Risks of specialised IT systems and information security measures

A retail chain's sales are keyed at tills in 40 shops, transmitted to head office, processed overnight and posted to the ledger. Purchase orders go to suppliers electronically. Customers order on a website and pay by card. There is no paper trail from the till to the ledger, and no clerk can see a transaction in flight. The auditor cannot follow invoices through a filing cabinet.

The audit must follow data through networks, so the auditor needs to know what each type of system risks and what controls to expect.

This topic covers the audit risks and controls of four kinds of system that need special attention: microcomputer systems, online systems, electronic data interchange (EDI) and e-commerce, together with information security measures. The earlier topic on control activities covered general and application controls, and the next topic covers tests of controls.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• internal controls in a computerised accounting environment (ISA 315)
• information security measures
• the application of technology in audit, assurance and forensics

CAMA 2020 and IT systems

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Why the type of system matters

When the auditor evaluates general and application controls, the type of system must be taken into account. Four types need special attention: microcomputer systems, online systems, EDI systems and e-commerce.

Microcomputer systems

A microcomputer system uses a number of desktop computers across the organisation instead of a large central mainframe or minicomputer. Companies use them because they can be more efficient and cheaper, and because operating staff, such as accounts clerks, can run and sometimes even program them with little technical training. The audit risks are:

• it is hard to ensure the physical security of equipment spread over many locations;
• the same applies to the security of data and storage media, such as disks and memory drives;
• wide access creates problems of authorisation, with the chance of unauthorised changes to programs or data. Passwords restricting access to certain files reduce the risk;
• programs may be written or changed by users, which can cause processing and software problems; and
• there may be inadequate documentation. When software is bought, the supplier should provide documentation, and the auditor wants to see it.

Typical controls are passwords and logins, locked rooms or cable locks, regular back-ups held off the desk, licensed software only, anti-virus software, a ban on unauthorised programs and an inventory of all machines and software.

Online systems

Online systems give users direct access to centrally held data and programs through remote terminals linked in a network. Benefits are immediate entry of transactions, for example sales keyed at electronic point-of-sale terminals linked to a central computer; immediate updating of master files, such as stock records as soon as stock is requisitioned; and enquiry facilities, such as instant answers to price enquiries.

Because transactions are processed at once, the controls are a mixture of general and application controls.

General controls:

• Access controls must be strong, because unauthorised access would have an immediate effect on programs and files.
• Programming controls to prevent or detect unauthorised changes to programs or standing data.
• Transaction logs to give an audit trail: the ability to trace a transaction through all its stages. The trail may not exist on paper, but the program should produce it on request for any transaction.
• Firewalls: software or hardware that protects the network server from unauthorised access via the internet.

Application controls:

• Pre-processing authorisation: users must log on before they can use the program.
• Data validation checks on input: check digits, range checks, existence checks and completeness checks, which help ensure completeness and accuracy, for example the right number of digits in product codes.
• Balancing: immediate checking of control totals of data sent from a remote terminal, before and after processing.

Electronic data interchange (EDI)

EDI is the electronic transmission of business documents such as purchase orders, invoices or payroll information. It may work inside an organisation, for example the sales department sends copies of customer orders to accounts, or outside it, for example a company sends payroll data to a bureau or sends a purchase order electronically to a supplier.

The transmitted document is entered automatically into the receiver's different computer system, so it can be processed without manual intervention. The audit problems are:

• No paper audit trail. The system needs an electronic audit trail that it can produce.
• Greater dependency on the entity's computer systems, and possibly on outsiders, so a failure has a bigger effect, and general IT controls are extremely important.
• Loss or corruption of data during transmission.
• Security risks: unauthorised persons may be able to read the data.

Controls the auditor expects are: controls over transmission, which are encryption, acknowledgement systems and authentication codes; monitoring and checking of output; virus protection; and contingency plans and back-up. Authentication codes make senders and receivers prove their identity before data is sent. Encryption turns data into coded form for transmission and back again at the recipient's end.

E-commerce

E-commerce is any commercial activity that takes place through connected computers over a public network, such as a company that sells goods over the internet. As its volume and materiality grow, the auditor must consider the audit risks it creates and plan accordingly. The matters to consider are:

• Skills and knowledge the auditor needs to understand the effect of e-commerce on the entity. The more complex the activity, the greater the skill needed.
• Knowledge of the business. E-commerce may greatly change the business environment, raise security risks and broaden the geographical market, since customers can reach the site from anywhere.
• Additional business risks: loss of transaction integrity, use of inappropriate accounting policies, for example for capitalising website development costs, and legal and regulatory risks.
• Internal control: controls may exist within the system, but there may be no adequate audit trail for transactions on the website.

Typical e-commerce controls are secure payment processing, encryption of customer data, reconciliation of website orders to the accounting system and to the payment processor's settlements, authentication of customers, change control over the website, and monitoring for fraud. The auditor may need an IT specialist to help.

Information security measures

Information security aims to protect the confidentiality, integrity and availability of data. Measures include:

• Logical access: unique user IDs, strong passwords, multi-factor authentication and regular review of access rights;
• Physical access: locked server rooms, restricted entry and equipment protection;
• Network protection: firewalls, intrusion detection and secure remote access;
• Data protection: encryption of stored and transmitted data and secure back-ups;
• Malware defence: anti-virus software and prompt software updates;
• People: training on phishing and clear policies on use of systems and data; and
• Response: an incident response plan and tested disaster recovery.

A failure can cause loss of data, theft of funds, regulatory fines, damage to reputation and loss of reliable accounting records, so the auditor treats security as part of the control environment for IT.

Audit response to IT risks

The auditor evaluates the general controls first. If they are effective, the auditor tests application controls, and may test automated controls with a small number of examples. If they are not, the auditor does more substantive testing, often with computer-assisted audit techniques, which are explained in the next topic.

For systems with no paper trail the auditor asks the system to produce its logs and tests them, and for outsourced processing may need a report from the service provider on its controls.

Worked examples

1. Risks: unauthorised access and changes, loss or theft of data, and loss of back-ups in a fire or theft.
2. Controls: passwords, locked storage, back-ups held off site, and a record of who may use which files.

1. An online system should keep transaction logs that give an audit trail.
2. The auditor asks the system to produce the log for the chosen transaction and checks each stage.

1. Risk: loss or corruption of data in transmission and over-dependence on the system.
2. Controls: acknowledgement of each order, monitoring of unacknowledged orders and contingency arrangements.

1. That is an accounting policy risk specific to e-commerce.
2. The auditor tests whether the costs meet the recognition criteria for an intangible asset and whether any are really maintenance or marketing costs that must be expensed.

How to score full marks

• Name the type of system and give risks first, then controls.
• Separate general controls from application controls in online systems.
• Explain audit trail, encryption and authentication.
• Close with the audit response: test general controls first.

Common mistakes in the exam

• Looking for paper documents in a system that has none.
• Giving only risks or only controls.
• Forgetting transaction integrity and accounting policy risks in e-commerce.
• Not mentioning contingency plans for EDI.

Quick revision

• Micro: physical security, access, user programs, documentation.
• Online: access, programming controls, logs, firewalls, validation, balancing.
• EDI: no paper trail, dependency, corruption, security; encryption, authentication.
• E-commerce: skills, business risk, transaction integrity, policies, audit trail.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.