Chapter 14 - Controls and Security Measures Flashcards
Primary vs Secondary Controls
-
PRIMARY CONTROLS
-
Preventive controls: stop problems before occur. Examples:
- Access restriction.
- Using edit field checks to avoid certain types of incorrect data from entering a system. PRELISTING OF CASH RECEIPTS IS ALSO A PREVENTIVE MEASURE.
- Establishing formal security policy.
-
Detective controls: alert problems after problems occur.
- Automatic reporting of all rejected batches of invoices.
- Examining systems logs of action that require scrutiny.
-
Corrective controls: correct negative effects of unwanted events.
- Requiring that all cost variances over a certain amount are justified.
- Correcting errors on error listing.
-
Directive controls: cause or encourage the occurrence of a desirable event.
- Policy and procedure control
-
Preventive controls: stop problems before occur. Examples:
-
SECONDARY CONTROLS
-
Compensatory (mitigative) controls may reduce risk after primary controls fail but not to an acceptable level.
- An example is supervisory review when segregation of duties is not feasible.
-
Complementary controls work with other controls to reduce risk to an acceptable level.
- Deposit slips validated by the bank.
-
Compensatory (mitigative) controls may reduce risk after primary controls fail but not to an acceptable level.
Time-based Classification of Controls
- Feedback controls report information about completed activities, e.g. inspection of completed goods.
- Concurrent controls adjust ongoing processes. These real time controls monitor activities in the present to avoid them to deviate too far from standards.
- Feedforward controls anticipate and prevent problems. The controls require long term perspective. Organizational policies and procedures are examples.
FINANCIAL VS OPERATING CONTROLS
- Financial controls should be based on relevant established accounting principles, also known as accounting controls e.g.. appropriate record keeping, safeguarding of assets and compliance with laws.
-
Operating controls apply to production and support activities, also known as administrative controls.
- Based on management principles and methods
- Documentary control is also involved.
Areas where control activities are identified
- Segregation of duties, including four basic functional responsibilities.
- Independent checks and verification.
- Safeguarding controls.
- Prenumbered forms.
- Specific document flow.
Segregation of Duties
4 types of functional responsibilities must be segregated:
ARCR
- AUTHORIZATION - EXECUTE Authority to execute transactions.
- RECORDKEEPING - RECORD Recordkeeping of transactions.
- CUSTODY - HOLD Custody of the assets affected by transactions.
- RECONCILIATION - RECONCILE Periodic reconciliation of the existing assets and recoded amounts.
Examples on purchase cycle:
WHO STARTS THE PURCHASE PROCESS IS INVENTORY CONTROL
(The managers should submit purchase requisitions to the purchasing department. The purchasing function should be separate from operations.)
Execute: purchase department execute and follows up on transactions.
Record: accounts payable record the transaction.
Receiving prepares a receiving report and forwards it with the goods to warehouse. Receiving also sends the receiving report along with the packing slip to accounts payable for matching with the purchase order and updating of the accounts payable file
The Accounts Payable Department prepares a voucher from a vendor’s invoice only after examining supporting documents. These include a properly authorized purchase order and a receiving report stating quantities received and their condition.
Hold: custody of the assets is vested in the warehouse.
Reconciliation: inventory control does recon.
Examples on sales cycle:
Execute: sales department.
Record: accounts receivable.
Hold: treasurer (in case of cash) or warehouse.
Reconciliation: general ledger accounting group.
Sales order (approved by credit department), packing slip & bill of lading (provided by shipping to customer), invoice (provided by billing and is matched vs packing slip & bill of lading), acknowledgement (Upon receipt of an approved sales order, sales sends an acknowledgment to the customer)
CREDIT SALES SHOULD BE AUTHORIZED PRIOR TO EXECUTING THE SALES.
Examples in payroll cycle:
Execute: human resources hires and terminates.
Record: payroll department.
Hold: treasurer (since is cash).
Reconciliation: general ledger accounting group.
Independent Checks and Verifications
- The reconciliation of recorded accountability with the assets must be performed by a part of organization 1) unconnected with the original transaction 2) without custody of assets involved.
- An agreement of cash count with the recorded balance does not providence that all cash received has been recorded properly. HAS TO BE ASSET VS CASH.
Safeguarding controls
- Limits access to an organization’s assets to authorized personnel.
- E.g. unescorted access to computer operations center prohibited: 1) all non information system personnel 2) all non operations information system personnel such as developers.
- Holding of securities in safe deposit box.
- Authorization of payment voucher accounts payable only after examining supporting documents.
- Approval of credit memos by the credit department not sales.
Pre-numbered Forms
- Sequentially prenumbered forms are the basis for a strong set of internal controls. Receiving reports in the warehouse and purchase orders in the sales department are common examples.
- When every hardcopy is prenumbered, all can be accounted for for. E.g. date of their use and the person who filled out can be ascertained.
- ID identified transactions can be checked for review and approval.
Specific Document Flow
>>> SPECIFIC DOCUMENT FLOW
- Together with prenumbered forms, this allows for proper tracing of processes.
- Tracing and vouching (double way vlookup)
-
TRACING: follows a transaction from the triggering event to a resulting event, ensuring that the transaction was accounted for properly.
- LIABILITY ACCRUED FOR GOODS RECEIVED.
-
VOUCHING: tracks a result backward to the original event, ensuring that an accounted amount is properly supported.
- RECEIVABLE CLAIM IS SUPPORTED TO A SALES TO CUSTOMER.
-
TRACING: follows a transaction from the triggering event to a resulting event, ensuring that the transaction was accounted for properly.
- Tracing and vouching (double way vlookup)
Compensating Control
COMPENSATING CONTROLS
- Compensating controls replace the normal controls, such as segregation of duties, when the latter cannot be feasibly implemented.
- For example, top management my authorize and execute investments and have access to record. To compensate, you can put two people to perform each function.
-
Other compensating controls:
- Periodic communication with the board.
- Oversight by a committee of the board.
- Internal auditing reconciliation of the securities portfolio with the recorded information.
THREE GOALS OF INFORMATION SECURITY
- Availability
- Confidentiality
- Integrity
Threats to systems: Input manipulation
Intrusion exploiting vulnerability of the system, using input fields that can be viewed by hackers.
Threats to system: Sabotage
disruption of an organzation’s system not for personal gain but simply for revenge or vandalism.
Threats to systems: Malwares: Virus vs Logic Bombs vs Spyware vs Ransomware vs Works vs Trojan Horses vs Phishing
Malware: short for malicious software.
- Viruses: computer programs that propagate (replicate) themselves from one computer to the other without the user’s knowledge.
- Logic bombs: also destroy data, but unlike viruses, they stay on a single computer and don’t replicate.
- Spyware: spies on a user without his or her knowledge and collects data such as keystrokes. Programs that capture key strokes are called keylogger software.
- Ransomware: holds a computer files hostage and demands a ransom payment. Ransomware distributors do really want to cause a major trouble.
- Worms: pieces of codes that do not threaten the data on the computer, but are destructive because of the rapidity with which they replicate themselves (congest data/server traffic)
- Trojan horses: voluntarily masquerades in programs that users wants, and can be a door to control the computer, retrieve data, or use it to launch proxy attacks on other computers.
- Phishing: is the attempt to acquire sensitivity information by pretending to be a trustworthy entity.
SYSTEMS DEVELOPMENT CONTROLS
- All information system, automated or manual, perform four basic functions on information: 1) input, processing, output and storage.
- The most critical separation of duties in an information system is between (1) computer operators, files, equipment, and production programs and (2) programmers and system analysts.
Logical Controls
-
Logical controls - ADAPTIVE (limit system access (1) to authorized people (2) only to a certain extent.
-
Authentication: is the act of ensuring that the person attempting to access the system is in fact who he/she says he is.
- Password optimization: be difficult to guess, at least 8 with variation of characters, and system should force passwords to change periodically.
- Single sign-on can be a solution to password optimization..
- Authorization: access rules and user groups in Adaptive
-
Authentication: is the act of ensuring that the person attempting to access the system is in fact who he/she says he is.
Logical computer controls are needed to determine whether an acceptable user is allowed to proceed. The one item that is not part of this control process is a
A.List of all files maintained on the system.
B.List of all programs maintained on the system.
C.List of all authorized user code numbers and passwords.
D.Limit on the number of transaction inquiries that can be made by each user in a specified time period.
Answer (D) is correct.
Restricting access to the computer system requires determining whether access by a given user (or device) is compatible with the nature of the attempted use. A series of passwords or identification numbers may be required to gain access to the system, to examine data files, and to perform processing using particular programs. Thus, a clerk might be authorized only to read the data in a given file while using a specified terminal, but his or her superior might be able to update the file. Logical controls require online storage of authorization tables or matrices that specify the access permitted to specified codes and devices. The number of authorized inquiries per user is not included in such a table.
- *
