Chapter 4: Internal Controls

Question 1

What does security mean? (1)

Answer 1

The establishment and application of safeguards to protect data, software and computer hardware from accidental or malicious modification, destruction or disclosure.

Question 2

What are the basic concerns of the computerised system that security should maintain? (3)

Answer 2

1. The availability of the computerised service.
2. The integrity of the data that it processes and stores.
3. The confidentiality of the data before, during and after processing.

Question 3

What is the information system’s security based on? (3)

Answer 3

1. Physical= equipment can be impaired when subjected to events eg fire, flooding, improper environmental conditions etc.
2. People= as a threat.
3. Data= that might get lost or damaged.

Question 4

What functions should all security measures perform? (5)

Answer 4

1. The avoidance or prevention of loss.
2. The deterrence of as many threats as possible.
3. Easy recovery after any loss.
4. Identification of the cause of any losses after the event.
5. The correction of vulnerable areas to reduce the risk of repeated losses.

Question 5

What are general controls? (1)

Answer 5

General controls relate to the environment within which computer based systems are developed, maintained and operated.

Question 6

What are some examples of general controls? (8)

Answer 6

1. Personnel recruitment policies= to ensure honesty and competence.
2. Segregation of duties= between different types of jobs to minimise data tampering.
3. Training programmes= for new staff and new systems.
4. Authorisation= procedures for program amendments and testing.
5. Backup procedures= maintaining copies of files and back ups off site.
6. Access controls= eg anti virus, firewalls.
7. Transmission measures= to ensure data isn’t hacked when being transferred.
8. Controls to ensure computing resources are used efficiently.

Question 7

What are the main issues that affect security? (3)

Answer 7

1. The nature of the personal data and the possible harm of it was accessed, altered, disclosed, lost or destroyed.
2. The place where personal data is stored.
3. The reliability of staff that have access to the data.

Question 8

What are the main data security measures? (3)

Answer 8

1. Physical security.
2. Software security eg failed access logs.
3. Operational security eg work taken home by employees.

Question 9

According to the data protection act, data must be: (3)

Answer 9

1. Accurate and up to date.
2. Kept for no longer then necessary.
3. Handled in a way that ensures security, including protection against unlawful processing, access, loss, destruction or damage.

Question 10

What physical controls are used to protect computer systems? (4)

Answer 10

1. Fire systems and procedures eg fire alarms, smoke detectors.
2. Location of hardware= away from the risk eg not having computers near areas prone to flooding.
3. Building maintenance= attention to roofs, windows and doors to reduce the risk of flooding or break ins.
4. Physical controls= eg security, CCTV.

Question 11

What individual staff controls are used to protect the computer systems? (5)

Answer 11

1. Physical controls.
2. Logical access systems= if physical controls fail eg methods to ID the user.
3. Personal ID= eg a PIN or passwords that are kept secret and frequently changed.
4. Usage logs= the system should automatically record login and log off times.
5. Secure storage= backups should be kept in a safe or in an off site area.

Question 12

What errors might occur during the operation of a system? (4)

Answer 12

1. Data capture/ classification errors.
2. Transcription errors= occurring when data is input eg typed incorrectly.
3. Data communication faults= if the system operates over a wide network then the original terminal may be corrupted during transmission.
4. Data processing errors= because of programming errors, system design or data corruption.

Question 13

What are data capture/ classification errors and what do they include?

Answer 13

These occur before data is ready for input into the system eg:

1. Incorrect data classification= allocating a production cost as an admin cost.
2. Measuring mistake= recording the incorrect quantity of goods received.
3. Incorrect spelling or transposition error= recording £50.60 as £50.06.

Question 14

The purpose of the controls is to ensure that: (4)

Answer 14

1. The data being processed is complete.
2. The data being processed is authorised.
3. The results are accurate.
4. A complete audit trail of activity is available.

Question 15

What states should have controls? (3)

Answer 15

1. Input.
2. File processing.
3. Output.

Question 16

What is included in the input stage? (6)

Answer 16

1. Data collection and preparation.
2. Data authorisation.
3. Data conversion.
4. Data transmission.
5. Data correction.
6. Corrected data re-input.

Question 17

What is included in the file processing stage? (3)

Answer 17

1. Data validation and editing.
2. Data manipulation, sorting and merging.
3. Master file updates.

Question 18

What is included in the output stage? (2)

Answer 18

1. Output control and reconciliation with predetermined data.
2. Information distribution.

Question 19

What does data integrity mean? (1)

Answer 19

Completeness and accuracy of data maintained using controls over data input, file processing and output.

Question 20

What should data controls ensure? (4)

Answer 20

1. That data is collected accurately in full.
2. Data is generated at appropriate times.
3. Data is accurate and kept up to date.
4. Processed properly and accurately to provide useful and meaningful output.

Question 21

What is the biggest security weakness for any system? (1)

Answer 21

Human error, which is minimised using input controls.

Question 22

What techniques do input controls use? (3)

Answer 22

1. Verification= checks data has been conveyed from the source to the system completely and accurately.
2. Validation= the application of a series of rules designed to test the data’s reasonableness.
3. Data communication/ transmission controls= controls to stop data being corrupted when transmitted over a wide area network.

Question 23

What are some examples of verification? (6)

Answer 23

1. Type checks= every entry must comply with the prescribed format.
2. Non existence checks= eg a validation table so only pre-existing data can be entered.
3. Consistency checks= data is input and doesn’t require maintenance/ can’t be edited.
4. Duplication checks= the system checks for data that has been previously entered.
5. Range checks= a min and max value which input can be checked against.
6. Input comparison= between the document and screen.

Question 24

What are some examples of validation? (6)

Answer 24

1. Comparison of totals= eg checking debits and credits match.
2. Comparison of data sets= eg checking 2 files to identify and reject any differences.
3. Sequence numbers= the system can be programmed to reject an invoice number out of order.
4. Range checks= eg values may be rejected outside of £3- £6.
5. Format checks= the system may only except certain characters eg numbers only, rejecting letters.
6. File controls= making sure correct files are processed, files aren’t lost or corrupted, unauthorised access is prevented and lost/ corrupted data can be recreated.

Question 25

What are processing controls? (2)

Answer 25

Processing controls ensure the accuracy and completeness of data when processed. These controls should be tested regularly.

Question 26

What are some types of processing controls? (3)

Answer 26

1. Standardisation= structured procedures for processing activities. 2. Batch control= information about the batch is entered prior to processing. 3. Double processing= repeat of processing with comparisons of individual reports.

Question 27

What are output controls? (1)

Answer 27

Output controls ensure that the produced output is checked against the input controls to ensure the completeness and accuracy of processing.

Question 28

What are the features of output controls? (5)

Answer 28

1. Batch controls= the totals of accepted and rejected data. 2. Exception reports= reporting abnormal transactions that may require investigation. 3. Page numbers= so a user doesn’t receive a report with missing pages. 4. Nil return reports= if there’s nothing to report, a report should be produced that says so. 5. Distribution lists= the header of the report should show the distribution list for the report, the number of copies, the copy number and the planned recipient.

Question 29

What are application controls? (1)

Answer 29

Application controls are incorporated into the system’s software to ensure the data’s integrity is preserved.

Question 30

What are some types of application controls? (4)

Answer 30

1. Passwords= to prevent accidental or deliberate changes to the data. 2. Authorisation levels= certain actions will require users to have certain levels of clearance. 3. Training and supervision= staff should receive adequate training to prevent mistakes. 4. Audit trails= software should be written in such a way that shows the sequence of tasks performed.

Question 31

What is systems integrity? (1)

Answer 31

The controlling and monitoring of the system to ensure that it does exactly what it’s designed to do.

Question 32

What are some factors of systems integrity? (6)

Answer 32

1. Project management. 2. Operations management. 3. Systems design. 4. Personnel. 5. Procedure control. 6. Hardware configuration.

Question 33

What are admin controls? (1)

Answer 33

Admin controls relate to personnel and support functions.

Question 34

What are some types of admin controls? (6)

Answer 34

1. Segregation of duties. 2. The selection process for new staff (vetting). 3. Job rotation. 4. Enforced holidays. 5. System logs. 6. Supervision.

Question 35

What are some types of admin procedures? (3)

Answer 35

1. Health and safety procedures eg fire drills. 2. Document management. 3. Filing or shredding documents.

Question 36

Why do online and real time systems need controls? (1)

Answer 36

Transactions are input as they arise so more people are inputting data over a wide network which makes control problems more likely.

Question 37

What are some controls used for an online and real time system? (4)

Answer 37

1. Passwords and physical restrictions (locked rooms). 2. Transaction logs= showing movements on control accounts. 3. Documentation of transactions= all input transactions should be recorded and signed by appropriate personnel within the department. 4. Matching transactions to a master file.

Question 38

How is the system’s integrity effected by network environments?

Answer 38

The complexity of the network, either local or over a wide area allows for more security breaches due to having multiple computers connected at the same time.

Question 39

What are the main risks to systems integrity for local/ wide spread networks? (4)

Answer 39

1. Hardware/ software malfunction. 2. Computer viruses. 3. Unauthorised access to the system. 4. Electronic eavesdropping.

Question 40

What controls can prevent electronic eavesdropping?

Answer 40

1. Physical access controls. 2. User identification. 3. Data access authorisation= having types of provides tied with different user accounts. 4. Database integrity controls= controls and audit systems that protect the system from unauthorised access, disclosure or modification. 5. Program integrity controls= ensure that unauthorised access and alternations can’t be made to the program. 6. Anti virus software. 7. Surveillance= the detection of security violations by direct observation, review of computer logs or reviewing data usage. 8. Encryption. 9. Firewalls.

Question 41

What is a computer disaster? (1)

Answer 41

The loss of access or the unavailability of some computer systems.

Question 42

What are contingency controls? (1)

Answer 42

Contingency controls correct the consequences of a risk rather than reducing the risk itself.

Question 43

What should contingency controls include? (3)

Answer 43

1. Standby procedures= so essential operations can be performed while normal services are disrupted. 2. Recovery procedures= to return to normal working once the breakdown is fixed. 3. Management policies= to ensure that the plan is implemented.

Question 44

What is the effectiveness of a contingency plan dependent on? (1)

Answer 44

The contingency plan is dependent on the data and system’s backup procedures

Question 45

When should data and systems backups be made? (3)

Answer 45

1. When a lot of work has been completed in a short space of time. 2. When a large piece of work has been completed. 3. Backups should be made regularly.

Question 46

What are recovery plans? (1)

Answer 46

Recovery plans outline the procedures for various scenarios including corrupt file retrieval and individuals responsible for recovery procedures.

Question 47

What are the advantages of contingency planning? (5)

Answer 47

1. Helps management cope with changes and emergencies. 2. Reduces response time therefore minimising profits lost. 3. Enables more rational decision making during an emergency. 4. Helps prevent panic measures by allowing for detailed consideration of potential threats. 5. Managers have the opportunity to evaluate low profitability events.

Question 48

What the disadvantages of contingency plans? (2)

Answer 48

1. It can lead to a negative attitude among management and staff. 2. Focusing on low profitability threats may be demoralising and demotivating.

Question 49

What are risks? (1)

Answer 49

Risks refer to anything that could lead to financial loss for an organisation.

Question 50

What are the types of risks? (5)

Answer 50

1. Disasters outside the organisation’s control. 2. Poor trading conditions. 3. Mismanagement. 4. Human or machine errors. 5. Misappropriation of resources, tangible or intangible assets.

Question 51

What are the steps of assessing a risk? (9)

Answer 51

1. Identify the risk. 2. Quantify the risk. 3. Identify counter measures. 4. Cost counter measures. 5. Choose which counter measures are required. 6. Draw up contingency plans. 7. Monitor, review and update the plan. 8. Constantly watch for new risks and encourage all staff to report potential risks.

Question 52

What counter measures can an organisation use? (7)

Answer 52

1. Transfer the risks eg use insurance policies. 2. Decide to live with the risks if counter measures can be justified. 3. Modify a system to eliminate the risk. 4. Reduce the probability of risks by introducing controls. 5. Reduce the exposure to risks by removing the organisation from a risky situation. 6. Adopt measures that reduce the cost associated with a risk eg regular backups. 7. Use recovery procedures.