We are discussing common issue we find, as we apply data analytics tools to our audits, that suggest that Ghanaian businesses are not getting good returns from their investments in an accounting software. In part 1, we discussed observation on systems configuration.
In this article we discuss security, information technology skills and data issue we see as we apply analytical tools to our audits.
Security
Most accounting systems we reviewed are insecure. This is a serious concern.
Those deploying such systems in a small business environment do not give enough consideration to the security of the accounting system. The focus is to get the system to work. But this approach is risky and exposes the business to significant risks.
Why? Unauthorized people can access and manipulate electronic data to defraud the business or steal business information if proper controls and security measures are not in place. You must impose strict controls to make sure only authorized personnel can access and use the accounting software.
The common issues we found were:
A. User Rights and Privilege Settings
User rights and privileges define what a user can do with the software. In most of the accounting systems we reviewed, they assigned rights and privileges without ensuring that people cannot play incompatible roles.
As the users often have few restrictions on what they can do on with the software, the accounting system is not secure.
Basic control principles, such as one person should be able to originate, approve and post transactions also apply to computerized systems. The rights and privileges settings of the accounting system provide the means to impose control.
B. Username and Passwords
(i). Passwords not required to access the system–in a corporate setting this is risky. Anyone who gets access to your computers can access it. They can use your computer, steal your data, and even lock you out of it.
(ii). Sometimes, the users share one password. The problem with this is, you cannot hold any one person responsible for what happens in the system. This creates a perfect condition for fraud.
We recommend strongly that each user should have a unique username and password. This should be a minimum requirement.
C. Date Lock Settings
We found several instances of accounting periods not being locked, even though the books have been closed and reports issued. In such systems, people can post transactions to past periods without restriction.
In such situations, reports generated at different times for the same period may differ. The difference will be because of transactions posted after the period is closed. The inconsistent reports raise a question, which report can you trust? This is a credibility problem.
Date locks are very essential features of any accounting system. It locks up the information in any accounting period to prevent changes to the data of periods that have been closed.
We recommend that you use the date lock features to prevent transactions being posted to closed periods.
Information Technology (IT) Skills
Information Technology (IT) is increasingly taking over both the mundane and sophisticated accounting functions that accountants perform. To perform, accountants need deeper IT skills. Knowledge of Excel and word will not be enough.
Accountants need at a minimum the following skills:
- A good knowledge of the software they use.
- Ability to apply control concepts in an IT setting.
- Basic database concepts.
- Basic skill in data manipulation tools: e.g. Excel and Power BI, for example.
The Ghanaian accountants lack adequate IT skills to perform effectively in an increasingly computerized setting, and this shows in all the issues we found.
Many of the issues discussed so far reflect the accountants’ lack of adequate IT skill. This general weakness is causing the companies to have poor data quality. Poor data quality leads to the final issue we will discuss – poor information.
Poor Information
The quality of information you get from your accounting system is only as good as the quality of data you input. It was common to find that control accounts and the underlying records do not agree.
To gain control, accountants must put in measures such as
- Policies and procedures–they must apply policies and procedures. A policy defines a rule, and procedure defines the steps to execute the policy – what, who, how and when. It is important that everyone who processes a transaction observes the policies and follows the procedures for processing that transaction.
- Input controls –These are controls to ensure the data being processed is complete, accurate and authorized.
- Reconciliations – implement procedures to reconcile the ledgers and underlying details regularly.
- Reviews – do regular reviews of the output from the system for accuracy and validity.
Conclusion
Ghanaian businesses have a lot to do to derive optimal value from their investment in accounting software and ensure proper usage, so they can generate accurate information. Key to that is the skills of their accountants. The Ghanaian accounting profession must urgently improve their IT skills, otherwise they willbe a pervasive risk to their employers getting the desired benefits from their investment in accounting systems.
The boards and CEO’s must realize that their information technology assets and the data they hold are a strategic asset that can advance or hamper their competitive advantages. To ensure they get the benefits of IT, they must improve their general awareness of the impact of IT and ask critical questions.
For more blogs and information please follow SCG Chartered Accountants on Facebook, Twitter, Youtube and LinkedIn.
