midsize, publicly traded retail hardware company named Merchandise Hardware. In these roles, you use GAS procedures that you develop with Microsoft Access (Access) Queries and a Module. You obtain data downloaded from Merchandise Hardware's AIS that supports the company's procurement and accounts payable functions and analyze and audit the data with your GAS routines. Merchandise Hardware does not have ACL, IDEA, or any of the other commercially available GAS products. However, all of the accountants, managers, and auditors working for Merchandise Hardware have full use of a company-issued personal computer installed with Microsoft Windows operating system and Microsoft Office suite that includes Microsoft Access 2010.

You have the following questions regarding Merchandise Hardware's operations during the six-month period beginning January 1, 2016, and lasting through June 30, 2016:

1. Have any payments been made to unauthorized vendors?

2. Have payments for vendor invoices been accurate?

3. For what items and for what amounts has the company paid more than the standard cost established for each merchandise hardware item?

4. Have there been any duplicate payments to vendors?

Asking basic questions, such as the four questions above, is one way to develop the objectives for GAS procedures. One way GAS procedures are used is to provide evidence about whether a system's internal controls are in place and working effectively in accordance with management's control objectives. Another way GAS procedures are used is to provide evidence about whether a system is functioning effectively in helping managers achieve their operating objectives, such as sales, costs, and profit objectives. When used to assess internal controls and processes, GAS procedures often provide evidence that is symptomatic of the nature of existing controls and processes, not the actual nature of the controls and processes themselves. GAS results help you analyze systems and identify missing or ineffective controls and processes. Only after you understand the system weaknesses can you recommend corrective actions to improve internal controls and processes.

In answering the four questions listed above, you assume the following roles:

1. The internal auditor who will seek the answer to question 1;

2. The general ledger accountant who will seek the answer to question 2;

3. The procurement manager who will seek the answer to question 3; and

4. The accounts payable manager who will seek the answer to question 4.

In answering questions 1, 2 and 4, you are concerned with safeguarding the company's assets and ensuring the adequacy of internal controls.

In answering question 3, as the procurement manager you are concerned about the efficiency and cost-effectiveness of operating activities within Merchandise Hardware's Procurement Department. One of your concerns is that buyers may be paying vendors too much for purchased hardware items. You have established a standard unit cost for each inventory item, and you want to develop a GAS procedure that lists all occurrences where buyers have paid more than the standard cost. Also, you want the GAS procedure to compute for each occurrence the difference between the actual amount paid and the standard amount based on the standard unit cost.

You obtain the input data for your GAS routines by exporting data from the Merchandise Inventory's AIS Access database provided that represents the portion of Merchandise Hardware's actual AIS that supports procurement and accounts payable activities. After exporting the data to Excel worksheets, you then import the worksheets into Tables in an Access database that you have created as your GAS Access database named, GAS.

With the input data stored in your GAS Access database, you then create three Access Queries that identify:

1. Payments made to unauthorized vendors;

2. Inaccurate vendor payments; and

3. Hardware items purchased for more than the standard costs allowed by management.

Having learned how to use Access Queries as GAS, you then create an Access Module that identifies suspect duplicate payments made to vendors. In the Assignment that follows the Case, you use the results that you obtained from your GAS routines to guide you in identifying underlying control weaknesses in Merchandise Hardware's AIS. Then, you recommend Information Technology (IT) controls that correct the control weaknesses. Finally, you assume the identities of IT personnel and implement your recommended IT controls.

Access can practically support AIS only for small businesses. For example, more than ten concurrent users may degrade online, real-time response times in AIS supported by Access. Likewise, large-size Tables can negatively impact online response times in Access-supported AIS. However, these limitations do not apply when using Access as GAS. Normally, users execute Access GAS routines offline, and the extra few minutes needed to process large-size Tables with Access GAS routines is normally not an issue. Although not unlimited, Access has ample space for storing data. Specifications provided in Access Help state that the maximum size of an Access database file (Table) is two gigabytes, minus the space needed for system objects. Access has robust capabilities for processing the data in its Tables with Structured Query Language (SQL) used in Queries and Visual Basic for Applications (VBA) used in Modules. Hence, whereas Access can practically support AIS only for small businesses, Access can be used as GAS by virtually any entity.

Downloading Data from Merchandise Hardware AIS for Input to GAS

You should imagine that Merchandise Hardware has one of the commercially available Enterprise Resource Planning (ERP) systems. Commercially available ERP systems include Oracle JD Edwards and SAP Business All-in-One for mid-size enterprises, and Oracle E-Business Suite and SAP Business Suite for large enterprises. When assigning the Case, your instructor will provide an Access database named “Merchandise Hardware AIS.” This database is intended to represent the procurement and accounts payable portion of Merchandise Hardware's ERP system. You begin the Case by exporting data stored in the Tables of the Merchandise Hardware AIS Access database to Excel spreadsheets that you save in a folder on your computer. When you export data from the Merchandise Hardware AIS Access database, you simulate downloading data from an RDBMS other than Access that supports ERP, such as Oracle Database or Microsoft SQL Server. In so doing, you simulate downloading data from the RDBMS of virtually any enterprise's ERP system into Excel spreadsheets.¹

After exporting data from Merchandise Hardware AIS into Excel spreadsheets, you then import the Excel spreadsheets into Tables in a second Access database that that you will use as GAS. This second Access database is referred to in the Case as the “GAS” Access database. By first exporting data from the Tables of an Access RDBMS into Excel spreadsheets and then importing the Excel spreadsheets into an Access database used for GAS, you learn the procedures often used to obtain GAS input.²

Exporting (downloading) data from Merchandise Hardware AIS requires “direct,” “read” access to the data stored in the Tables in the ERP system's RDBMS. “Direct” access means accessing the data in the RDBMS directly without interfacing with the application system. “Read” access means that you will be able to copy the data, but not change, add, or delete the data in the RDBMS. IT management may object to giving non-IT personnel direct, read access to production databases, such as direct access provided by ODBC links mentioned in Footnote 2, and require that IT personnel perform the download operation. Whether you obtain data by ODBC links, IT downloads the data, or other method, determining how you will obtain the input data for your GAS is an important aspect of planning and performing GAS procedures. If IT downloads the data, you will need to obtain temporary authorization from the data owner(s) to access the data. Then you should coordinate with the IT function to determine whether you or IT personnel will perform the download. If IT performs the download, you should observe the download process and obtain system printouts from the download execution to verify that the data downloaded by IT is a complete, unaltered version of the data residing in the audited/analyzed system.

The following screen shows the relational database within Merchandise Hardware AIS that contains the data downloaded and input to the Case's GAS routines:

The Tables and relationships used in the relational database shown above are intended to simulate the portion of the RDBMS that Merchandise Inventory uses in its ERP system to support procurement and accounts payable. Merchandise Hardware creates a separate purchase order for each purchase of a given quantity of an inventory item. For example, if 15 AA items and 18 BB items are purchased, then one purchase order is created to buy 15 AA items, and another purchase order is created to buy 18 BB items. Also, Merchandise Hardware processes a separate payment for each vendor invoice after the inventory has been received. See the Student Case file for step-by-step instructions to prepare the case.