General Motors Inc Accounting Information System - Case Study Example

Background Information on General Motors Inc.

General Motors Company commonly known as GM is an American multinational company whose headquarters are in Detroit, Michigan. GM deals with designing, manufacturing, marketing and distributing of vehicles and vehicle parts. It also deals with selling financial services. The company started in 1908 as General Motors Corporation, which was later changed to General Motors Company in 2009. The company has manufacturing companies in thirty-seven countries with the most popular brands being Chevrolet, Cadillac and GMC. In additional to the thirty-seven manufacturing plants, it has joined ventures and businesses in more than 120 countries.

With an operating income of US$5.346 billion in the year 2015, GM is among the largest automobile industries in the world according to the global industry sales. The company has an average of 212000 employees who are spread over 120 countries. GM Company is divided into five business segments: Opel Group, GM International Operations, GM South America, GM Financial and GM North America. In 2008, it was the ranked ninth largest publicly traded company in the world. However, the company has faced significant financial constraints such as the 38 billion dollar loss in 2007.

GM adopts a simple organizational structure where managerial operations are managed by the highest management and other tasks delegated to smaller functional departments. The company’s Chief Executive Officer (CEO) has absolute power in decision making which is also closely monitored by other higher management personnel.

General Motors’ sales have increased over the years despite the many challenges in the market and emergence of competitors. This has been attributed to the strategy used to handle the sales and the purchase cycle of the company. The market success can be attributed to the fact that GM has too many brands and variations within these brands whose agenda is to meet consumers ever growing needs. Additionally, the company has several business segments that help to come up with innovations and new ideas on how to manage the porous market.

How the Purchases Cycle in General Motors Operate

Balance at December 31

2015 2014

Productive material and supplies 5,102,815,152 4,969,637,350

Work in process and semi-products 543,062,743 294,188,707

Finished product, including service parts 122,025,733 513,984,879

Total inventories 5,767,903,628 5,777,810,936

The table above shows the inventory content of GM Company for the year 2015 and 2014. Referring to the financial statements of the company as per the year 2015, it is evident that the marketing strategy of the company is highly effective but there is a slight decrease in total value of inventories. Above it all, the company has put the interests of the company at the center of all its operation. This has led to the good returns witnessed in the financial statements. GM like other big companies has a huge and complex multilevel corporate portfolio that is connected to all manufacturing and offices. Within the corporate portfolio are other divisions for brands within the division, model within brands, marketing segment, manufacturing segment, and supply chains. The purpose of this network of the portfolio is to create a positive net cash flow for every item produced by the company. This is achieved by creating a comprehensive market focus for the company. GM has created a market focus plan by creating market segments. This should ensure that every level of portfolio support and sustain choice and maintain its market share. However, the high market share of a certain segment is not to support the market focus of the company because the company requires these segments grow net cash flow from the created market share.

Although it is hard to create an effective customer choice and grow a market share at the same time, GM has adopted a model that closely meets the two conditions. To get net cash flow for a specific car portfolio, we get the difference between positive cash flows and the negative cash flows. Negative cash flow is the sum of fixed costs negative cash flow and investments negative cash flows. On the other hand, the positive cash flow is the product of the car unit sales and car unit margins. Additionally, a car unit sale is the product of market segment share and market segment size while car unit margin is the difference between car unit price and car unit variable costs. This is known as the dynamic cash flow for an individual car which is determined by different factors.

To sell a large number of units in the above model, a car should have a significant market share if of the larger market segment. Therefore, for the company to raise unit sales, they have to worry about the unit size of the market segment and then determine what share of the market will be able to make a positive cash flow.

To remain effective in the world market, the company had to come up with an efficient purchases plan. First, the company had to promote a good relationship with suppliers. With the ever increasing competitors in the world market, the company needed to come with a super strategy to deal with the cut-throat competition for the automobile market. Therefore, they had to come up with a way to cement their relationship with the suppliers. One of the strategies has been to award business contract to low-bidding competitors. Additionally, the company has rolled out General Motors Vehicle Purchase Program that allows eligible people living in the US to purchase/lease new and used vehicles used by the company.

General Motors IT Audit

The company uses automated systems to monitor the purchases, sales, and other business processes. The company entirely depends on these systems for business continuity and. Therefore, they must be frequently checked and audited to ensure they are working right. In this section, I will come up with an IT audit plan for the company's information system concerning the identified business cycle. IT audit is an audit that involves review, and evaluation of company’s automated information systems, non-automated systems within the system and their interfaces. IT audit involves the gathering of information, planning, and understanding existing internal control structures. Many organizations today are resulting to risk-based audit that helps auditors decide on whether to perform substantive testing or compliance testing on their information systems.

Goal of an IT Audit

The primary goal of doing an audit of an information system is to determine whether internal controls exist and that they are functioning as they should be to minimize business risk. The main purpose of an information system in the case study is to ensure that all purposes data is well maintained to reflect the actual sales that business makes. If the data is accurate, the company can be able to calculate the net cash flow of every portfolio thus enabling it to make substantive business decisions.

Audit Plan Development Process

Annual audit plan for any company should follow a systematic set of processes to ensure important business processes are functioning as they should. Purchase cycle of the cars makes an important part of the business processes for the motor company. This is because it determines the net income of the company and consequently determines the financial position of the company. The audit process takes a top-down approach.

In a drop-down approach, the first step is for the auditors to determine the business and all the business processes involved. In this case, the business process is the purchases cycle. Additionally, the auditors identify strategies, company objectives and available business models that enable them to understand business risks. Secondly, the auditors need to define the IT universe of the company. This involves identifying the company’s infrastructure that is needed to the business processes. Using the existing IT model, supporting technologies and other network devices auditors can be able to create a comprehensive inventory of the IT environment. After auditors have gained a comprehensive information about the company’s business processes, the third step will be to perform a risk assessment on its IT and business infrastructure. Risk assessment is performed to determine the likelihood of a risk occurring and impacting internal controls of the company. The fourth and the final step involve formalizing the audit plan.

Understanding the Business Processes

Before doing an audit, it is important to have in mind that technology is adopted to support the goals of the company and poses a great risk to its success if it fails. Therefore, the auditors should have a clear picture of the business processes that technology is supposed to support. General Motor’s main business is to manufacture automobiles, market them and avail them to their customers through the numerous retail and wholesale outlets. The relationship between sales and purchases determines the impact that the company makes on the market. The company is divided into five different segments that produce huge amounts of data that must be analyzed effectively to give the actual financial position of the company. Auditors, therefore, must first learn the company goals, objectives, and the business model so that they can be able to identify products and services offered by the company, market base, supply chains, delivery mechanisms and product generation process. This information is important is identifying business risks and how the existing technology can be able to support the current business models and reduce the occurrence of the risk.

To understand the business process, the auditors must accept that every organization is different concerning business model, structure, IT infrastructure, and objectives. Therefore, the IT plan developed must be unique for that company and may not be used for another company even if they are in the same industry. Additionally, the auditors have to identify the operating environment of the company as well as the IT environment factors. After understanding the different business processes, they need to understand the relationship between a particular business process and another process. In a big company like General Motors that has many business processes, every business process depends on another business process. For instance, the vehicle manufacturing will depend on the market forces. For instance, if demand for a certain model goes down, the company will be forced to reduce its production. Every business is unique but it’s equally important to the business continuity of the company. However, there are key business processes whose failure can hinder the company from achieving its goals. Such processes in GM Company are manufacturing, sales, and distribution process. After identifying different levels of business processes, the nest step is to outline the underlying IT infrastructure and applications such as operating system, networks, and databases. Analyzing the IT infrastructure from top to bottom will enable the auditors fully understand every critical component of the business environment and the risk it poses.

Internal Control Questionnaires (ICQ)

To get clear information regarding the key systems in the company, the auditors will require to ask or clarification from the employees and other stakeholders who are involved with daily running of the system. The most efficient tool to gather that information is use of an ICQ. ICQ helps evaluate internal business controls in specific areas by asking questions. ICQs are used as primary information gathering tools and later supplement them with more advanced control evaluation techniques and information gathering tools such as flowcharting and documentation review.

Internal Control Questionnaire

Purchases Cycle Control System

Objective:

To ensure accuracy, completeness and efficiency of the purchases cycle of all General Motors market segments.

Key Questions:

• How does one become a supplier for the company?
• What are the terms of the contract between the company and the suppliers?
• Is supplier information stored in the regional database or the central database?
• How long is the data stored in the system before deletion?
• If so, is it on the central server? Has security measures been reviewed by IT services?
• How long does the invoice take to be processed?

Key Internal Controls

• The company selects suppliers using a procedure known as One Cost Model. I this procedure, a supplier gets a contract to supply parts for a period up to the life of the vehicle. Once a supplier has been contracted, the company does not seek bids from other vendors.
• The quality of the parts is determined by collaborative intervention between the Supply Company and GM Company. A team of engineers from GM and purchasing executives visit the supplier's factory to assess the manufacturing process together with cost data.
• The purchases are done on the company’s information system to minimize errors in the invoices. The invoice from the supplier must be close-checked for errors before it is processed.
• As long as the supplier is in contract with the company, their data remains in the company system. However, if the contract ends, their information is retained for a period not exceeding one year.
• The regional purchases are sent to the central system in real time to enable the company to get the actual financial position of the company at any time.

Risk Analysis

The risk is defined as the possibility of an event occurring that will deter achievement of short term and long term goals of a company. The risk is measured concerning impact and likelihood. This means that it is important for the company to periodically assess risk portfolio and try to manage it to acceptable level. Risk assessment involves examining IT infrastructure, applications and computer operations that can adversely hinder the company from achieving its goals by threatening the company’s ability to ensure data security, reliability, integrity and confidentiality. The auditors, therefore, need to identify the usefulness of the results. An effective risk assessment model is the one that enables the auditors to predict the proper way to deal with it. For instance, if the input is incorrect, it should be easy to predict that the output will be incomplete too.

Risk Assessment Process

After understanding the company's structure and its use of technology, they can conduct a risk assessment. The success of this exercise is important to the company because major IT risks will be identified, evaluated and appropriate mitigation measures were taken. The culmination of the risk assessment is then used by the team of auditors to develop a comprehensive IT audit plan. The following are the main processes in risk assessment:

• Identifying business objectives: It is important for the auditors first to understand the company’s goals and how IT supports the company systems to achieve the set goals. These business objectives can be broad, strategic or linear in nature. Risks that arise from business strategies should be identified and given some priorities. Additionally, ongoing monitoring activities should be conducted to realize risks periodically and effectively manage them. Finally, the top company management should be highly involved in this stage by acting on the periodic risk management process reports. It is their duty to periodically communicate risks, strategies and control measures to all stakeholders.
• Identify and understand company’s IT strategy: The overall IT strategy should be identified and made to align with the company’s objectives identified in the previous stage. It strategy in addition to linking with company’s objectives, it should identify tactical activities that IT department should take within the defined time to achieve organization’s objectives.
• Identity IT universe: This involves inventorying key computing environment components so that it is easy to determine which IT areas need to be reviewed from a risk controls perspective. IT universe is in most cases divided into three major categories i.e. infrastructure, computer operations, and applications. Infrastructure consists of the computing components that facilitate the flow of information such as bridges, routers, and communication lines together with processing components such as mainframes, datacenters, and computer systems. Computer operations, on the other hand, refers to processes and controls that manage the company’s computing environment such as backup and recovery, program change controls and physical and logical security administration. Applications finally refer to software used by the company to process, store and present business transactions such as ERP systems and other stand-alone applications.

System Operations

Major operations in the company are automated to ensure accuracy and efficiency. The data received from various suppliers to the company must be securely stored for proper analysis and reference. Therefore, the company maintains a synchronized data backup to ensure there are no data losses whatsoever. The data backups are stored at various remote data centers to ensure business continuity in case the information in the system is destroyed by natural occurrences. To ensure that company data is secure, the company maintains a comprehensive security strategy to prevent physical access by unauthorized persons and using physical and logical security administration.

Use of Computer Assisted Audit Techniques (CAATs)

CAAT is software that is used by auditors to interrogate a client’s information system for audit data. Unlike the manual data audit, CAATs can scrutinize a large number of data that would be impossible to analyze manually. The software then presents the data scrutiny results in a systematic way so that further analysis can be done on it. CAATs can be able to do several things on a given sample data. For instance, the system can extract certain data depending on certain criteria, calculate ratios and select values that fail to meet the benchmark conditions, check whether arithmetic is accurate, prepare reports and trace transactions done through computer systems. Although the software simplifies the auditor's procedure for identifying risk areas, it does not replace the need for an audit plan.

Test Data

Test data in this software involves the auditors delivering “dummy” data into the system to ensure that it correctly processes the data, prevent and detect any erroneous data. This is done to test operations of the application controls within the client’s system. The best sample data that sufficiently test a system should comprise of data with errors and another data without errors. Such data could comprise codes that do not exist in the system, transactions that are above the limits, invoices with calculation errors and data with incorrect batch control totals.

The auditors should choose the perfect time to run the test data on a given system. Data may be processed at a special time set aside to test the system (dead testing) or at a normal operation cycle. However, both of the two times have their advantages and disadvantages. For instance, the live test can interfere with the normal operation of the system or corrupt the master file with the incorrect data. Dead testing may produce correct results but ignore the fact that there are strains when the system is operational that could affect the correct running of the system.

Advantages of CAATs

• This software allows the auditors to access the data stored in a computer system without depending on the client.
• Allow auditors to test the reliability of the client system.
• Increase the accuracy and reliability of the audit tests.
• Perform audits more efficiently with a guarantee of reliable results.

Disadvantages of CAATs

• The software is expensive and time-consuming to set up.
• It is sometimes difficult to obtain client permission and cooperation.
• The software may not be compatible with the computer system used by the client.
• Use of the software requires special skills which might be lacking in the audit team.
• Important data may be lost or corrupted during the audit process.

Annual Information Technology (IT) Audit Plan

The table below shows the audit plan that will be used by the selected group of auditors to scrutinize General Motors Company IT systems and operations involved in the purchases cycle.

General Motors Company: Annual Internal IT audit

No

Audit Area

High Level Description

Risk Reference

Estimated Timing

Estimated Hours

2015/2016

comments

1

Supply Chain Management

Assess the efficiency of company systems to control the supply chain in compliance with company standards

12

April-2016

120

2

IT System Performance

Evaluate the efficiency and performance of company’s information systems. This will involve testing the systems for accuracy and validity of the information produced from sample data.

Legislative requirement.

Jan-2016

150

3

Internal Financial Controls

Assess the adequacy of internal financial controls and processes. This audit will involve controls surrounding revenues, suppliers, and creditors.

Legislative requirement

May-2016

100

4

Data Backup

Evaluate the data backup processes to ensure that every data collected by the system is correctly backed up without any errors.

8

June-2016

100

5

Suppliers Information Review

Evaluate whether every supplier meets the threshold set by the company for suppliers

Legislative requirement

June 2015

100

6

Registration of Auditors

Evaluation of controls surrounding the registration of auditors.

8

Jan-2016

100

Total number of hours for the audit excluding planning and management time

670

Audit Report for General Motors Company on IT Control Systems

To: Audit Committee

Introduction

The audit was conducted to evaluate the effectiveness of the company's information system concerning the purchases cycle. The entire purchases cycle in GM is computerized which made the audit process efficient. Additionally the company has permanent-like suppliers which mean that it is easy to manage the entire process.

Audit Scope

The audit was conducted only on the control system used in purchases. Those involved data storage facilities, application systems that handle invoices and payments to suppliers. Additionally, the audit was conducted on systems that involved processing and movement of Purchases information from one market segment to another.

Strengths of the Company’s IT Systems

• The company uses an ERP that integrates all the processes from every department making managing and processing of data easy.
• The company network is efficient enabling data movement from one market segment to another.
• The company information system has automatic data backup that guarantees data safety.

Weaknesses of company's IT system.

The system does not have an elaborate data validation system that means that invoices can have errors and be processed without being noticed.

Negative Effect of the Weakness

Lack of a system to verify the data input to the system could lead to losses if the values have errors. The profit enjoyed by the company is derived from the purchases in relation to the annual sales. Therefore, if the purchases’ values are erroneous, the company is likely to suffer losses unless the error is eliminated.

Recommendations

The audit team recommended that the company should introduce a double check system to check the validity of the invoices before the purchases can be confirmed. Additionally, the company should consider adjusting its purchases' model by allowing suppliers to bid for the supply contract. This will enable the company to select the lowest bidder.

Conclusion

In conclusion, it is evident that the audit was concluded on time and within budget. The company can improve its purchases cycle by highlighting the areas that attract risk and consequently increase its revenue. With a fully functional information system, the company can be guaranteed of enjoying market control supremacy in the ever competitive environment.