Controls Over Master File Amendments Solution

(a) Controls over master file amendments. Validity 1. All amendments to the debtors master file, e.g. addition of a new account, changes to credit terms, should be recorded on master file amendment forms (MAFs). 2. MAFs should be 2.1 pre-printed, sequenced and suitably designed to reflect their purpose. 2.2 signed by two senior staff members (e.g. the credit controller and the financial accountant) after they have agreed the details of the MAF to any supporting documentation. 3. Access to unused MAFs should be strictly controlled by restricting physical access thereto. 4. Access to the masterfile amendment module of the revenue and receipts software should be restricted (least privilege policy) 4.1 to a terminal in the debtors department (possibly). 4.2 write access only to a specified individual in the debtors department. 4.3 by the use of user profiles/user IDs and passwords. Note: There should be general controls over access to the network as well. 5. All master file amendments should be automatically logged by the computer on sequenced logs. 6. There should be no write access to the logs. 7. Logs should be reviewed regularly by the debtors manager (or similar individual). 7.1 all amendments logged should be tied back to an authorised MAF. 8. Where applicable, programme checks, e.g. range or limit checks on credit limits should be in operation. Note: Accuracy and completeness controls are not required. (b) 1. On accessing the orders module of the revenue application, the internal sales order should appear “on screen” for completion. 1.1 screen document should be designed to promote accurate and complete entry of data, e.g. customer account number prominent and to be entered first. 2. The software should be amended where necessary to include the following programmed controls. 2.1 mandatory fields, e.g. capture from the customers sales order cannot continue until a valid customer’s account number (see 2.2 below,) has been entered, or, e.g., quantity field must be completed or, e.g., customer order reference/number is entered. 2.2 verification of the customer account number against the debtors master file. 2.3 minimum keying in of data, e.g. once the account number has been verified against the debtors master file, the standing data applicable to the debtor appears on the “screen” internal sales order. (This reduces the amount of information which Xavier Frans is required to key in.) 2.4 program checks (as appropriate) • alphanumeric, e.g. on quantity field. • limit/range, e.g. on quantity field. • missing data, e.g. on delivery address fields. 2.5 screen dialogue, e.g. prompt Xavier Frans to check quantities ordered which he has keyed in. (c) (d) 3. The warehouse administration clerk should not have to recapture information from the ISO to create a picking slip. 3.1 The ISO document should be re-designed as multi-functional stationery which includes a document headed “picking slip” (two copies) which is printed out with the ISO. 4. Xavier Frans should sign the ISO/picking slips once they have been printed to acknowledge that he has checked the accuracy and completeness of information captured from the customer sales order and if practical a second person should check the preparation of the documents against the customer order prior to the order being sent to the warehouse. 1. All orders (faxed, emailed or posted) received should be entered in an orders received register daily. The responsibility should be allocated to a specific individual who should sign the register. 2. Each customer order should be numerically sequenced (by stamp) before being entered into the register in the numerical sequence. 3. Xavier Frans should cross-reference each ISO he creates to the internally generated customer order number. 4. On a frequent and regular basis (possibly daily) an employee in the cycle other than Xavier Frans, should enter the relevant ISO number into the orders received register against the customer orders listed and confirm that 4.1 the sequence stamped on the customer orders is complete and 4.2 that there is a unique internal sales order number allocated to all customer orders. 5. All queries from customers in respect of orders placed but not received should be followed up promptly to determine whether the order was initiated by the creation of an ISO. 1. The IT department should adhere to the pre-defined standards for programme changes. 2. Programme change requests (improvements to the revenue software) should be documented on prenumbered, pre-printed change control forms. 3. The programme change requests should be evaluated and approved by • the user department • the IT manager 4. The change should be managed as a mini-project • project team appointed • proper planning • responsibilities allocated • deadlines set • progress monitored 5. Changes should be made to a development program, not the production program. 6. Changes should be thoroughly tested using standard debugging techniques. 7. Changes made should be discussed with the user departments and they should sign the programme change control form if they approve. 8. All documentation affected by the change should be updated. 9. The amended programme should be copied to the live environment by the network administrator and the changes should be logged by the computer. 10. The IT manager should review this log and reconcile it to the program change requests.