Martha Tick, daughter of Mark Tick, Auditor Extraordinaire: a case study.

ABSTRACT

Lessons learned through the appropriate use of humor often are quite effective while making class more interesting and enjoyable. Paul D. Johnson's 1974 case "Mark Tick's Data Center Audit" was an excellent counter-example where students learned by observing Mark's mistakes. However, being a product of the 1970's it was written for mainframe operations in the days of punched cards and is older than many of today's students. The out-dated technology partially negates its effectiveness as a teaching tool in today's environment, particularly for small to mid-size businesses that use micro computers. This update brings the technology more up to date to restore the effectives for use in the classroom. Rather than interrupting the flow of the case, we have identified direct quotes through careful wording.

THE CASE

Netherlands Bottling Company recently acquired Hogun Industries which had Babbling Brook Pure Water Bottling as a subsidiary of a subsidiary. After the acquisition they discovered that the last audit of the computer operations of Babbling Brook was in 1974. Management of Babbling Brook believed that the auditor at that time, Mark Tick, Auditor Extraordinaire, had been so thorough that another audit was not necessary. Since Tick & Tick, LLP, was the only accounting firm within the region and Mark Tick was familiar with the operations, Netherlands contacted them to conduct another audit to update the documentation of operations. The following is a record of that audit.

Martha Tick had just graduated from her father's alma mater and was visiting her first client, which had been her father's first client several years ago. From reviewing his files and discussing the client with him, she recognized the location immediately as she drove up River Road because of the neon sign her father had described. It read, "New Data Center in Base_ent of M_in Build_ng on River S_de Way." Being quite perceptive, she noted that the data center was no longer new and that a few letters were in need of repair--thus began her audit.

Her father's CIA emblazoned belt buckle had been converted into a very attractive pin, which she wore on the lapel of her green blazer. His wire framed sunglasses fit her perfectly, as she fidgeted with them nervously preparing to get out of the car for her first audit, not noticing the three inches of water standing in the parking lot.

Upon meeting the receptionist she immediately complained about ruining her blue suede shoes. The receptionist pointed to a stack of forms and said, "Here. Fill one of these out and put it with the others in the pile. We'll let you know when we hear from the Public Service Commission. When the building was constructed, it was 3 feet above flood level, but since they put that Bugabun Dam down at Muddy Creek Crossing, the water has been backing up quite often."

Martha completed the form and browsed through the stack of other completed forms noting that the company was doing a good job of keeping all of the forms together because some dated back 5 years. But, being ever alert, she decided that her dress would be out of style before she collected due to the stain on her dress that she got when she crawled over the sandbags around the building. Besides, the mud was barely visible on her brown skirt. She asked the receptionist if the data center was where it had always been. Without asking for identification and/or purpose of the visit, the receptionist retorted that it had not been moved in 30 years.

She passed the cafeteria, as expected from her father's directions, but noticed that the magnetic tape reels had been replaced by assorted compact disks. Most of the CDs were in former music cases (saving money, she thought) but some had neat labels, such as "YTD Payroll Master", "General Ledger Summary," etc. taped over the music labels. She stopped and opened the one labeled "Stockholder Records," but found it empty. One of the employees heading to the cafeteria proved most helpful as he remarked, "Don't bother looking for that one. Ole Rusty, the president's dog, caught it in mid-air last month when we were using it to play Frisbee golf before lunch. Most of those disks just get a little crack or chip when they bang off the walls, but Rusty snapped that one in half."

She thanked the gentleman for the information and proceeded toward the data center. After wandering around for a while and ending up at the boiler room, she realized that she had not understood her father's directions quite as well as she had thought and sheepishly returned to the receptionist. The receptionist, again without requiring identification or purpose of the visit, gave her new directions, but added that the manager would be away from the data center for a while--he was doing some work in the boiler room. When Martha finally found the data center, she was proud of herself because she had only missed it by one door.

Upon entering the data center Martha was amazed to find several personal computers (one of which appeared to be working) rather than the mainframe and console her father had described, but she was happy to find that the gas-fired coffee urn was right where her father said it would be. Martha's father had detailed the layout of the room, including the punch-card machines, card-readers, disk-packs, and coffee urn. Martha thought she was in the wrong place since the layout was quite different. Turning to the sole occupant in the room, Martha inquired about the location of the punch-card machines, readers, etc. The operator scowled and replied, "We don't use them any more! When Muddy Creek Elementary School got some new computers two years ago we bought all of their Pentium 3s. After we sold the card reader to an antique dealer last year, we even got a P4 for the main operations here at the data center."

"What's a P4?" she interrupted. "Pentium 4. It's a newer machine. It uses these little 3 1/2" disks that store more information than those larger 5 1/4" disks used on the P2s we used to have," came the reply as he pointed to the stack of unlabeled 5 1/4" disks neatly placed on the plunger handle next to the coffee urn. "One of those CDRWs came with it and we added a DVD recorder/player just last month," he continued, quite proud of the new system. But, he confessed, "To be honest I think the manager just wanted the DVD recorder to record movies after work." Martha thought about asking what all those terms meant, but thought better of it given the tone of his last response.

She poured a cup of coffee and, unable to find any napkins, grabbed an open CD lying on the desk to use as a coaster. She was a bit dismayed that the coffee she spilled on the disk caused the label to smear. She fixed the problem though by taking her own felt-tip pen and re-writing DAILY SALES on the disk. It was much neater than the original writing anyway, she thought.

Above the plunger of disks Martha found three new signs, which appeared to be covering the ones her father had been so impressed with. Martha lifted the new signs to read the faded ones, which were just as her father had described them:

[check] Fairness is our motto. All input is processed on a first-come, first-served basis.

[check] This is a data processing operation, not a delivery service. All output for the week will be placed on the big table in the cafeteria before 4 p.m. each Friday. Help yourself.

[check] To expedite processing and cut down on unnecessary paper shuffling, all documents rejected by the computer because of out-of-balance controls or invalid data will be immediately corrected and re-entered by the machine operators.

She then read the new signs, which were even more impressive.

* If your machine breaks, just find one of those on the left table that works. If none are working, drop a note in the box and we'll fix one as soon as we can. [Since there were several computers on the right-hand side of the room but none on the left, Martha thought this should have been right table rather than left. She then saw the notes in the box and realized that the mistake was hers.]

* Now that you all have computers and Excel (for DOS) on each one, write your own programs and do your own data entry. The only exception is the sales staff that is never here. If you forget your password, just use DATA which is the default password. We are busy doing the important stuff for the company, so don't bother us with your problems.

* If you missed the training session, another won will be held next year.

Martha noticed the spelling error, but did not want to embarrass the operator, who was watching intently as she bent down to pick up a post-it note that had fallen off the signs. She complimented him instead, "I see that you run an efficient operation. It looks like you save even more time with these new processes," as she stapled the post-it note to the sign. The post-it note read, "If you still have the 5 1/4 inch disks, we cannot help you." The operator replied, "Yea, the new processes really help, but we still have to make some corrections. For example, I just finished correcting a programmer's error," as he tossed her a 3 1/2" disk labeled "Payroll Source Code" and asked her to toss it into the closet behind her. "We keep all of our important disks close by," he finished. "Quite efficient, indeed," mused Martha as she nodded her head in approval. She noted in her pad the extra effort the operator was putting forth, intending to formally compliment him in her report.

When the program started, Martha noticed the antiquated printer fed the checks directly into the old check signing machine. She also noticed that the carbon copies were being automatically separated from the checks. The copies were then automatically shredded and dumped into the fiberboard wastebasket. "With backup files on the computer, there is no need for the copies," remarked the operator. "Yea, just wasted paper and wasted trees," Martha replied. "It seems that you have added a new shredder since my father was here," she continued. "Oh, you must be Mark's daughter, right?" the operator queried and Martha nodded in agreement. "We had quite a party the last time he was here. How is he doing?" "Just fine," she replied. The operator then reached in the bottom drawer of the desk and withdrew a bottle of Scotch. He then offered the bottle to Martha. She refused, but asked what brand of cigarettes he was smoking. Finding the brand suitable, she took him up on this offer.

As two mail clerks entered the room and began yanking at the operator's bottle, Martha decided that this would be a good time to count the petty cash. As the mail clerks exchanged sips of the Scotch, the operator told her that the petty cash box was underneath the disks in the closet. As she removed the steel cash box from beneath the disks, she accidentally knocked another box off a shelf and spilled what looked like baking soda on the remaining disks. The operator, looking a bit anxious, told her not to worry about the problem and that he would clean it up later. She also noticed a box of disposable latex gloves and inquired as to their use.

The operator explained that when the machines were bought from the elementary school the principal had warned them that the machines might have some viruses. He suggested that they practice "safe computing" and the gloves were used to keep the viruses from spreading. "Best to be protected," murmured Martha as she closed the closet door and began to count the cash. "You bet," replied the operator. "But the only ones who use the gloves now are those who have an internal modem. We heard that a lot of viruses can be transmitted through the internet. The guy at the elementary school insisted that we needed a firewall before operating the computers, so we build one on the other side of the plywood partition separating the computer room from the boiler room." As she was counting the petty cash, she eavesdropped on the conversation between the operator and mail clerks (her father had suggested that technique). She was surprised to learn that some vice-presidents were paid almost five times as much as some of the others and that the president's assistant was paid more than any of them. After the operator and mail clerks headed to lunch, Martha wrote a check for $40 and put it in the petty cash box, withdrawing $42.41 to make the petty cash fund balance. She left $5.62 in change for other needs. When putting the petty cash box back in the cabinet, Martha accidentally dropped it and the change scattered everywhere. She saw a dime roll toward the back of the room and under some of the chairs piled in a corner. While moving one of the damp chairs, Martha noticed for the first time that there was a faint musty smell and that the plywood wall 'next to her was very damp. As she moved the second damp chair in search of the dime, a mouse came out of the stuffing and she screamed, quite loudly.

The data center manager came running from the boiler room next door to see what all of the commotion was about. "There's a mouse in here!" she angrily yelled. "Don't worry," he replied. "They got into the building with the flood last month and we just could not stand to kill the mother and all of her babies. We let them nest in one of the old chairs destroyed in the flood. The flood did a lot of damage, but we solved that problem by sandbagging the building. One benefit of the flood, though, was that I got a brand new 'executive' chair," as he pointed toward the desk, noticing for the first time that his new chair was smoldering from the cigarette Martha had dropped. He quickly scattered the remaining chairs, threw some wet punched card boxes across the room, grabbed a water hose protruding through the wall, and raced to put out the fire. Unfortunately, on the way he tripped and fell over some loose electrical cords Martha sprang into action, saving the day. She grabbed the hose and doused the fire, noting that the backup power system functioned quite well when the surge protector exploded.

Turning toward the manager, who was recovering from his spill and a modest electrical shock, she remarked, "Thank goodness you had that surge protector. We could have had a serious problem otherwise. But I think you might want to get a new hose since this one is leaking." "Listen," continued Martha. "Since I have made a mess of your office and have burned a hole in your new chair, let me take you to lunch." With that, the data center manager grabbed his jacket, put the rest of the bottle of Scotch in an inside pocket, grabbed the box with the "baking soda" from the closet, and they headed out the door for a grand adventure.

As they headed down the hall Martha stopped him; "Wait just one minute," she emphatically stated. She then got a post-it pad out of his desk drawer and scribbled, "Audit complete. Excellent work and efficiency. The only problem appears to be the ten cent shortage in the petty cash fund." She then threw the petty cash box back into the closet, again spilling the change but also cracking a couple of the 3 1/2 disk covers and knocking one of the disk's metal slides off. As they left the data center, she stuck the note on the data center door as they headed off for their adventure.

But as they again started down the hall, she ran back and added to the note, "P.S. You really do need to replace the letters on the sign on top of the building. They make the data center look old and out of date not new and up to date." As they left the building, arm in arm, the computer operator heard Martha inquire, "By the way, what were those punched cards doing back there? I thought that you had changed to a new system." "Oh those," came the reply. "Those were our backup system. Guess we ought to replace them since they too were ruined in the flood." Their adventure must have been grand indeed, because it was years before either was heard from again.

Required:

From the information provided, apply standard internal and/or external audit objectives to identify 1) each sentence(s) identifying a problem, 2) state the problem encountered, and 3) suggest a corrective action. As an illustration, the first one is completed.

Sentence Indicating
Problem                     Problem                     Solution

From reviewing his files    Identifying location of     Keep the
and discussing the client   computer center to public   location of the
with him, she recognized    makes it more susceptible   computer center
the location immediately    to potential attack.        secret.
as she drove up River
Road because of the neon
sign her father had des-
cribed. It read, "New
Data Center in Base_ent
of M_in Build_ng on River
S_de Way."

Case Learning Objectives

The Martha Tick case focuses on the audit and evaluation of internal controls in an Information Technology (IT) environment. Internal auditors, and particularly information systems auditors, are ultimately concerned with the effectiveness and efficiency of internal controls. In other words, the controls must be reliable while being as economical as reasonable. Internal controls comprise a set of interrelated components that function together to prevent, detect, and/or correct the occurrence of undesirable events. The overall purpose of internal controls is to reduce expected losses from these undesirable events that may occur in an information system (Weber 1999). The complexity of internal controls makes teaching aids even more valuable.

This case allows students to appreciate the fact that conducting an information systems audit deals with complex issues. But the case simplifies the learning process by presenting these issues in a linear pattern through a narrative format. This approach allows the student to stop at each issue, analyze its internal control aspects, and document the solution before moving on to the next issue. Furthermore, the case format is flexible enough to allow additional issues to be added in the future to respond to contemporary IT needs.

In addition, the case requires students to sharpen their critical thinking skills. A large number of IT internal control issues are embedded in the case, requiring students to extract the relevant internal control issues. Though exaggerated to make the issues more clear, they are representative of authentic control issues in clients' actual business practices. This embedding of an internal control issue in a business process requires the student to be able to apply critical thinking skills to recognize the individual issue presented first, and then proceed with analysis.

Case Implementation Guidance

This case lends itself to a several implementation approaches. One approach is to use the case as a means of introducing the concepts of internal control in an IT environment. This approach requires no special advance preparation by the students. Since almost every sentence contains some lesson, the case effectively introduces the concepts and practices of internal controls. Thus, when students subsequently read or review the text material, the concepts seem much clearer because they have been internalized. It should also be noted that students often effectively learn what to do from observing what not to do.

A second method is to use the original Mark Tick case in class and give the Martha Tick case as a take-home assignment. This approach has been used in a graduate class quite effectively. Students commented that the most important lessons they learned related to the internal control violations documented in the case. Students typically spend between three and six hours with the case when used as an exam. While the case is too comprehensive to be used as an in-class exam, it can be used in a group context, with small groups of two to three students presenting parts of the case.

Both of these approaches have been effectively used by different instructors at our universities. However, based on the authors' experience, the first approach, in class with or without preparation, seems quite effective for undergraduate courses, and the take-home exam approach works well for graduate courses.

Professors should contact the authors ([e-mail]) for a detailed solution, but there may be no such thing as a complete solution; students continue to observe different issues.

REFERENCES

Johnson, P. D., 1974. Mark Tick's Data Center Audit. EDPACS (June): 16-17.

Weber, Ron. Information Systems Control and Audit, Prentice Hall, Upper Saddle River, NJ, 1999.

Rodger G. Holland, Georgia College & State University

Patrick T. Hogan, Columbus State University