Article Lapping it Up httpswwwjournalofaccountancycomissues2

Article: Lapping it Up

https://www.journalofaccountancy.com/issues/2002/feb/lappingitup.html

What serious internal control deficiency should the bank’s external auditors have detected?

Solution

The most important internal control defeciency which should have been detected and corrected is:
Computer programmer(Nelsen in this case) having access to \"live\" customer data. Being the principal architect of the data, such programmers shall have a restricted \"view only access\" (if needed) to prevent misuse of the data the way Nelsen did. The whole fraud would have been avoided if the access has been denied/restricted,