Use of Software and Collaboration Tools to Integrate AIS and MIS Curricula
This paper discusses the collaboration our university has developed between the AIS and MIS programs. We include learning objectives for the overall learning objectives of our integrated program, suggestions for collaboration, and the courses addressing the identified objectives. The authors have found that using software tools can improve collaboration across departments can add to the learning experience in both the accounting and MIS programs. AIS instructors can use software tools to demonstrate how control requirements are implemented within information systems. MIS instructors can use software tools to provide explanations and examples of program structures and data structures used in information systems. Instructors with training in ERP systems can use software tools to add valuable perspective in discussions of scalability, multiple currencies, conversion of measuring units, and automation of business processes. Tools which are used to support instruction can also be used to enable collaboration between faculty members. When group projects are used to teach information system development, additional collaboration tools can be included to give students experience in working within a workgroup environment. The authors discuss their experience in the use of software packages and collaboration tools to better prepare our students to succeed in the challenging business environment of audit and IT professionals.ABSTRACT
INTRODUCTION
Coordination across the curriculum between accounting information systems (AIS), management information systems (MIS), and other specialties such as IT/IS audit and security provide the best of all worlds for future systems professionals. Our university has begun a process to better coordinate our efforts to map our course topics to the ISACA Model Curriculum, the Association for Information Systems Model Curriculum for Graduate Degree Programs in Information Systems, and AICPA Core Competencies to better prepare our graduates. While this process started informally at our university with some accounting and MIS professors discussing ways to better utilize our resources across the curricula, the process has evolved to include an MIS “track” in our accounting program to provide an opportunity for our students to develop both accounting and system design skills. Our accounting advisory board has also provided suggestions as to skill sets of their recent hires. Both the MIS track and the suggestions of our accounting advisory board have resulted in adjustments and improvements to our curriculum.
In this treatise, we discuss our experience in hopes of providing guidance to other universities wanting to develop an environment of collaboration across the accounting and MIS curricula. We suggest that collaboration between these programs give our students the best possible combination of skills to get them started on their career path after graduation in IT auditing, IT security, or other IT-related careers. While our program is still evolving, the benefits of making the best use of teaching and technology resources available helps reinforce concepts relating to risk assessment, controls, and system design/development; we hope other universities wishing to give their students a more comprehensive skill set compatible with our technology-dependent economy will find our experience useful.
We begin by providing the overall learning objectives of our collaboration, followed by how we use various software packages in the collaborative classes to illustrate various control concepts. We then describe five control examples to illustrate these concepts in several classes to reinforce and illustrate their importance to business processes. We provide examples of integrated courses, topic schedules, assignments, and mapping of course learning objectives to formalized curricula (e.g., CPA Core Competencies), as well as suggestions for future collaboration.
Overall Learning Objectives for Teaching Control Concepts
To improve the skill sets of our students, we use several software packages to meet the following learning objectives:
-
To familiarize students with the importance of integrated processes in automated information systems
-
To familiarize students with the need for system controls to improve security and data integrity in information systems
-
Analyze the unique risks of information technology and related data
-
Provide an understanding and application of system analysis and design processes
-
Recognize, model and use processes to achieve reporting and compliance objectives
These learning objectives are addressed in our accounting program (MIS track) and our MS-MIS program in several courses:
-
Accounting Information Systems (offered at both the graduate and undergraduate levels in the accounting department)
-
Introduction to ERP Systems (offered at the graduate level in the MIS department)
-
Systems Analysis and Design (offered at the graduate level in the MIS department)
-
IT Audit and Security (offered at the graduate level in the accounting department)
While our accounting degree programs have offered the MIS track for several years, coordination between instructors in the accounting and MIS departments has been relatively informal. The authors, who represent both departments, are working to formalize this coordination to impart the skill sets needed for students to pursue careers in IT and accounting. To demonstrate the applicability of this coordination to other universities, we present what we have done up to this point to map our learning objectives in the above-listed courses to the ISACA Model Curriculum, the Association for Information Systems Model Curriculum, and the AICPA Core Competencies. We include the learning objectives for each of the courses, and provide suggestions on implementation of an across-curriculum program to make efficient use of resources to provide our students with the skills they need to succeed after graduation.
We begin with a general discussion of how and why it is important to introduce students to various software packages, along with how we chose the packages in use at our university. We then discuss how we map our learning objectives to the ISACA Model Curriculum, Association for Information Systems Model Curriculum, and the AICPA Core Competencies for the four classes listed above.
Automated accounting systems have been used for decades in the teaching of accounting systems and business processes. As technology has advanced, the tools used to build these systems have become more complex and the tools used to protect the integrity of these systems have become more sophisticated. At the same time, advances in software technology have made these systems easier to use. While it is easier to demonstrate what accounting systems can do, it is harder to explain how they do it. For most accounting courses, this is not a problem. For higher-level MIS and AIS courses, however, the “black box” explanation is often not good enough.
Off-the-shelf packages such as Sage 501 (a mid-level accounting system) and SAP-ERP (a popular system in the oil and gas and manufacturing industries) provide the framework of an accounting system, with modules for typical business processes such as purchasing, revenue, human resources, inventory, and financial accounting. We chose these two software packages because of their use in the oil and gas industry, both by up-and down-stream suppliers and by the major oil companies in our area. Users of these systems have the ability to do some customization of their chart of accounts and internal controls, with limited customization in reporting. These systems allow instructors to illustrate how an integrated accounting system is set up and show how information flows between the modules.
To teach our students how to utilize software for data analytics, we make use of the IDEA software and SAP Business Analytics software to illustrate how large quantities of data can be evaluated for trends and anomalies, and can be used to detect fraud. IT auditors must possess analytical skills and be able to communicate their findings in a diplomatic way to management so that issues are resolved effectively. The IDEA software provides excellent graphics for reporting, and is a tool for teaching students how to evaluate their findings and follow up on them.
Open source systems allow instructors to dig into the mechanics of an information system to demonstrate to students how such systems are built from the ground up. Management Information Systems students need to know how systems work and also need to know how various “front-end” application systems interact with the “back-end” systems which manage most of the data. When the back-end involves the accounting system, explaining the interactions becomes difficult if you cannot directly access the data sources and the processes used within the system.
The skill sets needed to teach accounting systems are different from the skill sets needed to teach information system technology. Use of collaboration tools allows faculty members from AIS and MIS departments to interact effectively to provide resources and monitor progress of projects and assignments. Blackboard and other course management tools include features which are designed to allow students to collaborate on projects. These same tools can be used to allow instructors to collaborate in providing instructional support. When a project requires features which are not available within the course management tools like Blackboard or when instructors want to give students experience in working with tools used outside of universities, advanced collaboration tools can be used. These tools allow instructors from different departments to collaborate while providing practical experience for students. Microsoft Sharepoint is a tool that is widely used in business environments for collaboration and system development.
In the business world, IT professionals and auditors need to be able to understand how systems work to effectively monitor and evaluate the reliability of the output (specifically financial information used in decision-making). In this paper, the authors illustrate an integrated approach to demonstrate how systems work for both accounting and MIS students. This approach helps to bridge the communications gap often found in business between IT and accounting personnel.
LEARNING OBJECTIVES FOR OUR INTEGRATED COURSES
Below we list the course learning objectives for the four courses included in our integrated program:
Accounting Information Systems (AIS):
This course is taught in the accounting department and incorporates some of the AICPA Core Competencies as well as some of the topics itemized in the ISACA Model Curriculum. AIS is required for all accounting majors.
Learning objectives are:
-
Discuss the conceptual aspects of accounting systems and apply them to decision-making processes
-
Understand business processes (revenue, purchasing, inventory, financial)
-
Practice decision-making skills in a small group setting.
-
Create flowcharts to depict/evaluate accounting systems (MS Visio).
-
Work with advanced spreadsheet functions (MS Excel).
-
Set up an accounting system application in a database management system (MS Access).
-
Employ accounting systems software to assess controls and to create a business accounting system (Sage 50).
-
Perform a fraud detection exercise using generalized auditing software (IDEA).
Introduction to ERP Systems:
This course corresponds to MSIS 2006.2 in the Association for Information Systems Model Curriculum. It is taught in the MIS department and is an elective for accounting majors (MIS track), and for MIS majors.
Learning objectives are:
-
To acquaint the student with the role of integrated processes within business enterprises.
-
To present the fundamental concepts and technology used to build and support ERP systems.
-
To give students “hands on” opportunities to use current ERP system technologies.
-
To prepare the students for future courses and future careers using integrated processes and automated information systems.
Systems Analysis and Design:
This course is the “capstone” course for MIS majors and is one of the courses that accounting majors (MIS track) can choose to take as a cross-listed, elective accounting course. The course combines characteristics of MSIS 2006.2 and MSIS 2006.7 from the Association for Information Systems Model Curriculum.
Learning objectives are:
-
To acquaint students with current methods used in systems development
-
To acquaint students with the tools and techniques for the planning, analysis, design, development, evaluation, and implementation of information systems.
-
To teach students the importance of information security and demonstrate tools and techniques used to strengthen information system security.
-
To prepare students for future system careers in planning, analyzing, designing, developing, evaluating, and implementing systems.
-
To introduce team working skills used in developing information system projects
-
To prepare the students for future courses and future careers by requiring the use of online collaboration tools in team and workgroup projects
IT Audit and Security:
This course is taught in the accounting department and is cross-listed as an MIS course. It is one of the courses accounting majors (MIS track) can take to fulfill their track requirements. The course learning objectives and topic coverage are built on the ISACA Model Curriculum (3rd Edition)
Learning objectives are:
-
Apply the core concepts of information systems auditing
-
Recognize legislation, rules and regulations related to information systems auditing.
-
Analyze the unique risks of information technology and related data.
-
Cover other topics recommended by the ISACA model curriculum.
-
Practice decision-making skills in a small group setting (short in-class cases).
-
Acquire experience with auditing software to detect fraud (IDEA) and test application controls in accounting software (Sage 50)
-
Develop written communication skills by writing audit reports for the computer assignments; written communications are specifically evaluated in the written audit reports
The topics covered in this course are based on the Information Systems, Control and Audit Association's (ISACA) model curriculum. This class can help the student to prepare to sit for the Certified Information Systems Auditor (CISA) exam. The emphasis on written communication skills fulfills 1 semester hour of writing, required by the Texas Society of CPAs to qualify to sit for the CPA exam.
Table 1, shown below, summarizes the information systems courses offered at the graduate level in MIS and AIS program areas.
As the reader can see, we employ a number of different software packages in our classes. To summarize how we map our learning objectives into the ISACA Model Curriculum and/or the AICPA Competencies, we present Table 2.
BACKGROUND
At our university, the Sage 50 academic accounting package is used in Accounting Information Systems (AIS) classes, taught in the accounting department. The IT Audit course is taught in the accounting department and makes use of both the Sage 50 software and the IDEA data analysis software. SAP Business Suite and SAP Business ByDesign are used in ERP classes. An open source system called HAWK System is used in teaching System Analysis and Design. Both the ERP and Systems Analysis and Design course are taught in the MIS department. Our university cross-lists these courses so that they apply for various degree plans, such as the MS Accounting Information Systems Track, and the MS MIS programs. The AIS course, the ERP course and the Systems Analysis and Design course are taught at both the undergraduate and graduate levels.
Use of an Accounting Software Package in the Classroom
In the AIS course, several software packages are included in the curriculum. This has both advantages (e.g., exposure to several software packages with different missions such as flowcharting or spreadsheets) and disadvantages (e.g., the students do not have an opportunity to learn advanced functions of those software packages). For purposes of illustrating how an accounting system works, an accounting software package is used to allow students to gain an understanding of how business processes must be integrated in order to provide reliable financial information. Although we use Sage 50, there are other possibilities, such as QuickBooks or Microsoft Dynamics, which are available in educational versions for use in the classroom.
Why We Use Sage 50 in the AIS course
Although many small businesses in our area use Sage 50, our program uses Sage 50 in all of the AIS courses for a number of reasons:
-
The educational version provides sample companies and has all controls turned off so that students can perform all functions (e.g., setting up vendors)
-
The learning curve for Sage 50 is not as steep as some other accounting software packages, and the graphical interface is fairly intuitive
-
There are several excellent teaching resources available that include explanations of how to set up companies, process transactions, and generate reports. These resources also include projects setting up different types of businesses (e.g., Carol Yacht's Sage 50 Complete Accounting 2013, Aren, Ward, and Henry's Computerized Accounting Using Sage Peachtree Complete Accounting 2012, or Glen Owen's Using Peachtree Complete 2012 for Accounting). Our university uses a custom book built from Carol Yacht's Sage 50 Complete Accounting 2014 (McGraw-Hill), which includes the educational version of the software and chapters relevant to the assignments (cost: approximately $40 for a printed version of the book with software, $35 for an e-book without the software).
-
The simple businesses set up in the projects provide students with the opportunity to “build” a system from the ground up and understand the integration of the business processes to produce financial information reports
How We Use Sage 50 in the AIS course
In the accounting program, all accounting students must take either the undergraduate or graduate AIS course as part of their degree plan (BS, BS/MS, or MS plans). As part of the course curriculum, the students complete two assignments in Sage 50. The first assignment is to set up either a simple retail merchandising business (e.g., a bicycle shop) or a non-profit club (e.g., a computing club). This assignment requires that the students do the following:
-
Set up a chart of accounts based on a sample company in the same industry, customizing it to fit the needs of the assigned company
-
Set up beginning balances for the balance sheet accounts
-
Set up vendor, inventory, customer, and employee master files
-
Post the transactions for one month (e.g., payroll, accounts receivables, accounts payables, etc.)
-
Generate financial statements (i.e., balance sheet, income statement, statement of cash flows)
-
Reconcile the cash account balance with the bank statement
If desired, the instructor can also have the students generate the following reports/files:
-
General ledger master file
-
Customer and vendor master files
-
Inventory valuation reports
-
Sales, purchases, cash disbursements, and/or cash receipts transaction files
-
Payroll and/cost of goods sold transaction files
Once the students have built a simple accounting system and generated the financial reports, they are required to test the application controls in Sage 50. The application control assignment (used in both the AIS and the IT Audit courses with variations so they are not exactly the same assignment), has the students evaluate the application controls within Sage 50 and write a report on their findings (adapted from Lehmann et al 2007). In the AIS course, the students use the company system built in the first Sage 50 assignment to test the controls (or lack thereof) for various transactions. The IT audit students are instructed to use a sample company provided in the Sage 50 educational package (e.g., Bellwether Garden Supply). The students test various transactions of their choosing and discuss the risk exposure implications if there are no controls in place. The application assignments used in AIS and in IT audit are included in Appendices A1 and A2 (teaching notes available from the authors); the rubrics for the assignments can be found requested from the authors.
As another example of control reviews, the students in the AIS class are also required to complete a simple assignment written by one of the authors as an introduction to fraud detection/review of process controls in the travel expense area using the IDEA data analytic software.2
How We Use Sage 50 in the IT Audit Course
In the IT audit course, we use two software packages: Sage 50 and IDEA. The students perform an application controls assessment using the Sage 50 software as follows: the students choose a business process and test transactions to see if the application controls are working. They test these transactions in a sample company in the Sage 50 educational version (e.g., Bellwether Garden Supply). Based on their control weakness findings, they prepare a final report discussing the risk exposure implications to management (refer to assignment in Appendix A2).
As far as cost for the software used in this course, the IDEA educational version of the software with workbook costs the students approximately $40, and we use the same Sage 50 custom book and software that is used in the AIS course. Both Sage 50 and IDEA are loaded on the network at the university so that students do not have to purchase the software unless they wish to work on their assignments off campus.
Use of ERP Software in the Classroom
The MS-MIS curriculum at our university is consistent with the MS-IS curriculum recommended by the Association of Information systems (AIS) as described by Gorgone and Gray (2006). The curriculum contains one ERP Systems course, which corresponds to the ERP Systems course (MS-IS 2006.2) in the MS-IS curriculum. The objectives of this course are:
-
To present the fundamental concepts and technology used to build and support ERP systems.
-
To acquaint the student with role of integrated processes within business enterprises.
-
To give students “hands on” opportunities to use current ERP system technologies.
-
To prepare the students for future courses and future careers using integrated enterprise systems.
Two different SAP software products are used in the ERP Systems course at our university. SAP Business Suite (Magal and Word, 2013), the traditional SAP-ERP product which has been used for decades by large corporations, is used in the ERP Systems course and in the Software Applications in Auditing course. SAP Business ByDesign (SAP-UCC, 2012) is used in the ERP Systems course and the introduction to Management Information Systems course. Although SAP Business ByDesign has been extremely useful and will continue to be used in the MIS curriculum, the authors do not recommend its adoption by any school which is not already using it.3
It should be noted that SAP Business Suite and SAP Business ByDesign are only available for classroom use to members of the SAP University Alliance (http://scn.sap.com/community/uac). These packages are hosted at SAP University Competence Centers (UCCs). SAP-UA members must pay an annual hosting fee of $8,000 for the use of SAP Business Suite and $4,500 for the use of SAP Business ByDesign. This hosting fee entitles SAP-UA member schools access to all developed curricula and all training materials provided by SAP. Faculty or IT staff at SAP-UA member schools can install user interface modules, which facilitate inter-action with the hosted software packages.
Within the ERP Systems course, both the traditional SAP-ERP product and the new Business ByDesign product are used to demonstrate how integrated processes are handled within an enterprise management environment. The specific processes demonstrated within the Introduction to ERP Systems course are: personnel administration, marketing, sales, customer relationship management, purchasing, materials management, product management, project management, managerial accounting, financial accounting and business analytics.
Within the Introduction to ERP Systems course, the Global Bikes 2.0 case is used as the business environment for the traditional SAP-ERP software and a modified version of the SAP University Alliance basic curriculum is used to support the teaching activities. The syllabus for the Introduction to ERP course, containing references to the SAP-UA curricula is provided in Appendix D1.
The pedagogical method used is to introduce general concepts first. This introduction includes a slide presentation which combines definitions and concepts with a few screen shots showing how a particular process is handled in the software packages. This presentation is followed by demonstrations of the business processes being handled. After the demonstrations, students complete a three-part assignment.
In the first part of the assignment, students are required to describe (“in their own words”) the basic business process using the definitions and concepts presented in the introductory material. In the second part of the assignment, students are required to demonstrate how a particular example of the process works using Business ByDesign and the Almika case. In the third part of the assignment, students are required to demonstrate how a particular example of the process works using traditional SAP-ERP and the Global Bikes case. An example of an assignment in the ERP Systems course is included in Appendix D. This pedagogical process is repeated during 14 sessions within the semester, with a different topic or sub-process covered in each session (refer to Appendix C1 for the topic coverage).
Small universities with limited budgets and limited faculty resources might have to limit exposure offered in ERP systems to a single course while universities with larger budgets and greater faculty resources might be able to afford several courses and a variety of experiences using ERP tools. After learning how ERP systems work from a user's point of view, additional course work would provide experience in configuring ERP applications and using additional system features to implement system controls. The SAP-UA provides curricula (SAP-UCC 2012) designed to support the teaching of controls in ERP systems (refer to Appendix C1 for diagram). The Classic Rockers case (Daigle et al 2011) is very well suited to teaching students how applications are configured and how controls are implemented within ERP systems.
Use of Open Source Software in the Classroom
While proprietary software such as Sage 50 and the two versions of SAP systems serve important functions in many classes, such software is of limited use in teaching Systems Analysis and Design (SAD). The structure of the software and the structure of the underlying data are hidden from the user in almost every proprietary accounting software package. SAP allows trained faculty members to configure SAP-ERP client installations to modify the content of master data tables and make these tables available to students, but the basic structure of the underlying database cannot be changed. This is understandable from a security perspective, but severely limiting from a pedagogical perspective. Students must learn to evaluate different structural alternatives for system design and different alternatives for the data structure, which supports the system design. Because students cannot experiment with the basic data structure used in proprietary accounting software packages, open source systems are attractive alternative.
The primary software package used in the SAD class is an open source system called HAWK. The HAWK system is used to demonstrate the principles of system design and system development and to provide a platform that can be used to develop specific information system applications. In addition to the HAWK system, examples are presented to the class using existing software packages (Sage 50, SAP Business ByDesign and SAP-ERP). Each semester, a different case is presented to the students taking this course. The case describes different applications that do not work well within a particular company. The SAD class members are put on teams to solve the problems represented within the case. Each team has a particular application to develop within the overall system. Because each team must work on different parts of the same overall problem and work within a common environment and infrastructure, communication and collaboration are essential. Equally essential is the understanding of the common system design structure and the data structure which supports the system design. In an open source system, this information can be demonstrated and made available to application teams to work with and even modify (at their own peril). Appendix E1 shows the semester project requirements. Appendix E2 shows an example of an assignment in SAD requiring an analysis of controls.
Having an open source system allows the instructor to replace certain parts of the system with non-working components while maintaining the integrity of the rest of the system. The instructor can vary the content of the underlying case and the selective replacement of specific application components and infrastructure components each semester. Replacement of components is not allowed within most proprietary software systems.
The authors have found that using an open source system to develop a project in the capstone MIS class is viewed by students as an effective method of learning. Not as many accounting students take the course—however, anecdotal comments indicate that accounting students are extremely apprehensive about the course, but become more enthusiastic as the course proceeds. They realize that they have excellent access to technically advanced student team members; they also are surprised at how well their accounting and business knowledge is appreciated by their technically proficient teammates. We suggest that accounting students can benefit from the Systems Analysis and Design (SAD) course, and should be encouraged to enroll. While the AIS course introduces relational database design and illustrates the normalization process (using Microsoft Access), the SAD course takes these concepts a step further by allowing students to use “semi-real” data to design and build a database from scratch.
DEMONSTRATING CONTROL ISSUES WITH SAGE 50 (PEACHTREE), SAP, and OPEN SOURCE SYSTEMS
Addressing Essential Controls in Systems
As a result of the Sarbanes-Oxley Act of 2002 (SOX), auditors are required to evaluate entity-level controls for their clients. Entity-level controls are controls that permeate the entire organization (as opposed to being relevant to a specific business process), eventually affecting the information in financial reports. These controls are referred to as “ICFRs” or “internal controls over financial reporting” and encompass an enormous amount of management and audit resources. While there are many controls that an organization should have in place to maintain good ICFRs, we focus on just five of those essential controls. Specifically, we will illustrate how these controls apply to the purchasing or procurement process, as this process is the one that varies least between different types of organizations (Heagy et al, 2013). The five that we have chosen to discuss are:
-
User authentication and enforcement of user permissions,
-
Segregation of duties,
-
Validation of input data
-
Maintenance of master files,
-
Transaction sequencing and processing controls
Note that these controls should be found in all business processes of an organization, but we will focus on their application in a generic purchasing process.
1. User Authentication and Enforcement of User Permissions
Enforcement of user permissions is critical to establishing system integrity. User permissions are used to determine which users can access various system resources. User authentication/enforcement of user rights in the purchasing process would include controls such as allowing only those with authorization authority to prepare or approve purchase orders. Preparing a purchase order would require a user log in and password at a minimum to authenticate the preparer.
User authentication and enforcement of user permissions in Sage 50 Accounting
The educational version of Sage 50 purposely has all controls turned off to allow students to get a “feel” for how the software works. By default, students are allowed to do everything in the software. Sage 50's user security can be set up in the Navigation Center. This feature allows an administrator (once an administrator is set up) to establish the type of access allowed for each user that is set up to use the system. For example, the administrator can limit the access of a purchasing agent by setting up a user ID and password (which must be used every time that individual logs on to Sage 50). Access can be “full”, “no”, or the administrator can specify the subareas (e.g., maintenance, recording transactions, or reporting) to which the user has access.
User authentication and enforcement of user permissions in SAP Business Software
When SAP Business Suite is provided through the SAP University Alliance Program, separate user IDs and passwords are provided for each student who will be using the software. Unless extraordinary measures are taken by the faculty member teaching the course, the same set of permissions is recorded for each of the users. Each user is provided with his or her own set of data to use within the client framework supplied and supported by SAP University Alliance. It is possible to provide customized permissions for different students, but this degree of specialization is usually reserved for advanced courses.
User authentication and enforcement of user permissions in Open Source software
Open Source software can be configured in whatever manner fits the needs of the instructor. A common way is to create position-sensitive user identifications and passwords, and allow students to log in under different user identities for different situations. This allows students who are working in one application area to be isolated from students who are working on other application areas. It also allows students to see that permissions can be implemented by application area as well as authority level.
2. Segregation of duties
Segregation of duties would include separating the authorization (e.g., authorizing a purchase requisition), recording (e.g. the preparation of a purchase order), and the custody of the related asset (e.g., receipt of purchased items from a vendor). In addition, the handling of the payment of invoices should be separated from the other purchasing functions.
Segregation of Duties in Sage 50 Accounting
Sage 50 permits access specifications that allow/require different individuals (previously added as users by the administrator) to “touch” different areas of a process. For example, the administrator can set up limited access in the customer area so that different individuals will record vendor transactions and write disbursement checks. The audit trail function in the software allows a supervisor or auditor to track the historical record of financial data to show, for example, that User 1 added a new vendor record, and User 2 modified that record. The audit trail feature allows a supervisor to analyze activity related to records and transactions (e.g., adding vendors or employees), miscellaneous actions (e.g., reconciling accounts) and system functions (e.g., closing the fiscal year).
In order for segregation of duties to be enforced in the educational environment, an administrator and the users must be set up by the instructor. At our university, we generally give the students total access to the software to illustrate how vulnerable a system is without controls in place to protect master files and monitor/validate payments and receipts. This means that anyone can add a vendor to the master file, make a purchase, and issue a check to any vendor without being stopped by the system.
Segregation of Duties in SAP Business Software
When instructors use SAP Business Suite in a hosted environment (through SAP University Alliance), a number of user IDs and passwords are provided to the instructor. In the basic “Global Bikes” client platform, each user ID is connected to its own set of data tables. The initial roles and permissions allocated to each user ID are identical by default. In this platform, it is difficult for instructors to change the permissions assigned to user groups and to change permissions associated with each individual user ID. For this reason, the normal Global Bikes platform provided to instructors by SAP University Alliance for the traditional SAP Business Suite is well suited to an introductory course and not as well suited to teaching segregation of duties.
Certain client platforms have been developed to overcome this limitation. The Fly-a-Kite platform was designed to provide more flexibility in establishing and enforcing accounting controls. Additional enhancements in accounting controls were added when the Fly-a-Kite platform was upgraded and evolved into the Classic Rockers platform. Information about the Classic Rockers platform can be found on the SAP University Alliance Educational materials portal (Daigle, Quarles, and Fawzi, 2011).
Segregation of Duties in Open Source software
Open Source software can be configured to create position-sensitive user identifications and passwords. Using this type of implementation, students are able to log in under different user identities for different situations. This allows students to see that permissions which are available in one application area may not allow the user to access resources in a different application area. Students also see that permissions which are available at a particular authority level are different from permissions which are available at higher or lower authority levels within the same application area.
3) Validation of input data
The validation of input data would include controls such as only allowing purchases from a qualified vendor (that is set up in the master file) or making sure order amounts and part numbers are valid.
Validation of Input Data in Sage 50 Accounting
The educational version of Sage 50 allows the user to input nonsense data such as a payroll check for 600 hours, since the controls are turned off. Even with the controls turned off, however, the software might prompt the user to double-check their input. For example, if a user tries to make a purchase from a vendor not on the vendor master file, they will receive a message stating that the vendor has not yet been set up. There is an option on the error screen to add that vendor to the master file, and by clicking on that option, the user is sent to the vendor set up function. As another example related to sales of inventory, a user entering a sale of items that exceeds the items available will be allowed to post the sale that unless a control is put in place to stop the transaction (or generate a report of the error).
Validation of Input Data in SAP Business software
SAP Business Suite and SAP business ByDesign are proprietary business software products. These products must meet very strict standards of data integrity. Part of the process of providing data integrity is to provide validation of all input data entered by users of these systems. Instructors can assign students the task of testing these systems by trying to enter invalid data. In an introductory ERP systems course, the instructor can point out that these systems will reject invalid data. In advanced courses, well-trained instructors might be able to disclose the particular mechanisms used to screen the data.
Validation of Input Data in Open Source software
The amount of data validation to be included in open source software is entirely up to the person who implements the software. Since data validation is an important topic in MIS classes as well as AIS classes, students should be exposed to form level validation as well as design level validation. For forms level validation, specific validation tools should be applied to data entry objects such as TextBoxes and ListBoxes. This, however, only covers part of the problem. Data enters a system when files are read and when databases are queried. To assure that invalid data does not enter through these events, additional validation procedures should be applied. MIS programming courses emphasize Object-Oriented Design and Object-Oriented Programming techniques. When an object is constructed, Properties are used to handle input and output of each member of the object. The Properties are defined for the class from which the object is instantiated. For a member named _cost, the Property might look like this:
The values for _minimum_Allowed and _maximum_Allowed would have to be defined as configuration parameters for the program. Open source systems allow unlimited flexibility in defining and applying object property validation as a screening tool. The use of such tools provides excellent opportunities to teach students the importance of data validation.
4) Maintenance of master files,
Vendor master file maintenance should be tightly controlled, so that any additions or deletions of records, for example, result in a review because a report has been generated and received by someone other than the person making the change.
Maintenance of Master Files in Sage 50 Accounting
As with other functions in the educational version of Sage 50, file maintenance (i.e., adding/deleting records) in master files can be done by any user of the software. If proper access controls are set up by the administrator, this will limit who can do file maintenance on master files. For example, the individual who adds new vendors to the vendor master file could be prohibited from posting purchase transactions by the access rights set up by the administrator.
Maintenance of Master Files in SAP Accounting software
Master files are essential in maintaining the integrity of an accounting system. Master files are created when a new company is defined. Data is entered through a tightly controlled configuration process or uploaded from a “trusted” source. When an instructor obtains a client such as Global Bikes from SAP University master files have already been created. Changes to those files can only be accomplished by using features provided by the hosting center. Students can view the contents of these files as part of various pre-defined processes. Making changes to these files requires special permissions and procedures. When these permissions are granted subject to restrictions mentioned under segregation duties students can add records to master files and change characteristics of customers and vendors by modifying fields within the master records. A good example of this can be introduced at the beginning of the course where students are “hired” by Global Bikes and Almika and must enter personal information for contact and payment purposes.
Maintenance of Master Files in Open Source software
In open source software, the persons who implement the system create master files. The specific mechanisms used to create and maintain master files can be provided to students or hidden from students at the discretion of the implementers. While it might be very instructive to allow students to directly access master files, it is also quite dangerous to do so. Course instructors and system implementers must decide whether the learning obtained from direct access is justified by the risk of system corruption. Most students access master files indirectly by calling external data access procedures such as GetList() and GetTable(). A few highly qualified students may be given permission to directly access master files and provide data access procedures for application teams. The instructors and implementers make these decisions.
5) Transaction sequencing and processing controls
Examples of transaction sequencing and processing controls include automatic sequential numbering of purchase orders entered into the purchase order open file, and batch controls to make sure that all purchasing transactions entered into the system are either processed or end up on an exception listing (i.e., no transactions are dropped or processed twice).
Transaction sequencing and processing controls in Sage 50 Accounting
In the educational (and professional) versions of Sage 50, the sequencing of transactions is done automatically (e.g., check numbers are issued sequentially). However, without controls an individual can set the starting sequence number anywhere and in some cases, can issue a purchase order number more than once.
Transaction sequencing and processing controls in SAP Accounting systems
Sequencing of documents such as purchase orders and invoices enables auditors to perform missing documents checks easily. All commercial accounting systems have some provisions for document control which identifies missing documents. In SAP Business, documents numbers are assigned sequentially in protected automatic processes to avoid possible manipulation and corruption. The automatic sequencing prevents duplicate document numbers and also prevents gaps in the numbering system which would provide opportunities to create counterfeit documents. SAP Business Suite provides “document flow” capability which allows users to see the relationships between documents created within automated procedures. Figure 1 below shows a simple document flow from a purchasing process in SAP Business Suite.
Citation: AIS Educator Journal 10, 1; 10.3194/1935-8156-10.1.43
It is possible to use SAP systems to demonstrate the consequences of automatic sequential assignment. It is usually unnecessary to explain how this sequencing is accomplished. Similarly, it is instructive to show that fields which show account balances cannot be edited, and not necessary to show how this is accomplished.
Transaction sequencing and processing controls in Open Source systems
In open source systems, it is important to maintain proper sequencing of documents from a practical as well as a control point of view. Duplicate document numbers create confusion and corruptive errors in any system. While it is usually not necessary to show how duplicate numbers are avoided in a commercial accounting system, it might be useful to show members of a system design class how to accomplish this important feature. A simple function called Last_Number_Assigned can be connected to any file which requires automatic sequencing.
When documents are created, this function is called automatically by the module creating the document. When a document is created from another document (delivery document created from a purchase order document) relevant information from the source document is automatically copied from the source document to the document being created. This means that vendor numbers, product codes, unit costs and other information used to create the purchase order is used by default in the internal version of the delivery document. As this information is compared to the vendor's (external) copy of the delivery document and to the inspection report for materials actually delivered, discrepancies can be documented and corrected. For account value protection, setting the ReadOnly property to ‘true’ for any field or object that displays account balances is a simple way to provide this important feature.
Refer to Table 3, which provides a summary of the control issues we discussed and how instructors can use software to address the control issue.4
CONCLUSIONS AND SUGGESTIONS FOR CONTINUING COLLABORATION IN THE FUTURE
Different courses have different learning objectives and these objectives often dictate the type of software chosen for the course. Although different software systems have specific characteristics that make them attractive to particular types of courses, instructor discretion determines which software packages are most effective for their program. We include our software selections to illustrate a method for integrating AIS and MIS. We describe how our university has worked to integrate our accounting and MIS programs more effectively by encouraging instructors to work together to teach our students the skills they need to be successful in their chosen careers. Our university is relatively small, so we strive to give our graduates any advantages we can so they can compete effectively in a job market that recruits IT professionals and auditors from larger universities.
In our university, the collaboration between the AIS and MIS programs started out informally. Discussion between faculty members eventually led to the MIS “track” in the accounting program, which allowed accounting students to “specialize” in MIS. In addition, one of the authors pursued an opportunity for our university to be part of the SAP Academic Alliance, which allowed us to add an Introduction to ERP course to the curriculum. Our students have choices that allow them to gather skills in IT audit, database and system design (an illustration of our Accounting—MIS Track program is included as Appendix F). Historically, AIS and IT audit courses emphasize the nature of business processes and the importance of system controls. Proprietary accounting packages such as Sage 50 meet the basic needs of AIS courses at minimal cost and minimal instructor preparation. Other software packages, such as QuickBooks or Microsoft Dynamics are other options for illustrating accounting systems.5 Publishers of accounting textbooks provide instructional materials and discounted access to software for students and instructional support for faculty members. SAP software can be used effectively in AIS courses (Jones, 2012), but the amount of instructor training and preparation work can make this “cost-prohibitive” in terms of time and learning curve. Similarly, open source software can add significant insights about program structures, data structures and security processes, but the significant time and resources required for instructor training and preparation work might not make this option attractive to many AIS instructors. This is where collaboration with the MIS program and/or an MIS “track” in the accounting program (with cross-listed courses) can help provide the next level of skills for the students by letting them delve more deeply into systems design and implementation.
To illustrate how ERP systems permeate all business processes in an organization, ERP software vendors such as SAP provide hosted versions of their software products which are affordable and relatively easy to use. In some cases, these vendors provide repositories of curricular material. Curricular material for Global Bikes (Magal et al 2011) and Classic Rockers (Daigle et al 2011) are also useful tools to help students understand ERP systems. Although non-ERP accounting packages and open source systems do not provide the complete range of ERP services that are offered by extensive ERP software products, these packages can provide specific insights into specific areas, by allowing students to build systems from scratch and to demonstrate the importance of designing controls into an accounting system. Open source systems reveal the mechanics used to set up proper authorization/access controls, maintain segregation of duties, properly sequence transactions, control the file maintenance function, and validate data entries (among other control activities). While proprietary accounting packages and ERP systems can be used as models to show effective user interfaces and report formats, they can also teach students how the system validates the results of business processes developed within the open source system.
Our experience with collaboration across the curriculum (which is still evolving) suggests accounting students can significantly contribute in the definition of control requirements for S.A.D. projects. MIS professors can add explanations and examples of program structures and data structures used in accounting systems. Those with training in ERP systems can add valuable perspective in discussions of scalability, multiple currencies and conversion of measuring units. When professors collaborate across department boundaries, scarce resources are used more effectively, and the students graduate with the skill set combination necessary to be successful in their chosen careers. Our accounting advisory board has been supportive of the need to combine the skills of accounting and MIS as the accounting and MIS/IT professions sometimes overlap. We have found that a benefit of the AIS course is the introduction to the concept of risk assessment, internal control evaluation, and relational database design. Students who pursue the MIS track can then pursue a hands-on approach to understanding these concepts in the context of the IT Audit and the Systems Analysis and Design courses. While the introductory MIS course brings the technical skills and security awareness issues to the students' attention, we suggest these concepts are enhanced and developed in the IT Audit and Introduction to ERP courses. Collaboration across curricula reinforces the importance of an understanding of risk management and internal controls, which benefit both those graduates who pursue a career in IT security and those who pursue a career in IT auditing.
Document Flow in SAP Business Suite
Both SAP Business Suite provides “document flow” capability allowing users to see the relationships between documents created within automated procedures. The figure below shows a simple document flow from a purchasing process in SAP Business Suite.