Contents Cover Title Page Copyright About the Authors Eddy Vaassen Roger Meuwissen Caren Schelleman Preface Part I: Foundations of Internal Control Chapter 1: Organizations and their Systems Introduction Information in Organizations Information and Communication Technology Governance and Control An Integral Control Framework Quality and Quality Criteria Developments in Organizations, Technology and Society Alignment in a Complex Control Environment The Relationship between Information Disciplines Summary Chapter 2: Internal Control Introduction The Importance of Internal Control The Evolution of Internal Control The COSO Reports Corporate Governance The Scope of Internal Control Cornerstones of Internal Control Classifications of Internal Controls Conclusion Summary Chapter 3: Bridging the Gap between Internal Control and Management Control Introduction A Management Control Framework Avoiding Management Control Problems Market Control Cultural Control Input Control Process Control Output Control The Relationship between Management Control and Internal Control Control and Innovation A Combination of Hard and Soft Controls Summary Chapter 4: The Dynamics of Control and IT Introduction Information and IT Components of Information Systems Information System Development IT Applications IT-enabled Innovations The Importance of IT Information Security Codes on Information Security IT-enabled Innovations and Internal Control IT Governance Summary Chapter 5: Documenting and Evaluating Internal Control Systems Introduction Narrative Descriptions of Internal Control Systems Graphic Documentation of Internal Control Systems The Controls Checklist Automated Tools in Documenting Internal Control Systems Normative Internal Control Descriptions The Internal Control Manual Summary Part II: Internal Control in Various Organizational Processes Chapter 6: Organizational Processes Introduction Primary and Secondary Organizational Processes Organizational Processes in the Value Cycle Summary Chapter 7: The Purchasing Process Introduction Risks, Exposures and Internal Controls in the Purchasing Process Purchase Requisitions Purchase Orders Receipt of Goods Validation of Invoices Accounts Payable Payment of Vendor Invoices A Generic Logical Data Flow Diagram of the Purchasing Process Summary Chapter 8: The Inventory Process Introduction Risks, Exposures and Internal Controls in the Inventory Process Receiving Goods Recording of Goods Storage Release of the Goods Inventory Counts Summary Chapter 9: The Production Process Introduction Risks, Exposures and Internal Controls in the Production Process Product Design Annual Planning, Cost Calculation and Production Planning Job Preparation Raw Materials Release Production and Production Records Post-calculation A Generic Data Flow Diagram of the Production Process Summary Chapter 10: The Sales Process Introduction Risks, Exposures and Internal Controls in the Sales Process Preparing Offers Order Receipt and Order Acceptance Billing Picking and Shipping Accounts Receivable Cash Sales A Generic Logical Data Flow Diagram of the Sales Process Summary Chapter 11: Secondary Processes Introduction Human Resources Management Investment in Fixed Assets Cash Management Accounting and General Ledger Process Summary Part III: Internal Control in Various Types of Organizations Chapter 12: Typology of Organizations Introduction Typology of Organizations Trade Organizations Production Organizations Service Organizations with a Limited Flow of Goods Service Organizations that Put Space and Electronic Capacity at their Customers’ Disposal Service Organizations that Put Knowledge and Skills at their Customers’ Disposal Governmental and Other Not-for-profit Organizations Introduction to the Following Chapters Summary Chapter 13: Trade Organizations Introduction Characteristics of Trade Organizations with Cash Sales Characteristics of Trade Organizations with Credit Sales Summary Chapter 14: Production Organizations Introduction Characteristics of Organizations that Produce to Stock Characteristics of Organizations with Mass Customization Characteristics of Agrarian and Extractive Organizations Characteristics of Organizations that Produce to Order Summary Chapter 15: Service Organizations with a Limited Flow of Goods Introduction Limited Flow of Own Goods Limited Flow of Goods Owned by Third Parties Summary Chapter 16: Service Organizations that Put Space and Electronic Capacity at their Customers' Disposal Introduction Disposition of Specific Space Disposition of Specific Electronic Capacity Disposition of Nonspecific Space Summary Chapter 17: Service Organizations that Put Knowledge and Skills at their Customers' Disposal Introduction Selling of Man Hours Deployment of Intellectual Property Selling of Financial Products Summary Chapter 18: Governmental and Other Not-for-profi t Organizations Introduction Characteristics of Governmental and Other Not-for-profit Organizations Risks, Exposures and Internal Controls of Governmental and Other Not-for- profit Organizations Administrative and Organizational Conditions in Governmental and other Not- For-Profit Organizations Summary Bibliography Glossary Index This edition fi rst published 2009 Copyright © 2009 John Wiley & Sons Ltd Registered office John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom For details of our global editorial offi ces, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at www.wiley.com. The right of the author to be identifi ed as the author of this work has been asserted in accordance with the Copyright, Designs and Patents Act 1988. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior permission of the publisher. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought. Library of Congress Cataloging-in-Publication Data Vaassen, E. H. J. (Eddy H. J.) Accounting information systems and internal control / Eddy Vaassen, Roger Meuwissen and Caren Schelleman.–2nd ed. p. cm. Includes bibliographical references and index. ISBN 978-0-470-75395-8 (pbk.) 1. Accounting–Data processing. 2. Information storage and retrieval systems–Accounting. I. Meuwissen, Roger. II. Schelleman, Caren. III. Title. HF5679.V33 2009 657.0285—dc22 2009017247 About the Authors Eddy Vaassen Eddy Vaassen is a professor of Accounting Information Systems (AIS) at Maastricht University and Universiteit van Amsterdam. He wrote his dissertation in 1994 at Universiteit Maastricht. He graduated from the Accountancy programme of Universiteit Maastricht in 1990 and from the Economics programme of the same university in 1988. He has Dutch and international publications – including six textbooks – within the fields of AIS, Information Management, Auditing and Management Control. Eddy Vaassen is a member of the editorial boards of the Journal of Information Systems, the International Journal of Accounting Information Systems, Global Perspectives on Accounting Education, the Journal of Emerging Technologies in Accounting, the International Journal of Digital Accounting Research, Management Control & Accounting, Accountant Adviseur and Controllersjournaal. He is the director of the International Executive Master of Finance and Control programme (Registered Controller) and a member of various councils, including the Board of the European Accounting Association. In 2005–2007 he was the Vice-President Europe/Africa/Mid East with the SIG-ASYS of the Association for Information Systems. In 2003–2004 he was the International Member at Large of the Council of the American Accounting Association. He is the co- founder and co-chair of the annual European Conference on Accounting Information Systems. He is also the co-chair of the International Research Symposium on Accounting Information Systems. His research interests are in the areas of the use of decision aids in auditing, professional judgement in audit decision-making and the interaction between management controls and internal controls. He supervises and has supervised doctoral dissertations on the factors explaining ERP use, decision aid use in auditing, contract auditing, professional judgement in internal control assessments and just-in-time information provision. Roger Meuwissen Roger Meuwissen is professor of Control and Auditing at Maastricht University. He currently serves on the Board of the Faculty of Economics & Business Administration as vice-dean and is responsible for education. He previously chaired the Department of Accounting and Information Management and was director of the Maastricht Accounting, Auditing and Information Management Research Center. Professor Meuwissen received his PhD from Maastricht University. He also finished the postgraduate programme in auditing to become a licensed auditor in the Netherlands. His primary teaching areas are internal control and auditing. He teaches undergraduate and graduate courses on internal control and accounting information systems as well as on assurance services. His research interests lie primarily in the areas of audit markets, audit regulation and internal control. He is author of several articles in both academic and practitioner journals, and has conducted several commissioned research projects on the market for audit services and audit regulation. He has also published several Dutch textbooks on internal control and accounting information systems.