lOMoARcPSD|1779620
Boek Romney & Steinbaert
Accounting Information Systems A&C (Rijksuniversiteit Groningen)
StudeerSnel wordt niet gesponsord of ondersteund door een hogeschool of universiteit
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 1 Accounting Information Systems.......................................................................................2
Chapter 2 Overview of transaction processing and ERP systems.......................................................5
Chapter 3 Systems documentation techniques................................................................................10
Chapter 5 Fraud...............................................................................................................................12
Chapter 6 Computer fraud and abuse techniques............................................................................14
Chapter 7 Control and Accounting Information Systems..................................................................19
Chapter 8 Controls for information security....................................................................................27
Chapter 9 Confidentiality and privacy controls................................................................................30
Chapter 10 Processing integrity and availability controls.................................................................32
Chapter 11 Auditing computer-based information systems.............................................................36
Chapter 12 The revenue cycle..........................................................................................................39
Chapter 13 The expenditure cycle...................................................................................................42
Chapter 14 The production cycle.....................................................................................................45
Chapter 15 The HRM and payroll cycle............................................................................................48
Chapter 16 General ledger and reporting system.............................................................................51
1
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 1 Accounting Information Systems
System is a set of two or more interrelated components that interact to a goal. Most systems are
composed of smaller subsystems that support the larger system.
Each subsystem is designed to achieve one or more organizational goals. Changes in subsystems
cannot be made without considering the effect on other subsystems and on the system as a whole
Goal conflict occurs when subsystem’s goals are inconsistent with the goals of another
subsystem or with the system as a whole.
Goal congruence occurs when a subsystem achieves its goals while contributing to the
organization’s overall goal.
Data are facts that are collected, recorded, stored, and processed by an information system.
Information is data that have been organized and processed to provide meaning and improve the
decision-making process.
Characteristics of useful information
Relevant
Reduces uncertainty, improves decision making, or confirms or corrects prior
expectation
Reliable
Free from error or bias; accurately represents organization events or activities
Complete
Does not omit important aspects of the events or activities it measures
Timely
Provided in time for decision makers to make decisions
Understandable Presented in a useful and intelligible format
Verifiable
Two independent, knowledgeable people produce the same information
Accessible
Available to users when they need it and in a format they can use
Information overload – exceeding the amount of information a human mind can absorb and process,
resulting in a decline in decision-making quality and an increase in the cost of providing information
Information technology (IT) – the computers and other electronic devices used to store, retrieve,
transmit, and manipulate data. It helps decision makers more effectively filter and condense
information.
Value of information – the benefit provided by the information less the cost of producing it. Benefits
of information include:
1. Reduced uncertainty
2. Improved decisions
3. Improved ability to plan and schedule activities
Business process – a set of related, coordinated and structured activities and tasks, performed by a
person, a computer, or a machine, that help accomplish a specific organizational goal.
Transaction is an agreement between two entities to exchange goods or services or any other event
that can be measured in economic terms by an organization.
Transaction processing – process of capturing transaction data, processing it, storing it for later use,
and producing information output, such as managerial report or a financial statement
Give-get exchange – transactions that happen a great many times, such as giving up cash to get
inventory from a supplier and giving employees a paycheck in exchange for their labor
These exchanges can be grouped into five major business processes or transaction cycles
2
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Revenue cycle
Expenditure cycle
Production or
conversion cycle
Human resources/
payroll cycle
Financing cycle
Goods and services are sold for cash or a future promise to receive cash
Companies purchase inventory for resale or raw materials to use in
producing products in exchange for cash or future promise to pay cash
Where raw materials are transformed into finished goods
Employees are hired, trained, compensated, evaluated, promoted, and
terminated
Companies sell shares in the company to investors and borrow money,
and where investors are paid dividends and interest is pain on loans
!See table 1-3 for common cycle activities!
General ledger and reporting system – information-processing operations involved in updating the
general ledger and preparing reports for both management and external parties.
Accounting information system (AIS) – a system that collects, records, stores, and processes data to
produce information for decision-makers. it includes:
1. People
2. Procedures and instructions
3. Data
4. Software
5. Information technology infrastructure
6. Internal controls and security measures
To fulfill three important business functions:
1. Collect and store data about organization activities, recourses and personnel
2. Transform data into information so management can plan, execute, control and evaluate
activities, recourses and personnel
3. Provide adequate controls to safeguard the organization’s assets and data
A well-designed AIS can add value to an organization by:
1. Improving the quality and reducing the costs of products
2. Improving efficiency
3. Sharing knowledge
4. Improving the efficiency and effectiveness of its supply chain
5. Improving the internal control structure
6. Improving decision making
An AIS can help improving decision making in several ways:
1. Identify situations requiring management action
2. Reduce uncertainty and thereby provide a basis for choosing among alternative actions
3. Store information about the results of previous decisions, which provides valuable feedback
that can be used to improve future decisions
4. Provide accurate information in a timely manner
5. Analyze sales data to discover items that are purchased together, and it can use such
information to improve the layout of merchandise or to encourage additional sales of related
items
Three factors that influence the design of an IS
1. IT developments
2. Predictive analysis - the use of data warehouses and complex algorithms to forecast future
events, based on historical trends and calculated probabilities. Predictive analysis provides an
3
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
educated guess of what one may expect to see in the near future, allowing companies to
make better business decisions and improve their processes.
3. Organizations structure
Value chain – linking together of all the primary and support activities in a business. Value is added as
a product passes through the chain.
Primary activities: value chain activities that produce, market, and deliver products and
services to customers and provide post-delivery service and support
1. Inbound logistics
2. Operations
3. Outbound logistics
4. Marketing and sales
5. Service
Support activities: value chain activities such as firm infrastructure, technology, purchasing,
and human resourcing that enable primary activities to be performed efficiently and
effectively
1. Firm infrastructure
2. Human recourses
3. Technology
4. Purchasing
Supply chain – an extended system that includes an organization’s value chain as well as its suppliers,
distributors and customers.
Raw
materials
supplier
Manufacturer
Distributor
Retailer
Consumer
4
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 2 Overview of transaction processing and ERP
systems
Data processing cycle – the four operations (data input, data storage, data processing, and
information output) performed on data to generate meaningful and relevant information
Data
Storage
Data
input
Data
processing
Information
ouput
Data input
Data must be collected about three facets of each business activity:
1. Each activity of interest
2. The resource(s) affected by each activity
3. The people who participate in each activity
Source documents – documents used to capture transaction data at its source – when the
transaction takes place. Examples include sales orders, purchase orders, and employee time cards
Turnaround documents – records of company data sent to an external party and then returned to the
system as input. Turnaround documents are in machine-readable form to facilitate their subsequent
processing as input records. An example is a utility bill
Source data automation – the collection of transaction data in machine-readable form at the time
and place of origin. Examples are point-of-sale terminals and ATMs.
Business activity
Take customer order
Deliver or ship order
Receive cash
Deposit cash receipts
Adjust customer account
Request items
Order items
Receive items
Pay for items
Collect employee withholding data
Record time worked by employees
Source document
Revenue Cycle
Sales order
Delivery ticket or bill of lading
Remittance advice or remittance list
Deposit slip
Credit memo
Expenditure Cycle
Purchase requisition
Purchase order
Receiving report
Check or electronic funds transfer
Human Recourses Cycle
W-4 form
Time cards
5
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Record time spent on specific jobs
Job time tickets or time sheet
Steps of processing input
1. Capture transaction data and enter them into the system
2. Make sure captured data are accurate and complete. One way to do this is to use source data
automation or well-designed turnaround documents and data entry screens
a. Well-designed documents and screens improve accuracy and completeness by
providing instructions or prompts about what data to collect, grouping logically
related pieces of information close together, using checkoff boxes or pull-down
menus to present the available options, and using appropriate shading and border to
clearly separate data items
3. Make sure company policies are followed, such as approving or verifying a transaction.
Data Storage
A general ledger – a ledger that contains summary-level data for every asset, liability, equity, revenue,
and expense account of the organization
A subsidiary ledger – a ledger used to record detailed data for a general ledger account which many
individual subaccounts, such as accounts receivable, inventory, and accounts payable
Control account – the general ledger account corresponding to a subsidiary ledger. General ledger
account summarized the total amounts recorded in a subsidiary ledger.
Coding is the systematic assignment of numbers or letters to items to classify and organize them
Techniques:
1. Sequence codes items are numbered consecutively to account for all items. Any missing
items cause a gap in the numerical sequence (e.g. include prenumbered checks, invoices,
purchase orders)
2. Block code blocks of numbers are reserved for specific categories of data. Users can identify
an item’s type and model using the code numbers
3. Group codes which are two or more subgroups of digits used to code items, are often used in
conjunction with block codes
4. Mnemonic codes letters and numbers are interspersed to identify an item. The mnemonic
code is derived from the description of the item and is usually easy to memorize.
The following guidelines result in a better coding system:
1. Be consistent with its intended use, which requires that the code designer determine desired
system outputs prior to selecting the code
2. Allow for growth
3. Be as simple as possible to minimize costs, facilitate memorization and interpretation, and
ensure employees acceptance
4. Be consistent with the company’s organizational structure and across the company’s divisions
Chart of accounts – a listing of all the number assigned to balance sheet and income statement
accounts. The account number allow transaction data to be coded, classified and entered into the
proper accounts. They also facilitate financial statement and report preparation.
A journal entry shows the accounts and amounts to be debited and credited. Transactions data are
often recorded in a journal before they are entered into a ledger.
General journal – a journal used to record infrequent or nonroutine transactions, such as loan
payments and end-of-period adjusting and closing entries
Specialized journal – a journal used to record a large number of repetitive transactions such as credit
sales, cash receipts, purchases, and cash disbursements
6
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Audit trial – a path that allows a transaction to be traced through a data processing system from
point of origin to output or backwards from output to point of origin. It is used to check the accuracy
and validity of ledger positions and to trace changes in general ledger accounts from their beginning
balance to their ending balance.
Computer-based storage concepts
Entity – the item about which information is stored in a record (e.g. employee, inventory item,
customer)
Attributes – the properties, identifying numbers, and characteristics of interest of an entity that is
stored in a database. (e.g. employee number, pay rate, name, address)
Field - the portion of a data record where the data value for a particular attribute is stored (e.g.
spreadsheet each row might represent a customer and each column is an attribute of the customer)
Record – a set of fields whose data values describe specific attributes of an entity, such as all payroll
data relating to a single employee (e.g. row in a spreadsheet)
Data value – the actual value stored in a field. It described a particular attribute of an entity. For
example, the customer name field would contain “ZYX Company” if that company was a customer
File – a set of logically related records, such as the payroll records of all employees
Master file – a permanent file of records that stores cumulative data about an organization. As
transactions take place, individual records within a master file are updated to keep them current.
Transaction file – a file that contains the individual business transactions that occur during a specific
fiscal period. A transactional file is conceptually similar to a journal in a manual AIS
Database – a set of interrelated centrally controlled data file that are stored with as little data
redundancy as possible. A database consolidates records previously stored in separate files into a
common pool and serves variety of uses and data processing applications.
Data processing
Once business activity have been entered into the system, they must be processed to keep the
databases current. The four different types of data processing activities:
1. Creating
new data records, such as adding a newly hired employee to the payroll
database
2. Reading
retrieving, or viewing existing data
3. Updating
previously stored data
4. Deleting
data
Batch processing – accumulating transaction records into groups or batches for processing data
regular interval such as daily or weekly. The records are usually sorted into some sequence before
processing
Online, real-time processing – the computer system processes data immediately after capture and
provides updated information to users on a timely basis.
7
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
A combination of the two approaches is online batch processing, where transaction data are entered
and edited as they occur and stored for later processing.
Information output
Information output on a screen/monitor is referred to “soft copy” and printed on paper is referred to
“hard copy”.
Documents – a record of a transaction or other company data (e.g. include checks, invoices, receiving
reports, and purchase requisitions
Report – system output, organized in a meaningful fashion, that is used by employees to control
operational activities, by managers to make decisions and design strategies, and by investors and
creditors to understand a company’s business activities.
External users need reports to evaluate company profitability, judge creditworthiness, or comply with
regulatory requirements.
The need for reports should be periodically assessed, because they are often prepared long
after they are needed, wasting time, money, and recourses.
Query – a request for the database to provide the information needed to deal with a problem or
answer a question. The information is retrieved, displayed or printed, and/or analyzed as requested
Repetitive queries are often developed by information systems specialists. One-time queries are often
developed by users.
ERP systems
ERP = Enterprise Resource Planning
ERP system – a system that integrates all aspects of an organization’s activities – such as accounting,
finance, marketing, human recourses, manufacturing, inventory management- into one system. An
ERP system is modularized; companies can purchase the individual modules that met their specific
needs. An ERP facilities information flow among the company’s various business functions and
manages communications with outside stakeholders.
Typical ERP modules include:
1. Financial (general ledger and reporting system)
2. Human recourses and payroll
3. Order to cash (revenue cycle)
4. Purchase to pay
5. Manufacturing (production cycle)
6. Project management
7. Customer relationship management
8. System tools
Advantages
Disadvantages
Integrated enterprise-wide
Better flow of the information
Centralized database
Accessed by various departments
Costly
Significant amount of time to implement
Complex
User resistance (learning new things is
sometimes hard for employees)
Improves customer service.
Data captured once (i.e., no longer need sales
to enter data about a customer and then
accounting to enter same customer data for
invoicing)
8
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Improved data security
Standardization of procedures and reports
ERP systems are complex and expensive, choosing one is not an easy task. In doing so, there must be
take great care to ensure that the ERP system has module for every critical company process and that
they are not paying for software modules that they do not need. Because it is too difficult for most
companies to implement ERP software by themselves, they often hire an ERP vendor or a consulting
company to do it for them. These firms usually provide three types of services: consulting,
customization, and support.
Because many processes automatically trigger additional actions in other modules, proper
configuration is essential. This requires a sound understand of all major business processes and their
interactions, so they can be defined. The integrated nature of ERP systems means that unless every
data item is validated and checked for accuracy at the time of initial entry, errors will automatically
propagate throughout the system. Thus, data entry controls and access controls are essential.
9
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 3 Systems documentation techniques
Documentation explains how a system works, including the who, what, when, where, why, and how
of data entry, data processing, data storage, information output, and system controls. Narratives,
flowcharts, diagrams and other written materials that explain how a system works.
Narrative description – written step-by-step explanation of system components and how they
interactive.
Three common systems documentations tools:
1. Data flow diagrams (DFD)
a graphical description of data sources, data flows,
transformation processes, data storage and data destinations
2. Flowcharts
which is graphical description of a system
a. Document flowchart
shows the flow of documents and information between
departments or areas of responsibility
b. System flowchart
shows the relationship among the input, processing, and
output in an information system
c. Program flowchart
shows the sequence of logical operations a computer
performs as it executes a program
3. Business process diagrams
which are graphical descriptions of the business processes
used by a company
Data flow diagrams
Data source – the entity that produces or sends the data that is entered into a system
Data destination – the entity that receives data produced by a system
Processes – the action that transforms data into other data or information
Data store – the place or medium where system data is stored
Data flow diagram symbols:
Data sources and destinations
the people and organisations that send data to and receive data from the system
Data flows
The flow of the data into or out of a process.
The movement of data among processes, stores, sources, and destinations
Transformation processes
The processes that transform data from inputs to outputs
Data stores
The storage of data
Internal control
Context diagram – highest-level DFD, a summary-level view of a system, showing the data processing
system, its input(s) and output(s), and their sources and destinations.
10
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Flowcharts
Four categories of flowcharts symbols:
1. Input/output symbols
2. Processing symbols
3. Storage symbols
4. Flow and miscellaneous symbols
indicate the flow of data, where flowcharts begin or
end, where decisions are made, and how to add explanatory notes to flowcharts.
!See p.84 & p.85 for the symbols + description of flowchart!
Document flowcharts – illustrates the flow of documents and data among areas of responsibility
within an organization
Internal control flowchart – used to describe, analyze, and evalute internal controls, including
identifying system strengths. They are used to identify weaknesses of inefficiencies.
A system flowchart – depicts the relationship among system input, processing, storage, and output.
System flowcharts are used to describe data flows and procedures within an AIS.
Program flowchart – illustrates the sequence of logical operations performed by a computer in
executing a program. A program flowchart describes the specific logic used to perform a process
shown on a system flowchart.
Business Process Diagrams
BPD – a visual way to describe the different steps or activities in a business process
BPD’s can describe interactions within an entity as well as interaction between entities. BPD gives a
clear depiction of what happens, but not how it happens.
Start/begin
End
Activity in a process
Decision
Flow
Annotation information
11
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 5 Fraud
Threats to AIS
1. Natural and political disasters
2. Software errors and equipment malfunctions
3. Unintentional acts
4. Intentional acts (computer crimes)
Sabotage – an intentional act where the intent is to destroy a system or some of its components
Cookie – a text file created by a website and stored on a visitor’s hard drive. Cookies store
information about who the user is and what the user has done.
Fraud is an intentional act by one or more individuals among management, those charged with
governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal
advantage.
White-collar criminals – typically, businesspeople who commit fraud. White-collar criminals usually
resort to trickery or cunning, and their crimes usually involve a violation of trust or confidence
Corruption – dishonest conduct by those in power which often involves actions that are illegitimate,
immoral, or incompatible with ethical standards. Examples bribery and bid rigging.
Investment fraud – misrepresenting or leaving out facts in order to promote an investment that
promises fantastic profits with little or no risk. Examples include Ponzi schemes and securities fraud.
Two types of frauds that are important to business are misappropriation of assets and fraudulent
financial reporting
Misappropriation of assets – theft of company assets by employees
The most significant contributing factor in most misappropriations is the absence of internal controls
and/or the failure to enforce existing internal controls.
Fraudulent financial reporting – intentional or reckless conduct, whether by act or omission, that
results in materially misleading financial statements. Management falsifies financial statements to
deceive investors and creditors, increase a company’s stock price, meet cash flow needs, or hide
company losses and problems.
The Treadway commission recommended 4 actions to reduce fraudulent financial reporting:
1. Establish an internal environment that contributes to the integrity of the financial reporting
process
2. Identify and understand the factors that lead to fraudulent financial reporting
3. Assess the risk of fraudulent financial reporting within the company
4. Design and implement internal controls to provide reasonable assurance of preventing
fraudulent financial reporting
An asset misappropriation is 17 times more likely than fraudulent financial reporting, but the
amounts involved are much smaller. As a result, auditors and management are more concerned with
fraudulent financial reporting even though they are more likely to encounter misappropriations.
12
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
SAS No. 99 (Statement on Auditing Standards) requires auditors to:
1. Understand fraud
2. Discuss the risks of material fraudulent misstatements
3. Obtain information
4. Identify, assess and respond to risks
5. Evaluate the results of their audit tests
6. Document and communicate findings
7. Incorporate a technology focus
The Fraud triangle
1. Pressure – a person’s incentive or motivation for committing fraud
2. Opportunity – the condition or situation that allows a person or organization to commit and
conceal a dishonest act and convert it to personal gain
3. Rationalization – the excuse that fraud perpetrators use to justify their illegal behaviour
Lapping – concealing the theft of cash by means of a series of delays in posting collections to
accounts receivable
Check kiting – creating cash using the lag between the time a check is deposited and the time it
clears the bank
Computer fraud
Computer fraud – any type of fraud that requires computer technology to perpetrate
The number of incidents of computer fraud are increasing rapidly for several reasons:
1. Not everyone agrees on what constitutes computer fraud
2. Many instances of computer fraud go undetected
3. A high percentage of frauds is not reported
4. Many networks are not secure
5. Internet sites offer step-by-step instructions on how to perpetrate computer fraud and abuse
6. Law enforcement cannot keep up with the growth of computer fraud
7. Calculating losses is difficult
Computer fraud classifications
1. Input fraud – to alter or falsify computer input, requires little skill
2. Processor fraud – unauthorizes system use, including the theft of computer time and services
3. Computer instruction fraud – tampering with company software; copying software illegally,
using software in an unauthorized manner, and developing software to carry out an
unauthorized activity
4. Data fraud – illegally using, copying, browsing, searching, or harming company data
5. Output fraud – unless properly safeguarded, displayed or printed output can be stolen,
copied or misused
Prevent and detect fraud:
1. Make fraud less likely to occur
2. Increase the difficulty of committing fraud
3. Improve detection methods
4. Reduce fraud losses
See table 5-5 on how to prevent and detect fraud in detail!
13
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 6 Computer fraud and abuse techniques
Hacking is the unauthorized access, modification, or use of an electronic device or some element of a
computer system.
Hijacking is gaining control of someone else’s computer to carry out illicit activities, such as sending
spam without the computer user’s knowledge
A botnet (robotic network) is a network of powerful and dangerous hijacked computers that are used
to attack systems or spread malware
Zombie – a hijacked computer, typically part of a botnet, that is used to launch a variety of Internet
attacks
Bot herder – the person who creates a botnet by installing software on PCs that responds to the bot
herder’s electronic instructions
Denial-of-service (DoS) attack is a computer attack in which the attacker sends so many e-mail
bombs or webpage requests, often from randomly generated false addresses, that the internet
service provider’s e-mail server or the web server is overloaded and shuts down
Botnets are used to perform a DoS attack.
Spamming is simultaneously sending the same unsolicited message to many people at the same
time, often in an attempt to sell something.
Dictionary attacks – using special software to guess company e-mail addresses and send them blank
e-mail messages. Unreturned messages are usually valid e-mail addresses that can be added to
spammer e-mail lists.
Splogs (spam and blog) – spam blogs created to increase a website’s Google PageRank, which is how
often a web page is referenced by other web pages
Spoofing is making an electronic communication look as if someone else sent it to gain the trust of
the recipient
Spoofing can take various forms:
 E-mail spoofing – making a sender address and other parts of an e-mail header appear as
though the e-mail originated from a different source
 Caller ID spoofing – displaying an incorrect number on the recipient’s caller ID display to hide
the caller’s identity
 IP address spoofing – creating internet protocol packets with a forged IP address to hide the
sender’s identity or to impersonate another computer system
 Address Resolution Protocol (ARP) spoofing – sending fake ARP messages to an Ethernet
LAN. ARP is a computer networking protocol for determining a network host’s hardware
address when only it’s IP or network address is known
o MAC address – a Media Access Control address is a hardware address that uniquely
identifies each node on a network
 SMS spoofing – using SMS to change the name or number a text message appears to come
from
 Web-page spoofing – see phishing
 DNS spoofing – sniffing the ID of a Domain Name System (DNS, the “phone book” of the
internet that converts a domain, or website name, to an IP address) request and replying
before the real DNS server
Zero-day attack is an attack between the time a new software vulnerability is discovered and the time
a software developer releases a patch that fixes the problem
Patch – code released by software developers that fixes a particular software vulnerability
Cross-site scripting (XSS) is a vulnerability in dynamic web pages that allows an attacker to bypass a
browser’s security mechanisms and instruct the victim’s browser to execute code, thinking it came
from the desired website
14
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Buffer overflow attack happens when the amount of data entered into a program is greater than the
amount of the memory set aside to receive it. The input overflow usually overwrites the next
computer instruction, causing the system to crash. Hackers exploit this by crafting the input so that
the overflow contains code that tells the computer what to do next. This code could open a back door
into the system
SQL injection (insertion) attack – inserting a malicious SQL query in input such that it is passed to and
executed by an application program. This allows a hacker to convince the application to run SQL code
that it was not intended to execute.
Man-in-the-middle (MITM) attack – a hacker placing himself between a client and a host to intercept
communications between them
Masquerading or impersonation is pretending to be an authorized user to access a system. This is
possible when the perpetrator knows the user’s ID number and password or uses her computer after
she has logged in.
Piggybacking:
 Tapping into a communications line and electronically latching onto a legitimate user who
unknowingly carries the perpetrator into the system
 The clandestine use of a neighbour’s Wi-Fi network
 An unauthorized person following an authorized person though a secure door, bypassing
physical security controls
Password cracking – when an intruder penetrates a system’s defences, steals the file containing valid
passwords, decrypts them, and uses them to gain access to programs, files, and data
War dialing – programming a computer to dial thousands of phone lines searching dialup modem
lines. Hackers hack into the PC attached to the modem and access the network to which it is
connected.
War driving – driving around looking for unprotected home or corporate wireless networks
War rocketing – using rockets to let loose wireless access point attached to parachutes that detect
unsecure wireless networks
Phreaking – attacking phone systems to obtain free phone line access; use phone lines to transmit
malware, and to access, steal and destroy data
Data diddling is changing data before or during entry into a computer system in order to dele, alter,
add, or incorrectly update key system data.
Data leakage is the unauthorized copying of company data.
Podslurping is using a small device with storage capacity to download unauthorized data.
Salami technique is used to embezzle money a “salami slice” at a time from many different accounts.
Economic espionage is the theft of information, trade secrets, and intellectual property
Cyber-extortion – threatening to harm a company or a persion if a specified amount of money is not
paid
Cyber-bullying – using computer technology to support deliberate, repeated, and hostile behaviour
that torments, threatens harasses, humiliates, embarrass or otherwise harms another person
Sexting – exchanging sexually explicit text messages and revealing pictures with each other people,
usually by means of a phone
15
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Internet terrorism – using the internet to disrupt electronic commerce and harm computers and
communications
Internet misinformation – using the internet to spread false or misleading information
e-mail threats – threats sent to victims by e-mail. The threats usually require some follow-up action,
often at great expense to the victim.
Internet action fraud – using an internet auction site to defraud another person
Internet pump-and-dump fraud – using the internet to pump the price of a stock and then sell it
Click fraud – manipulating the number of times an ad is clicked on to inflate advertising bills
Web cramming – offering a free website for a month, developing a worthless website, and charging
the phone ill of the people who accept the offer for months, whether they want to continue using the
website or not
Software privacy – the unauthorized copying or distribution of copyrighted software
Social engineering – the techniques or psychological tricks used to get people to comply with the
perpetrator’s wishes in order to gain physical or logical access to a building, computer, server, or
network. It is usually to get the information needed to obtain confidential data.
Seven human traits in order to entice a person to reveal information or take a specific action:
1. Compassion
2. Greed
3. Sex appeal
4. Sloth
5. Trust
6. Urgency
7. Vanity
Establishing the following policies and procedures can help minimize social engineering:
1. Never let people follow you into a restricted building
2. Never log in for someone else on a computer, especially if you have administrative access
3. Never give sensitive information over the phone or though e-mail
4. Never share passwords or used IDs
5. Be cautious of anyone you do not know who is trying to gain access through you
Identity theft – assuming someone’s identity, usually for economic gain, by illegally obtaining
confidential information such as a social security number or a bank account or credit card number
Pretexting – using an invented scenario that creates legitimacy in the target’s mind in order to
increase the likelihood that a victim will divulge information or do something
Posing – creating a seemingly legitimate business, collecting personal information while making a
sale, and never delivering the product
Phishing – sending an electronic message pretending to be a legitimate company, usually a financial
institution, and requesting information or verification of information and often warning of a
consequence it if it not provided. The request is bogus, and the information gathered is used to
commit identity theft or to steal funds from the victim’s account
Vishing – voice phishing; it is like phishing except that the victim enters confidential data by phone
16
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Carding – activities performed on stolen credit cards, including making a small online purchase to
determine whether the card is still valid and buying and selling stolen credit car numbers
Pharming – redirecting website traffic to a spoofed website
Evil twin – a wireless network with the same name as a legitimate wireless access point. Users are
connected to the twin, because it has a stronger wireless signal, or the twin disrupts or disables the
legitimate access point. Users are unaware that they connect to the evil twin and the perpetrator
monitors the traffic looking for confidential information
Typosquatting or URL hijacking is setting up similarly named websites so that users making
typographical errors when entering a website name are sent to an invalid site.
To stop typosquatting, companies send a cease-and-desist letter to the offender, purchase the
website address, or file a lawsuit.
QR barcode replacements – fraudsters cover valid quick response codes with stickers containing a
replacement QR code to fool people into going to an unintended site that infects their phones with
malware
Tabnapping – secretly changing an already open browser tab in order to capture user IDs and
passwords when the victim logs back into the site
Scavenging or dumbster diving – searching documents and records to gain access to confidential
information. Scavenging methods include searching garbage cans, communal trash bins and city
dumps
Shoulder surfing – when perpetrators look over a person’s shoulders in public place to get
information such as ATM PIN numbers of used IDs and passwords
Lebanese looping – inserting a sleeve into an ATM that prevents it from ejecting the card. The
perpetrator pretends to help the victim, tricking the person into entering the PIN again. Once the
victim gives up, the thief removes the card and uses it and the PIN to withdraw money
Skimming – double-swiping a credit card in a legitimate terminal or covertly swiping a credit card in a
small, hidden, handheld card reader that records credit card data for later use
Chipping – planting a small chip that records transaction data in a legitimate credit card reader. The
chip is later removed or electronically accessed to retrieve the data recorded on it.
Eavesdropping – listening to private communications or tapping into data transmissions intended for
someone else. One way to intercept signals is by setting up a wiretap.
Malware – any software that is used to do harm
Spyware – software that secretly monitors computer usage, collects personal information about
users, and sends it to someone else, often without the computer user’s permission
Spyware infections, of which users are usually unaware, come from the following:
 Downloads such as file-sharing programs, system utilities, games, wallpapers, screen savers,
music, and videos
 Websites that secretly download spyware
 A hacker using security holes in web browsers and other software
 Malware masquerading as antispyware security software
 A worm of virus
 Public wireless networks.
17
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Adware – spyware that causes banned ads to pop up on a monitor, collects information about the
user’s web-surfing and spending habits, and forwards it to the adware creator, often an advertising or
media organization. Adware usually comes bundled with freeware and shareware downloaded from
the internet
Torpedo software – software that destroys competing malware. This sometimes results in “malware
warfare” between competing malware developers
Scareware – malicious software of no benefit that is sold using tactics
Ransomware – software that encrypts programs and data until a ransom is paid to remove it
Keylogger – software that records computer activity, such as a user’s keystrokes, e-mails sent and
received, websites visited and chat session participation
Trojan horse – a set of unauthorized computer instructions in an authorized and otherwise properly
functioning program
Time bomb/logic bomb – a program that lies idle until some specified circumstances or a particular
time triggers it. Once triggered, the program sabotages the system by destroying programs or data
Trap door/back door – a set of computer instructions that allows a user to bypass the system’s
normal controls
Packet sniffers – programs that capture data from information packets as they travel over the
internet or company networks. Captured data is sifted to find confidential or proprietary information.
Steganography program – a program that can merge confidential information with a seemingly
harmless file, password protect the file, and send it anywhere in the world, where the file is unlocked,
and the confidential information is reassembled. The host file can still be heard or viewed because
humans are not sensitive enough to pick up the slight decrease in image or sound quality
Rootkit – a means of concealing system components and malware from the operating system and
other programs; can also modify the operating system
Superzapping – the unauthorized use of a special system program to bypass regular system controls
and perform illegal acts. The superzap utility was originally written to handle emergencies, such as
restoring a system that had crashed.
Virus – a segment of executable code that attaches itself to a file, program, or some other executable
system component. When the hidden program is triggered, it makes unauthorized alterations to the
way a system operates
Worm – similar to a virus, except that it is a program rather than a code segment hidden in a host
program. A worm also copies itself automatically and actively transmits itself directly to other
systems
Bluesnarfing – stealing (snarfing) contact lists, images, and other data using flaws in Bluetooth
applications
Bluebugging – taking control of someone else’s phone to make or listen to calls, send or read text
messages, connect to the internet, forward the victim’s calls, and call numbers that charge fees
18
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 7 Control and Accounting Information Systems
Threat/event – any potential adverse occurrence or unwanted event that could injure the AIS or the
organization
Exposure/impact – the potential dollar loss should a particular threat become a reality
Likelihood/risk – the probability that a threat will come to pass
Internal control – the processes and procedures implemented to provide reasonable assurance that
control objectives are met
1. Safeguard assets – prevent or detect their unauthorized acquisition, use or disposition
2. Maintain records in sufficient detail to report company assets accurately and fairly
3. Provide accurate and reliable information
4. Prepare financial reports in accordance with established criteria
5. Promote and improve operational efficiency
6. Encourage adherence to prescribed managerial policies
7. Comply with applicable laws and regulations
Internal control provides reasonable assurance- complete assurance is difficult to achieve and
prohibitively expensive. Internal control systems have inherent limitations, such as susceptibility to
simple errors and mistakes, faulty judgments and decision making, management overrides, and
collusion.
Developing an internal control system requires a thorough understanding of information technology
(IT) capabilities, and risks, as well as how to use IT to achieve an organization’s control objectives.
Internal controls perform three important functions:
1. Preventive controls – deter problems before they arrive
2. Detective controls – discover problems that are not prevented
3. Corrective controls – identify and correct problems as well as correct and recover from the
resulting errors
Internal controls are often segregated into two categories:
1. General controls – controls designed to make sure an organization’s information system and
control environment is stable and well managed
2. Application controls – controls that prevent, detect, and correct transaction errors and fraud
in application programs
Robert Simons has espoused four levers of control to help management reconcile the conflict
between creativity and controls:
1. Belief system – system that describes how a company creates value, helps employees
understand management’s vision, communicates company core values, and inspire
employees to live by those values
2. Boundary system – system that helps employees act ethically by setting boundaries on
employee behaviour
3. Diagnostic control system – system that measures, monitors and compares actual company
progress to budgets and performance goals
4. Interactive control system- system that helps managers to focus subordinates’ attention on
key strategic issues and to be more involved in their decisions
Foreign Corrupt Practices Act (FCPA) – legislation passed to prevent companies from bribing foreign
officials to obtain business; also requires all publicly owned corporations maintain a system of
internal accounting controls
19
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Sarbanes-Oxley Act (SOX) – legislation intended to prevent financial statement fraud, make financial
reports more transparent, provide protection to investors, strengthen internal controls at public
companies, and punish executives who perpetrate fraud
Public Company Accounting Oversight Board (PCAOB) – a board created by SOX that regulates the
auditing profession; created as part of SOX
Control frameworks
Control Objectives for Information and Related Technology (COBIT) – a security and control
framework that allows:
1. Management to benchmark the security and control practices of IT environments
2. Users of IT services to be assures that adequate security and control exist
3. Auditors to substantiate their internal control opinions and advise on IT security and control
matters
COBIT 5 is based on the following five key principles of IT governance and management:
1. Meeting stakeholders needs
2. Covering the enterprise end-to-end
3. Applying a single, integrated framework
4. Enabling a holistic approach
5. Separating governance from framework
Committee of Sponsoring Organizations (COSO) – a private sector group consisting of the American
Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management
Accountants, and the Financial Executives Institute.
Internal Control – Integrated Framework (IC) – a COSO framework that defines internal controls and
provides guidance for evaluating and enhancing internal control systems. Control-based approach.
It is widely accepted as the authority on internal controls and is incorporated into policies, rules, and
regulations used to control business activities.
5 components:
1. Control environment
2. Risk assessment
3. Control activities
4. Information and communication
5. Monitoring
Enterprise Risk Management – Integrated Framework (ERM) – a COSO framework that improves the
risk management process by expanding COSO’s Internal Control – Integrated. Risk-based approach.
ERM adds three dimensions to the IC framework:
1. Objective setting
2. Event identification
3. Risk response
Internal environment
Internal environment – the company culture that is the foundation for all other ERM component, as
it influences how organizations establish strategies and objectives; structure business activities; and
identify, assess, and respond to risk
An internal environment consists of the following:
20
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
1.
2.
3.
4.
5.
6.
7.
Management’s philosophy, operating style, and risk appetite
Commitment to integrity, ethical values, and competence
Internal control oversight by the board of directors
Organizational structure
Methods of assigning authority and responsibility
Human recourse standards that attract, develop and retain competent individuals
External influences
Management’s philosophy, operating style, and risk appetite
Collectively, an organization has a philosophy, or shared beliefs and attitudes, about risk that affects
policies, procedures, oral and written communications, and decisions. Companies also have a risk
appetite.
Risk appetite – the amount of risk a company is willing to accept to achieve its goals and objectives.
To avoid undue risk, risk appetite must be in alignment with company strategy.
The more responsible management’s philosophy and operating style, and the more clearly, they are
communicated, the more likely employees will behave responsibly.
Commitment to integrity, ethical values, and competence
Organizations need a culture that stresses integrity and commitment to ethical values and
competence. Ethics pays- ethical standards are good business. Integrity starts at the top, as company
employees adopt top management attitude about risks and controls
Internal control oversight by the board of directors
An involved board of directors represent shareholders and provides an independent review of
management that acts as a check and balance on its actions.
Audit committee – the outside, independent board of director members responsible for financial
reporting, regulatory compliance, internal control, and hiring and overseeing internal and external
auditors.
Organizational structure
A company’s organizational structure provides a framework for planning, executing, controlling, and
monitoring operations. Important aspects of the organizational structure include the following:
1. Centralization or decentralization authority
2. A direct of matrix reporting relationship
3. Organization by industry, product line, location, or marketing network
4. How allocation of responsibility affects information requirements
5. Organization of and lines of authority for accounting, auditing, and information system
functions
6. Size and nature of company activities
Methods of assigning authority and responsibility
Management should make sure employees understand entity goals and objectives, assign authority
and responsibility for goals and objectives to departments and individuals, hold the individuals
accountable for achieving them, and encourage the use of initiative to solve problems. Authority and
responsibility are assigned and communicated using formal job descriptions, employee training,
operating schedules, budgets, a code of conduct, and written policies and procedures.
Policy and procedures manual – document that explains proper business practices, described
needed knowledge and experience, explains document procedures, explains how to handle
transactions, and lists the resources provided to carry out specific duties.
Human recourse standards that attract, develop, and retain competent individuals
21
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
One of the greatest control strengths is the honesty of employees. HR policies and practices
governing working conditions, job incentives, and career advancement can be a powerful force in
encouraging honesty, efficiency and loyal service.
The following HR policies and procedures are important:
1. Hiring – employees should be hired based on educational background, experience,
achievements, honesty, integrity, and meeting written job requirements.
Background check – an investigation of a prospective or current employee that
involves verifying their educational and work experience, talking to references,
checking for criminal record or credit problems, and examining other publicly
available information
2. Compensating, evaluating and promoting – poorly compensated employees are more likely
to feel resentment and financial pressures that can motivate fraud
3. Training – training programs should teach new employees their responsibilities; expected
levels of performance and behaviour and the company’s policies and procedures, culture,
and operating style
4. Managing disgruntled employees – some disgruntled employees, seeking revenge for a
perceived wrong, perpetrate fraud or sabotage system
5. Discharging – dismissed employees should be removed from sensitive jobs immediately and
denies access to the information system
6. Vacations and rotations of duties – fraud schemes that require ongoing perpetrator attention
are uncovered when the perpetrator take time off
7. Confidentiality agreements and fidelity bond insurance – all employees, suppliers, and
contractors should sign an abide by a confidentiality agreement
8. Prosecute and incarcerate perpetrators – most fraud is not reported or prosecuted
Eternal influences
External influences include requirements imposed by stock exchanges
Objective setting and event identification
Objective setting is the second ERM component. Management determines what the company hopes
to achieve, often referred to as the corporate vision or mission. Management sets objectives at the
corporate level and then subdivides them into more specific objectives for company subunits.
Strategic objectives – high-level goals that are aligned with and support the company’s vision and
create shareholder value
Operations objectives – objectives that deal with the effectiveness and efficiency of company
operations and determine how to allocate resources
Reporting objectives – objectives to help ensure the accuracy, completeness, and reliability of
company reports; improve decision making; and monitor company activities and performance
Compliance objectives – objectives to help the company comply with all applicable laws and
regulations
COSO defines an event as “an incident or occurrence emanating from internal or external sources
that affects implementation of strategy or achievement of objectives”. Events may have positive or
negative impacts or both.
Risk assessment and risk response
The risks of an identified event are assessed in several different ways: likelihood, positive and
negative impacts, individually and by category, their effect on other organizational units, and on an
inherent and residual basis.
Inherent risk – the susceptibility of a set of accounts or transactions to significant control problems in
the absence of internal control
22
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Residual risk – the risk that remains after management implements internal controls or come other
response to risk
Companies should assess inherent risk, develop a response, and then assess residual risk.
Management can respond to risk in one of four ways:
1. Reduce – reduce the likelihood and impact of risk by implementing an effective system of
internal controls
2. Accept – accept the likelihood and impact of the risk
3. Share – share risk or transfer it to someone else by buying insurance, outsourcing an activity,
or entering into hedging transactions
4. Avoid – avoid risk by not engaging in the activity that produces the risk. This may require the
company to sell a division, exit a product line, or not expand as anticipated
The following up steps of event identification are:
1. Estimate likelihood and impact
2. Identify controls
3. Estimate costs and benefits
Expected loss = impact x likelihood
4. Determine cost/benefit effectiveness
5. Implement control of accept, share or avoid the risk
Control activities
Control activities – policies, procedures, and rules that provide reasonable assurance that control
objectives are met, and risk response are carried out
Management must make sure that
1. Controls are selected and developed to help reduce risks to an acceptable level
2. Appropriate general controls are selected and developed over technology
3. Control activities are implemented and followed as specified in company policies and
procedures
Control procedures fall into the following categories:
1. Proper authorization of transactions and activities
2. Segregation of duties
3. Project development and acquisitions controls
4. Change management controls
5. Design and use of documents and records
6. Safeguarding assets, records, and data
7. Independent checks on performance
Proper authorization of transactions and activities
Authorization – establishing policies for employees to follow and then empowering them to perform
certain organizational functions. Authorizations are often documented by signing, initializing, or
entering an authorization code on a document or record.
Digital signature - a means of electronically signing a document with data that cannot be forged
Specific authorization – special approval an employee needs in order to be allowed to handle a
transaction
General authorization - the authorization given employees to handle routine transactions without
special approval
23
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Segregation of duties
Segregation of duties – separating the accounting functions of authorization, custody, and recording
to minimize an employee’s ability to commit fraud
If one person performs two of these functions, problems can arise
Collusion – cooperation between two or more people in an effort to thwart internal controls
Segregation of systems duties – implementing control procedures to clearly divide authority and
responsibility within the information system function
Authority and responsibility should be divided clearly among the following functions:
1. System administration; system administrators are responsible for making sure a system
operates smoothly and efficiently
2. Network management; network managers ensures that the organization’s networks operate
properly
3. Security management; security management makes sure systems are secure and protected
from internal and external threats
4. Change management; change management is the process of making sure changes are made
smoothly and efficiently and do not negatively affect systems reliability, security,
confidentiality, integrity, and availability
5. Users; users record transactions, authorize data processing and use system output
6. Systems analysis; system analysts help users determine their information needs and design
systems to meet those needs
7. Programming; programmers use the analyst’s design to create and test computer programs
8. Computer operations; computer operators run the software on the company’s computers,
they ensure data are input properly, processed correctly, and that needed output is
processed
9. Information systems library; the information system librarian maintains custody of corporate
databases, files, and programs in a separate storage area called the information system
library
10. Data control; the data control group ensure that source data is approved, monitor the flow of
work, reconcile input and output, handle input errors, and distribute systems output
Project development and acquisition controls
It is important to have a proven methodology to govern the development, acquisition,
implementation, and maintenance of information systems.
Important systems development controls include the following
1. Steering committee – guides and oversees systems development and acquisition
2. Strategic master plan – multiple-year plan of the projects the company must complete to
achieve its long-range goals
3. Project development plan – document that shows how a project will be completed
Project milestones – points where progress is reviewed, and actual and estimated
completion times are compared
4. Data processing schedule – schedule that shows when each data processing task should be
performed
5. System performance measurements – ways to evaluate and assess a system
a. Throughput – the amount of work performed by a system
b. Utilization – the percentage of time a system is used
c. Response time – how long it takes for a system to respond
6. Postimplementation review – review, performed after a new system has been operating for a
brief period, to ensure that it meets its planned objectives
System integrator – an outside party hired to manage a company’s systems development effort
24
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Companies using system integrators should use the same project management process and controls
as internal projects, they should:
1. Develop clear specifications
2. Monitor the project
Change management controls
Organizations modify existing systems to reflect new business practices and to take advantage of IT
advancements
Design and use of document and records
The proper design and use of electronic and paper documents and records help ensure the accurate
and complete recording of all relevant transaction data. Their form and content should be as simple
as possible, minimize errors, and facilitate review and verification.
Safeguard assets, records, and data
A company must protect its cash and physical assets as well as its information. Employees are a much
greater security risk than outsiders are. Employees also cause unintentional threats, such as
accidentally deleting company data, opening virus-laden e-mail attachments, or trying to fix hardware
and software without the appropriate expertise.
Independent checks on performance
Independent checks on performance, done by someone other than the person who performs the
original operation, including:
1. Top-level reviews – management should monitor company results and periodically compare
actual company performance to:
1. Planned performance as shown in budgets, targets and forecasts
2. Prior period performance
3. Competitors’ performance
2. Analytical reviews – the examination of the relationships between different sets of data
3. Reconciliation of independently maintained records – records should be reconciled to
documents or re cords with the same balance
4. Comparison of actual quantities with recorded amounts – significant assets are periodically
counted and reconciled to company records
5. Double-entry accounting – the maxim that debits equal credits provides numerous
opportunities for independent checks
6. Independent review – after a transaction is process, a second person reviews the work of the
first
Communicate information and monitor control processes
7th component in the ERM model is information and communication, last component is monitoring.
Information and communication
Information and communication systems should capture and exchange the information needed to
conduct, manage, and control the organization’s operations. The primary purpose of an AIS is to
gather, record, process, store, summarize, and communicate information about an organization.
Audit trial – a path that allows a transaction to be traced through a data processing system from
point of origin to output or backward from output to point of origin.
Communication must occur internally and externally to provide information needed to carry day-today internal control activities.
25
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Monitoring
The internal control system that is selected or developed must be continuously monitored, evaluated,
and modified as needed. Key methods of monitoring performance are:
1. Perform internal control evaluations
2. Implement effective supervision
3. Use responsibility accounting systems
4. Monitor system activities
5. Track purchased software and mobile devices
6. Conduct periodic audits
7. Employ a computer security officer and a chief compliance officer
8. Engage forensic specialists
9. Install fraud detection software
10. Implement a fraud hotline
Computer security officer (CSO) – an employee independent of the information system function who
monitors the system, disseminates information about improper system uses and their consequences
and reports to top management
Chief compliance officer (CCO) – an employee responsible for all the compliance tasks associated
with SOX and other laws and regulatory rulings
Forensic investigators – individuals who specialize in fraud, most of whom have specialized training
with law enforcement agencies such as the FBI or IRS or have professional certifications such as
Certified Fraud Examiner (CFE).
Computer forensics specialists – computer experts who discover, extract, safeguard, and document
computer evidence such that its authenticity, accuracy, and integrity will not succumb to legal
challenges
Neural networks – computing systems that imitate the brain’s learning process by using a network of
inter connected processors that perform multiple operations simultaneously and interact dynamically
Fraud hotline – a phone number employees can call to anonymous report fraud and abuse
26
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 8 Controls for information security
The Trust Services Framework organizes IT-related controls into five principles that jointly contribute
to systems reliability:
1. Security
2. Confidentiality
3. Privacy
4. Processing integrity
5. Availability
BIV = beschikbaarheid, integriteit, vertouwelijkheid
CIA = Confidentiality, integrity, availability
Two fundamental information security concepts
1. Security is a management issue, not just a technology issue
The security life cycle:
1. Assess threats &
selectrisk response
4. Monitor
performance
2. Develop and
communicate policy
3. Acquire &
implement solutions
2. The time-based model of information security
Time-based model of security – implementing a combination of preventive, detective, and
corrective controls that protect information assets long enough to enable an organization to
recognize that an attack is occurring and take steps to thwart it before any information is lost or
compromised
Formula: P > D + R,
P = time it takes an attacker to break through preventive controls
D = time it takes to detect an attack is in progress
R = time it takes to respond to the attack and take corrective action
Defense-in-depth – employing multiple layers of controls to avoid a single point-of-failure
The time-based model of security provides a means for management to identify the most costeffective approach to improving security by comparing the effects of additional investments in
preventive, detective, or corrective controls.
Although, the time-based model of security provides a sound theoretical basis for evaluating and
managing an organization’s information security practices, it should not be viewed as a precise
mathematical formula.
Understanding targeted attacks
Basic steps criminals use to attack an organization’s information system:
1. Conduct reconnaissance
2. Attempt social engineering – using deception to obtain unauthorised access to information
recourses
3. Scan and map the target
27
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
4. Research
5. Execute the attack
6. Cover tracks
Protecting information recourses
It is important to understand that “outsiders” are not the only one threat source.
Authentication controls
Authentication – verifying the identity of the person or device attempting to access the system
Three types of credentials can be used to verify a person’s identity:
1. Something the person knows, such as passwords or personal identification numbers (PINs)
2. Something the person has, such as smart cards or ID badges
3. Some physical or behavioural characteristic (referred to as a biometric identifier) of the
person, such as fingerprints or typing patterns
Although none of the three basic authentication credentials, by itself, is fool proof, the use of two or
all three types in conjunction, a process referred to as multifactor authentication, is quite effective.
Multimodal authentication – the use of multiple authentication credentials of the same type to
achieve a greater level of security.
Authorization controls
Authorization – the process of restricting access of authenticated users to specific portions of the
system and limiting what action they are permitted to perform
Authorization controls are often implemented by creating an access control matrix – a table used to
implement authorization controls.
Compatibility test – matching the user’s authentication credentials against the access control matrix
to determine whether that employee should be allowed to access that recourse and perform the
requested action.
Penetration test – an authorized attempt to break into the organization’s information system
Change control and change management – the formal process used to ensure that modifications to
hardware, software, or processes do not reduce systems reliability.
Perimeter defence
Border router – a device that connects an organization’s information system to the Internet
Behind the border router is the main firewall – a special-purpose hardware device or software
running a general-purpose computer that controls both inbound and outbound communication
between the system behind the firewall and other networks.
Demilitarized zone (DMZ) – a separate network located outside the organization’s internal
information system that permits controlled access from the Internet
Together, the border router and firewall act as filters to control which information is allowed to enter
and leave the organization’s information system.
Routers – special purpose devices that are designed to read the source and destination address field
in IP packet headers to decide where to send (route) the packet next
Access control list (ACL) – a set of IF-THEN rules used to determine what to do with arriving packets
Packet filtering – a process that uses various fields in a packet’s IP and TCP headers to decide what to
do with the packet
28
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Deep packet inspection – a process that examines the data in the body of a TCP packet to control
traffic, rather than looking only at the information in the IP and TCP headers
Intrusion prevention systems – software or hardware that monitors patterns in the traffic flow to
identify and automatically block attacks.
Endpoints – collective term for the workstations, servers, printers, and other devices that comprise
an organization’s network
Vulnerabilities – flaws in programs that can be exploited to either crash the system or take control of
it
Vulnerability scanners – automated tools designed to identify whether a given system possesses any
unused and unnecessary programs that represent potential security threats.
Exploit- a program designed to take advantage of a known vulnerability
Patch – code released by software developers that fixes a particular vulnerability
Patch management – the process of regularly applying patches and updates to software
Hardening – the process of modifying the default configuration of endpoint to eliminate unnecessary
settings and services
Log-analysis – the process of examining logs to identify evidence of possible attacks
Intrusion detection systems (IDS) – a system that creates logs of all network traffic that was
permitted to pass the firewall and then analysed those logs for signs of attempted or successful
intrusions
Computer incident response team (CIRT) – a team that is responsible for dealing with major security
incidents
The CIRT should lead the organization’s incident response process through the following four steps:
1. Recognition
2. Containment
3. Recovery
4. Follow-up
Virtualization – running multiple systems simultaneously on one physical computer
Cloud computing – using a browser to remotely access software, data storage, hardware, and
applications
29
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 9 Confidentiality and privacy controls
Four basic actions that must be taken to preserve the confidentiality of sensitive information
1. Identify and classify the information
2. Encrypt the information
3. Control access to the information
4. Train employees to properly handle the information
Information rights management (IRM) – software that offers the capability not only to limit access to
specific files or documents but also to specify the actions that individuals who are granted access to
that recourse can perform. Some IRM software even has the capability to limit access privileges to a
specific period of time and to remotely erase protected files.
Data loss prevention (DLP) – software which works like antivirus programs in reverse, blocking
outgoing messages that contain key words or phrases associated with intellectual property or other
sensitive data the organization wants to protect
Digital watermark – code embedded in documents that enables an organization to identify
confidential information that has been disclosed
Privacy controls - Identify and classify information, encryption, access controls en training
Encryption is a fundamental control for protecting the privacy of personal information that
organizations collects.
Data masking - protecting privacy by replacing sensitive personal information with fake data, also
called tokenization
Privacy concerns
Spam – unsolicited e-mail that contains either advertising or offensive content
Identity theft – assuming someone’s identity, usually for economic gain
Encryption
Encryption – the process of transforming normal text, called plaintext, into unreadable gibberish,
called ciphertext
Plaintext – normal text that has not been encrypted
Ciphertext – plaintext that was transformed into unreadable gibberish using encryption
Decryption – transforming ciphertext back into plaintext
Three factors determine the strength of any encryption:
1. Key length
2. Encryption algorithm
3. Policies for managing the cryptographic keys
Symmetric encryption systems – encryption systems that use the same key both to encrypt and
decrypt
Asymmetric encryption systems – encryption systems that use two keys (one public, other private)
either key can encrypt, but only the other matching key can decrypt
Public key – one of the keys used in asymmetric encryption systems. It is widely distributed and
available to everyone
Private key – one of the keys used in asymmetric encryption systems. It is kept secret and known only
to the owner of that pair of public and private keys.
30
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Public key can encrypt data, and only the linking private key can decrypt data. It is allowed to know
somebody’s public key. E.g. with a mailbox. Somebody’s address would be the public key. But only
with a private key, the mailbox can be opened, and the messages can be read by the owner. So, if you
need to send somebody a document, the public key of the receiver is used. The owner can then open
with its private key the document.
Key escrow – the process of storing a copy of an encryption key in a secure location
Hashing – transforming plaintext of any length into a short code called a hash
Hash - plaintext that has been transformed into short code
Digital signatures
Nonrepudiation – creating legally binding agreements that cannot be unilaterally repudiated by
either party
Digital signature – a hash encrypted with the hash creator’s private key
Digital certificated and public key infrastructure
Digital certificate – an electronic document that certifies the identity of the owner of a particular
public key and contains that party’s public key
Certificate authority – an organization that issues public and private keys and records the public key
in a digital certificate
Public key infrastructure (PKI) – the system for issuing pairs of public and private keys and
corresponding digital certificates
VPN
Virtual private networks – using encryption and authentication to securely transfer information over
the internet, thereby creating a “virtual” private network
31
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 10 Processing integrity and availability controls
Integrity
Input controls
Forms designs. Source documents and other forms should be designed to minimize the chances for
errors and omissions. Two particularly important forms design controls involve
1. Sequentially prenumbering source documents
2. Using turnaround documents – a record of company data sent to an external party and then
returned by the external party for subsequent input to the system
Process stage
Input
Processing
Output
Threats/risks
Data that is:
1. Invalid
2. Unauthorized
3. Incomplete
4. Inaccurate
Errors in output and stored data
1. Use of inaccurate incomplete
reports
2. Unauthorized disclosure of
sensitive information
3. Loss, alteration, or disclosure
of information in transit
Controls
Forms design, cancellation and
storage of documents, authorization
and segregation of duties controls,
visual scanning, data entry controls
Data matching, file labels, batch
totals, cross-footing and zero-balance
tests, write-protection mechanisms,
database processing integrity controls
Reviews and reconciliations,
encryption and access controls, parity
checks, message acknowledgement
techniques.
Data entry controls
1. Field check – an edit check that tests whether the characters in a field are of the correct field
type
2. Sign check – an edit check that verifies that the data in a field have the appropriate
arithmetic
3. Limit check – an edit check that tests a numerical amount against a fixed value
4. Range check – an edit check that tests whether a data item fall within predetermined upper
and lower limits
5. Size check – an edit check that ensure the input data will fit unto the assigned field
6. Completeness check – an edit check that verifies that all data required have been entered
7. Validity check – an edit test that compared the ID code or account umber in transaction data
with similar data in the master file to verify that the account exists
8. Reasonableness test – an edit check of logical correctness of relationships among data items
9. Check digit – ID numbers can contain a check digit computed from other digits
Check digit verification – recalculating a check digit to verify that a data entry error
has not been made
Additional batch processing data entry controls
1. Sequence check – an edit check that determines if a transaction file is in the proper
numerical or alphabetical sequence
2. Batch totals – the sum of a numerical item for a batch of documents, calculated prior to pro
cessing the batch, when the data are entered, and subsequently compared with computergenerated totals after each processing step to verify that the data was processed correctly
The following are commonly used batch totals:
32
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
1. Financial total – sums a field that contains monetary values
2. Hash total – sums a nonfinancial numeric field
3. Record count – number of records in a batch
Additional online data entry controls
1. Prompting – an online data entry completeness check that requests each required item of
input data and then waits for an acceptable response before requesting the next required
item
2. Closed-loop verification – an input validation method that uses data entered into the system
to retrieve and display other related information so that the data entry person can verify the
accuracy of the input of the data
3. A transaction log
Processing controls
1. Data matching; in certain cases, two or more items of data must be matched before an action
can take place
2. File labels; file labels need to be checked to ensure that the correct and most current files are
being updated
Header record – type of internal label that appears at the beginning of each file and
contains the file name, expiration date, and other file identification information
Trailer record – type of internal label that appears at the end of a file; in transaction
files, the trailer record contains the batch totals calculated during input
3. Recalculating of batch totals; batch totals should be recomputed as each transaction record is
processed, and the total for the batch should then be compared to the values in the trailer
record
Transposition error – an error that results when numbers in two adjacent columns
are inadvertently exchanges (e.g. 64 written as 46)
4. Cross-footing and zero balance tests – often totals can be calculated in multiple ways
Cross-footing balance test – a processing control that verifies accuracy by comparing
two alternative ways of calculating the same total
zero-balance test – a processing control that verifies that the balance of control
account equals zero after all entries to it have been made
5. Write-protection mechanism – these protect against overwriting or erasing of data files
stored on magnetic media
6. Concurrent update controls – errors can occur when two or more users attempt to update the
same record simultaneously
Concurrent update control – controls that lock out users to protect individual records
from errors that could occur
Output controls
Important output controls include the following:
1. User review of output
2. Reconciliation procedures
3. External data reconciliation
4. Data transmission controls
1. Checksums – a data transmission control that uses a hash of a file to verify accuracy
2. Parity bit – an extra bit added to every character; used to check transmission
accuracy
a. Parity checking – a data transmission control in which the receiving device
recalculates the parity bit to verify accuracy of transmitted data
33
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Availability
Minimize risk of system downtime
Fault tolerance – the capability of a system to continue performing when there is a hardware failure
Redundant arrays of independent drives (RAID) – a fault tolerance technique that records data on
multiple disk drives instead of just one to reduce the risk of data loss
Uninterruptible power supply (UPS) – an alternative power supply device that protects against the
loss of power and fluctuations in the power level by using battery power to enable the system to
operate long enough to back up critical data and safely shut down
Objective
1. To minize risk of system downtime
2. Quick and complete recovery and
resumption of normal operations
Key controls
1. Preventive maintenance
2. Fault tolerance
3. Data center location and design
4. Training
5. Patch management and antivirus
software
1. Backup procedures
2. Disaster recovery plan (DRP)
3. Business continuity plan (BCP)
Recovery and resumption of normal operations
Recovery point objective (RPO) – the amount of data the organization is willing to re-enter or
potentially lose
Recovery time objective (RTO) – the maximum tolerable time to restore an organization’s
information system following a disaster, representing the length of time that the organization is
willing to attempt to function without its information system
Data backup procedures
Data backup procedures are designed to deal with situations where information is accessible because
the relevant files or database have become corrupted as a result of hardware failure, software
problems, or human error, but the information system itself is still functioning.
Full backup – exact copy of an entire database
Full backups are time-consuming, so most organizations only do full backups weekly and supplement
them with daily partially backups.
Two types of daily partial backups:
1. Incremental backup – involves copying only the data items that have changed since the last
partial backup. This produces a set of incremental backup files, each containing the results of
one day’s transactions.
2. Differential backup – copies all changes made since the last full backup. Thus, each new
differential backup file contains the cumulative effects of all activity since the last full backup
34
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Archive – a copy of database. Master file, or software that is retained indefinitely as a historical
record, usually to satisfy legal and regulatory requirements
Disaster recovery and business continuity planning
Disaster recovery plan (DRP) – a plan to restore an organization’s IT capability in the event that its
data center is destroyed
Three basic option for replacing their IT infrastructure:
1. Cold site – relies on access to an alternative facility that is prewired for necessary
telephone and Internet access, but does not contain any computing equipment
2. Hot site – relies on access to a completely operational alternative data center that is
not only prewired but also contains all necessary hardware and software
3. Real-time mirroring – maintaining complete copies of a database at two separate
data centers and update both copies in real-time as each transaction occurs
The different DRP options vary in cost, cold sites being least expensive and real-time mirroring most
expensive.
Business continuity plan (BCP) – a plan that specifies how to resume not only IT operations but all
business processes in the event of a major calamity.
35
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 11 Auditing computer-based information
systems
Auditing – objectively obtaining and evaluating evidence regarding assertions about economic
actions and events to ascertain the degree of correspondence between those assertions and
established criteria
Internal auditing – assurance and consulting activity designed to add value, improve organizational
effectiveness and efficiency, and accomplish organization objectives
Types of internal audits
1. Financial audit – examination of the reliability and integrity of financial transactions,
accounting records, and financial statements
2. Information systems/internal control audit – examination of the general and
application controls of an IS to assess its compliance with internal control policies and
procedures and its effectiveness in safeguarding assets
3. Operational audit – examination of the economical and efficient use of recourse and
the accomplishment of established goals and objectives
4. Compliance audit – examination of organizational compliance with applicable laws,
regulations, policies, and procedures
5. Investigative audit – examination of incidents of possible fraud, misappropriation of
assets, waste and abuse, or improper governmental activities
Overview of the audit process
Audit planning – determines why, how, when, and by whom the audit will be performed.
1. Establish scope and objectives
2. Organize audit team
3. Develop knowledge of business operations
4. Review prior audit results
5. Identify risk factors
6. Prepare audit program
Three types of audit risk:
1. Inherent risk – susceptibility to significant control problems in the absence of internal control
2. Control risk – risk that a material misstatement will get through the internal control structure
and into the financial statements
3. Detection risk – risk that auditors and their audit procedures will fail to detect a material
error or misstatement
AR = IR x (I)CR x DR
Collection of audit evidence
1. Observation of operating activities
2. Review of documentation
3. Discussions
4. Questionnaires
5. Physical examination
6. Confirmation – written communication with independent third parties to confirm the
accuracy of information, such as customer account balances
7. Reperformance – performing calculations again to verify quantitative information
8. Vouching – comparing accounting journal and ledger entries with documentary evidence to
verify that a transaction is valid, accurate, properly authorized, and correctly recorded
9. Analytical review – examination of the relationships between different sets of data;
abnormal or unusual relationships and trends are investigated
36
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
10. Audit sampling
Evaluation of audit evidence
The auditor evaluates the evidence gathered and decided whether is supports a favourable or
unfavourable conclusion. Errors exist in most system, focus on detecting and reporting those that
significantly impact management’s interpretation.
Materiality – amount of an error fraud, or omission that would affect the decision of a prudent user
of financial information
Reasonable assurance – obtaining complete assurance that information is correct is prohibitively
expensive, so auditors accept a reasonable degree f risk that the audit conclusion is incorrect.
Communication of audit results
The auditor submits a written report summarizing audit findings and recommendations to
management, the audit committee, the board of directors, and other appropriate parties. Afterwards,
auditors often do a follow-up study to ascertain whether recommendations were implemented.
Risk-based audit approach
1. Determine the threats facing the company
2. Identify the control procedures that prevent, detect, or correct the threats
3. Evaluate control procedures
Evaluated in two ways:
b. Systems review – determines whether control procedures are actually in
place
c. Tests of control – are conducted to determine whether existing controls work
as intended
4. Evaluate control weaknesses to determine their effect on the nature, timing, or extent of
auditing procedures
a. Compensating controls – control procedures that compensate for the deficiency in
other controls
The risk-based approach provides auditors with a clearer understanding of the fraud and errors that
can occur and the related risks and exposures.
Information systems audits
Objectives
1. Protect overall system security (includes computer equipment, programs, and data)
2. Program development and acquisition occur under management authorization
3. Program modifications occur under management authorization
Three ways for unauthorized program changes
1. Code comparison program - software that compares the current version of a
program with its source doe; differences should have been properly authorized
and correctly incorporated
2. Reprocessing – using source code to reprocess data and comparing the output
with the company’s output; discrepancies are investigated to see if unauthorized
program changes were made
3. Parallel simulation – using auditor-written software to process data and
comparing the output with the company’s output; discrepancies are investigated
to see if unauthorized program changes were made
4. Accurate and complete processing of transactions, records, files, and reports
5. Prevent, detect, or correct inaccurate or unauthorized source data (controls)
6. Accurate, complete, and confidential data files (BIV=CIA)
37
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Audit software
Computer-assisted audit techniques (CAATS) – audit software that uses auditor-supplied
specifications to generate a program that performs audit functions
Often call generalized audit software (GAS)
Two of the most popular software packages are Audit Control Language (ACL) and Interactive Data
Extraction and Analysis (IDEA).
Computer assisted audit software that can perform audit tasks on a copy of a company’s data. Can
be used to:
 Query data files and retrieve records based upon specified criteria
 Create, update, compare, download, and merge files
 Summarize, sort, and filter data
 Access data in different formats and convert to common format
 Select records using statistical sampling techniques
 Perform analytical tests
 Perform calculations and statistical tests
38
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 12 The revenue cycle
Revenue cycle – the recurring set of business activities and data processing operations associated
with providing goods and services to customers and collecting cash in payment for those sales
Information system
Most large organizations use an ERP system. All revenue cycle activities depend on the integrated
database that contains information about customers, inventory, and pricing.
Threats:
 Data input errors
 Unauthorized disclosure of sensitive information
 Loss or destruction of master data
4 basic revenue cycle activities:
1. Sales order entry
2. Shipping
3. Billing
4. Cash collections
Sales order entry
The revenue cycle begins with the receipt of orders from customers. The sales department, which
reports to the vice president of marketing, typically performs the sales order entry process, but
increasingly customers are themselves entering much of this data through forms on a company’s
website storefront.
Sales order entry process entails three steps:
1. Taking the customer’s order
2. Checking and approving customer credit
3. Checking inventory availability
Sales order – the document created during sales order entry listing the item numbers, quantities,
prices, and terms of the sale
Electronic data interchange (EDI) – the use of computerized communications and a standard coding
scheme to submit business document electronically in a format that can be automatically processed
by the recipient’s information system
Threats and controls
- Important data about the order will be either missing or inaccurate
- Legitimacy of orders
- Possibility of making sales that later turn out to be uncollectible
Credit limit – maximum allowable credit account balance for each customer, based on past credit
history and ability to pay
Accounts receivable aging report -a report listing customer account balances by length of time
outstanding
In addition to checking a customer’s credit, salespeople also need to determine whether sufficient
inventory is available to fill the order, so that customers can be informed of the expected delivery
date
39
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
If there is not sufficient inventory on hand to fill the order, a back order will be created.
Back order- a document authorizing the purchase or production of items that is created when there
is insufficient inventory to meet customer needs
Once inventory availability has been determined, the system then generates a picket ticket.
Picking ticket – a document that lists the items and quantities ordered and authorizes the inventory
control function to release that merchandise to the shipping department
To improve efficiency, the picking ticket often lists the items by the sequence in which they are stored
in the warehouse, rather than in the order listed on the sales order
Customer relationship management (CRM) – software that organizes information about customers in
a manner that facilitates efficient and personalized service
Shipping
The second based activity in the revenue cycle is filling customer orders and shipping the desired
merchandise.
This process consists of two steps:
1. Picking and packing the order
2. Shipping the order
Threats:
- Risk of picking the wrong item or in the wrong quantity
- Theft of inventory
Packing slip – a document listing the quantity and description of each item included in a shipment
Bill of lading – a legal contract that defines responsibility for goods while they are in transit
Threats:
- Theft
- Shipping errors
Billing
Billing includes two tasks:
(1) Invoicing and (2) updating accounts receivable
Invoicing activity is just an information processing activity that repackages and summarizes
information from the sales order entry and shipping activities.
Sales invoice – a document notifying customers of the amount of a sale and where to send payment
Threats:
- Failure to bill customers
- Billing errors
The two basic ways to maintain accounts receivable are the open-invoice and the balance-forward
methods.
 Open-invoice method – pay according to each invoice
o Remittance advice – a copy of the sales invoice returned with a customer’s payment
that indicates the invoices, statements, or other items being paid
 Balance-forward method – pay according to the amount shown on am monthly statement,
rather than by individual voices. Remittances are applied against the total account balance,
rather than specific invoices.
40
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
o
Monthly statement – document listing all transactions that occurred during the past
month and information customers of their current account balance
One advantage of the open-invoice method is that it is conducive to offering discounts for prompt
payment, as invoices are individually tracked and aged. It also results in a more uniform flow of cash
collection throughout the month. A disadvantage of the open-invoice method is the added
complexity required to maintain information about the status of each individual invoice for each
customer.
Many companies that use the balance-forward method use a process called cycle billing.
Cycle billing – producing monthly statements for subsets of customers at different times
Adjustments to customers’ accounts are sometimes necessary, in case of return of goods.
Credit memo – a document, approved by the credit manager, authorizing the billing department to
credit a customer’s account
Cash collections
The last step in the revenue cycle is collecting and processing payments from customers. Methods to
identify the source of any remittances and the applicable invoices:
1. Remittance advance (two copies of invoice)
2. Remittance list – a document listing names and amount of all customer payments received in
the mail
3. Lockbox – a postal address to which customers send their remittances
Electronical lockbox – lockbox arrangement in which the bank electronically sends
the company information about the customer account number and the amount
remitted as soon as it receives payments
Electronical funds transfer (EFT) – the transfer of fund through use of online banking software
Financial electronic data interchange (FEDI) – the combination of EFT and EDI that enable both
remittance data and funds transfer instructions to be included in one electronic package
Employees who have physical access to cash should not have responsibility for recording or
authorizing any transactions involving its receipt. Specifically, the following pairs of duties should be
segregated:
1. Handling cash or checks and posting remittances to customer accounts
2. Handling cash or checks and authorizing credit memos
3. Handling cash or checks and reconciling the bank statement
Universal payment identification code (UPIC) – a number that enables customers to remit payments
via an ACH credit without requiring the seller to divulge detailed information about its bank account
The best control procedure to reduce risk of unanticipated cash shortfalls is to use cash flow budget.
Cash flow budget – a budget that shows projected cash inflows and outflows for a specified period
41
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 13 The expenditure cycle
Expenditure cycle - a recurring set of business activities and related data processing operations
associated with the purchase of a payment for goods and services
Four basic expenditure cycle activities
1. Order materials, supplies and services
2. Receiving materials, supplies, and services
3. Approving supplier invoices
4. Cash disbursements
Threats:
- Inaccurate or invalid master data
- Unauthorized disclosure of sensitive information
- Loss or destruction of master data
Ordering materials, supplies and services
First identifying what, when, and how much to purchase and then choosing from which supplier to
purchase.
Identifying what, when, and how much to purchase
Economic order quantity (EOQ) – the traditional approach to managing inventory is to maintain
sufficient stock so that production can continue without interruption even if inventory use is greater
than expected or if suppliers are late in making deliveries.
EOQ is based on calculating an optimal order size to minimize the sum of ordering, carrying and
stockout costs.
Recorder point – specifies when to order. Companies typically set the recorder point based
on delivery time and desired levels of safety stock to handle unexpected fluctuations in
demand.
Materials requirement planning (MRP) – an approach to inventory management that seeks to reduce
required inventory levels by improving the accuracy of forecasting techniques to better schedule
purchases to satisfy production needs
Just-in-time (JIT) inventory system – a system that minimizes or virtually eliminates inventories by
purchasing and producing goods only in response to actual, rather than forecasted, sales.
A major difference between MRP and JIT systems is production scheduling. MRP schedule production
to meet forecasted sales, JIT schedule production in response to customer demands.
Both, JIT and MRP, can reduce costs and improve efficiency
MRP systems are more effectively used with products that have predictable patterns of demand
JIT systems are especially useful for product that have relatively short life cycle and for which demand
cannot be accurately predicted
Purchase requisition – a document or electronic form that identifies the requisitioner; specifies the
delivery location and date needed; identifies the item numbers, descriptions, quantity, and price of
each item requested; and may suggest a supplier
42
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Choosing suppliers
Factors considered when selecting suppliers:
1. Price
2. Quality of materials
3. Dependability in making deliveries
Purchase order- a document that formally requests a supplier to sell and deliver specified products at
designated prices. It is also a promise to pay and becomes a contract one the supplier accepts it.
The purchase order includes
- The names of the supplier and purchasing agent
- The order and requested deliver dates
- The delivery location and shipping method
- Information about the items ordered
Blanket purchase order or blanked order – a commitment to purchase specified items at designated
prices from a particular supplier for a set time period, often one year
Vendor-managed inventory programs provide another means of reducing purchase and inventory
costs.
Vendor-managed inventory – practice in which manufacturers and distributors manage a retail
customer’s inventory using EDI. The supplier accesses its customer’s point-of-sale system in order to
monitor inventory and automatically replenish products when they fall to agreed-upon levels
EDI – electronic data interchange
Kickbacks – gifts given by suppliers to purchasing agents for the purpose of influencing their choice of
suppliers
To prevent kickbacks, companies should prohibit purchasing agents from accepting any gifts from
potential or existing suppliers
Receiving
When a delivery arrives, a receiving clerk compares the purchase order number reference on the
supplier’s packing slip with the open purchase order file to verify that the goods were ordered
Receiving report – a document that records details about each delivery, including the data received,
shipper, supplier, and quantity received
Three possible exceptions to this process are:
1. Receiving a quantity of goods different from the amount ordered
2. Receiving damaged goods
3. Receiving goods of inferior quality that fail inspection
Debit memo – a document used to record a reduction to the balance due to a supplier
The accounts payable is notified and adjusts the account balance owed to that supplier
Approving supplier invoices
The accounts payable department approves supplier invoices for payment. A legal obligation to pay
suppliers arises at the time goods are received.
Voucher package – the set of documents used to authroize payment to a supplier. It consists of a
purchase order, receiving report, and supplier invoice
43
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Nonvoucher system – a method for processing accounts payable in which each approved invoice is
posted to individual supplier records in the accounts payable file and is then stored in an open invoice
file. Contrast with voucher system
Voucher system - a method for processing accounts payable in which a disbursement voucher is
prepared instead of posting invoices directly to supplier records in the accounts payable subsidiary
ledger. Contrast with nonvoucher system
Disbursement voucher – identifies the supplier, lists the outstanding invoices, and indicates
the net amount to be paid after deducting any applicable discounts and allowances.
A voucher system offers three advantages over nonvoucher systems:
1. They reduce the number of checks that need to be written, because several invoices may be
included on one disbursement voucher
2. The disbursement voucher is an internally generated document, it can be prenumbered to
simplify tracking all payables
3. The voucher provides an explicit record that a supplier invoice has been approved for
payment, it facilitates separating the time of invoice approval from the time of invoice
payment. This makes it easier to schedule both activities to maximize efficiency
Evaluated receipt settlement (ERS) – an invoiceless approach to accounts payable that replaces the
three-way matching process (supplier invoice, receiving report, and purchase order) with a two-way
match of the purchase and receiving report
Procurement card – a corporate credit card that employees can use only at designated suppliers to
purchase specific kinds of items
Spending limits can be set for each card
Cash disbursements
The cashier, who reports to the treasurer, is responsible for paying suppliers. Payments are made
when account payable send the cashier a voucher package.
It is often more convenient to pay for minor purchases, such as coffee, donuts or pens, in cash. The
petty cash fund should be set up as an imprest fund. e
Imprest fund – a cash account with two characteristics
1. It is set as a fixed amount
2. Vouchers are required for every disbursement
At all times, the sum of cash plus vouchers should equal the present fund balance
44
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 14 The production cycle
Production cycle – the recurring set of business activities and related data processing operations
associated with the manufacture of products
Four basic activities:
1. Product design
2. Planning and scheduling
3. Production operations
4. Cost accounting
Product design
The product design activity creates two outputs:
1. Bill of materials – a document that specifies the part number, description, and quantity of
each component used in a product
2. Operations list – a document that specifies the sequence of steps to follow in making a
product, which equipment to use, and how long each step should take
Planning and scheduling
The objective is to develop a production plan efficient enough to meet existing orders and anticipated
short-term demand while minimizing inventories of both raw materials and finished goods.
Production planning methods
1. Manufacturing recourse planning (MRP-II) – is an extension of materials requirements
planning that seeks to balance existing productions capacity and raw materials needs to meet
forecasted sales demands. Often referred to push manufacturing.
2. Lean manufacturing – extends the principles of JIT to the entire production process. The goal
of lean manufacturing is to minimize or eliminate inventories of raw materials, work in
process, and finished goods. Often referred to pull manufacturing.
MRP-II may develop production plans for up to 12 months in advance, whereas lean manufacturing
systems use much shorter planning horizons.
Master production schedule (MPS) – specifies how much of each product is to be produced during
the planning period and when that production should occur.
MPS is used to develop a detailed timetable that specifies daily production and to determine whether
raw materials need to be purchased.
Three other documents for planning and scheduling activity:
1. Production order – a document authorizing the manufacture of a specified quantity of a
particular product
2. Materials requisition – authorizes the removal of the necessary quantity of raw materials
from the storeroom
3. Move tickets – documents that identify the internal transfer of parts, the location to which
they are transferred, and the time of the transfer
Accurate production planning required integrating information about customer orders (from the
revenue cycle) with information about purchases from suppliers (from the expenditure cycle), along
with information about labour availability (from the HR/payroll cycle)
45
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Production operations
The manner in which this activity is accomplished varies greatly across companies, differing according
to the type of product being manufactured and the degree of automation used in the production
process.
Computer-integrated manufacturing (CIM) – a manufacturing approach in which much of the
manufacturing process is performed and monitored by computerized equipment, in part through the
use of robotics and real-time data collection of manufacturing activities
Orders for machinery and equipment almost always involve a formal request for competitive bids by
potential suppliers.
Request for proposal (RFP) – a request by an organization or department for suppliers to bid to
supply a fixed asset that possesses specific characteristics
Cost accounting
The three principles of cost accounting system are
1. Provide information for planning, controlling, and evaluating the performance of production
operations
2. Provide accurate cast data about products for use in pricing and product mix decisions
3. Collect and process the information used to calculate the inventory and cost of goods sold
values that appear in the company’s financial statements
Job-order costing – a cost system that assigns costs to specific production batches or jobs
Process costing – a cost system that assigns costs to each process, or work center, in the production
cycle, and then calculates the average cost for all units produced
The choice of job-order or process costing affects only the method used to assign costs to products,
not the methods used to collect that data.
Job-time ticket – a document to collect data about labour activity by recording the amount of time a
worker spent on each specific job task.
Manufacturing overhead – all manufacturing costs that are not economically feasible to trace directly
to specific jobs or processes. (e.g. costs of water, power, miscellaneous supplies)
Activity based costing (ABC) - a cost system designed to trace costs to the activities that create them
ABC differ from conventional cost accounting systems in three important ways:
1. ABC attempt to directly trace a larger proportion of overhead costs to products. Advances in
IT make this feasible
2. ABC use a greater number of cost pools to accumulate indirect costs
a. Batch-related overhead – ABC accumulate these costs for a batch and then allocate
them to the units produced in that batch
b. Product-related overhead – ABC try to link these costs to specific products when
possible
c. Companywide overhead – these costs apply to all products
3. ABC attempt to rationalize the allocation of overhead to products by identifying cost drivers
Cost driver – anything that has a cause-and-effect relationship to costs
Other advantages of ABC:
- Better decisions
- Improved cost management
- Improved control with innovative performance metrics
46
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Throughput – a measure of production efficiency representing the number of “good” units produced
in a given period of time
Throughput = (total units produced / processing time) x (processing time/ total time) x (goods units / total units)
Quality control measures
1. Prevention costs – changes to production process designed to reduce product defect rate
2. Inspection costs – testing to ensure that products meet quality standards
3. Internal failure – reworking, scrapping, products identified as being defective prior to sale
4. External failure – defective products are sold to customers
47
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 15 The HRM and payroll cycle
HRM/payroll cycle – the recurring set of business activities and data processing operations
associated with effectively managing the employee workforce
Important tasks include:
1. Recruiting and hiring new employees
2. Training
3. Job assignment
4. Compensation (payroll)
5. Performance evaluation
6. Discharge of employees due to voluntary or involuntary termination
Knowledge management systems – software that stores and organizes expertise possessed by
individual employees so that the knowledge can be shared and used by others
Payroll cycle activities
Five major sources of inputs to the payroll system:
1. HRM department
2. Various departments
3. Government agencies
4. Employees
5. Bank
6. Insurance and other companies
The HRM department provides information about hirings, terminations, and pay-rate changes due to
raises and promotions.
Employees initiate changes in their discretionary deductions.
The various departments provide data bout actual hours employees work
Government agencies provide tax rated and instructions for meeting regulatory requirements
Insurance companies and other organizations provide instructions for calculating and remitting
various withholdings.
Checks are the payroll system’s principal output. Employees receive individual paychecks in
compensation for their services. A payroll check is sent to the bank to transfer fund from the
company’s regular accounts to its payroll accounts. Checks also are issued to government agencies,
insurance companies, and other organizations to meet company obligations.
Update payroll master database
Activity one of the HRM/payroll cycle.
HRM department is responsible for updating the payroll master database for internally initiated
changes related to employment, whereas the payroll department updates information about tax
rates and other payroll deductions when it receives notification of changes from various government
units and insurance companies.
Validate time and attendance data
The second step in the payroll cycle is to validate each employee’s time and attendance data.
Time card – a document that records the employee’s arrival and departure times for each work shift
Time sheets – a data entry screen (or paper document) used by salaried professionals to record how
much time was spent performing various tasks for specific clients
48
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Prepare payroll
The third step is preparing payroll.
First, payroll transaction data is edited, and the validated transactions are then sorted by employee
number. If the organization is processing payrolls from several divisions, each of these payroll
transaction files must also be merged.
Next, all payroll deductions are summed, and the total is subtracted from gross pat to obtain net pay.
Payroll deductions fall into two broad categories:
1. Payroll tax withholdings
2. Voluntary deductions
Next, the payroll and deduction registers are created.
Payroll registers – a listing of payroll data for each employee
Deduction register – a report listing the miscellaneous voluntary deductions for each employee
Earnings statement – a report listing the amount of gross pay, deductions, and net pay for the current
period and the year-to-date totals for each category.
Three types of data processing integrity controls that can mitigate the threat of payroll errors:
1. Batch totals
2. Cross-footing the payroll register
3. A payroll clearing account – a general ledger account used to check the accuracy and
completeness of recording payroll costs and their subsequent allocation to appropriate cost
centers
Disburse payroll
The next step is the actual disbursement of paychecks to employees.
After paybacks have been prepared, accounts payables review and approves the payroll register. A
disbursement voucher is then prepared to authorize the transfer of fund from the company’s general
checking account to its payroll bank account. The disbursement voucher is then used to update the
general ledger. The cashier then prepares and signs a check transferring funds to the company’s
payroll bank account.
Calculate and disburse employer-paid benefits, taxed, and voluntary employee deductions
The final payroll activity.
Employers must pay Social Security taxes in addition to the amounts iwthhel from employee
paycheks. In addition to mandatory tax-related disbursement, employers are responsible for ensuring
that other funds deducted from employee paychecks are correctly calculated and remitted in a timely
manner to the appropriate entity.
Many employers offer their employees flexible benefits plans.
Flexible benefits plans – a plan under which each employee receives some minimum coverage in
medical insurance and pension contributions, plus additional benefit “credits” that can be used to
acquire extra vacation time or additional health insurance. These plans are sometimes called
cafeteria style benefit plans because they offer a menu of options.
Outsourcing options
Payroll service bureau – an organization that maintain the payroll master file for each of its clients
and performs their payroll processing activities for a fee.
Professional employer organization (PEO) – an organization that processes payroll and also provides
human resource management services such as employee benefit design and administration
49
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Payroll service bureaus and PEOs are especially attractive to small and midsized businesses for the
following reasons:
 Reduced costs
 Wider range of benefits
 Freeing up computer resources
50
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Chapter 16 General ledger and reporting system
All general ledger and reporting cycle activities depend on the integrated database.
The centralized database must be organized in a manner that facilitates meeting the varied
information needs of both internal and external users.
Managers need timely detailed information about the results of operations in their particular area of
responsibility.
Investors and creditors want periodic financial statements and timely updates to help them assess
the organization’s performance.
Various government agencies also mandate specific information requirements
Update general ledger
Updating consists of posting journal entries that originate from two sources:
1. Accounting subsystems
2. Treasurer
Journal voucher file – a file that stores all journal entries used to update the general ledger
Threats:
- Inaccurate updating of general ledger
- Unauthorized journal entries
The following types of input edit and processing controls are needed to ensure accuracy and
completeness:
1. Validity check
2. Field (format) checks
3. Zero-balance checks
4. Completeness test
5. Closed-loop verification
6. Sign check
7. Run-to-run totals
Trial balance – a report listing the balances of all general ledger accounts
Audit trial – a path that allows a transaction to be traced through a data processing system from
point of origin to output or backwards
Post adjusting entries
Adjusting entries fall into five basic categories:
1. Accruals – entries that have occurred but for which cash has not yet been received or
disbursed
2. Deferrals – entries that reflect the exchange of cash prior to performance of the related event
3. Estimates – entries reflect a portion of expenses expected to occur over a number of
accounting periods
4. Revaluations – entries made to reflect either differences between the actual and recorded
value of an asset or a change in accounting principle
5. Corrections – entries made to counteract the effects of errors found in the general ledger
Threats
- Inaccurate adjusting entries
- Unauthorized journal entries
51
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)
lOMoARcPSD|1779620
Prepare financial statements
Most organizations “close the books” to produce financial statements monthly, quarterly, and
annually.
A closing journal entry zeroes out all revenue and expense accounts in the adjusted trial balance and
transfers the net income to retained earnings
The income statement summarized performance for a period of time
The balance sheet presents information about the organization’s assets, liabilities, and equity at a
point in time.
The statement of cash flows provides information about how the organization’s operating, investing,
and financing activities affected its cash balance.
Threats:
- Inaccurate financial statements
- Fraudulent financial reporting
Produce managerial reports
An operating budget depicts planned revenues and expenditures for each organizational unit
A capital expenditures budget shows planned cash inflows and outflows for each capital project
Cashflow budgets compare estimated cash inflows from operations with planned expenditures and
are used to determine borrowing needs
Responsibility accounting – a system of reporting financial results on the basis of managerial
responsibilities within an organization
Flexible budget – a budget in which the amounts are stated in terms of formulas based upon acutal
level of activity
Balanced scorecard – a management report that measures four dimensions of performance:
financial, internal operations, innovation and learning, and customer perspectives of the organization
Threats:
- Poorly designed reports and graphs
52
Gedownload door Agnes Nijmeijer (agnes.nijmeijer@hetnet.nl)