会计信息系统12版英文教辅资源rais12-IM-CH05GE

Page1of23

CHAPTER5

COMPUTERFRAUD

Instructor’sManual

LearningObjectives:

1.Explainthethreatsfacedbymoderninformationsystems.

2.Definefraudanddescribetheprocessonefollowstoperpetuatea

fraud.

3.Discusswhoperpetratesfraudandwhyitoccurs,includingthe

pressures,opportunities,andrationalizationsthatarepresent

inmostfrauds.

4.Definecomputerfraudanddiscussthedifferentcomputerfraud

classifications.

5.Explainhowtopreventanddetectcomputerfraudandabuse.

Jasonanticipatedthefollowingquestionsthatmanagementwasgoingto

ask:

1.Whatconstitutesafraud,andisthewithholdingproblemafraud?

2.Howwasthefraudperpetrated?WhatmotivatedDontocommitit?

3.Whydidthecompanynotcatchthesemistakes?Wasthereabreakdownincontrols?

4.Howcanthecompanydetectandpreventfraud?

5.Howvulnerableisthecompany’scomputersystemtofraud?

Introduction

Oursocietyhasbecomeincreasinglydependentonaccountinginformation

systems.

Assystemcomplexityandourdependenceonsystemsincrease,companies

facethegrowingriskoftheirsystemsbeingcompromised.

Arecentsurveydisclosedthat

1.67percentofcompanieshadasecuritybreach

2.Morethan45percentweretargetedbyorganizedcrime

3.60percentreportedfinanciallosses

ThefourtypesofthreatsacompanyfacesareexplainedinTable5-1on

page142.

Page2of23

LearningObjectiveOne

Explainthethreatsfacedbymoderninformation

systems.

AISThreats

FourTypesofSystemsThreats:

1.Naturalandpoliticaldisasters

2.Softwareerrorsandequipmentmalfunctions

3.Unintentionalacts

4.Intentionalacts(computercrimes)

1.Naturalandpoliticaldisasters

Fires,excessiveheat,floods,earthquakes,highwinds,war,

andattacksbyterrorists

▪WorldTradeCenterinNewYorkCity

▪FloodinChicago

▪HeavyrainsinMississippiandMissouriRivers

▪EarthquakesinLosAngelesandSanFrancisco

▪Attacksongovernmentinformationsystemsbyforeigncountries,espionageagents,andterrorists

2.SoftwareErrorsandEquipmentMalfunctions

Lossesduetosoftwarebugsareatalmost$60billiona

year.

Morethan60percentofthecompaniesstudiedhad

significantsoftwareerrorsinthepreviousyear.For

example,

▪BugsinnewtaxaccountingsystemweretoblameforCalifornia’sfailuretocollect$635millioninbusinesstaxes.

▪Therehavebeenanumberofmassivepowerfailuresthathavelefthundredsofthousandsofpeopleandmanybusinesseswithoutpower.

Page3of23

▪AsoftwarebuginBurgerKing’ssoftwareresultedina$4,334.33debitcardchargeforfourhamburgers.Thecashieraccidentallykeyedinthe$4.33chargetwice.

3.UnintentionalActs

TheComputingTechnologyIndustryAssociationestimates

thathumanerrorscause80percentofsecurityproblems.

ForresterResearchestimatesthatemployeesunintentionally

createlegal,regulatory,orfinancialrisksin25percent

oftheiroutbounde-mails.

Programmersmakelogicerrors.Examplesincludethe

following:

▪InJapan,adataentryclerkatMizuhoSecuritiesmistakenlykeyedinasalefor610,000sharesofJ-Comfor1yeninsteadofthesaleof1sharefor610,000yen.Theerrorcostthecompany$250million.

▪Abankprogrammermistakenlycalculatedinterestforeachmonthusing31days.Resultedinmorethan$100,000inexcessinterestpaid.

▪AnerrorinaFannieMaespreadsheetresultedina$1.2billionmisstatementofitsearnings.

▪UPSlostacardboardboxwithcomputertapescontaininginformation,suchasnames,SocialSecuritynumbers,accountnumbers,andpaymenthistorieson3.9millionCitigroupcustomers.

▪TreasuryDepartmentmistakeininterestrate8.67percentthatshouldhavebeen6.87percent.Thiswascaughtbeforethechecksweresentout;couldhaveresultedinoverpaymentsofmorethan$14million.

NotetoInstructor:Thefollowingexampleisnotinthe11th

editionofthisbook.However,itwasinthe10theditionof

thebook.

▪AdataentryclerkatGiantFoodmistakeinquarterlydividend$2.50shouldbe$0.25.Resultedin$10millioninexcessdividends.

4.IntentionalActs(ComputerCrimes)

Themostfrequenttypeofcomputercrimeisfraud.Thisis

wheretheintentistostealsomethingofvalue.

Page4of23

Thethreatcanalsobeintheformofsabotage,inwhich

theintentistodestroyorharmasystemorsomeofits

components.

Informationsystemsareincreasinglyvulnerabletoattack.

Inarecentthree-yearperiod,thenumberofnetworksthat

werecompromisedrose700percent.

Exampleofsecuritybreaches,considerthecaseof

OpenTable,

designits

arestaurantreservationservicethatdidnot

cookieproperly.

AcookieisdatathatWebsitesstoreonyourcomputer.

ThecookieidentifiestheWebsitestoyourcomputer

andidentifiesyoutotheWebsitesoyoudonothave

tologoneachtimeyouvisitthesite.

AtOpenTable,thecustomernumberstoredinthe

cookiewasveryeasytochange.

Anexperiencedprogrammeropenedanaccountat

OpenTableand,inlessthananhour,wrotea

programthatcycledthroughallthecustomer

numbersanddownloadedmostofthecompany’s

database.

MultipleChoice1

Operatingsystemcrashesisanexampleof:

a.naturalandpoliticaldisasters

b.intentionalacts

c.unintentionalacts

d.softwareerrorsandequipmentmalfunctions

LearningObjectiveTwo

Definefraudanddescribetheprocessonefollows

toperpetuateafraud.

INTRODUCTIONTOFRAUD

Fraudisanyandallmeansapersonusestogainanunfair

advantageoveranotherperson.Legally,foranacttobe

consideredfraudulenttheremustbe:

1.Afalsestatement,representation,ordisclosure

2.Amaterialfact,whichissomethingthatinducesaperson

toact

Page5of23

3.Anintenttodeceive

4.Ajustifiablereliance;thatis,thepersonreliesonthe

misrepresentationtotakeanaction

5.Aninjuryorlosssufferedbythevictim

AttemptstoEstimatetheStaggeringLossesfromFraud:

1.TheAssociationofCertifiedFraudExaminersestimates

totalfraudlossesintheUnitedStatestobeabout$660

billionayear.

2.Income-taxfraud(thedifferencebetweenwhattaxpayersowe

andwhattheypaytothegovernment)isestimatedatwell

over$350billiondollarsayear.

3.Fraudinthehealth-careindustryisestimatedtoexceed

$100billionayear.

75to90percentofallcomputercrimesareperpetratedby

insiders.

Fraudperpetratorsarealsoreferredtoaswhite-collarcriminals.

StatementonAuditingStandards(SAS)No.99:

Fraudtakestwoforms

1.Misappropriationofassetsand

2.Fraudulentfinancialreporting

MisappropriationofAssets

Misappropriationofassetsisoftenreferredtoasemployee

fraud

Atypicalemployeefraudhasanumberofimportantelements

orcharacteristics:

1.Thefraudperpetratormustgainthetrustor

confidenceofthepersonorcompanybeingdefrauded.

2.Insteadofaweaponorphysicalforcetocommita

crime,fraudperpetratorsusetrickery,cunning,or

falseormisleadinginformationtoobtainmoneyor

assets.

3.Theyhidetheirtracksbyfalsifyingrecordsorother

information.

4.Fewfraudsareterminatedvoluntarily.Instead,the

fraudperpetratorcontinuesdueto“needorgreed.”

Page6of23

Often,perpetratorsbegintodependonthe“extra”

incomeandgettoapointwheretheycannotaffordto

stop.

Othertimestheymovetoahigherlifestylethat

requiresagreateramountofmoney.

It’satthispointwheretheygetbraver,orshould

wesaymorerelaxed,wheretheperpetratorgets

greedyandstartsstealinglargeramountsofmoney;

thisiswheretheynormallygetcaught.

5.Fraudperpetratorsspendtheirill-gottengains,

usuallyonanextravagantlifestyle.Rarelydothey

saveorinvestthemoneytheytake.Someofthese

highcostluxuriousitemsincludebighomes,fancy

cars,gambling,orjustabigspendertypeperson.

6.Manyperpetratorsthatbecomegreedynotonlystart

takinggreateramountsofmoney,butalsotakethe

moneymoreoften.

7.Aspreviouslymentioned,perpetratorsatsomepoint

startgettingbraverandgrowcarelessor

overconfident.Thisisthepointwheretheycanalso

makeamistakeandgetcaught.

8.Thefraudperpetratorcannotgetawaywithstealing

cashorpropertyforever.Atsomepoint,althoughit

maytakesometime,theyaregoingtogetcaught.

9.Themostsignificantcontributingfactorsinmost

employeefraudsaretheabsenceofinternalcontrols

orfailuretoenforceexistinginternalcontrols.

Afterall,ifapersonthatisalreadydishonestin

hisorhernature;iftheyfindoutthemanagementis

notconcernedaboutinternalcontrols,thenthis

makesitveryeasyforthemtobecomeafraud

perpetratorandstartstealingcashorproperty.

FraudulentFinancialReporting

TheTreadwayCommissiondefinedfraudulentfinancial

reportingasintentionalorrecklessconduct,whetherby

actoromission,thatresultsinmateriallymisleading

financialstatements.

TheTreadwayCommissionstudied450lawsuitsagainst

auditorsandfoundundetectedfraudtobeafactorin

halfofthem.

SomeprimeexamplesareEnron,WorldCom,Tyco,

Adelphia,HealthSouth,GlobalCrossing,andXerox.

Executivescookthebooks,astheysay,byfictitiously

inflatingrevenues,recognizingrevenuesbeforetheyare

Page7of23

earned,closingthebooksearly(delayingcurrentperiod

expensestoalaterperiod),overstatinginventoriesor

fixedassets,andconcealinglossesandliabilities.

TheTreadwayCommissionrecommendedfouractionstoreduce

thepossibilityoffraudulentfinancialreporting:

1.Establishanorganizationalenvironmentthat

contributestotheintegrityofthefinancial

reportingprocess.

2.Identifyandunderstandthefactorsthatleadto

fraudulentfinancialreporting.

3.Assesstheriskoffraudulentfinancialreporting

withinthecompany.

4.Designandimplementinternalcontrolstoprovide

reasonableassurancethatfraudulentfinancial

reportingisprevented.

AstudybytheAssociationofCertifiedFraudExaminersfound

thatmisappropriationofassetsbyemployeesismorethan17

timesmorelikelythanfraudulentfinancialreporting.

SASNo.99:TheAuditor’sResponsibilitytoDetectFraud

SASNo.99requiresauditorsto:

1.Understandfraud.

2.Discusstherisksofmaterialfraudulent

misstatements.

3.Obtaininformation.

4.Identify,assess,andrespondtorisks.

5.Evaluatetheresultsoftheiraudittests.

6.Documentandcommunicatefindings.

7.Incorporateatechnologyfocus.

MultipleChoice2

TheAssociationofCertifiedFraudExaminersestimatestotalfraud

lossesintheUnitedStatestobemorethan

a.$350billionayear

b.$660billionayear

c.$100billionayear

d.$800billionayear

MultipleChoice3

WhichofthefollowingstatementsisFALSE?

a.Foranacttobefraudulenttheremustbeafalsestatement,

representation,ordisclosure.

Page8of23

b.Fraudperpetratorsareoftenreferredtoasmanagementfraud.

c.Misappropriationofassetsisoftenreferredtoasemployee

fraud.

d.SASNo.82wasadoptedin1997.

LearningObjectiveThree

Discusswhoperpetratesfraudandwhyitoccurs,

includingthepressures,opportunities,and

rationalizationsthatarepresentinmostfrauds.

WhoPerpetratesFraudandWhyItOccurs

Perpetratorsofcomputerfraudtendtobeyoungerandpossess

morecomputerknowledge,experience,andskills.

Somehackersandcomputerfraudperpetratorsaremoremotivated

bycuriosity,aquestforknowledge,thedesiretolearnhow

thingswork,andthechallengeof“beatingthesystem.”

Mosthavenopreviouscriminalrecord.

Researchshowsthatthreeconditionsarenecessaryforfraudto

occur:apressure,anopportunity,andarationalization.Thisis

referredtoasthefraudtriangleandisshownasthemiddle

triangleinFigure5-1onpage147.

Pressures

Apressureisaperson’sincentiveormotivationforcommittingthefraud.Thethreecommontypesofpressuresare1)financial,emotional,andlifestyle,whichissummarizedinTable5-2onpage147.Table5-3onpage148providesthepressuresthatcanleadtofinancialstatementfraud.

Opportunities

AsshownintheopportunitytriangleinFigure5-1onpage

147,opportunityistheconditionorsituationthatallows

apersonororganizationtodothreethings:

1.Committhefraud

Mostfraudulentfinancialreportingconsistsofthe

overstatementofassetsorrevenuesorthe

understatementofliabilities,orthefailureto

discloseinformation.

2.Concealthefraud

Page9of23

Acommonandeffectivewaytohideatheftisto

chargethestolenitemtoanexpenseaccount.For

example,chargesuppliestoanexpenseaccountwhen

theyareinitiallypurchased;beforetheyareused.

Thisallowstheperpetratortheopportunitytouse

someofthesuppliesforpersonalbenefitatthe

expenseofthecompany.Theseunusedsuppliesshould

havebeenrecordedasanassetcalledSuppliesuntil

theyareused.

Anotherwaytohideadecreaseinassetsisby

lapping.Inalappingscheme,theperpetratorsteals

thecashorcheckthatcustomerAmailsintopayits

accountsreceivable.Fundsreceivedatalaterdate

fromcustomerBareusedtopayoffcustomerA’s

balance.FundsfromcustomerCareusedtopayoff

customerB,andsoforth.

Inakitingscheme,theperpetratorcoversupatheft

bycreatingcashthroughthetransferofmoney

betweenbanks.Forexample,supposeafraud

perpetratoropenscheckingaccountsinthreebanks,

calledbankA,B,andC,anddeposits$100ineach

account.Thentheperpetrator“creates”cashby

depositinga$1,000checkfrombankAintobankBand

thenwithdrawsthe$1,000frombankB.Ittakestwo

daysforhischecktoclearbankA.Becausethereare

insufficientfundsinbankAtocoverthe$1,000

check,theperpetratordepositsa$1,000checkfrom

bankCtobankAbeforehischecktobankBclears

bankA.BecausebankCalsohasinsufficientfunds,

$1,000mustbedepositedtobankCbeforethecheck

tobankAclears.ThechecktobankCiswrittenfrom

bankB,whichalsohasinsufficientfunds.Andthe

schemecontinues.Ihavealsoseensituationswhere

kitingalsoincludescreditcardsinwiththeuseof

checkingaccounts.

NotetoInstructor:Becausemostbankswouldrequireyoutodepositsomemoneytostartacheckingaccount,aninitialdepositof$100ineachbankwasincludedabove.Inaddition,thechartsbelowprovideasomewhatpictureexplanationoftheabovekitingscheme.Thechartbelowusesdates,balances,andNSFduedates.

Page10of23

BANKA

#11/11,000check

Bal.-1,000

NSFdueon1/3

1/3+1,000

Bal.-0-

NoNSFDue

BANKB

1,000

1/1Bal.+1,000

#21/2W/D-1,000

Bal.-0-

NoNSFDue

#41/51,000check

Bal.-1,000

NSFDue1/7

Deposit+1,0001

PERPETRATOR

1/2+1,000

#31/31,000check

Bal.-1,000

NSFDue1/5

+1,000

Bal.-0-

NoNSFDue

Note#1:Atthispointtheperpetratormaywanttodepositthe$1,000hehashadfor5days(1/2

through1/6),onthemorningof1/7andstartoveragainwithBankA.

Legend:W/D=withdrawscashNSF=nonsufficientfundsBal.=balance

BANKC

3.ConverttheTheftorMisrepresentationtoPersonalGain

Inemployeefraud,allfraudperpetratorsgothroughtheconversionphaseunlessthey

stealactualcashthatcanbespentorusetheassetpersonally.

Table5-4onpage149listssomeofthemorefrequentlymentionedopportunitiesthat

permitemployeeandfinancialstatementfraud.

Opportunitiesforfraudoftenstemfrominternalcontrolfactors.

Acontrolfeaturemanycompanieslackisabackgroundcheckonallpotentialemployees.

Page11of23

[Thispageisleftblankintentionally]

Rationalizations

Rationalizationallowsperpetratorstojustifytheirillegal

behavior.

Alistofsomeoftherationalizationspeopleuse:

1.Iamonly“borrowing”themoney(orasset)andwill

repaymy“loan.”

2.YouwouldunderstandifyouknowhowbadlyIneeded

it.

3.WhatIdidwasnotthatserious.

4.Itwasforagoodcause(theRobinHoodsyndrome,

robbingfromtherichtogivetothepoor).

5.Ioccupyaveryimportantpositionoftrust.Iam

abovetherules.

6.Everyoneelseisdoingit,soitisnotthatwrong.

7.Noonewilleverknow.

8.Thecompanyowesittome,andIamtakingnomore

thanisrightfullymine.

MultipleChoice4

Thethreeconditionsthatarepresentwhenfraudoccursincludes:

a.attitude

b.opportunity

c.lackofcontrol

d.financial

MultipleChoice5

Thepressuresthatcanleadtoemployeefraudinclude

a.fearoflosingjob

b.lackofcontrol

c.poorperformanceratings

d.familyorpeerpressure

e.AandD

MultipleChoice6

Internalcontrolfactorsthatprovideanopportunityforemployeeand

financialstatementfraudincludes

a.incompetentpersonnel

b.operatingonacrisisbasis

c.inadequatesupervision

d.lowemployeemoraleandloyalty

LearningObjectiveFour

Definecomputerfraudanddiscussthedifferent

Page12of23

computerfraudclassifications.

Page13of23

ComputerFraud

TheU.S.DepartmentofJusticedefinescomputerfraudasany

illegalactforwhichknowledgeofcomputertechnologyis

essentialforitsperpetration,investigation,orprosecution.

Morespecifically,computerfraudincludesthefollowing:

1.Unauthorizedtheft,use,access,modification,copying,and

destructionofsoftwareordata

2.Theftofmoneybyalteringcomputerrecords

3.Theftofcomputertime

4.Theftordestructionofcomputerhardware

5.Useortheconspiracytousecomputerresourcestocommita

felony

6.Intenttoillegallyobtaininformationortangibleproperty

throughtheuseofcomputers

TheAssociationoftheCertifiedFraudExaminersprovidesthe

generaldefinitionofcomputerfraud:

Anydefalcationorembezzlementaccomplishedbytamperingwithcomputerprograms,datafiles,operations,equipment,ormediaandresultinginlossessustainedbytheorganizationwhosecomputersystemwasmanipulated.

Anotherdefinitionofcomputercrime:

Inacomputercrime,thecomputerisinvolved—directlyorindirectly—incommittingthecriminalact.Sabotageofcomputerfacilitiesisclassifiedasadirectcomputercrimeandunauthorizedaccessofstoreddataisanindirectcomputercrimebecausethepresenceofthecomputercreatedtheenvironmentforcommittingthecrime.

TheRiseinComputerFraud

Computersystemsareparticularlyvulnerabletocomputercrimes

forthefollowingreasons:

1.Billionsofcharactersofdataarestoredincompany

databases.Peoplewhomanagetobreakintothesedatabases

cansteal,destroy,oraltermassiveamountsofdatain

verylittletime.

2.Organizationswantemployees,customers,andsuppliersto

haveaccesstotheirsystem.Thenumberandvarietyof

theseaccesspointssignificantlyincreasetherisks.

3.Computerprogramsonlyneedtobechangedormodifiedonce

Page14of23

withoutpermissionforthesystemtooperateimproperlyfor

aslongasthesystemisinuse.

4.Modernsystemsutilizepersonalcomputers(PCs),whichare

inherentlymorevulnerabletosecurityrisks.Itis

difficulttocontrolphysicalaccesstoeachnetworkedPC.

Inaddition,PCsandtheirdatacanbelost,stolen,or

misplaced.

5.Computersystemsfaceanumberofuniquechallenges:

reliability(i.e.,accuracy,completeness),equipment

failure,environmentaldependency(i.e.,power,damagefrom

waterorfire),vulnerabilitytoelectromagnetic

interferenceandinterruption,eavesdropping,and

misrouting.

Theincreaseincomputerfraudschemesisduetosomeofthe

followingreasons:

1.Noteveryoneagreesonwhatconstitutescomputerfraud.

2.Manycomputerfraudsgoundetected.

TheFBIestimatedthatonlyonepercentofallcomputer

crimewasdetected;whereasothersestimatedittobe

between5and20percent.

3.Ahighpercentageofuncoveredfraudsarenotreported.

4.Manynetworkshavealowlevelofsecurity.

5.ManyInternetpagesgivestep-by-stepinstructionsonhow

toperpetratecomputercrimesandabuses.

6.Lawenforcementisunabletokeepupwiththegrowing

numberofcomputerfrauds.

7.Thetotaldollarvalueoflossesisdifficulttocalculate.

ComputerFraudClassifications

AsshowninFigure5-2onpage152,onewaytocategorize

computerfraudistousethedataprocessingmodel:input,

processor,computerinstructions,storeddata,andoutput.

Input

Thesimplestandmostcommonwaytocommitfraudistoalter

computerinput.Itrequireslittle,ifanycomputerskills.

Instead,perpetratorsneedonlyunderstandhowthesystem

operatessotheycancovertheirtracks.

Tocommitpayrollfraud,perpetratorscanenterdatato

increasetheirsalary,createafictitiousemployee,orretain

aterminatedemployeeontherecords.

Page15of23

Exampleofinputfraud,aNewYorkbankemployeechangesthe

companydepositslipstoforgeddepositslips.Forthreedays

hedepositedbankdepositsinhispersonalaccount.Thenhe

disappearedandwasnotcaughtasheusedanaliasname.

Therearemoreexamplesonpages152and153.

Processor

Computerfraudcanbecommittedthrou