N4T L INST, OF STAND &

|fJ[j, .I'lJ, NISI

iJBLICATIONSi

A11104 SfiTfiM4

Computer

Systems

Technology

U.S. DEPARTMENT OF

COMMERCE

Technology Administration

National Institute of Standards and Technology

Nisr

NIST Special Publication 500-226

Self Monitoring

Accounting

Systems

Roger Sies
7he National Institute of Standards and Technology was established in 1988 by Congress to "assist industry

in the development of technology . . . needed to improve product quality, to modernize manufacturing processes,

to ensure product reliability . . . and to facilitate rapid commercialization ... of products based on new scientific discoveries." NIST, originally founded as the National Bureau of Standards in 1901, works to strengthen U.S. industry's

competitiveness; advance science and engineering; and improve public health, safety, and the environment. One of the agency's basic functions is to develop, maintain, and retain custody of the national standards of measurement, and

provide the means and methods for comparing standards used in science, engineering, manufacturing, commerce,

industry, and education with the standards adopted or recognized by the Federal Government.

As an agency of the U.S. Commerce Department's Technology Administration, NIST conducts basic and applied research in the physical sciences and engineering, and develops measurement techniques, test methods, standards, and

related services. The Institute does generic and precompetitive work on new and advanced technologies. NIST's

research facilities are located at Gaithersburg, MD 20899, and at Boulder, CO 80303. Major technical operating units and their principal activities are listed below. For more information contact the Public Inquiries Desk, 301-975-3058.

Office of the Director

• Advanced Technology Program

• Quality Programs

• International and Academic Affairs

Technology Services

• Manufacturing Extension Partnership

• Standards Services

• Technology Commercialization

• Measurement Services

• Technology Evaluation and Assessment

• Information Services

Materials Science and Engineering

Laboratory

• Intelligent Processing of Materials

• Ceramics

• Materials Reliability'

• Polymers

• Metallurgy

• Reactor Radiation

Chemical Science and Technology

Laboratory

• Biotechnology

• Chemical Kinetics and Thermodynamics

• Analytical Chemical Research

• Process Measurements'

• Surface and Microanalysis Science

• Thermophysics"

Physics Laboratory

• Electron and Optical Physics

• Atomic Physics

• Molecular Physics

• Radiometric Physics

• Quantum Metrology

• Ionizing Radiation

• Time and Frequency'

• Quantum Physics'

Manufacturing Engineering Laboratory

• Precision Engineering

• Automated Production Technology

• Intelligent Systems

• Manufacturing Systems Integration

• Fabrication Technology

Electronics and Electrical Engineering

Laboratory

• Microelectronics

• Law Enforcement Standards

• Electricity

• Semiconductor Electronics

• Electromagnetic Fields'

• Electromagnetic Technology'

• Optoelectronics'

Building and Fire Research Laboratory

• Structures

• Building Materials

• Building Environment

• Fire Safety

• Fire Science

Computer Systems Laboratory

• Office of Enterprise Integration

• Information Systems Engineering

• Systems and Software Technology

• Computer Security

• Systems and Network Architecture

• Advanced Systems

Computing and Applied Mathematics

Laboratory

• Applied and Computational Mathematics^

• Statistical Engineering"

• Scientific Computing Environments^

• Computer Services

• Computer Systems and Communications^

• Information Systems

'At Boulder. CO 80303. -Some elements at Boulder, CO 80303.
NIST Special Publication 500-226

Self Monitoring Accounting

Systems

Roger F. Sies, Certified Internal Auditor

Computer Systems Laboratory

National Institute of Standards and Technology

Gaithersburg, MD 20899-0001

March 1995

U.S. Department of Commerce

Ronald H. Brown, Secretary

Technology Administration

Mary L. Good, Under Secretar>' for Technology

National Institute of Standards and Technology

Arati Prabhakar, Director
Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) has a unique responsibility for computer

systems technology within the Federal government. NIST's Computer Systems Laboratory (CSL) develops standards and guidelines, provides technical assistance, and conducts research for computers and

related telecommunications systems to achieve more effective utilization of Federal information technology resources. CSL's responsibilities include development of technical, management, physical, and administrative standards and guidelines for the cost-effective security and privacy of sensitive unclassified

information processed in Federal computers. CSL assists agencies in developing security plans and in improving computer security awareness training. This Special Publication 500 series reports CSL re- search and guidelines to Federal agencies as well as to organizations in industry, government, and

academia.

National Institute of Standards and Technology Special Publication 500-226

Natl. Inst. Stand. Technol. Spec. Publ. 500-226, 15 pages (Feb. 1995)

CODEN: NSPUE2

U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON: 1995
Table of Introduction 1 Contents

Background 1

About this Report 3

Monitoring Accounting Systems in the Past 4

Need for Change 5

Self Monitoring Allows Management to be Proactive . 6

Considerations for Implementation of the Self

Monitoring Service 8

Conclusions 10

References 11

iii

Introduction

Background

On January 8, 1993 Charles A. Bowsher, Comptroller General of the

United States, testified before the Committee on Governmental

Affairs of the United States Senate. He discussed the high-risk

series of reports issued by the General Accounting Office CGAO).

This series of reports focused on the Federal Government's efforts to identify and correct problems in 17 areas that the GAO identified as especially vulnerable to waste, fraud, abuse, and mismanagement.

When the GAO started its high-risk program in November 1989,

they reported that it was evident that "the government did not have

the internal control and accounting systems necessary to effectively

operate many of its programs and safeguard its assets."

In November 1990 Congress enacted the "Chief Financial Officers

(CFO) Act of 1990."

Three findings listed in the Act (as amended) are as follows:

"Billions of dollars are lost each year through fraud, waste, abuse, and

mismanagement among the hundreds of programs in the Federal

Government."

"These losses could be significantly decreased by improved

management, including improved central coordination of internal

controls and financial accounting."

"The Federal Government is in great need of fundamental reform in

financial management requirements and practices as financial

management systems are obsolete and inefficient, and do not provide

complete, consistent, reliable, and timely information."

One purpose for the Act listed in the document is... "Provide for

improvement, in each agency of the Federal Government, of systems

of accounting, financial management, and internal controls to assure

the issuance of reliable financial information and to deter fraud,

waste, and abuse of Government resources."

1
The Act establishes the following:

a Deputy Director for Management within 0MB ~ shall be the chief

official responsible for financial management in the United States

Government;

an Office of Federal Financial Management in 0MB;

nothing in the Act shall be construed to interfere with the exercise

of the functions, duties, and responsibilities of the Department of the

Treasury, as in effect immediately before the enactment of this Act;

agency Chief Financial Officers;

need for OMB to submit a government wide 5 -year financial

management plan;

need for Financial Statements by agencies submitted to OMB; and

need for Financial Statements to be audited in accordance with

applicable generally accepted government auditing standards.

In 1990 the Federal Accounting Standards Advisory Board (FASAB)

was created. The mission of the FASAB is to recommend

accounting standards for the federal government. The board must

consider the financial and budgetary information needs of

congressional oversight groups, executive agencies, and the needs of

other users of Federal financial information.

In April 1994 the "Core Financial System Requirements" document,

from the Joint Financial Management Improvement Program, was

updated to reflect the passage of the Chief Financial Officers Act of

1990; the creation of the Federal Accounting Standards Advisory

Board; the experiences of the departments and agencies in using the

original document; and the views of the CFO Council's Financial

Systems Committee, the President's Council on Integrity and

Efficiency, and others interested in improving financial systems in

the federal government. The "Core Financial System Requirements"

document establishes standard requirements for the backbone

applications of an agency's integrated financial management system.
Another current initiative of tiie Treasury Department, ihc I rcasury

Financial Management Service (FMS) consists of the following

components:

The U. S. Standard General Ledger

The Federal Agencies Centralized Trial Balance System

Credit Reform

In congressional testimony Treasury's Financial Management Service

said... "With the increasing implementation of the U. S. Standard

General Ledger (SGL) in the agencies, a much improved system

becomes possible. 'Standard' is the key word. With the SGL,

agencies across government identify certain accounts in the same

way. Because of this standardization, it is possible to retrieve the

actual account balances directly out of the agencies' accounting

systems, thus eliminating the need for manually compiled reports.

Because of this standardization, agencies are able to write computer

programs which more fully automate the transmission of financial

data to FMS."

About this Report This report focuses on one of the two major aspects discussed

above, the need for more dependable accounting and financial

systems. The need for more "Standard" accounting systems across government will be addressed in future work on "Open Accounting

Systems." This report recommends a service for use by management

in performing self audits of financial systems. Tools used in the

past by Electronic Data Processing (EDP) auditors to audit

accounting systems are examined, and the similarities between these

tools and the service recommended in this report can be observed.

The use of this service is then described as it would be used within

the accounting system. How the service can provide more internal

control and financial information usually obtained from analysis

performed by financial consultants is explained.

3
Monitoring

Accounting

Systems in the

Past

Historically "monitoring" of accounting systems has been in the

form of audits conducted by internal auditors such as those from the

Office of the Inspector General, or from outside auditors such as those from the General Accounting Office. Generalized Audit

Software, and the Integrated Test Facility are primary tools used in

performing audits on computerized accounting systems. This

computer software typically can be installed on the system under

audit, and allows the auditor to extract and analyze data from the

financial records within that system. Some of the functions in

generalized audit software allow auditors to perform the following:

data file analysis, inquiry, and extraction;

statistical sampling, file summarization, footing and recomputation;

comparing, joining and merging files; and

aging Accounts Receivable, gap and duplicate record detection.

The Integrated Test Facility is used for the test of:

edit checking and verification criteria;

database updates and security features such as transaction rollbacks

computer generated transactions; and output.

This software has become more powerful and easier to use over the

past few years, and now crosses all computing platforms from

mainframe to minicomputers to microcomputers.

4
Need for

Change

It can be easily determined that the methods of the past are not

totally adequate. The audit function has always been, and will

remain, an important function. It has always been necessary for

independent verification and certification of financial records and

this will not change in the future. However, it is often not possible

to allow financial systems to go unaudited for any given length of

time and then expect to be able to perform an audit to determine the areas and extent of problems. Even if this were possible, using only

this kind of reactive auditing may not be efficient. The ability to constantly monitor (or audit) the system is needed to establish good

financial integrity with our systems today. With computer

technology as it is today, this method is practical.

5
Self Monitoring

Allows

Management to

be Proactive

Management should not need auditors to tell them where problems

exist. Management should have the tools and ability to find and

correct problems as they occur. New accounting systems can

provide ways to prevent errors from occurring. One method is to have data verification and edit-checking occur as the data are entered. Some well know edit-checks are:

mandatory fields - insures that vital information is entered in the

record;

range - checks to see that data input to a certain field fits within predefined limits;

list - limits input to a list of pre-defined literals; and

unique - prevents the entering of two records with the same

information in the key field.

In other words, reasonable edit checks and limits are established as the system is implemented. Data are compared to these checks and

limits as they are entered. If the data fail the tests, the user must

take the appropriate action to correct the problem. These tests greatly improve the quality of information in a financial information

system. Edit-checking and data verification as described above are important and are used as data are entered into the system. They

operate as a mechanism to decide if the data entered should be

allowed into the system. If the data are not acceptable, they are rejected and need to be entered again. This mechanism should be

considered to be the first level of self monitoring in a good financial

system. Documentation should be available in a "Self Monitoring"

section of the manuals and should describe in detail the tests that are performed on data being entered into the system. These edit-checks

and their documentation should be a part of the Self Monitoring

Service. This however is only the first part of that service. Next

we must verify data involved in multiple transactions such as incurring and paying a liability. Also we must verify transactions

that are within an acceptable range but which still should cause management to take a second look after they are in the system. One

example is the need to review valid but high dollar transactions.

6
These capabilities should be included in the Sell Monitoring Service

as a set of reports generated by queries to the data in the system.

These reports should give the manager some of the functionality that

has been used by auditors to analyze the data in the system. The

service should also include those tools auditors use such as Generalized Audit Software and the Integrated Test Facility. These

kinds of capabilities could and should be included in accounting

systems allowing management to perform the functions and tests described previously on page 4. Management could then more

easily perform financial analysis on the data from their accounting

systems and they would also have the ability to find discrepancies in accounts and transactions as they occur.

The Self Monitoring Service should include expert system

functionality that allows for an information store of applicable rules,

regulations, accounting policy and law to be compared to transactions. This expert system functionality could be provided

with or without the use of an actual expert system. The store of

rules, regulations, policy, and law will be used for both edit-checks

and reports to management on discrepancies found in the records.

The store could also contain information regarding managements

goals. The Self Monitoring Service could then test and report to management the level of success with which these goals are being

met. The figure below is a flowchart of how systems are currently

audited/monitored and how they would be audited/monitored with

the Self Monitoring Service in place.

The unshaded blocks

represent the use of Generalized Audit

Software with an

accounting system.

The shaded areas show the Self Monitoring Service

Added.

AGENCY DATABASE

Built In

1 Audit Tests I

Agency

Reports Management

Exception Reports

Corrective Action

If Needed

IGeneralized

Audit Software

Selected Data

Analysis

Audit Reports

7
Considerations

for

Implementation

of the Self

Monitoring

Service

The Self Monitoring Service will contain a set of edit-checking and

data verification functions and a set of reports based on queries

made of the financial records. If the financial system is built on top

of a relational database, designing these edit-checks and reports from

a computer technology standpoint is simple. In any case these

capabilities are technically possible. A more vexing question is where and how to implement the edit-checks and who should

develop the reports for the Self Monitoring Service. The answer to

this question will probably be different in each situation. In an

organization that is made up of very uniform divisions, the

implementation can probably be done by the developer of the

financial system or at a central point in the organization. In a very

diverse organization, implementation will probably be needed for

each division. In most cases there will likely be a combination of

these two methods. There are some areas such as travel where

similarities exist in how organizations do things. This would allow

a large portion of the Self Monitoring Service to be developed for an entire organization. Some minor additions or changes may be

needed in some divisions or areas within the organization. These

changes will most likely be more effective if they are developed

with the help of the division that will use them. In all cases the

help of an audit organization is essential. In the case of the federal

government the Office of the Inspector General is probably a good

audit organization to have involved. This involvement will assure

that the set of tools in the Self Monitoring Service is complete and

relevant.

The Self Monitoring Service might include the following set of edit

checks or queries to the financial records:

Prevent duplicate or overpayment for goods or services

Prevent duplicate payments or over payments for travel

Prevent a payment from being made to a male patient for prenatal care

'km Prevent a transaction for a dollar amount that is higher than an

authorized amount

Report payments that are not made in a timely manner

Report payments that are legal but are for a high dollar value (These

may be correct, but management might want to review them)

8
Assure that benefit payments are not paid for a longer period of time

than legal

Identify all employees who received an advance of $1,000 or more

Identify all employees with travel claims that have been outstanding

for longer than a given period

Prevent the payment of transportation cost that exceeds the

transportation cost authorized

Identify those instances in which transportation cost claimed exceeds

the transportation cost authorized

Identify those instances where travel was completed, an advance was

drawn, and the agency reimbursed the individual between specific

amounts such as $200 and $500

Identify all employees who took longer than 10 days to file their

claims after completing their travel

Verify the interest rate for a loan during a designated period

Verify the discount rate for a specific quantity ordered.

Travel is an area where most organizations and parts of

organizations tend to have very similar operating methods. Still it is not clear that the dollar ranges in the above example would apply to

all parts of an organization. For instance, some parts of the

organization might have reason to travel internationally. In this case, the dollar amounts would be expected to be higher than a part

of the organization that never has the need for international travel. This is an example of where changes would be needed at various

parts of the organization.
Conclusions There is concern from many levels of government regarding the

need for more dependable accounting and financial systems in use

within the Federal Government today. Clearly, current systems and

methods of monitoring these systems are not working well. It is important to build into financial systems as many methods as possible to monitor the transactions of the systems; to have methods

that determine the validity of data before they are entered into the

system; and for management to be able to take a second look at

' particularly sensitive data after they are in the system. It is also

important to build other audit tools such as Generalized Audit

Software and the Integrated Test Facility into today's financial

systems. Finally, it is important to include expert system

functionality such as providing management reports that indicate

how the data in the system compare with rules, regulations, laws and

goals of the organization. Today's computer technology makes this

possible. Implementors of new accounting systems should include a

set of tools that prevents obviously incorrect data from being entered

into the system, and allows management to review data that are determined to be sensitive to the organization. These tools should

be well documented and presented in a central place within the

system. This group of tools can be thought of and described to audit organizations as a Self Monitoring Service. Audit

organizations base the decision of how complete an audit is needed

for a system in part on the internal control included in the system.

The Self Monitoring Service, if well thought out and well

documented in conjunction with the audit organization, should serve

to lower the audit work and the audit cost incurred by the

organization in producing audited financial statements for the

organization.

10
^9191*911068 1- Charles A. Bowsher, Comptroller General of the United

States - "Government Management - Report on 17 HighRisk Areas," Testimony Before the Committee on Governmental Affairs, United States Senate, January 8,

1993.

2. One Hundred First Congress of the United States of America

- "Chief Financial Officers Act of 1990," January 23, 1990

(amended 1994).

3. Joint Financial Management Improvement Program - "Core

Financial System Requirements," January 1988 and Revised

April 1994.

4. John W. Lainhart, IV and Barry R. Snyder - "A

Simultaneous-Parallel Approach To Testing Computerized

Systems," GAO Review, Summer 1977.

5. United States General Accounting Office - "Assessing the

Reliability of Computer-Processed Data," GAO/OP-8.1 .3, September 1990.

11
I
ANNOUNCEMENT OF NEW PUBLICATIONS ON

COMPUTER SYSTEMS TECHNOLOGY

Superintendent of Documents

Government Printing Office

Washington, DC 20402

Dear Sir:

Please add my name to the announcement Hst of new pubUcations to be issued in the series: National Institute of Standards and Technology Special Publication 500-.

Name

Company

Address

City State Zip Code

(Notification key N-503)

U.S. Government Printing Office -is :1995 390-201



Technical Publications

Periodical

Journal of Research of the National Institute of Standards and Technology—Reports NIST research and development in those disciplines of the physical and engineering sciences in which the Institute is active. These include physics, chemistry, engineering, mathematics, and computer sciences. Papers cover a broad range of subjects, with major emphasis on measurement methodology and the basic technology

underlying standardization. Also included from time to time are survey articles on topics closely related to the Institute's technical and scientific programs. Issued six times a year.

Nonperiodicals

Monographs—Major contributions to the technical literature on various subjects related to the

Institute's scientific and technical activities. Handbooks—Recommended codes of engineering and industrial practice (including safety codes) devel- oped in cooperation with interested industries, professional organizations, and regulatory bodies. Special Publications—Include proceedings of conferences sponsored by NIST, NIST annual reports, and

other special publications appropriate to this grouping such as wall charts, pocket cards, and bibliographies.

National Standard Reference Data Series—Provides quantitative data on the physical and chemical

properties of materials, compiled from the world's literature and critically evaluated. Developed under a worldwide program coordinated by NIST under the authority of the National Standard Data Act (Public

Law 90-396). NOTE: The Journal of Physical and Chemical Reference Data (JPCRD) is published

bimonthly for NIST by the American Chemical Society (ACS) and the American Institute of Physics (AIP).

Subscriptions, reprints, and supplements are available from ACS, 1155 Sixteenth St., NW, Washington, DC

20056.

Building Science Series—Disseminates technical information developed at the Institute on building

materials, components, systems, and whole structures. The series presents research results, test methods, and

performance criteria related to the structural and environmental functions and the durability and safety

characteristics of building elements and systems.

Technical Notes—Studies or reports which are complete in themselves but restrictive in their treatment of

a subject. Analogous to monographs but not so comprehensive in scope or definitive in treatment of the subject area. Often serve as a vehicle for final reports of work performed at NIST under the sponsorship of

other government agencies.

Voluntary Product Standards—Developed under procedures published by the Department of Commerce

in Part 10, Title 15, of the Code of Federal Regulations. The standards establish nationally recognized

requirements for products, and provide all concerned interests with a basis for common understanding of

the characteristics of the products. NIST administers this program in support of the efforts of private-sector

standardizing organizations.

Order the following NIST publications—FIPS and NISTIRs—from the National Technical Information

Service, Springfield, VA 22161.

Federal Information Processing Standards Publications (FIPS PUB)—Publications in this series collectively constitute the Federal Information Processing Standards Register. The Register serves as the

official source of information in the Federal Government regarding standards issued by NIST pursuant to the Federal Property and Administrative Services Act of 1949 as amended, Public Law 89-306 (79 Stat. 1127), and as implemented by Executive Order 11717 (38 FR 12315, dated May 11, 1973) and Part 6 of

Title 15 CFR (Code of Federal Regulations).

NIST Interagency Reports (NISTIR)—A special series of interim or final reports on work performed by

NIST for outside sponsors (both government and nongovernment). In general, initial distribution is handled

by the sponsor; public distribution is by the National Technical Information Service, Springfield, VA 22161,

in paper copy or microfiche form.