Task and Question 7 - IT and Health & Safety

This question consists of two related parts

SterMetro Cinemas (SMC) is a South Africa based cinema company with its head office situated in Johannesburg. SMC has 48 commercial cinema complexes across South Af-rica, with 4 international sites within Africa, encompassing over 450 large-scale screen auditoriums translating into more than 60 000 seats.

As the industry leader, SMC has pioneered cinema concepts such as CineArte, the world's largest dedicated art-house multiplex circuit as well as bringing CinePlatinum, the first 'business class' cinema experience, to South Africa.

SMC has a dedicated in-house internal audit activity, where you are employed as a senior internal auditor. You have more than 10 years internal audit experience and hold both the Certified Internal Auditor (CIA) and Certified Information Systems Auditor (CISA) des-ignations. You recently completed a research project on continuous auditing and hope to implement it at SMC in the near future. 

 SMC has been operating for the past 36 years. Until recently, movie tickets were only sold over the counter at the various cinema complexes. However, senior management recently realised that ticket sales were decreasing due to SMC not being in touch with its target market and their technology needs. It was therefore decided to develop and imple-ment a new computerised system for the processing of ticket sales, in order to address this problem. 

The director of entertainment services, Mr G Clooney, approached you for assistance, as he heard that internal auditing should be involved in systems development. He provided you with the following user requirements:

• Ticket sales will be completely computerised. Customers will be able to purchase movie tickets from the SMC website as well as at new ticket terminals that will be located at the various cinema complexes.

• The new system should enable customers to simply select the cinema, movie, show time and number of tickets on the website before making payment.

• Payment for online bookings will be done by credit or debit card.

• The following credit/debit card information must be entered: the type of card, the card number, the card's security code and the name of the card holder. 
• New movies are released every Friday, which affects the scheduling of shows in cin-emas. 
• Customers should be able to book movies at least four weeks in advance. 

You are required to:

1. Discuss the benefits of involving internal auditing at the beginning of the systems development process. 

Part B

2. Using only the information provided above, discuss the specific application controls that should be in place in the new system to ensure the accuracy, validity and com-pleteness of online ticket sales. 

The internal audit activity recently performed a health and safety audit on a local cinema complex in Hatfield, Pretoria. As part of this engagement, a risk assessment was performed. The risk of fire was rated as the most serious threat to SMC customers and employees. You reviewed the procedures and controls in place at the complex and made the following notes on fire detection and emergency exits in the complex:

The complex is fitted with smoke detectors. One smoke detector is installed in the roof of each of the cinema auditoriums and the complex foyer. Each smoke detector is linked to its own a fire alarm and functions independently of the other detectors and alarms. As such, an alarm will only sound in the auditorium when a smoke detector activated it.

The complex is a single storey building consisting of 10 auditoriums of the same size. Each auditorium has a self-closing door through which customers enter the auditorium, two emergency exit doors, and is constructed using fire and sound resistant material. The emergency exit doors are clearly marked with illuminated escape signs that function on back-up battery power in case of a power failure Emer-gency exit doors need to be unlocked and can only open from the inside. The key for each door is located in a break-glass box next to the door. Opening one of these doors immediately triggers an alarm at both the front desk and in the manager's office where the complex's alarm control panels are installed and indicates the sector (auditorium) where the door was opened. These door alarms should not be confused with the smoke alarms in each auditorium. All emergency exits lead to open air parking lots (referred to as final exits). 

1 Explain why the current fire detection and warning system at the complex is not sufficient. 

2 Formulate six engagement procedures for assessing the controls related to emergency exits. 

An internal auditor recently concluded an internal audit engagement of  a company department. The findings, expressed in the internal auditor's owns words read as follows.

1. I suspect that employees are using the microcomputers in thier offices to keep personal records, reconcile cheque account balance, select lottery numbers and maitain a lottery pool.

2. Local personal phone calls are being made on company time according to data pro-each  by the communications system's automated call tracking feature, which matches each outside number called with the originating extension. Also four employees were found to have made a total of R2 348 worth of personal long-distance calls on the company's Wide Area Telecommunications Service (WATS) line during the year. This ganisation. paucity of character and dearth of professionalism should not be tolerated by this oganisation.

3. The office supplies inventory was originally thought to be excessive because it ex-ceeds the prior year's inventory by 35% with no increase in staff or production. How-ever, the department managers assured me that the additional inventory is not excessive, and provided me with a written confirmation.

4. Some purchasing agents were using a request-for-quote form that was superseded by a revised form three weeks ago. The department manager has since destroyed all copies of the old form. 

5. The department did not notify all suppliers promptly of a change in the company's mailing address, thus 17 suppliers' were forwardedodrwarded to us by the post office too late to take advantage of the cash discousnwt department manager assures me that all suppliers have now been informed of our new

6. A few purchasing agents are keeping their own personal vendor databases on their desktop PCs instead of working with the departmental database as company policy requires.

7. Three purchasing agents routinely do company work on their personal computers at home.

8. Purchasing agents routinely use form JS181-K to make competitive price checks among suppliers before placing purchase orders.

9. 15% of all purchase orders requiring the departmental manager's signature were signed by a secretary when the manager was absent. The manager initialled after the secretary's signature on his return.

10. The department follows up on late or incomplete deliveries and damaged shipments without delay.

11. Two of the eight purchasing e companY agents accepted different cash discount Th nt terms from the same suppliers for products purchased within one three-month period. would have saved IR15 000 by negotiating for ,the lowest cash discount offered by those suppliers. No reason was offered for this inconsistency.

12. I believe that the department secretaries' telephone courtesy was extremely impres-sive, and the co-operation of all departmental employees was exceptional and greatly appreciated during the course of this extensive and exhaustive engagement. 

1 Identify four findings that demonstrate objectivity, clarity, and conciseness or bal-anced reporting and justify each.

2 Identify four findings that demonstrate the need for objectivity. clarity, and concise-ness or balanced reporting and justify each. Provide reasons for your answers.