Stewardship - the careful and responsible oversight and Employee fraud

use of the assets entrusted to management. - conducted by non-management employees.

-maintain systems which allow it to demonstrate that it Examples: Inventory & cash receipts theft, acct. Payable
has appropriately used these funds and assets. fraud, payroll fraud, expense fraud
kickback - cash payment that the vendor gives the
COSO report defines internal control: employee in exchange for the sale; it is like a business
a process, effected by an entity’s board of directors, bribe.
management, and other personnel, designed to provide Skimming - cash is stolen before it is entered into the
reasonable assurance regarding the achievement of accounting
objectives - most difficult to discover kasi no record
Larceny -steal the company’s cash after it has been
Fraud can be defined as the theft, concealment, and recorded in the accounting records.
conversion to personal gain of another money, physical Collusion - occurs when two or more people work
assets, or information. together to commit a fraud.
Customer fraud - customer improperly obtains cash or
Misappropriation of assets property from a company, or avoids a liability through
- involves theft of any item of value. deception.
- defalcation, or internal theft, Ex: credit card fraud, check fraud, refund fraud
- most common examples are theft of cash or inventory. Vendor fraud - vendors obtain payments to which they
are not entitled.
Misstatement of financial records - intentionally submit duplicate or incorrect invoices,
- involves the falsification of accounting reports. - send shipments in which the quantities are short
earnings management, or fraudulent financial reporting. Vendor audits - involve the examination of vendor
records in support of amounts charged to the company.
Fraud triangle industrial espionage - the theft of proprietary company
 Incentive to commit the fraud. - pressure information, by digging through the trash of the
 Opportunity to commit the fraud. intended target company.
 Rationalization of the fraudulent action. moral software piracy - the unlawful copying of software
-plan, do, justify programs.
internal computer fraud - When an employee of an
Management fraud organization attempts to conduct fraud through the
- conducted by one or more top-level managers within misuse of a computer-based System
the company - Input manipulation,Program manipulation, Output
-usually in the form of fraudulent financial reporting. manipulation
management override salami technique -alter a program to slice a small
- Involves top management’s circumvention of the amount from several accounts and then credit those
systems or internal controls that are in place small amounts to the perpetrator’s benefit.
Trojan horse program - small, unauthorized program Segregation of duties
within a larger, legitimate program trap door alteration Supervision - compensating control
is a valid programming tool that is misused to commit Reasonable assurance means that the controls achieve
fraud. a sensible balance of reducing risk when compared with
Hacking is the term commonly used for computer the cost of the control.
network break-ins. General controls apply overall to the IT accounting
A denial of service attack (DOS Attack) -intended to system; they are not restricted to any particular
overwhelm an intended target computer system with accounting application.
so much bogus network traffic that the system is Application controls
unable to respond to valid network traffic - used specifically in accounting applications to control
inputs, processing, and outputs
Spoofing occurs when a person, through a computer - intended to ensure that inputs and processing
system, pretends to be someone else. are accurate and complete and that outputs are
properly distributed, controlled, and disposed.
1. Preventive controls Ex: validity check
2. Detective controls
3. Corrective controls General Controls
1. Authentication of Users and Limiting Unauthorized
According to COSO report, there are five interrelated Users
components of internal control: - ensure that the person accessing the IT system is a
 the control environment - sets the tone of an valid and authorized user.
organization and influences the control
consciousness of its employees. Log in means to make the computer recognize you in
 risk assessment - considers existing threats and order to create a connection at the beginning of a
the potential for additional risks computer session.
 Control activities - the policies and procedures password is a secret set of characters that identifies the
that help ensure that management directives are user as the authentic owner of that associated user ID.
carried out and that management objectives are smart card - plugged into the computer’s card reader
achieved. and helps authenticate that the user is valid.
 information and communication - security token - plugs into the USB port and thereby
 monitoring. - involves the ongoing review and eliminates the need for a card reader.
evaluation of the system. two-factor authentication - Like smart cards or tokens ,
since the person who logs in must physically possess
General authorization is a set of guidelines that allows and use the smart card or token.
transactions to be completed as long as they fall within Biometric devices use some unique physical
established parameters. authorization. characteristic of the user to identify the user and allow
Specific authorization means that explicit the appropriate level of access to that user.
approval is needed for a transaction to be completed.
The computer log is a complete record of all dates, perform malicious actions such as deleting files or
times, and uses for each user. shutting down the computer.
Nonrepudiation means that a user cannot deny any Vulnerability assessment is the process of proactively
particular act that he or she did on the IT system. examining the IT system for weaknesses that can be
authority table contains a list of valid, authorized users exploited by hackers, viruses, or malicious employees.
and the access level granted to each one. Intrusion detection systems are specific software tools
configuration tables for hardware, software, and that monitor data flow within a network and alert the IT
application programs that contain the appropriate staff to hacking attempts or other unauthorized access
set-up and security settings. attempts.
A firewall is hardware, software, or a combination of Penetration testing is the process of legitimately
both that is designed to block unauthorized access. attempting to hack into an IT system to find whether
Encryption is the process of converting data into secret weaknesses can be exploited by unauthorized hackers.
codes referred to as cipher text. IT governance committee - function is to govern the
Symmetric encryption uses a single encryption key that overall development and operation of IT systems.
must be used to encrypt data and also Operations personnel are employees who are
to decode the encrypted data. responsible for processing operating data.
Public key encryption uses both a public key and a database administrator develops and maintains the
private key. The public key, which can be known by database and ensures adequate controls over data
everyone, is used to encrypt the data, and a private key within the database.
is used to decode the encrypted data.
system development life cycle can be generally
Wireless network equipment, such as access points and described as the systematic steps undertaken to plan,
wireless network cards, uses an encryption method oversee , implement large-scale changes to the IT
called wireless protected access, or WPA, system.
-WPA can check to see whether encryption keys have uninterruptible power supply includes a battery to
been tampered with. maintain power in the event of a power outage
service set identifier, or SSID - password that is passed emergency power supply is an alternative power supply
between the sending and receiving nodes of a wireless that provides electrical power in the event that a main
network. source is lost.
A virtual private network utilizes tunnels, redundant servers—two or more computer network or
authentication, and encryption within the Internet data servers that can run identical processes or
network to isolate Internet communications so that maintain the same data.
unauthorized users cannot access or use certain data. off-site backup, an additional copy of the backup files
secure sockets layer, or SSL.- communication protocol stored in an off-site location.
built into Web server and browser software that disaster recovery plan (DRP) - plan for the continuance
encrypts data transferred on that website. of IT systems after a disaster
virus is a self- replicating piece of program code that operating system is the software that controls the basic
can attach itself to other programs and data and input and output activities of the computer.
database management system (DBMS) is a software
system that manages the interface between many users
and the database.
A limit check has only an upper limit; for example,
hours worked cannot exceed a value of 70 hours per
week.
A range check has both an upper and a lower limit.
reasonableness check compares the value in a field with
those fields to which it is related to determine whether
the value is reasonable.
completeness check assesses the critical fields
in an input screen to make sure that a value is in those
fields.
sign check examines a field to determine that it has the
appropriate sign, positive or negative.
sequence check ensures that the batch of transactions
is sorted in order, but does not help find missing
transactions because it checks only sequence, not
completeness.
self-checking digit is an extra digit added to a coded
identification number, determined by a mathematical
algorithm.
Control totals are subtotals of selected fields for an
entire batch of transactions.
Record counts are a simple count of the number of
records processed.
Batch totals are totals of financial data, such as total
gross pay or total federal tax deducted.
Hash totals are totals of fields that have no apparent
logical reason to be added.
run-to-run control totals. - reconciliation of
controlntotals at various stages of the process