Computer Controls for Organizations and Accounting Information Systems

2. Chapter 10:ComputerControls for Organizations and Accounting Information Systems • Introduction • Enterprise Level Controls • General Controls for Information Technology • Application Controls for Transaction Processing

3. Enterprise Level Controls • Consistent policies and procedures • Management’s risk assessment process • Centralized processing and controls • Controls to monitor results of operations

4. Enterprise Level Controls • Controls to monitor the internal audit function, the audit committee, and self-assessment programs • Period-end financial reporting process • Board-approved policies that address significant business control and risk management practices

5. Risk Assessment and Security Policies

6. Integrated Security forthe Organization • Physical Security • Measures used to protect its facilities, resources, or proprietary data stored on physical media • Logical Security • Limit access to system and information to authorized individuals • Administrative – Policies, procedures, standards, and guidelines.

7. Physical and Logical Security

8. General Controls for Information Technology • Access to Data, Hardware, and Software • Protection of Systems and Data with Personnel Policies • Protection of Systems and Data with Technology and Facilities

9. General Controls for Information Technology • IT general controls apply to all information systems • Major Objectives • Access to programs and data is limited to authorized users • Data and systems protected from change, theft, and loss • Computer programs are authorized, tested, and approved before usage

10. Access to Data, Hardware, and Software • Utilization of strong passwords • 8 or more characters in length…..or longer • Different types of characters • Letters, numbers, symbols • Biometric identification • Distinctive user physical characteristics • Voice patterns, fingerprints, facial patterns, retina prints

11. Security for Wireless Technology • Utilization of wireless local area networks • Virtual Private Network (VPN) • Allows remote access to entity resources • Data Encryption • Data converted into a scrambled format • Converted back to meaningful format following transmission

12. Controls for Networks • Control Problems • Electronic eavesdropping • Hardware or software malfunctions • Errors in data transmission • Control Procedures • Checkpoint control procedure • Routing verification procedures • Message acknowledgment procedures

13. Controls for Personal Computers • Take an inventory of personal computers • Identify applications utilized by each personal computer • Classify computers according to risks and exposures • Enhance physical security

14. Additional Controls for Laptops

15. Personnel Policies • Separation of Duties • Separate Accounting and Information Processing from Other Subsystems • Separate Responsibilities within IT Environment • Use of Computer Accounts • Each employee has password protected account • Biometric identification

16. Separation of Duties

17. Division of Responsibility in IT Environment

18. Division of Responsibility in IT Environment

19. Personnel Policies • Identifying Suspicious Behavior • Protect against fraudulent employee actions • Observation of suspicious behavior • Highest percentage of fraud involved employees in the accounting department • Must safeguard files from intentional and unintentional errors

20. Safeguarding Computer Files

21. File Security Controls

22. Business Continuity Planning • Definition • Comprehensive approach to ensuring normal operations despite interruptions • Components • Disaster Recovery • Fault Tolerant Systems • Backup

23. Disaster Recovery • Definition • Process and procedures • Following disruptive event • Summary of Types of Sites • Hot Site • Flying-Start Site • Cold Site

24. Fault Tolerant Systems • Definition • Used to deal with computer errors • Ensure functional system with accurate and complete data (redundancy) • Major Approaches • Consensus-based protocols • Watchdog processor • Utilize disk mirroring or rollback processing

25. Backup • Batch processing • Risk of losing data before, during, and after processing • Grandfather-parent-child procedure • Types of Backups • Hot backup • Cold Backup • Electronic Vaulting

26. Computer Facility Controls • Locate Data Processing Centers in Safe Places • Protect from the public • Protect from natural disasters (flood, earthquake) • Limit Employee Access • Security Badges (color-coded with pictures) • Man Trap • Buy Insurance

27. Study Break #1 • A _______ is a comprehensive plan that helps protect the enterprise from internal and external threats. • Firewall • Security policy • Risk assessment • VPN

28. Study Break #3 • Fault-tolerant systems are designed to tolerate computer errors and are built on the concept of _________. • Redundancy • COBIT • COSO • Integrated security

29. Application Controlsfor Transaction Processing • Purpose • Embedded in business process applications • Prevent, detect, and correct errors and irregularities • Application Controls • Input Controls • Processing Controls • Output Controls

30. Application Controlsfor Transaction Processing

31. Input Controls • Purpose • Ensure validity • Ensure accuracy • Ensure completeness • Categories • Observation, recording, and transcription of data • Edit tests • Additional input controls

32. Observation, Recording,and Transcription of Data • Confirmation mechanism • Dual observation • Point-of-sale devices (POS) • Preprinted recording forms

33. Preprinted Recording Form

34. Edit Tests • Input Validation Routines (Edit Programs) • Programs or subroutines • Check validity and accuracy of input data • Edit Tests • Examine selected fields of input data • Rejects data not meeting preestablished standards of quality

35. Edit Tests

36. Edit Tests

37. Additional Input Controls • Validity Test • Transactions matched with master data files • Transactions lacking a match are rejected • Check-Digit Control Procedure

38. Processing Controls • Purpose • Focus on manipulation of accounting data • Contribute to a good audit trail • Two Types • Control totals • Data manipulation controls

39. Audit Trail

40. Control Totals • Common Processing Control Procedures • Batch control total • Financial control total • Nonfinancial control total • Record count • Hash total

41. Data Manipulation Controls • Data Processing • Following validation of input data • Data manipulated to produce decision-useful information • Processing Control Procedures • Software Documentation • Error-Testing Compiler • Utilization of Test Data

42. Output Controls • Purpose • Ensure validity • Ensure accuracy • Ensure completeness • Major Types • Validating Processing Results • Regulating Distribution and Use of Printed Output

43. Output Controls • Validating Processing Results • Preparation of activity listings • Provide detailed listings of changes to master files • Regulating Distribution and Use of Printed Output • Forms control • Pre-numbered forms • Authorized distribution list

44. Study Break #5 • Organizations use ______ controls to prevent, detect, and correct errors and irregularities in transactions that are processed. • Specific • General • Application • Input

45. Triangles of Information Security Why We Do It (Fraud) How We Prevent It

46. Fraud Triangle

47. CIA Triangle