Information Systems: Characteristics and Security

Internal Controls

• Internal control is a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations per PCAOB AU Section 319.06

• Internal controls are essential for dealing with risks and understanding controls, and will be reviewed in the chapter.

Categorization of Internal Controls

• Preventative controls are designed to prevent an event from occurring.
• Detective controls are designed to provide notice to the company that an event has occurred.
• Corrective controls are designed minimize or eliminate undesired outcomes when an event occurs.

Quick Class Exercise:

• A fire insurance policy for a company warehouse is a transfer, so the code is "T".
• Before any new employee is hired, a company runs a criminal background check this is preventative (P).
• Every month the company reconciles the cash account balance in the general ledger to the cash balance shown on their bank statement. This is detective (D).

Preventative Control

• Segregation of duties involves separating and assigning the three components of a transaction to separate employees.
• One component of a transaction is custody of assets.
• Another component of a transaction is authorization.
• The third component of a transaction is record keeping.
• An employee, such as the Inventory Manager or Clerk, is the only one authorized to have access to the inventory (custody).
• Another employee, such as the Purchasing Manager or Purchasing Agents, is the only person authorized to order inventory (authorization).
• A third employee, such as the Accounts Payable Manager or Clerk, is the person authorized to record increases to the inventory and accounts payable accounts for ordered and received inventory (record keeping).

Threats that can defeat internal control

• One threat is management override; when someone in a supervisory role directs one of the people that report up to them to not follow policy/ well designed control can be defeated.
• Another threat is collusion; when two or more employees work together (especially across segregated duties) a well designed control can be defeated.

Classification of Controls

• Physical controls are outside of the IT environment and govern human activities and the ability to work from home if an office is closed.
• IT General controls apply to the full set of systems used by the company requiring a password needed to access your office computer.
• IT application controls apply to a specific application; accounts payable clerk is allowed to enter AP transaction, but a payroll clerk is not allowed to enter AP transaction.

What is Risk

• Risk is the likelihood of an unfavorable event occurring and is essential in business.
• Risk is not always a bad thing.
• Focus is on unfavorable outcomes.
• The key is choosing the right level of risk.

Identifying Risks

• Risks can be related to a single business event, a business process, a business function, or the entire organization including the business model and strategy. Be as specific as possible to identify all risks
• Enterprise Risk Management (ERM) is a thorough process to identify, categorize, prioritize, and respond to an entity’s risks.

Risk Identification and Statements

• Identify existing risks and their outcomes.
• Categorize the risks based on their types; this helps fine-tune risks from entity-level to business-process-related risks.
• Prioritize risks that are most likely to occur or will have the largest impact on the organization and prioritize responding to those.
• Risk statements have two parts: the issue and the possible outcome, and are in the form of, "This issue may result in this outcome.”

Risk Categories

• Internal risks occur within the normal operations of a company and are preventable.
• External risks come from outside of a company. Some appear to be both internal and external.
• Internal risks include operational, technology and financial.
• External risks includes compliance, reputational, and strategic.

Risk Prioritization

• Risk severity is combination of risk likelihood and risk impact.
• Risk likelihood estimates the probability of occurrence.
• Risk impact estimates the damage.
• Risks are prioritized based on both factors.

Responding to Risk

• Before responding to risk, respond to the level of risk the entity faces is inherent risk.

• After a response, the remaining level of risk the entity faces is residual risk..

• There are four general types of responses to deal with each risk:

  • Accept the risk, no risk response is chosen, and the entity accepts the inherent risk.
  • Mitigate the risk by adjusting to reduce the likelihood of risk event occurring.
  • Transfer the risk transferring the risk to another entity (often in exchange for a payment).
  • Avoid the risk by avoiding events that cause the risk, and is not be possible in many cases

Example of Risk Response with Car

• You buy a new car that has a leather interior and sometimes your friends eat inside.
• Accept: Don't worry about. If someone spills, clear it and hope the stain isn't noticeable.
• Mitigate: Treat your seats with a chemical that makes the likelihood of a food stain much less.
• Transfer: Buy a specific insurance policy that covers damage to your seats.
• Avoid: Do not allow anyone to eat in your car

Types of Software

• Batch processing is when data is collected and processed later at the same scheduled time

• Real-time processing is when transactions are processed as they occur, requiring more processing capacity and complex systems and controls, order entry and shipping systems.

• Programming languages includes the coded instructions that create the software: -Structured Query Language SQL

• Application software are end-user programs that perform specific functions facilitated by apps.

• System Software includes operating systems, communications software, and utility programs.

Software Sourcing

• Software can be purchased from a third-party vendor or developed in-house, each with its own benefits and risks.
• If the business isn't adhering to software licensing policies of the software, could face legal allegations and reputational loss.
• If third-party software is not properly secure, it is vulnerable to hackers.
• Vendor may require unnecessary updates to bill additional hours to its customers that cannot be refused.

Cloud Computing

• Cloud computing is the newer model for software deployment, connecting you to software via the internet; the advantages of Software as a Service(SaaS) include increased flexibility and scalability to meet changing conditions.
• There are various budgeting, scheduling, technical specification, external market, fraud, reliability, privacy, and security risk areas of cloud computing.

Organizational Information Systems

• Alternative system configurations are available for locations common is a centralized system which connects all users to one central location.
• As businesses grow, they acquire businesses, and their systems can be integrated into a single system.
• For small businesses, use proper segregation of duties, physical and logical access.
• Business need to use policies and procedures for bring-your-own-device.
• The most important thing is to tie functions to employees with usernames and passwords.

Benefits of ERP System

• Future cost savings
• Improved data transparency and quality
• Increased business efficiencies
• Quality improvement
• Automating routine business processes
• SAP is one of the most popular ERP systems.

Manual vs. Automated Controls

• Manual controls are useful when human judgment and interaction are present, and employee travel expenses are reimbursed. Before being reviewed and initialed by manager.
• Automated controls are often more reliable and consistent, like when a transaction is entered into an accounting system. Debits do not equal credits.

Establishment and Assessment of Internal Controls

• Management has the primary responsibility to establish and maintain an adequate system of internal controls.
• Internal auditors are independent of management and are tasked with assessing the effectiveness and efficiency of controls.
• Internal control frameworks are essential as internal control framework is a set of concepts and questions that can be used by management to establish and maintain the internal control system.
• The COSO framework is one of the most widely adopted.
• The COSO Cube displays the three dimensions of the framework: control objectives, control components, and organizational structure.