Background Literature

Concept mapping is a method for assisting the transfer of knowledge (Kim, 2013). It requires participants to link one concept to another concept by associating a threat to a particular field with the internal control preventing that threat. This linking acts as a memory aid by assimilating the necessary bits of information needed for a task and allows students to apply knowledge of one area (internal control) to another area (database software). Marlia et al. (2007) note that concept mapping is the tool that allows internal expert knowledge to be examined, refined, and re-used. This mapping increases information available to students and allows several knowledge components to appear at the same time to the individual, which can increase task accuracy.

The issue then becomes how to structure concept mapping in a learning project requiring multiple steps with multiple links. While concept mapping is commonly associated with visual diagrams, research indicates that paired associations (Frederick, 1991; Frederick et al., 1994), specific matching of concepts (Curtis & Viator, 2000), semantical associations (Kim, 2013), and textual lists (Block & Morwitz, 1999) are effective mechanisms for implementing “concept mapping,” as each method serves as an external memory aid. In our database exercise, we adopt the textual lists strategy of Curtis and Viator (2000) and Block and Morwitz (1999) because our task is multi-step, is textual, and requires a fair degree of specificity.

Assignment Description

Our database exercise helps students learn by matching concepts (threats, controls, and application of controls) to each other and applying them in a software context. This exercise combines two separate course components with which students have historically struggled: internal control and learning database software (Access).

This project extends the concept of internal control from transaction level to field level. Although most contemporary AIS textbooks (e.g., Romney et al., 2022) cover transaction-level controls thoroughly, they do not stress internal control at the field level, despite the pervasiveness of online data entry where initial internal control operates at the field level. Indeed, Taheer (2022) and Arora et al. (2021) estimate that 91% of the U.S. population will be shopping online in 2023 and beyond, making the use of internal controls over online data entry important.

Students often have difficulty comprehending internal control and are thus frequently unsuccessful at evaluating internal control deficiencies and identifying appropriate internal control solutions (Douglass et al., 2022). Compounding this effect, students often focus on higher transaction-level controls (e.g., credit limits preventing sales to unworthy customers) and fail to grasp that, in an online environment, control first occurs at the point of data entry. Yet, understanding field-level controls is crucial because many transactions (e.g., sales) originate online, necessitating accurate data entry.

Although students can identify a sales order transaction by listing the steps necessary to process this transaction (such as credit approval, inventory availability, etc.) and, with prompting, they can identify the necessary internal controls associated with each step, our experience teaching internal control over 20 years indicates that students often cannot identify how these steps translate into field-level controls. Absent this understanding, students find it difficult to design a database table, and even more difficult to incorporate appropriate field-level controls.

The learning outcomes for this case are that students will:

1. Match internal control threats with their appropriate internal controls at the cycle, activity, and field levels.

2. Apply internal controls when designing two Access tables, including all appropriate Access property controls.²

3. Identify the fields required to capture data for a given activity.

4. Identify the necessary internal controls to prevent threats to the fields.

Our assignment consists of an Access project divided into two separate steps. First, students match internal control threats with their appropriate controls at the cycle, activity, and field level. Second, students apply these controls in the design of two tables in Access, including all appropriate Access property controls. The complete assignment is provided in Appendix A. Appendix B contains a list of resources for Access that can be given to students.

Assignment Grading

This assignment is the result of an Access project developed over three semesters at a public regional institution. The students were senior-level undergraduate accounting students enrolled in an AIS course.

The assignment requires students to (1) identify fields required for a given activity (e.g., sales order entry), (2) match those fields with the threats (e.g., what could go wrong), and (3) identify the data entry (input edit) controls that would prevent those threats from occurring. Students submit written evidence of these activities, which is a critical part of the learning, because students must link the fields they identify with controls that would prevent those threats, focusing on both internal control and database concepts. Thus, these exercises facilitate student success in designing Access tables.

The written exercises and the Access project are graded separately. Fifty percent of the total points are awarded to the final Access project and fifty percent to the written exercises. Student grades thus reflect the amount of effort required to identify the fields, threats, and controls, and design the tables in Access. We have students complete the project over six weeks, as described in Appendix C.

We evaluated student performance in three ways: through change in knowledge scores (pre- to post-), student written exercises, and the final project grade, which included the two Access tables presented in design view with all appropriate controls working. Grading measures control properties and whether they effectively execute data entry controls.

Assignment Efficacy

Student scores on the pre- and post-questionnaires indicate that knowledge of general internal control and database knowledge improved over three separate semesters. Appendix D shows the mean difference scores from pre- to post- and the significance of this difference by semester. The students' knowledge improved as the case process improved over time. Additionally, we included six questions in our pre- and post- questionnaires specifically measuring student knowledge of Access. Student scores revealed that their Access knowledge increased significantly pre- to post- (p = 0.0029, mean = 1.4737) and that their total database knowledge scores (original database questions + Access database questions) also increased significantly, pre- to post- (p = 0.0001, mean = 3.5789). See Appendix E for the pre- to post-questionnaire.

Student scores on the written exercise also improved over the three semesters, increasing to 42.5% (from a low of 10%), with several (20%) of the scores at or above 90%. This improvement was important as the written exercises precede the Access database design and thus have a direct effect on the final project score. Overall, students' lists were robust, with the majority identifying all controls available for each threat in sufficient detail. Most importantly students' Access project grade averaged 86.54% with over 20% of the class scoring a 90% or better.

Assignment Use

This assignment is appropriate for an undergraduate AIS or database class that emphasizes internal controls. It could also be used at the graduate level in AIS, auditing, or database courses if enhanced with advanced features, such as look-ups to other tables for data validation or the use of more than one transaction cycle (e.g., linking revenue sales ordering with inventory control and re-ordering).

We run this project in a computer lab after students have designed Access tables, including property control features. Students begin their work in the lab but finish it on their own. Only a handful of students (less than 10% over three semesters) began and finished the project in the lab. The time taken ranged widely, from time-in-classroom of 300 minutes (four 75-minute sessions) to two weeks outside of class, where the actual time was unobserved and therefore not recorded.

We developed the assignment over several semesters after experiencing frustration teaching students how to apply their internal control knowledge to evaluate an accounting application. During the rounds of development and implementation, we learned the following:

1. Students performed better when they did not have many choices to make. In the beginning, we allowed students to choose the cycle (e.g., revenue or expenditure) and activity (e.g., sales order entry, shipping, invoicing, or cash collection). Students were overwhelmed with the choices, so we specified sales order activity in the revenue cycle. We originally allowed students to design up to three Access tables, and this choice was also difficult for the students. Thus, we reduced the complexity of the case by requiring students to design just two tables: the sales order master table and the sales order detail table.

2. Based on feedback in post-project student evaluations and conversations, we learned that students wanted more guidance about how to identify the threats and fields required for an activity or transaction, which data entry control was needed to match which threat, which data entry control matched which Access control property, and which Access control property to choose. From this feedback, we learned that students needed more specific instruction and practice linking the elements together, especially when they linked the threats to data entry controls and then to Access property controls. The assignment now provides specific instructions that help students connect the dots between data entry controls and Access property controls.

3. We realized students need a refresher on table design, including how to effect third normal form (primary key data, such as a specific account number in one row cannot be repeated elsewhere in the table), how and why to break data into separate tables, how to link Access Property controls to data entry controls, and how data rows (records) and data columns (fields) differ. These steps followed specific examples using transactions from a cycle different from the one assigned to students.

4. Our examination of project scores revealed that students often choose an easy property control option (e.g., choosing validation as the only control) rather than identifying each control that addressed each threat. Anecdotal feedback revealed a student perception that any validation control addressed all evils and that individual controls such as field type, size, sign, limit, or range were unnecessary. We amended our instructions by emphasizing the need for students to identify all the control(s) that addressed each threat. We also strengthened our coverage of referential integrity, highlighting it as both a detective and preventive control. To help students identify the appropriate property controls, we explained the relationship between threats, fields, and the data entry control to prevent the threat, followed by the Access property control that implements the data entry control. We also stressed that multiple property controls are often necessary to prevent threats to a given field.

5. Student feedback indicated students did not consider Access software a necessary skill an accountant needed to acquire. They expressed their perception of Access software as being for programmers and not a tool they expected to use. Thus, students were not sufficiently engaged or motivated to earn a good grade. To increase the assignment's salience, we added an in-class discussion of Access software' relevance to accounting analysis of big data. We included examples that showed database tables being imported into data visualization software and discussed advantages of using Access rather than a spreadsheet program for data entry.

Conclusion

This paper presents an assignment that addresses internal controls and the use of an Access database. The project instructions follow the concept mapping method for transferring knowledge. The project results show that matching threats, fields, and controls improved the learning of general and database internal controls. Specifically, linking a threat to the internal control preventing that threat served to connect one concept (internal controls) to another concept (database software). The textual lists and paired associations of the concepts in the written exercises proved to be effective mechanisms for improving student learning of internal controls and the Access database tool. Overall, the additional training in connecting field controls, threats, and Access property controls helped improve students' performance on the project.