A SIMULATION APPROACH TO DATA PROCESSING CONTROLS Simulation Games and Experiential Exercises in Action, Volume 2, 1975 145 A SIMULATION APPROACH TO DATA PROCESSING CONTROLS James A. Heintz, Indiana University John H. Myers, Indiana University The audit of computerized accounting systems is a topic of growing importance today in both graduate and undergraduate auditing courses. Fortunately, this growth in importance has been accompanied by a significant increase in the amount of literature available to introduce students to relevant computer auditing concepts. Yet, there remains a need to augment largely descriptive materials with opportunities to learn by doing. In order to make the computer lecture materials more meaningful, at Indiana University we have developed a data processing computer problem for classroom use. The problem employs a payroll processing program to provide students hands- on experience with data processing controls, test decks, and flow- charting. BASIC PROCEDURES Preparation for the eventual use of the simulation begins early in the semester, although the students are unaware of it. During the first class, each student records his name and social security number on a mark-sense sheet. From these sheets, data cards are generated which constitute the “personnel office” file ultimately used in the simulation. When the simulation is introduced, each student normally is provided with (1) a brief written introduction explaining the purposes and basic procedures of the simulation, (2) specific instructions for punching cards to operate the program, and (3) the payroll program flowchart. In a business with an EDP payroll routine, payroll processing typically involves reading year-to- date and other basic data from a master file (tape), reading a card containing the current pay period data, writing a pay check for the employee, and then writing an updated master file record on a new tape. For classroom purposes, this processing sequence is retained, but the old master file is replaced by punched master file cards prepared by each student, and the updated master file is written on computer paper. Thus, to operate the program, each student must prepare two cards: (1) a master file card and (2) a pay data card. The master file card contains the employee’s name and social security number, job classification, charitable deduction, and year-to-date figures for gross and net pay, federal income and social security taxes withheld, and charitable deductions. The pay data card contains the employee’s name and social security number, and indicates the beginning and ending dates of the current pay period, and the number of hours worked during the period. Simulation Games and Experiential Exercises in Action, Volume 2, 1975 146 At the class when the cards are turned in, a control worksheet also is prepared. On the worksheet each student records his name, job code, gross pay year-to-date, and number of hours worked. The worksheet columns are subsequently added to obtain control totals for comparison with totals that will be generated during the computer run. All cards turned in are processed, and each student is provided with feedback in the form of one sheet of computer paper for each pair of master file and pay data cards submitted. The top two lines of the page contain the data which were on the cards submitted. The contents of the rest of the page vary depending on the nature of the cards. If “good” data cards were submitted, the page will contain check stub information, a valid pay check, and a print out of the updated master file for this employee. If “bad” data cards were submitted, the program will cause error messages of various kinds to be printed on the page, as explained in the following section. STRUCTURE OF THE SIMULATION-LEARNING OPPORTUNITIES Classroom discussion and analysis of the payroll program flowchart lead to identification of many controls supposedly operative in the system. Preparation of test decks by individual students, groups, or the class as a whole constitutes a significant part of the experience. A substantial data set is needed to examine the various checks included in the program. A character mode test is made for alphabetic characters in numeric fields. Each social security number includes a check digit. If this or any other digit in the employee’s number is not correctly calculated and punched, an error message should result. The employee’s number is compared with the personnel office file to identify any unauthorized employees. The job code is examined to determine whether it is one of only three codes assumed to be authorized for this department. Mathematical accuracy of the year-to-date data on the master file is also tested. On the pay data card, the beginning and ending dates for the pay period are tested to be sure they are current. In addition, the hours worked are analyzed. If more than 80 but less than or equal to 120 hours are worked during the specified two-week period, this should register as an overtime check and require two signatures. If more than 120 hours are submitted as worked for the two week period, this should be treated as a special case requiring manual handling, and no pay check will be written. These represent a number of the tests incorporated in the program for which the students are challenged to develop an effective and efficient test deck. The deck should be effective in that the maximum number of system controls should be identified and tested. The deck should Simulation Games and Experiential Exercises in Action, Volume 2, 1975 147 be efficient in at least two senses. First, where tests of more than one control are possible on a single pass, this should be done. Second, care must be taken to see that only those errors intended to be tested are incorporated in a given pair of cards. It is not uncommon for a student’s intended test not to be executed because his cards were “kicked out” as a result of another, unintentional error that took precedent. The problems created by sloppy test deck preparation typically are very effectively demonstrated. In addition to this study of the test deck as a tool for examining individual controls, the simulation also affords an opportunity to demonstrate the roles of various types of control totals in system operation. As additional output from processing, the instructor is provided with two pages of processing and output controls. Included in the processing controls are an item count of cards processed, control totals on gross and net pay year-to-date and hours worked, and a hash total of all job codes. Output controls for the number of checks written and gross pay, taxes, charitable deductions and net pay are also provided. Reconciliation of the job code hash total, gross pay year-to-date, and hours worked totals with the figures ob- tamed manually on the control worksheets completed as the cards were submitted is normally highly educational. Rarely do the control worksheet and computer-generated totals match; invariably the problem is that the worksheet shows what the student intended to punch in the card rather than what he did punch. The meaning and functions of item counts, hash totals and control totals can be effectively demonstrated during this reconciliation process. One last aspect of the standard run of the simulation which provides a good learning experience at least for the brighter students is the lack of complete correspondence between the program flowchart and the actual program. Over the years we have noted certain deficiencies and inaccuracies in the program flowchart which we have decided to leave unchanged. It takes careful reading and analysis to ferret out these errors, and occasionally a few students identify them. When they do, this affords an additional opportunity to discuss appropriate auditor action and the general need for careful system documentation. OPTIONS - ADDITIONAL LEARNING DIMENSIONS In addition to the normal lack of correspondence between the flowchart and program noted above, further departure from the flowchart can be effected through an operator option to tamper with the program. Specifically, the hours-worked field can be altered, either consistently subtracting hours from those submitted or replacing all 8s with 7s. It typically takes a while after the output is returned for the protests to begin, but when the manipulation is discovered, another learning experience is provided. The need to gain assurance that you are testing the right Simulation Games and Experiential Exercises in Action, Volume 2, 1975 148 program and that no tampering is occurring during processing can be forcefully demonstrated by this simple “dirty deed” and subsequent discussion. In the discussion of a standard run of the simulation, considerable and fairly close student guidance was implied. As a practical matter, depending on the level of sophistication of a class, the students can be largely “turned loose” on the simulation virtually from the outset. We have found this approach to work well with graduate students who are more accustomed. to working as teams. Formed into teams, they often learn on their own the need to coordinate and generate an effective, efficient test deck, how to analyze the flow charting documentation, and the use of various control figures. The availability: of an operator option to generate intermediate summary totals by team facilitates the use of this team approach. One further optional dimension of the simulation which warrants mention is a “challenge” tun provided at the conclusion of the use of the simulation. For this run, students are encouraged to try to write themselves pay checks to which they are not entitled. They are encouraged to try any combination of data cards to achieve this end. It is at this stage that the final and most complete acquaintance with the role of the “personnel office” file is provided. The system will neither allow a check to be written to an employee not on the file, nor allow more than one check to be written to the same employee during the same pay period. The importance of control over this file in practice is readily demonstrated. SUMMARY This simulation is in no way a comprehensive exposure to system testing problems in an EDP environment. it does however, provide students with the opportunity to learn about the meaning and use flow charts, test decks, machine-oriented as distinct from people-oriented controls, processing controls and output controls. In addition, there is emphasis on the need for the auditor to exercise control to see that the right program is being tested and that it is being tested without unauthorized intervention. By augmenting descriptive materials with a simulation such as this, students are provided with an opportunity to learn by doing rather than by just reading. From our standpoint, the benefits are both numerous and clear. Table of Contents Volume 2, 1975 ABSEL Research - From Adolescence to Adulthood, Framing the Future of Business Simulation and Experiential Learning Inventory Simulation - A Time Sharing Television Output Simulation OMSIM: An Operations Management Game An Experiential-Cognitive Methodology in the First Course in Management: Some Preliminary Results Experiential Training Methodology, Traditional Training Methodology, and Perceived Opportunity to Satisfy Human Needs Operational Problems and Solutions of Business Gaming: A Primer One Experience with the V. K. Gadget Company - An Introduction to Managerial Accounting A conversational Marketing Mix Exercise The Use of Program BAYES in the Teaching of Sample Size Determination in Survey Research An Experiential Study of Performance in a Basic Management Course Using Student Opinions in Evaluation Results with a Business Game Some Impacts of Varying Amounts of Information on Frustration and Attitudes in a Finance Games Player Performance under Differing Player Configurations in the Investment Game: Some Preliminary Observations Integrating Across Functional Areas with a Computer-Assisted Case Using Computer Assisted Cases for Marketing Research Instruction ACQUIRES: ACcounting QUick Information REtrieval System A Simulation Approach to Data Processing Controls Motivating Simulation Game Performance and Satisfaction with Group Performance-Contingent Consequences The Educational Impact of Supplementary Personal Interaction in Computerized Business Games The Minnesota Manpower Management Simulation Games RAISE II, A Personal Simulation Management in a Test Tube: A Small Group Laboratory Simulation A Methodology for Measuring Decision Making in a Business Game A Case Study of a Capital Investment Simulation Combining Experiential and Clinical Methodologies in a Small Business Management Program Results of Using Gaming to Teach Ethics and Social Responsibility Business and Society: An In-Basket Simulation Crisis versus Non-Crisis Simulation Gaming Warm-up Company: A Business Simulation Business Simulations: Competition or Learning A Computerized Management Training System for Franchized Dealers Mode I Stores, Inc.: Computer Supported Cases on the Marketing Research and Problem Solving Process Experiential Learning in Statistics Through the Computer The COMPUSTAT Analysis System as an Instructional Resource Research on Experiential Learning: Enhancing the Process A Comparison of Lecture-Case Study and Lecture-Computer Simulation Teaching Methodologies in Teaching Minority Students Basic Marketing Student Evaluation of Reaction to a Marketing Simulation Game Under Varying Circumstances The Validity and Usefulness of Packaged Models in Game Play The Effectiveness of Experiential Methods in Training and Education: A Review Guidelines for the Future Development of Business Games The Future Potential of Structures Learning Exercises Turning Them on to Management by Turning Them Out to Managers with Video Tape Recorders