The previous discussion on electronic data exchange focused on routing of information.
What if your change affected the content of the information that you share
between partners via EDI? We keenly are sensitive to the “garbage in, garbage out” principle of data processing, which states that if you input bad data into a process, no
matter how good that process is, you will get bad information out of it. Recall the United
Airlines web page example where a mistaken change in their web page permitted
customers to buy flights at cut-rate prices, driving losses to the airline. United was able
to detect the mistake relatively quickly and take action to correct it, but what would happen
if the information in your EDI was tainted? What if a change was made and the bill
you send or receive for US $100 had an extra zero appended to it, making it now US
$1000? Do you have controls in place that would quickly catch and correct that mistake,
or does that bill get paid automatically because it is between two “trusted” sources?
What if the change is made on your partner’s side of the transaction? How do you detect
errors generated by your partners? What does your contract say? How long would it take
to find and fix tainted information, and what would it cost to repair the damage? What
would it cost if you didn’t detect the tainted information? Are you paying too much for
something and don’t even know it? Your electronic data exchanges are vital to modern
business yet need to be tightly controlled to preserve the integrity, accuracy, and security
of your information.
Internal control policies that specifically address how you manage and control all
changes to system configurations, software, web pages, and data exchanges will keep
you out of trouble. Remember, next to your people, your most valuable asset is your
information. Make it your policy that anything associated with the access, presentation,
processing, storage, or transmission of your information is tightly controlled.