Computer Based Information Systems Control

1. Computer Based Information Systems Control UAA – ACCT 316 – Fall 2003 Accounting Information Systems Dr. Fred Barbee 8 Chapter

2. SAS 29 (1958) This Chapter Text Chapter 7

3. Encourage adherence to management policies and procedures. • Promote operational efficiency. • Safeguard assets • Ensure accuracy of accounting data and information.

4. Preventive, Detective, and Corrective Controls Input Output Process Sensor Detective and Corrective Controls Corrective Controls Bench- mark

5. Discover the occurrence of adverse events. Tend to be active in nature. After the fact controls Detective

6. Corrective • Lead to the righting of effects caused by adverse events. • Tend to be more active than detective controls.

7. Block adverse events, such as errors or losses from occurring. Tend to be passive in nature. Preventive

8. Ensure that overall IS is stable and well maintained. • Ensure the accuracy of specific applications, inputs, files, programs & outputs.

10. What Constitutes A Reliable System

11. What Constitutes Reliability? • Availability • Security • Maintainability • Integrity

12. Maintainability Availability Security Integrity Control Classifications By Objectives By Settings By Risk Aversion Administrative Accounting General Application Input Processing Output Corrective Preventive Detective

13. Controls – The Text Approach • Key General Reliability Controls (> than one reliability principle) - Table 8-1 • Key Availability Controls - Table 8-2 • Key Security Controls - Table 8-3 • Key Maintainability Controls - Table 8-4 • Key Integrity Controls – Table 8-5

14. General Reliability Controls • Strategic Planning & Budgeting • Developing a System Reliability Plan • Documentation

15. Key Availability Controls • Minimizing System Downtime • Disaster Recovery Plan

16. Key Security Controls • Segregation of Duties in Systems Function

17. The Text Notes . . . • In a highly integrated AIS, procedures that used to be performed by separate individuals are combined. • Therefore, any person who has unrestricted access to the computer, its programs, and live data could have the opportunity to both perpetrate and conceal fraud.

18. The Text Notes . . . • To combat this threat, organizations must implement compensating control procedures such as the effective segregation of duties within the AIS function.

19. Organizational Independence Within the Information Systems Function of a Firm using Computer-Based processing Source: AIS, Wilkinson & Cerullo

20. Tasks which CREATE systems. Tasks which OPERATE systems. Planning Staff Information Systems Manager Steering Committee Systems Development Manager Technical Services Manager Data-Base Administrator Data Processing Manager These two functions need to be ORGANIZATIONALLY and PHYSICALLY separated Programming Systems Analysis & Projects Information Center WHY? Data Preparation Computer Operations Data Library Data Control

21. Flow of batched data within several units of an organization using computer-based processing. Source: AIS, Wilkinson & Cerullo

22. Computer-Based Data Processing Department User Departments Control Section Data Preparation Section Computer Operations Data Library Data Input Receive & Log Convert Data Process Files • Record input data in control log. • Follow progress of processing. • Maintains control totals • Reconciles totals during processing. • Distribute output. • Monitors correction of errors. Independent of Log & Distribute Outputs Outputs Files Errors to be corrected Error Listing

23. Computer-Based Data Processing Department User Departments Control Section Data Preparation Section Computer Operations Data Library Data Input Receive & Log Convert Data Process Files • Prepare and verify data for entry into processing. • What controls do we have here? • Batch controls • Various computer input controls. Log & Distribute Outputs Outputs Files Errors to be corrected Error Listing

24. Computer-Based Data Processing Department User Departments Control Section Data Preparation Section Computer Operations Data Library Data Input Receive & Log Convert Data Process Files • Processes data to produce outputs. • What controls do we have here? • Various computer processing controls. Log & Distribute Outputs Outputs Files Errors to be corrected Error Listing

25. Simplified organizational separation in a computer-based system using on-line processing. Source: AIS, Wilkinson & Cerullo

26. User Departments Computer Operations On-Line Files (Data Library) Data Inputs Batch Files Process Displayed Outputs On- Line Files Printed Outputs

27. Subdivisions of transaction (application) controls and typical control points. Source: AIS, Wilkinson & Cerullo

28. Processing Controls Output Controls Input Controls Editing Computer-Based Data Processing Source Document Convert To MRF Trans. Data Source Document User Manual Entry Transaction Via Terminal Soft-Copy Output User Control Point

29. Key Security Controls • Segregation of Duties in Systems Function • Physical Access Controls

30. Perimeter Control Building Controls Computer Facility Controls Physical Access Controls

31. Key Security Controls • Segregation of Duties in Systems Function • Physical Access Controls • Logical Access Controls

32. Logical Access Controls Identification Authentication Access Rights Threat Monitoring

33. Key Security Controls • Protection of Personal Computers and Client/Server Networks • Internet and e-commerce Controls

34. Key Maintainability Controls • Project Development and Acquisition Controls. • Change Management Controls

35. Ensure that overall IS is stable and well maintained. • Ensure the accuracy of specific applications, inputs, files, programs & outputs.

36. Objectives of Application Controls • To prevent, detect, and correct errors in transactions • as they flow through the various stages of a specific data processing program. Input Output Process

37. Objectives of Application Controls • The text correctly notes . . . • If application controls are weak • AIS output is likely to contain errors. • Erroneous data leads to significant potential problems

38. Key Integrity Controls • Source Data Controls • Input Validation Controls • On-Line Data Entry Controls • Data Processing and Storage Controls

39. Key Integrity Controls • Output Controls • Data Transmission Controls

40. Input Output Process

41. Key Integrity Controls Source Data Controls

42. Source Data Controls • Ensure that all source documents are authorized, accurate, complete, properly accounted for and entered into the system or sent to their intended destinations in a timely manner.

43. Source Data Controls • Forms Design • Prenumbered Forms Sequence Test • Turnaround Documents • Cancelation and Storage of Documents

44. Source Data Controls • Authorization and Segregation of Duties • Visual Scanning • Check Digit Verification • Key Verification

45. Key Integrity Controls Input Validation Controls

46. Input Validation Routines • Routines that check the integrity of input data as the data are entered into the system. • Edit Programs • Edit Checks

47. Input Validation Routines • Sequence Check • Field Check • Sign Check • Validity Check • Limit Check

48. Input Validation Routines • Range Check • Reasonableness Test • Redundant Data Check • Capacity Check

49. Key Integrity Controls On-Line Data Entry Controls

50. On-Line Data Entry Controls • To ensure the integrity of transaction data entered from on-line terminals and PCs by minimizing errors and omissions.