Accounting Information Systems — Complete Course

An ACCOUNTING INFORMATION SYSTEM (AIS) is the set of PEOPLE, PROCEDURES, DATA, SOFTWARE, and IT INFRASTRUCTURE that COLLECTS, RECORDS, STORES, PROCESSES, and REPORTS financial and non-financial data about an organization's transactions. An AIS supports three primary business functions: (1) COLLECT and store data about the organization's activities, resources, and personnel; (2) TRANSFORM that data into information useful for planning, execution, control, and decision-making; and (3) provide adequate CONTROLS to safeguard assets and ensure that data are RELIABLE, ACCURATE, and AVAILABLE. Modern AIS runs on ENTERPRISE RESOURCE PLANNING (ERP) suites such as SAP S/4HANA, Oracle NetSuite, Microsoft Dynamics 365, and Sage Intacct, which integrate accounting with operations, human resources, and supply chain.

A BUSINESS PROCESS is a set of related activities that produce a product or service for a customer. Every organization repeats five core TRANSACTION CYCLES: the REVENUE cycle (sell goods/services and collect cash), the EXPENDITURE cycle (acquire goods/services and pay cash), the PRODUCTION cycle (convert raw materials into finished goods), the HUMAN RESOURCES / PAYROLL cycle (hire, train, and pay employees), and the FINANCING cycle (raise capital, service debt, distribute to owners). All five cycles feed the GENERAL LEDGER and FINANCIAL REPORTING system, which produces the balance sheet, income statement, statement of cash flows, and other management reports. Understanding these cycles is the organizing principle of AIS coursework — every downstream topic (controls, databases, analytics, fraud) maps back to a cycle.

The VALUE of AIS-generated information can be evaluated using seven attributes: RELEVANT (reduces uncertainty and improves decisions), RELIABLE (free from bias and error), COMPLETE, TIMELY, UNDERSTANDABLE, VERIFIABLE, and ACCESSIBLE. Information that meets these attributes adds value by IMPROVING product/service quality, REDUCING costs, IMPROVING efficiency, SHARING knowledge, IMPROVING the supply chain, and IMPROVING internal control. A well-designed AIS is also aligned with the organization's STRATEGY — cost-leadership firms optimize for transaction efficiency, while differentiation firms invest in richer data capture and analytics. The accountant's role has expanded from bookkeeper to STRATEGIC BUSINESS PARTNER: designing controls, evaluating IT investments, interpreting analytics, and advising on ERP implementations.

Traditional FILE-BASED processing stored each application's data in its own file, causing REDUNDANCY, INCONSISTENCY, and low DATA INTEGRITY. The DATABASE approach centralizes data in a shared repository managed by a DATABASE MANAGEMENT SYSTEM (DBMS) such as Oracle, Microsoft SQL Server, PostgreSQL, or MySQL. Users interact through the DBMS, which enforces the DATA DICTIONARY, SECURITY, BACKUP, and CONCURRENCY. Key benefits: DATA INDEPENDENCE (application logic separated from storage), REDUCED REDUNDANCY, IMPROVED INTEGRITY, CROSS-FUNCTIONAL analysis, and CENTRAL CONTROL.

The RELATIONAL MODEL organizes data into TABLES (relations) of ROWS (tuples/records) and COLUMNS (attributes/fields). Each table has a PRIMARY KEY that uniquely identifies each row, and FOREIGN KEYS that reference primary keys of other tables to model relationships. Well-designed schemas obey NORMALIZATION rules (1NF, 2NF, 3NF) to eliminate anomalies: atomic values, no partial dependencies, no transitive dependencies. Users query with STRUCTURED QUERY LANGUAGE (SQL) — SELECT/FROM/WHERE/JOIN/GROUP BY/HAVING/ORDER BY. A basic revenue-cycle schema has tables for CUSTOMER, SALES_ORDER, SALES_ORDER_LINE, INVENTORY, INVOICE, and CASH_RECEIPT, joined by CustomerID, OrderID, ItemID, and InvoiceID.

ENTERPRISE RESOURCE PLANNING (ERP) systems unify data across modules (Finance, Sales, Purchasing, Inventory, HR, Manufacturing) around a SINGLE RELATIONAL DATABASE. The three-tier architecture is PRESENTATION (web/mobile), APPLICATION (business logic), and DATABASE. Modern deployments increasingly use CLOUD ERP (NetSuite, S/4HANA Cloud, Dynamics 365) offering elasticity, subscription pricing, and vendor-managed upgrades. Non-relational stores — DOCUMENT (MongoDB), COLUMNAR (Snowflake, BigQuery), and GRAPH (Neo4j) — supplement the ERP for analytics and unstructured data. The REA MODEL (Resources, Events, Agents — McCarthy 1982) is the AIS-specific database design pattern: every economic event links resources changed by the event to internal and external agents involved.

AUDITORS, ANALYSTS, and DEVELOPERS use standardized diagrams to describe HOW data move through an AIS. A DATA FLOW DIAGRAM (DFD) is a LOGICAL model showing WHAT happens: DATA SOURCES/SINKS (external entities — squares), PROCESSES (circles or rounded rectangles), DATA STORES (open-ended rectangles), and DATA FLOWS (labeled arrows). DFDs are drawn top-down: a CONTEXT DIAGRAM (Level 0) shows the entire system as ONE process with external entities. LEVEL 1 decomposes that process into its major sub-processes. LEVEL 2 and below decompose each sub-process further. Every DFD must be BALANCED — the inputs and outputs at a lower level must match the parent.

A DOCUMENT FLOWCHART traces the PHYSICAL flow of source documents (paper or electronic) among departments; columns represent departments and standard symbols represent documents, files, decisions, manual operations, and terminals. A SYSTEM FLOWCHART depicts the relationship among input sources, processes (manual and computer), and outputs. A PROGRAM FLOWCHART depicts the logic within one computer program. A BUSINESS PROCESS MODEL AND NOTATION (BPMN) diagram uses SWIMLANES (pools/lanes for participants), TASKS (rounded rectangles), EVENTS (circles: start, intermediate, end), and GATEWAYS (diamonds for XOR/OR/AND) to describe end-to-end processes. BPMN has largely replaced narrative descriptions in modern ERP and audit engagements.

Common documentation ERRORS include unbalanced DFDs, processes with only inputs or only outputs (BLACK-HOLE / MIRACLE processes), and flowcharts that omit CONTROLS. Best practice: (1) name each process with a strong VERB PHRASE ("Process Customer Order," not "Order"); (2) number processes hierarchically (1, 1.1, 1.2, 1.2.1); (3) show data stores where information persists between processes; (4) mark CONTROL POINTS (edit checks, authorizations, reconciliations) explicitly; (5) walk the diagram with a business owner to confirm accuracy. Tools include Microsoft Visio, Lucidchart, draw.io, and Signavio; ERP vendors (SAP Solution Manager, Oracle BPA) embed BPMN editors.

The COMMITTEE OF SPONSORING ORGANIZATIONS (COSO) 2013 INTERNAL CONTROL — INTEGRATED FRAMEWORK defines internal control as a PROCESS, effected by an entity's board, management, and other personnel, designed to provide REASONABLE ASSURANCE regarding achievement of objectives in three categories: (1) OPERATIONS, (2) REPORTING, and (3) COMPLIANCE. The framework has FIVE COMPONENTS and 17 PRINCIPLES. The five components are: CONTROL ENVIRONMENT (tone at the top, integrity, competence, structure), RISK ASSESSMENT (identify and analyze risks to objectives, including fraud risk), CONTROL ACTIVITIES (policies and procedures — segregation of duties, authorization, reconciliation, edits), INFORMATION & COMMUNICATION (quality info flows up, down, and across), and MONITORING ACTIVITIES (ongoing and separate evaluations, deficiency reporting).

SARBANES-OXLEY ACT (SOX) §302 requires the CEO/CFO to CERTIFY the accuracy of financial reports and disclosure controls, and §404 requires MANAGEMENT to ASSESS and REPORT on the effectiveness of INTERNAL CONTROL OVER FINANCIAL REPORTING (ICFR) and the EXTERNAL AUDITOR to ATTEST to that assessment (for accelerated filers). Public companies use COSO as the ICFR benchmark. COSO also publishes the ERM — INTEGRATING WITH STRATEGY AND PERFORMANCE (2017) framework, which extends internal control to enterprise risk management around STRATEGY, GOVERNANCE, PERFORMANCE, and REVIEW.

IT controls are split into ITGC (IT GENERAL CONTROLS) and APPLICATION CONTROLS. ITGC operate over the IT environment as a whole and include: (1) ACCESS to programs and data (user provisioning, least privilege, MFA), (2) PROGRAM CHANGE (change management, testing, migration), (3) PROGRAM DEVELOPMENT (SDLC controls), and (4) COMPUTER OPERATIONS (job scheduling, backup, incident response). APPLICATION CONTROLS operate within a specific application and include INPUT controls (edit checks, validity, completeness, reasonableness), PROCESSING controls (run-to-run totals, hash totals, batch controls), and OUTPUT controls (reconciliation, distribution). Effective ITGCs are a PRECONDITION for relying on application controls — if ITGCs fail, application-control effectiveness cannot be relied upon.

The REVENUE CYCLE (Order-to-Cash) is the recurring set of activities by which an organization SELLS goods/services and COLLECTS cash. It has FOUR ACTIVITIES: (1) SALES ORDER ENTRY (take the order, check inventory and credit, respond to customer); (2) SHIPPING (pick, pack, and ship goods); (3) BILLING (invoice the customer, update accounts receivable); and (4) CASH COLLECTIONS (receive, deposit, and record cash; handle disputes). Key documents/records: SALES ORDER, PICKING TICKET, PACKING SLIP, BILL OF LADING, SALES INVOICE, REMITTANCE ADVICE, CREDIT MEMO, and CUSTOMER MASTER FILE. Journal entries flow: DR Accounts Receivable / CR Sales at billing, then DR Cash / CR Accounts Receivable at collection, with DR Cost of Goods Sold / CR Inventory at shipment.

MAJOR THREATS with mitigating controls: (a) Incomplete/inaccurate orders → EDIT CHECKS, drop-down customer/item lists, credit-limit auto-check. (b) Sales to customers with poor credit → automated CREDIT AUTHORIZATION (block by system), aging analysis. (c) Stockouts / carrying costs → real-time INVENTORY VISIBILITY, backorder tracking. (d) Shipping errors → BAR-CODE picking, three-way match of order/pick/pack, reconciliation. (e) Theft of inventory → RESTRICTED WAREHOUSE access, periodic counts, RFID. (f) Failure to bill / duplicate billing → shipping triggers billing (no independent invoice creation), SEQUENTIAL prenumbered invoices. (g) Posting errors in AR → SUB-LEDGER reconciliation to GL, monthly customer statements. (h) Theft of cash → LOCKBOX, RESTRICTIVE ENDORSEMENT, deposit intact daily, SEPARATION of cash custody from AR recording, MONTHLY BANK RECONCILIATION by an independent person.

SEGREGATION OF DUTIES in the revenue cycle: sales-order approval, credit approval, warehouse custody, shipping, billing, AR recording, cash handling, and bank reconciliation should be split so that no single person can BOTH steal cash AND conceal the theft. In ERP systems (SAP SD, NetSuite ARM, Oracle Order Management), controls are enforced by ROLES/PROFILES and CONFIGURATION rather than paper documents — for example, SAP's Governance, Risk and Compliance (GRC) module identifies SoD conflicts across thousands of transaction codes. LOCKBOX banking, EFT, ACH, and credit-card gateways move the physical cash outside the entity, reducing internal theft risk but adding CYBER risk (skimming, BEC).

The EXPENDITURE CYCLE (Procure-to-Pay, P2P) acquires goods/services and pays for them. Four activities: (1) ORDER goods/services (requisition, RFQ/RFP, purchase order); (2) RECEIVE and INSPECT goods (receiving report); (3) APPROVE VENDOR INVOICES (voucher package); (4) DISBURSE CASH (check, ACH, wire). Key records: PURCHASE REQUISITION, PURCHASE ORDER (PO), RECEIVING REPORT, VENDOR INVOICE, VOUCHER PACKAGE, CHECK / ACH FILE, VENDOR MASTER FILE. The classic control is the THREE-WAY MATCH: PO, receiving report, and vendor invoice must agree in quantity, price, and terms before payment is authorized.

MAJOR THREATS and CONTROLS: (a) Ordering unnecessary items → REQUISITION with department-manager approval and budget check. (b) Vendor kickbacks → APPROVED-VENDOR LIST, PERIODIC VENDOR ROTATION, mandatory disclosure of relationships. (c) Fictitious vendors → INDEPENDENT VENDOR MASTER MAINTENANCE, vendor-vs-employee address match, W-9 verification. (d) Receiving wrong quantities or damaged goods → COUNT and INSPECT at receiving; blind receiving report (quantities not preprinted). (e) Duplicate payment → mark voucher "PAID," match invoice number to prior payments, unique invoice constraint in ERP. (f) Cash theft in disbursement → SEPARATE check preparation from signing, POSITIVE PAY with bank, IMPREST petty cash, TWO SIGNATURES for large checks, monthly BANK RECONCILIATION by an independent person.

In modern ERPs, P2P runs through P-cards, e-invoicing, and ELECTRONIC INVOICE PRESENTMENT & PAYMENT (EIPP). BUSINESS EMAIL COMPROMISE (BEC) has become the leading fraud vector: an attacker impersonates a real vendor and asks that ACH routing be changed. Controls: OUT-OF-BAND VERIFICATION for banking changes (call a known phone number, not one on the email), and dual approval for master-file updates. Segregation of duties in the expenditure cycle: requisitioning, purchasing, receiving, vendor master maintenance, AP invoice entry, disbursement, and bank reconciliation should all be split. GRC tools flag SoD conflicts like "user can maintain vendors AND process invoices AND approve payments."

The PRODUCTION CYCLE converts raw materials to finished goods. Four activities: (1) PRODUCT DESIGN (BOM, routing); (2) PLANNING & SCHEDULING (MRP, MPS); (3) PRODUCTION OPERATIONS (issue materials, capture labor and machine time, apply overhead); (4) COST ACCOUNTING (accumulate costs by job or process, compute variances). Key documents/records: BILL OF MATERIALS (BOM), OPERATIONS LIST (routing), MATERIALS REQUISITION, MOVE TICKET, JOB-COST SHEET, PRODUCTION ORDER. Threats include theft of inventory (bar-code, RFID, physical security), inaccurate cost data (standard-cost variance reporting and root-cause analysis), and inefficient production (throughput analytics, lean/six-sigma tools).

The HR / PAYROLL CYCLE hires, trains, evaluates, and pays employees. Activities: (1) UPDATE payroll master file (hires, terminations, rate changes) — segregated from payroll processing; (2) UPDATE tax rates and deductions; (3) VALIDATE time and attendance (biometric clock, supervisor approval); (4) PREPARE PAYROLL (gross to net); (5) DISBURSE payroll (direct deposit); (6) DISBURSE payroll TAXES; (7) FILE forms 941/940/W-2. Threats: unauthorized master-file changes (dual approval, exception reports), phantom employees (periodic audit of payroll to HR master; distribute paychecks in person on a surprise basis), inaccurate time (biometric + supervisor override), tax filing errors (payroll-tax service such as ADP, Paychex, Rippling).

The GENERAL LEDGER & REPORTING system consolidates every subsidiary ledger (AR, AP, inventory, payroll, PP&E) into the GL. Activities: (1) UPDATE the GL from subsidiary ledgers with journal-voucher summaries; (2) POST ADJUSTING entries (accruals, deferrals, revaluations, corrections); (3) PREPARE FINANCIAL STATEMENTS (BS, IS, SCF, SoE); (4) PRODUCE MANAGERIAL REPORTS (variance, budget-to-actual, KPIs, dashboards). Controls: RECONCILIATION of every sub-ledger to the GL; INDEPENDENT REVIEW of adjusting journal entries; VERSION-CONTROLLED chart of accounts; XBRL tagging for SEC filers; AUDIT TRAIL preserving who created, approved, and posted each entry. Tools like BlackLine, FloQast, and Trintech (Cadency) automate the CLOSE.

DATA ANALYTICS IN ACCOUNTING uses statistical, computational, and visualization techniques to extract insights from AIS data. The AICPA's ADA (AUDIT DATA ANALYTICS) framework and the IMPACT model (Identify the question, Master the data, Perform analysis, Communicate, Track outcomes) structure engagements. Four analytic types (Gartner): DESCRIPTIVE (what happened — trends, ratios), DIAGNOSTIC (why — drill-down, correlation), PREDICTIVE (what will happen — regression, ML), and PRESCRIPTIVE (what to do — optimization, simulation). Descriptive and diagnostic dominate accounting practice; predictive is common in forecasting and audit risk assessment; prescriptive appears in supply-chain optimization and pricing.

The data pipeline is ETL — EXTRACT from source systems (ERP tables via SQL, APIs, or CSV export), TRANSFORM (clean, deduplicate, join, aggregate — Power Query, dbt, pandas), and LOAD into an analysis layer (data warehouse such as Snowflake, BigQuery, Databricks; or in-memory model such as Power BI / Tableau). SQL remains the core query language for accountants: SELECT specific columns; JOIN transaction tables to master data (customer, vendor, item); GROUP BY dimensions; filter with WHERE; and aggregate with SUM/COUNT/AVG. Excel remains dominant for ad-hoc analysis: PIVOT TABLES, XLOOKUP, POWER QUERY, POWER PIVOT (DAX), and DYNAMIC ARRAYS.

AUDIT ANALYTICS applies these techniques to substantive testing. Examples: JOURNAL-ENTRY testing (round-dollar entries, entries at period end, entries by unauthorized users, entries to seldom-used accounts, entries that reverse a few days later); BENFORD'S LAW analysis of leading digits to detect fabricated numbers; DUPLICATE payment detection; three-way match compliance; VENDOR-EMPLOYEE address matching for fictitious vendors; REVENUE cutoff testing at period end; and PREDICTIVE modeling of allowance for doubtful accounts. Visualization matters: use BAR/COLUMN for comparisons, LINE for time series, SCATTER for correlation, HEATMAPS for magnitude across two dimensions, and BOX PLOTS for distribution/outliers. Tell the STORY behind the numbers — analytics without communication has zero value.

INFORMATION SECURITY protects the CIA triad: CONFIDENTIALITY (only authorized users can view data), INTEGRITY (data are accurate and unchanged), and AVAILABILITY (systems and data are accessible when needed). The Trust Services Criteria (SOC 2) add PROCESSING INTEGRITY and PRIVACY. DEFENSE IN DEPTH layers preventive, detective, and corrective controls: PREVENT (firewalls, MFA, encryption, patch mgmt, awareness training, least privilege); DETECT (SIEM, IDS/IPS, log review, anomaly detection); CORRECT (incident response, backups, disaster recovery). The NIST CYBERSECURITY FRAMEWORK 2.0 organizes activities into IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER, and (new) GOVERN. The AICPA offers SOC 1 (ICFR at a service organization), SOC 2 (Trust Services Criteria), and SOC 3 (general-use SOC 2 summary).

COMMON ATTACKS: PHISHING and SPEAR-PHISHING (email deception — mitigated by DMARC/SPF/DKIM, training, MFA); RANSOMWARE (encrypt-and-extort — mitigated by IMMUTABLE OFFLINE BACKUPS, EDR, network segmentation, patching); BUSINESS EMAIL COMPROMISE (impersonated vendor/CEO — mitigated by out-of-band verification and dual approval); SQL INJECTION and other web-app attacks (parameterized queries, WAF, OWASP Top 10); INSIDER THREAT (least privilege, monitoring, exit controls). SUPPLY-CHAIN attacks (SolarWinds, MOVEit) exploit a trusted vendor's software. PRIVACY laws (GDPR, CCPA, HIPAA) add legal obligations for personal data. Every serious incident triggers a NOTIFICATION obligation; SEC Rule S-K Item 106 requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days.

The FRAUD TRIANGLE (Donald Cressey) identifies three conditions present in nearly every occupational fraud: PRESSURE (financial, work, personal), OPPORTUNITY (weak internal control), and RATIONALIZATION (the actor's ability to justify the act). Auditors add a fourth — CAPABILITY (the FRAUD DIAMOND, Wolfe & Hermanson). The ACFE REPORT TO THE NATIONS categorizes occupational fraud into ASSET MISAPPROPRIATION (most common, lowest median loss), CORRUPTION (bribery, conflicts, extortion), and FINANCIAL STATEMENT FRAUD (rarest, highest median loss ≈ $766K). Median duration is ~12 months; TIPS (from employees, customers, vendors — usually via a HOTLINE) are the #1 detection method (>40%). Best AIS defenses: strong CONTROL ENVIRONMENT (tone at the top), SoD, mandatory VACATIONS and JOB ROTATION, WHISTLEBLOWER HOTLINE, and continuous transaction MONITORING for red flags (round dollars, weekend entries, dormant vendors reactivated, adjustments to reserves near period end).

CLOUD COMPUTING (IaaS, PaaS, SaaS) shifts CAPEX to OPEX, enables ELASTIC scale, and centralizes patching and backup. Public cloud dominates AIS: AWS, Microsoft Azure, and Google Cloud host modern data warehouses (Snowflake, BigQuery, Databricks) and SaaS accounting suites (NetSuite, Sage Intacct, Xero). Controls shift from the customer's data center to the vendor's, so auditors rely on SOC 1 TYPE II reports issued by the service organization to obtain assurance over the ITGC and application controls that support financial reporting. Customer responsibilities remain — identity/access management, encryption keys, data classification, and monitoring — this is the SHARED-RESPONSIBILITY MODEL.

ROBOTIC PROCESS AUTOMATION (RPA — UiPath, Automation Anywhere, Blue Prism, Power Automate) uses software bots to mimic human keystrokes across systems. AIS use cases include vendor onboarding, bank reconciliation, three-way match exception handling, journal-entry posting, tax-form data extraction, and 10-K/10-Q filing prep. Governance requires a BOT INVENTORY, VERSION control, non-human LOGIN accounts with least privilege, and EXCEPTION handling. MACHINE LEARNING and GENERATIVE AI (LLMs) augment RPA with cognition: document extraction (invoice OCR), classification (expense categorization), anomaly detection (unusual JEs), fraud scoring, forecasting, and drafting narrative disclosures. Risks include HALLUCINATION, BIAS, model drift, IP leakage, and privacy — controls include human-in-the-loop review, model validation, prompt injection defenses, and data-loss-prevention on prompts.

BLOCKCHAIN and DISTRIBUTED LEDGER TECHNOLOGY (DLT) provide an APPEND-ONLY, cryptographically linked ledger replicated across nodes. PUBLIC (Bitcoin, Ethereum) chains permit anyone to write; PERMISSIONED (Hyperledger Fabric, R3 Corda) chains restrict participation. Accounting-relevant capabilities: TRIPLE-ENTRY BOOKKEEPING (both parties record the same immutable event), SMART CONTRACTS (self-executing agreements — Ethereum EVM), and TOKENIZED assets (stablecoins, security tokens). Real production use cases: cross-border payments, trade finance (Marco Polo, Contour), supply-chain provenance (IBM Food Trust), and CBDC pilots. Audit implications: CONTINUOUS assurance may replace annual attest; auditor must audit the CONTROLS around the chain (private keys, smart-contract code, oracles) — not the cryptography itself. IFRS/US GAAP still treat most crypto as INTANGIBLE ASSETS under ASC 350 (post-2023 ASU 2023-08 permits fair-value measurement for qualifying crypto).