Robin Alper, a manager of the credit collections department for ACME Building Supplies, is extremely unhappy with a new system that was installed 3 months ago. Her complaint is that the data flows from the billing and accounts receivable departments are not occurring in the manner originally requested. Further, the updates to the database files are not occurring as frequently as she had envisioned. Thus, the hope that the new system would provide more current and timely information has not materialized. She claims that the systems analysts spent 3 days interviewing her and other workers. During that time, she and the other workers thought they had clearly conveyed their needs. She feels as if their needs were ignored and their time was wasted. 

What went wrong during the systems design process? 

What suggestions would you make for future projects?

 

Answer:

System design is the phase in which the system is framed as per the needs of the organization which are known by interviewing them in deep.

There are several risks associated with WF's systems development approach. These risks may include:

• One-man operation may result in poorly designed systems that contain undetected flaws that result in material misstatement of financial data.
• The programmer both designs and maintains the application and may therefore be in position to perpetrate program fraud.
• Documentation of the system may become inadequate and outdated thus hampering day-to-day operations and system audibility.

Internal Control Weakness.

1. The maintenance programmer trained in VIEW is wholly responsible for the design, implementation, and subsequent maintenance of new system. Consequently, he will perform many incompatible tasks in contradiction with internal control standards established of the SDLC.
2. Systems development and program changes should be segregated tasks. Under the proposed approach the programmer who codes the upgrade program also maintains the system later. Since WFS deals with client investments and wealth management, this access could possibly lead to the following frauds:

• The programmer has access to all files and sensitive data of the company and the clients. Given his expertise he can manipulate that information without knowledge of management.
• He may perform unauthorized and illegal transactions such as using proprietary information to invest for personal gain.
• Since, the programmer will have unlimited maintenance access to the program after the development stage he can remove any fraudulent code when the systems is under audit to protect himself from detection and reinitiate the fraud when the audit is complete.

Documentation Inadequacy.

Because the system programmer and the maintenance programmer are the same person, no formal transfer of the completed VIEW documentation to the maintenance group will take place. As a result system documentation will likely be sparse and only meant to refresh the programmers memory about specific routines and procedures. Existing documentation will thus be equivalent to a set of personal notes. This defeats the purpose of documentation, which is to allow future programmers to read and understand the system so they can work on it as efficiently as the original programmer.

A related problem is one of dependency where the VIEW programmer becomes indispensable to the company as he is the only one who understands the system. In addition to these operational issues, inadequate documentation impacts the auditability of the system. Accurate and current system documentation is critical to an auditor's understanding of system functionality and controls. Lacking such essential information auditors are severely encumbered in their ability to design tests of controls in compliance with auditing standards.