Contents Exclusive summar 1 Check-in Process for XYZ Company 3 Organizational Overview 3 Process overview 3 Detailed process description 4 Membership sign up sub-process (Figure 2) 4 Equipment service sub-process (Figure 3) 5 Transaction and Object 5 Give a general name for this chapter, such as DATA BASE DESIGH 6 Overview of Flow Chart and Data base 6 Give a name here, such as Data Base Detail 10 Court Type (Category table) 10 Employee（Object table） 10 Equipment (Category table) 10 Member (Object table) 11 Membership Type (Category table) 11 Payment （Transaction table） 11 Rental Record (Intersection table) 12 Schedule (Transaction table） 12 Information Technology Controls for XYZ Recreation center 14 ADD A TiTLE, Such s overview of Controls 14 Control Details 14 Control classification zone 15 Type 16 Implementation 17 Metrics 17 Compensating Control 18 Change log 19 PRJ 1 19 PRJ 2 20

Exclusive summary
Going to stadium is an enduring activities among Americans, especially among those college students. Those people are keen to exercise their body day by day. It brings our company, XYZ Stadium, large amount of clients and incomes. What’s more, other organizations are willing to rent our space to hold their activities such as sport event. However, these good news challenge us in management process especially in check-in process which we did not think it over carefully before. To mitigate these problem, our company pushes and implement a sequence of system associated with the check-in process to control and prevent existing and potential risks.

Our check-in system is mainly constituted by a main process and two sub-processes. The main process is a general and simple process which our clients will face directly. It’s an almost automatic process operating and recording by computer system after staffs input required information. Instead, those two sub-processes are more complex and mostly executed by the background staffs. Clients won’t see those processes.

The main Check-In process is carried out at the check-in desk. Staffs there will help customers to check in, rent and schedule equipment and courts. They are responsible to match the clients’ status and their requirements with the data store in a few seconds. One of the sub-process is Membership Sign Up. It will check whether or not a people is an existing client. If the answer is yes, then let the customer enter. Otherwise, the staff will help the person to register his membership. Another sub-process is the Equipment Service. It is carried out after check-in. This process is mainly in charge of rent, collect and maintain equipment.

To support these process, we design a data base. The data base contains eight tables which can be classified into four types. Court Type table, Equipment table and Membership Type table are Category table. Employee table and Member table are Object table. Payment table and Schedule table are Transaction table. And Rental Record table is an Intersection table. All these tables interact with others to generate and control all activities in the Check-in process.

Furthermore, our company has burdened several internal controls in the system to protect properties belonging to us and clients. Authorization system is an Entity level control to prevent all unwelcomed visits. System Backup and Employee ID and Password Control are IT General Control, trying to preventing and protecting our system from any data loss. Fraudulent ID Identification, Stock-out Control and Employee Check-in Manifest are Application level control that rules several activities to offer our customer and employee better experience.

As more and more clients join us, our work will rely on the Information System more and more. The Check-in system may allow us to serve our clients more efficiently and effectively, creating better experience for them.

Check-in Process for XYZ Company
Organizational Overview
XYZ recreation center, founded in 2003, is a local stadium based in Corvallis. This stadium owns 10 basketball courts, 2 soccer courts, 2 cardio rooms, 3 weight rooms and 8 tennis courts and different kinds of equipment for common sports, such as soccer, tennis, basketball and psychical exercises. In a typical year, XYZ serves approximately 300 customers every day. Most of these customers live in or near Corvallis. In addition, it rents place to different organizations to hold events. The center is honor to provide all the clients equipment and courts offering them great experience.

XYZ Company commit themselves to comfort all clients and make sure they have a great exercise journey in its place. The company’s revenue is mainly earned from two parts. One is from renting equipment and courts to clients for regular exercises which provides nearly 6 million dollar per year, almost 70% of its whole profit; and the other one is space rental which is 30% revenue, which is around 2.5 million dollars. In this project, we mainly focus on court regular uses and renting equipment associate with the court.

Process overview
The Check-in process in XYZ Company is mainly about confirm customer’s identity and their needs so that staff can further service them. It relies largely on computer based information system to check customer’s identity and make reservation in a short time.
XYZ stadium has 2 check-in desks in its lobby. Each desk has one computer terminal and a scanner to read the information from membership card. The check-in process stars when a customer enters the stadium and go to the check-in desk. The check-in process contains both human (staff) work and material (computer) resources. In order to complete the check-in process, some procedural tasks need to be accomplished. To ensure customer satisfaction, every step should run smoothly and efficiently.
General speaking, the whole check-in process is to satisfy customers by efficient works. Staffs should provide fast and accurate feedback to meet customers’ requirements, as well as computer system should operate quickly and smoothly.
There are some risks in the Check-in process. The biggest risk will be system breakdown. Because our check-in process is largely relies on the computer system, if it’s crash or goes wrong in some way, the check-in desk is not able to provide customers smooth service which will lower customers’ satisfaction. In order to prevent this risk, staff will maintains the Check-in system every month to make sure it’s working well and can provide data smoothly and quickly. In addition, staff will backups data every day, basically at the end of each day.

Another risk will be illegal log-in. The threat is in some situation, some people may try to access our data without permission. That will lead to lose data. To reduce this risk, every employee have their own ID and password which can effectively prevent illegal log-in.

A customer using an expired membership card or other invalid card to access to facilities is a risk and will bring loss to XYZ. The check-in computer system and membership cards provides customers’ photo and membership expiration date clearly to staff for matching in order to prevent and detect customers with fraudulent ID.

In addition, our equipment may stock-out. That’s happened when we haven’t enough stock to replace broken equipment. This may lower customer satisfaction. To figure this out, we set up safety stock for each equipment in maintenance department. If the amount of an equipment in stock is below the safety stock we set before, the computer system will automatically send an order to warehouse to purchase in order to match the safety stock.

In some situation, employee may lose or forget their ID card so that they cannot enter the system. This will hit the speed of the check-in process which will lower customer satisfaction. In order to give fair and consistent service, employee can enter their ID number and password manually to get access to the computer system.

The last risk is in inner security. Some employee may try to access or change data which they are not be able to. In order to prevent this problem, each time an employee card be scanned, the identity will be recognized. They can access only the data they can access.

Detailed process description
The check-in process (Figure 1) begins when customer arrive at XYZ recreation center and walk up to the check-in desk. The staff at check-in desk greats the customer and then ask the customer to show their membership ID for check-in. If he/she is a valid member, the check-in desk will go ahead to check court status from data store; schedule court for them and notice the staff to prepare court for the customer. If the customer is a new comer, it will goes to a sub-process in Figure 2 about membership sign-up. After schedule court, the staff will ask whether the customer need equipment (such as badminton rackets; basketball or soccer) or not, if yes, there will be a sub-process about equipment service which is shows in Figure 3.

Membership sign up sub-process (Figure 2)
The membership sign up sub-process start from check-in desk ask the customer whether he/she is a member. If not, the check-in desk will lead the customer to membership service center. The membership service center will add the customer as a new member in the data store. At the same time, the membership service center will create a paper invoice and give it to the customer. Then, the customer will pay the invoice. After the staff in membership center receive the payment and record the payment into the data store, he/she will finalize membership and create a membership card for the customer.
After the customer receive the card, he can go ahead to check-in desk to scan ID and access to facilities.

Equipment service sub-process (Figure 3)
The equipment service sub-process begin with staff ask customer whether he/she need to borrow equipment or not. If no, the customer can go ahead to use court and free to go. If the customer want to borrow equipment, then the staff will check the customer’s ID and equipment status and issue equipment to customer. When staff issue the equipment, he/she will create a rental record into data store. For example, the customer want to borrow a basketball, the staff will check the customer’s ID and basketball quantity, and then issue a basketball to the customer. At the same time, write a rental record: “one basketball” into data store for further matching purpose. After issue equipment, the customer can use the court for exercise. When they done their activity, if the customer had borrow an equipment, he/she needs to return the equipment to staff before they leave. After the staff receive the equipment, he/she needs to check whether the equipment need to be maintained or not. If yes, the staff will give the equipment to maintain department. After the maintain department receive the equipment, they will check the equipment to see if it can be fixed or have to be replaced. If it can be fixed, the department will fix it and return it to the staff. Otherwise, the maintain department will make an order and send it to warehouse. The warehouse receive the order and ship the required equipment back, and then, maintain department collect them and return them back to the staff.

Transaction and Object
The Check-in system’s data is stored in tables in a Microsoft Access database.

Object Table:
——The Member table lists customer’s individual information, such as the name, gender, address, contract number and membership type. It is an object table because it is continue exist unless the member’s information change.

——The Employee table lists our employee’s information. It is an object table because it will last a long time period, unless the employee need to be changed. For each employee we record a name, and their position.

Transaction Table:
——The Payment table record customer payments. For each payment, we will record the date, payment method, total amount, and customer pay for. It will change intermediately once the payment have been made.

——The Schedule table record the court use information. It is a transaction because it will change once the customer need to use the court. Each schedule record, we will record the member ID, employee ID, court type, beginning time and ending time.
Give a general name for this chapter, such as DATA BASE DESIGH
Overview of Flow Chart and Data base
Figure 1. Check-in process: The Check-in process in XYZ Company. Two sun-process will be mentioned below

Figure 2. Membership sign up: Include new member sign up and membership data create process.

Figure 3. Equipment service: Include equipment borrowing; returning and maintain process.

Figure 4. Relationship between all tables in access base.

Give a name here, such as Data Base Detail
Court Type (Category table)
The court type table is used to record the variety of courts. It includes a primary key which is “Court type ID”. The Court Type ID is a list of unique numbers to distinguish between different kinds of courts. There is another attribute called “description” which data type is short text to briefly explain the definition of each specific court related to each specific Court Type ID.

Figure 5. Court Type table

Employee（Object table）
Employee table is an object table. It contains a list of employee in this company. The table shows some information about each employee. The primary key is Employee ID. It is used as a unique ID for each staff to help people distinguish them. The Last Name and First Name record together record the full name of names which refer to different Employee ID. And the Position records jobs of different employees.

Figure 6. Employee table

Equipment (Category table)
The equipment table records all kinds of equipment which are available for check out in the company. The primary key of this table is equipment ID. The equipment ID is to give each kind of equipment a unique number for recognition and further record. Another attribute “Description” is to explain each equipment ID meaningfully by each equipment’s name.

Figure 7. Equipment table

Member (Object table)
Member table is an object table. It includes a list of members. The table presents information of each member. The primary key is Member ID which serves as a unique ID for each member to distinguish them. Last Name, First Name, Gender records the natural information of a member. Address, City, State and Phone Number store where the company could contact them. Membership Type ID is a foreign key records which kind of member a customer is from membership type table.

Figure 8. Member table

Membership Type (Category table)
The purpose of Membership type table is to list different membership type base upon customer’s billing cycle in order to decide the payment each time. The primary key of this table is the Membership type ID. It recorded as short text to show three different types of membership related to three billing cycle (monthly; semi-annually; yearly). The other attribute is membership type description to describe the membership type more specifically.

Figure 9. Membership Type table

Payment （Transaction table）
Payment table is another transaction table. This table records the process that a customer pays a bill. Payment ID serves as the primary key while Member ID serves as the foreign key, which could offer more information from certain corresponding tables. In this table, the Payment ID is a unique ID here to differentiate each payment. Member ID is used to identify who rents the court, linking more information from the Member table. The Payment Method depicts how a customer pay a bill. The Total Amount and Payment Date show how much and when a customer pays the bill, respectively. The Description is used to record some note for the payment, such as discount.

Figure 10. Payment table

Rental Record (Intersection table)
Rental Record is an intersection table, containing information about equipment rental. Rental Record ID is the primary key, help staffs distinguish different rentals. Member ID, Employee ID and Equipment ID are foreign keys which link to the corresponding table to give more information about these attributes. Quantity depicts how many items are rented by a customer. Issue Time and Return Time together is used to calculate how an equipment is rented. All these information together present an equipment rental process, help the company to track the situation of each equipment.

Figure 11. Rental Record table
The Rental_Record_Intersection_Table supports a many-to-many relationship between the Member Table, Employee Table and the Euipment Table. The intersection table, itself, is not a list of individual events or objects of interest, rather its purpose is to record an association between items in the other tables. It has its own primary key and has three foreign key attributes, Member ID which points to the primary key of Member Table, Employee ID which points to the Employee Table and Equipment ID which points to the primary key of Equipment Table.

Schedule (Transaction table）
Schedule table is a transaction table which links to Employee table, Court Type table and Member table. It depicts a process that an employee helps a customer book a court. In this table, its primary key is Court ID while Employee ID, Court Type and Member ID serve as foreign key. The Court ID describes is a unique ID to distinguish different court. The Member ID is used to record who borrows the court. The Employee ID records which employee helps to book the court. Beginning Time and Ending Time are recorded to help calculate how long the court is used. The Court Type ID is used to define which kind of court is rented. All these attributes together could help the company to track the status of each court, helping it to better understand and manage its court rental.

Figure 12. Schedule table

Information Technology Controls for XYZ Recreation center
ADD A TiTLE, Such s overview of Controls
The company’s philosophy of XYZ recreation center is making the fitness experience both safety and enjoyable for its customers. XYZ recreation center hire and train high-skill employees and use high quality system and controls to reach this target. The XYZ recreation center’s key goals are to ensure the quality of equipment and site in order to keep customers safe during the using period; to provide fair and consistent customer service; and to ensure XYZ’s process and controls can work effectively to help meeting this goal. The operational strategy in XYZ recreation center includes the implementation of preventative, detective, compensating and corrective controls to enhance the customers’ satisfaction and feeling of safety and well-being. Because our control and operation largely rely on computer, the biggest risk is system break-down. Other risks including illegal and unauthorized log-in; employee mistake specifically during check-in; fraudulent ID identification and equipment stock out. To lighten the risks and threats the following controls are implemented into the XYZ recreation center.

Control Table | Control Name | Control Zone | Type of Control | Implementation | System backup | IT General Control | Corrective | Hybrid | Employee log-in ID and password | IT General Control | Preventive | Automated | Fraudulent ID (Membership card) Identification | Application Control | PreventativeDetective | Hybrid | Stock-out control | Application Control | Detective | Automated | Employee check-in manifest | Application Control | Compensating | Manual | Authorization system | Entity level Control | Preventative | Automated |
Figure 1: XYZ Recreation center risk/threat control table showing individual control classification and implementation types.
Control Details
The system backup control is the first and the most important control to mitigate the risk of system break down which is the biggest and worst risk. The recreation center’s employee backups the databases once a day, basically at the end of the day. Employee will backups all the database in a large hard disk. If unfortunately, the system break down, we can use the backup database to correct it to minimize the possibility of lose data.

The employee log-in ID and password control decrease the risk of illegal log-in. Each employee has a unique ID and their own password. Each time they want to enter the system, they have to put in their ID number and the password relative to it. Only when the ID and the password match, they can enter the system. This control can prevent the risk of steal data and illegal log-in.

The Fraudulent ID (Membership card) Identification control can prevent the risk of customer enter the recreation center under other’s membership card or invalid card. The employee at the check-in desk will scan each customer’s membership card, the computer will identify it in order to make sure he/she has qualification to enter. If the information in the card match the person, he/she can access to the recreation center. Otherwise, he/she will not be able to enter in.

The stock out control can reduce the risk of equipment out of stock. We set up safety stock for each equipment in maintenance department. Each time an equipment is broken and cannot be maintained, we will replace the old one with a new one from the stock in maintenance department. If the amount of an equipment in stock is below the safety stock we set before, the computer system will automatically send an order to warehouse to purchase in order to match the safety stock.

The Employee check-in manifest is a second way for employee log-in. normally, employee can scan their ID card to log-in the system. However, sometimes employee may forget or lose their ID card. In order to give fair and consistent service, employee can enter their ID number and password manually to get access to the computer system.

The Authorization system is used to keep inner security in the XYZ recreation center and everyone has to follow the rule. Each time an employee card be scanned, the identity will be recognized. They can access only the data they can access. For example, manager can access and change every employee’s record but each employee can only see their own record and cannot edit it.

Control classification zone
XYZ stadium control include examples of entity –level controls, application controls, and IT general controls.

By definition, the entity level control is a control which can affect the whole company. Specifically in XYZ recreation center is the authorization system. The Authorization System forces everyone in the organization to follow the “no one can entry any area without permission” rule. For example, normal employee can only access to part of the data and cannot make any change. Managers have higher permission than normal employees so that they have full access to read and change all data.

IT General control includes system back-up and employee ID log-in system. By definition, IT level of control is used to address the IT system risk. The System Back Up is define as an IT control because the company needs to backup all data daily in case of the system break-down and data lose. Also, The Employee Login ID is an IT general control either. Each employee has their own personal ID and password to login the computer which can better to prevent illegal log-in.

Fraudulent ID and stock-out control are regard as Application control. Application control is used to address risk in a specific business application. Fraudulent ID control which is a specific topic in check-in process. Customer will hold their own customer ID to get access the stadium. The stock-out control is a part of application control because it directly associate to the equipment order process. Similarly, the Employee Check-in manifest is also an application control which only relative to the employee check in process.

Type
For the control of the XYZ stadium include preventive, detective, corrective and compensating controls.

The control classified as preventive is that it can effective prevents an illegal and physical enter the system. Base on this definition, we have three way to prevent the illegal enter the system. For the first step, we have Fraudulent ID control, we use this step to prevent the non-customer entry our system. Then, we use Employee Log-in ID system to identify our employee in order to prevent other people get in the system. Finally, we use authorization System to distinguish the different authority so that we can prevent people from access the data which they haven’t permission.

Detective is identify a control that can detect or report errors, omissions and malicious act. XYZ stadium using the Fraudulent ID identify to detective invalid membership card in order to prevent these customers to enter the stadium with invalid card. The Safety Stock Control is an effective method for the maintain department to detect whether the equipment is out of stock. In this case, maintain department will set up safety stock of the equipment in the computer, once a kind of equipment in the maintain department lower than the amount of safety stock we set up before, it will sent the purchase order to the warehouse automatically. (Employee will record the number we purchase and record the number of the equipment we sent to the stadium. The system keep tracking these number of equipment weekly. System will use automated subtract the number we sent to stadium by the purchase and compare this number we set up for the safety stock. If it is lower than the safety stock we set up, it will sent the purchase order to the warehouse.)

Control are classified as corrective when it can remedy problems and minimize the negative effect. The System Back Up is a kind of the Corrective control. As we mention before, our company backup data daily, which can decrease the loss from the system break down and minimize the negative impacts. Compensating control is identify as we have another way to figure out the error. In our system, Employee log-in is defined as compensating control. All employee can log-in the system with either ID card or enter their ID and password manually. If an employee forget their ID card, they can type in their information to get access to the system.

Implementation
The successful internal control relies extremely on employees and other components implementing their work carefully and strictly.
Manual controls require people to initiate the action. Manual work are used to avoid potential risks during the operating process. Employee Check-in Manifest is a manual control because an employee could input certain code to gain access if he/she left the ID somewhere else.

An automated control is that people just need to follow the system requirements rather than process by themselves. Employee Log-in Control is an automated control because the system will match the employee’s log-in ID and password in its data store to make sure whether this person have access or not. Authorization system Control is another automated control since when a person slides his employee ID card, the system will match his identity and his authorization in the list to decide the level of access. A hybrid control includes steps that requires people to initiate something first then the system will execute it automatically. System Back-up Control is a hybrid control since it requires people to back up whole data first during certain period. If the system break down and is unable to correct, the system will use the back-up data minimize the data lose. Fraudulent ID Control is another hybrid control since the staff will input the Member’s personal information like SSN, home address and photo to the data base first. Then when a person enter the check-in desk and slide their card, the system would match the information in the data base and also the employee will identify whether the person stand in front and in the photo is the same one. The last hybrid control is Stock-out control. This is because a staff will first decide the amount of safety stock and set a safety stock level. After that, when the system detects if the amount of certain equipment is lower than the safety stock level, it will automatically send order to warehouse to replenish the stock. Metrics
When people evaluate the how effective and accurate these controls are accomplished, lead or lag indicators would be usually used as standard. Lead Indicators describe whether or not the processes are being correctly applied. Lag indicators describe the degree to which XYZ’s goals are being accomplished.

System back-up control can be measured by how well the system recover from the last system crash. Because it is different to set a specific goal to evaluate the recovery level byte by byte. People could only evaluated through its general performance. So it would use lead indicator rather than the lag indicator to assess.
The lag indicators is used in Employee Check-in Control since this can be measured clearly by the number of trespass. The ideal goal would be zero which means there is no improper individual to pass the entrance with certain code. Each improper pass will lead the control to be far away from the goal.

The Employee Log-in Control can be measured by the amount of illegal log-in. The ideal goal would be zero which means there is no improper individual to log into the system. Any illegal log-in would result in a worse outcome than before. Clearly, the lag indicator could be the metric to the control.

Authorization control can be measured by how many times the improper happens. The ideal goal would be zero which means there is no improper individual trying to go to an unauthorized zone in the company. Any successful trail would be counted as a bad performance. So the lag indicator could be the metric here.

Fraudulent ID Control can be measured by how many times the Fraudulent ID is successfully pass the check-in process. The ideal goal would be zero which means there is no improper individual successfully enter the stadium with an invalid ID. Any successful trail would be counted as a bad performance. So the lag indicator could be the metric here.

Stock-out control can be measured by how many times stock-out happens. The ideal goal would be zero which means there is always enough equipment in our stock. Any stock-out would be regarded as a failure. So the lag indicator could be the metric here.

Compensating Control
Controls are classified as compensating controls when they are utilized to compensate for another control. The Employee Check-in Manifest is another manual control. This is because an employees could input correct password to enter a door in case of staffs leaving their ID card somewhere else which may lead them not to be able to gain access.

Change log
PRJ 1 * Add and correct some risks in process overview. * Add reference into Sub-process in the Check in Process. * Remove the relationship between the Sign up Membership Sub-process and Member data from the Check in process. * Remove the Equipment table from the Check in process. * Change the Sub-process table’s name to “Equipment service” to match the sub-process name from the Check in process. * Add a new Data store called “Schedule” and connect to “Schedule Court” table in the Check in Process. * Add a new data store called Employee into the sign up Membership process. * Remove the Paper Payment document from the Sign up Membership process. * Add the Scan ID table, and add the relationship between the Scan ID table and Receive Membership ID-Card from the Sign up Membership process. * Add a new data store called Payment into the Sign up Membership process. * Remove the “Need equipment” decision and “Rent Equipment” decision from the Equipment Service process. * Add a connection between the “Use Court” table and “Return Equipment” in Equipment Service process. * Add connection between “Ask customer need equipment or not” to “Check ID” table in Equipment Service process. * Add a connection between “Receive Equipment” and “Rental Record” in Equipment Service process. * Remove the Paper document “Purchase order” from the Equipment Service process, and connect the “Create purchase order” table and “Receive Order” table in Equipment Service process. * Change the name of “Purchase equipment” to “Ship equipment” in Equipment Service process. * Change the name “Maintain Equipment” decision table to “Maintenance” decision table and remove the connection between the “Maintenance” decision table to the End table in Equipment Service process. * Add a new End table and connect to the “Maintenance” decision table table in Equipment Service process. * Rewrite the describe about the “transaction and object”
PRJ 2 * Remove the space from the Table Name. * Add figure name for each table.