ABSTRACT:

Studies examining the relative importance of small business computer (SBC) controls have appeared frequently in the literature. However, the question of whether companies actually provide SBC controls at levels commensurate with those controls' importance remains unanswered. Moreover, a model of control provision and inadequacy has not been introduced in the literature. This paper addresses both of these issues. First, a model of control provision, incorporating control importance and control cost, is developed. Then, the results of an empirical test of this model are reported.

The test found that control provision is highly associated with control importance. It also discovered that the SBC controls considered to be the most important by the respondents were likewise considered to be the most inadequate. The model developed in this paper should provide a foundation for future research concerning SBC controls, and the findings from the empirical test should prove interesting to auditors, systems designers, managers, and researchers.