FRAUD-RELATED INTERNAL CONTROLS
|
|
- Brendan Brooks
- 6 years ago
- Views:
Transcription
1 GLOBAL HEADQUARTERS THE GREGOR BUILDING 716 WEST AVE AUSTIN, TX USA
2 TABLE OF CONTENTS I. THE NEED FOR INTERNAL CONTROLS Example... 1 Threats to an Organization s Internal Control Environment... 2 Why Threats Are Increasing... 4 How Internal Controls Curb Threats... 5 Overview of Internal Controls... 5 Types of Internal Controls... 6 Internal Control Requirements Under Anti-Corruption Laws... 8 The Sarbanes-Oxley Act... 9 Public Company Accounting Oversight Board... 9 Rules for Auditors Roles for Audit Committees Rules for Management Management Assessment of Internal Controls Requirement Powers Granted to the SEC Criminal Penalties Foreign Public Accounting Firms Whistleblower Protection Consideration by Appropriate State Regulatory Authorities Internal Control Over Financial Reporting Management s Assessment of Internal Control Management s Report on Internal Control PCAOB Auditing Standard No PCAOB Auditing Standard No AU Standard AU Standard Summary Review Questions II. THE COSO INTERNAL CONTROL INTEGRATED FRAMEWORK Understanding the Framework Achievement of Objectives A Process Affected by People Reasonable Assurance Adaptability to Entity Structure Objectives Operations Objectives Reporting Objectives Compliance Objectives Components and Principles of Internal Control Control Environment Component Risk Assessment Component Control Activities Component Transaction Types Examples of Authorization Functions i
3 II. THE COSO INTERNAL CONTROL INTEGRATED FRAMEWORK (CONT.) Information and Communication Component Monitoring Activities Component Limitations of Internal Controls Preconditions of Internal Control Judgment External Events Breakdowns Management Override Collusion Outsource Service Providers Interactions with External Parties Smaller Entities Challenges Cost-Effective Internal Controls Summary Case Illustration: Springer s Northwest Lumber & Supply Case Conclusion Review Questions III. COMPUTER-BASED CONTROLS: GENERAL CONTROLS Developing a Security Plan Segregation of Duties Within the System Project Development Controls Physical Access Controls Logical Access Controls Passwords Physical Possession Identification Biometric Identification Compatibility Tests Data Transmission Controls Data Encryption (Cryptography) Routing Verification Procedures Parity Message Acknowledgment Techniques Data Transmission Controls for EDI and EFT Protect Telephone Lines Documentation Standards Minimizing System Downtime Disaster Recovery Plans Priorities for the Recovery Process Backup Data and Program Files Specific Assignments Complete Documentation Backup Computer and Telecommunications Facilities Protection of Desktop Personal Computers and Client/Server Networks Protection of Laptops and Mobile Devices Cybercrime ii
4 III. COMPUTER-BASED CONTROLS: GENERAL CONTROLS (CONT.) Internet Controls Prosecution of Computer Fraud Perpetrators Improving Fraud Detection Methods Conduct Frequent Audits Set Up a Fraud Hotline Use Computer Consultants Monitor System Activities Use Certified Fraud Examiners and Forensic Accountants Use Fraud Detection Software Utilize Human Resources Summary Integrative Case: Seattle Paper Products (SPP) Case Conclusion Review Questions IV. COMPUTER-BASED CONTROLS: APPLICATION CONTROLS Introduction Input Processor Computer Instructions Data Output Source Data Controls Input Validation Routines Online Data Entry Controls Program Development, Acquisition, and Modification Controls Data Storage Controls Data Processing and File Maintenance Controls Processing Test Data Concurrent Audit Techniques Analysis of Program Logic Computer Audit Software Output Controls Application Controls: An Online Processing Example Data Entry File Updating Preparing and Distributing Output Application Controls: A Batch Processing Example Integrative Case: Northwest Industries Case Conclusion Computer Audit Software Integrative Case: Seattle Paper Products Case Conclusion Review Questions V. FRAUD SCHEMES: ASSET MISAPPROPRIATION Fraud Scheme Classifications Cash Receipts (Skimming) Fraud iii
5 V. FRAUD SCHEMES: ASSET MISAPPROPRIATION (CONT.) Unrecorded Sales Stealing Mail Receipts Understated Sales and Receivables Theft of Cash Theft of Cash from the Register Theft of Cash from a Deposit Theft and Misuse of Assets Other Than Cash Review Questions VI. FRAUD SCHEMES: DISBURSEMENT FRAUD Introduction Disbursement Fraud Schemes Register Disbursement Fraud Payroll Fraud Expense Reimbursement Fraud False Billing Fraud Review Questions VII. FRAUD SCHEMES: CHECK TAMPERING Introduction Check Tampering Schemes Forged Maker and Concealed Check Schemes Authorized Maker Schemes Intercepted Check Schemes Review Questions VIII. FRAUD SCHEMES: CORRUPTION Introduction Bribery, Economic Extortion, and Illegal Gratuities Kickback Schemes Bid-Rigging Schemes Conflict of Interest Commit Conceal and Convert Catch Control Review Questions IX. FINANCIAL STATEMENT FRAUD Introduction Categories of Fraudulent Financial Statement Fraud Fictitious Revenues Timing Differences Concealed Liabilities and Expenses Improper Disclosures Improper Asset Valuation Concealment of Fraudulent Financial Statement Fraud iv
6 IX. FINANCIAL STATEMENT FRAUD (CONT.) Conversion Process in Financial Statement Frauds Catching Financial Statement Fraud Controlling Fraudulent Financial Reporting Fraud Financial Statement Analysis Techniques Interviewing Company Personnel Interviewing Techniques Interview Questions Conclusion Review Questions X. PRACTICAL PROBLEMS Practical Problem Practical Problem Practical Problem Practical Problem Practical Problem Practical Problem XI. SOLUTIONS TO REVIEW QUESTIONS I. The Need for Internal Controls II. The COSO Internal Control Model III. Computer-Based Controls: General Controls IV. Computer-Based Controls: Application Controls VI. Fraud Schemes: Disbursement Fraud VII. Fraud Schemes: Check Tampering VIII. Fraud Schemes: Corruption IX. Financial Statement Fraud XII. SOLUTIONS TO PRACTICAL PROBLEMS Practical Problem Practical Problem Practical Problem Practical Problem Practical Problem Practical Problem XIII. FINAL EXAMINATION... E-1 XIV. INDEX... I-1 v
716 West Ave Austin, TX USA
: THE BASICS OF ASSET MISAPPROPRIATION GLOBAL HEADQUARTERS the gregor building 716 West Ave Austin, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION The Pervasive Threat of Employee Theft... 1 Introduction
More informationTHE CORPORATE CON: INTERNAL FRAUD AND THE AUDITOR
THE CORPORATE CON: INTERNAL FRAUD AND THE AUDITOR GLOBAL HEADQUARTERS THE GREGOR BUILDING 716 WEST AVE AUSTIN, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION Video Supplement... 1 Course Objectives
More informationOTHER PEOPLE S MONEY: THE BASICS OF ASSET MISAPPROPRIATION
: THE BASICS OF ASSET MISAPPROPRIATION World Headquarters the gregor building 716 West Ave Austin, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION The Pervasive Threat of Employee Theft... 3 Introduction
More informationTHE SMALL BUSINESS FRAUD PREVENTION MANUAL
THE SMALL BUSINESS FRAUD PREVENTION MANUAL TABLE OF CONTENTS PART 1: INTERNAL FRAUD THREATS I. INTRODUCTION TO EMPLOYEE FRAUD The Shocking Cost of Employee Theft and Fraud... 1 The Cost of Fraud to Small
More informationSmall Business FRAUD PREVENTION Manual
Small Business FRAUD PREVENTION Manual TABLE OF CONTENTS PREFACE... ix PART 1: INTERNAL FRAUD THREATS I. INTRODUCTION TO EMPLOYEE FRAUD The Shocking Cost of Employee Theft and Fraud... 1 The Cost of Fraud
More informationOTHER PEOPLE S MONEY: THE BASICS OF ASSET MISAPPROPRIATION (NO )
: THE BASICS OF ASSET MISAPPROPRIATION (NO. 99-5402) TABLE OF CONTENTS I. INTRODUCTION The Pervasive Threat of Employee Theft... 3 Asset Misappropriations... 5 ACFE s Occupational Fraud and Abuse Survey...
More information716 West Ave Austin, TX USA
Fundamentals of Computer and Internet Fraud GLOBAL Headquarters the gregor building 716 West Ave Austin, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION What Is Computer Crime?... 2 Computer Fraud
More informationTARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS
Target2-Securities Project Team TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS Reference: T2S-07-0270 Date: 09 October 2007 Version: 0.1 Status: Draft Target2-Securities - User s TABLE OF CONTENTS
More information354 & Index Board of Directors Responsibilities Audit Committee and Risk Committee Coordination, 244 Audit Committee Functions and Responsibilities, 2
Index Accounts Payable Process Review Procedures Assessments, 191 Actions to Resolve Risks COSO ERM Control Activities, 97 Activity Management COSO ERM Control Activities, 81 AICPA SAS No. 1 Internal Controls
More information"Charting the Course... Certified Information Systems Auditor (CISA) Course Summary
Course Summary Description In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business
More informationRisk Management in Electronic Banking: Concepts and Best Practices
Risk Management in Electronic Banking: Concepts and Best Practices Jayaram Kondabagil BICENTENNIAL B1CBNTENNIAL John Wiley & Sons (Asia) Pte Ltd. Contents List of Figures xiii List of Tables xv Preface
More informationCOPYRIGHTED MATERIAL. Index
Index 2014 revised COSO framework. See COSO internal control framework Association of Certified Fraud Examiners (ACFE), 666 Administrative files workpaper document organization, 402 AICPA fraud standards
More informationSecurity Policies and Procedures Principles and Practices
Security Policies and Procedures Principles and Practices by Sari Stern Greene Chapter 3: Information Security Framework Objectives Plan the protection of the confidentiality, integrity and availability
More informationIntroduction To IS Auditing
Introduction To IS Auditing Instructor: Bryan McAtee, ASA, CISA Bryan McAtee & Associates - Brisbane, Australia * Course, Presenter and Delegate Introductions * Definition of Information Technology (IT)
More informationIS Today: Managing in a Digital World 9/17/12
IS Today: Managing in a Digital World Chapter 10 Securing Information Systems Worldwide losses due to software piracy in 2005 exceeded $34 billion. Business Software Alliance, 2006 Accessories for war
More informationTable of Contents. Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING
Table of Contents Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING Chapter 1: Significance of Internal Auditing in Enterprises Today: An Update 3 1.1 Internal Auditing History and Background
More informationmanner. IOPA conducts its reviews in conformance with Government Auditing Standards issued by the Comptroller General of the United States.
PCAOB Public Company Accounting Oversight Board 1666 K Street, N.W. Washington, DC 20006 Telephone: (202) 207-9100 Facsimile: (202) 862-8430 www.pcaobus.org The Honorable Christopher Cox Chairman Securities
More informationRed Flags/Identity Theft Prevention Policy: Purpose
Red Flags/Identity Theft Prevention Policy: 200.3 Purpose Employees and students depend on Morehouse College ( Morehouse ) to properly protect their personal non-public information, which is gathered and
More informationKENYA SCHOOL OF GOVERNMENT EMPLOYMENT OPORTUNITY (EXTERNAL ADVERTISEMENT)
KENYA SCHOOL OF GOVERNMENT EMPLOYMENT OPORTUNITY (EXTERNAL ADVERTISEMENT) 1. DIRECTOR, LEARNING & DEVELOPMENT - LOWER KABETE Reporting to the Director General, Campus Directors will be responsible for
More informationInformation Security Policy
April 2016 Table of Contents PURPOSE AND SCOPE 5 I. CONFIDENTIAL INFORMATION 5 II. SCOPE 6 ORGANIZATION OF INFORMATION SECURITY 6 I. RESPONSIBILITY FOR INFORMATION SECURITY 6 II. COMMUNICATIONS REGARDING
More informationInformation Technology General Control Review
Information Technology General Control Review David L. Shissler, Senior IT Auditor, CPA, CISA, CISSP Office of Internal Audit and Risk Assessment September 15, 2016 Background Presenter Senior IT Auditor
More informationUniversity of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
More informationCertified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) 1. Domain 1 The Process of Auditing Information Systems Provide audit services in accordance with IT audit standards to assist the organization in protecting
More informationCOSO Enterprise Risk Management
COSO Enterprise Risk Management Establishing Effective Governance, Risk, and Compliance Processes Second Edition ROBERT R. MOELLER WILEY John Wiley & Sons, Inc. Contents Preface xi Chapter 1: Introduction:
More informationHIPAA Federal Security Rule H I P A A
H I P A A HIPAA Federal Security Rule nsurance ortability ccountability ct of 1996 HIPAA Introduction - What is HIPAA? HIPAA = The Health Insurance Portability and Accountability Act A Federal Law Created
More informationChapter 08. Consideration of Internal Control in an Information Technology Environment. McGraw-Hill/Irwin
Chapter 08 Consideration of Internal Control in an Information Technology Environment McGraw-Hill/Irwin Copyright 2012 by The McGraw-Hill Companies, Inc. All rights reserved. Nature of IT Based Systems
More informationCOSO Enterprise Risk Management
COSO Enterprise Risk Management COSO Enterprise Risk Management Establishing Effective Governance, Risk, and Compliance Processes Second Edition ROBERT R. MOELLER John Wiley & Sons, Inc. Copyright # 2007,
More informationAssessment and Compliance with Sarbanes-Oxley (SOX) Requirements DataGuardZ Whitepaper
Assessment and Compliance with Sarbanes-Oxley (SOX) Requirements DataGuardZ Whitepaper What is the history behind Sarbanes-Oxley Act (SOX)? In 2002, the U.S. Senate added the Sarbanes-Oxley Act (SOX) to
More information26 February Office of the Secretary Public Company Accounting Oversight Board 1666 K Street, NW Washington, DC
3701 Algonquin Road, Suite 1010 Telephone: 847.253.1545 Rolling Meadows, Illinois 60008, USA Facsimile: 847.253.1443 Web Sites: www.isaca.org and www.itgi.org 26 February 2007 Office of the Secretary Public
More informationVirginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Personnel Security Standard This standard is applicable to all VCU School of Medicine personnel. Approval
More informationSAS70 Type II Reports Use and Interpretation for SOX
SAS70 Type II Reports Use and Interpretation for SOX November 19, 2007 Presented by: Erin Erickson, Senior Manager Enterprise Governance and Brenda Karl, Director Technology Risk Management Agenda Background
More informationOhio Supercomputer Center
Ohio Supercomputer Center Security Notifications No: Effective: OSC-10 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original Publication
More informationSecuring Information Systems
Introduction to Information Management IIM, NCKU System Vulnerability and Abuse (1/6) Securing Information Systems Based on Chapter 8 of Laudon and Laudon (2010). Management Information Systems: Managing
More informationVoting System Security as per the VVSG
Voting System Security as per the VVSG Austin Conference on State Certification Testing for Voting Systems (2017) Michael Santos Test Manager SLI Compliance Elements of Security Outside Vendor Control
More informationService Organization Control (SOC) Reports: What they are and what to do with them MARCH 21, 2017
Service Organization Control (SOC) Reports: What they are and what to do with them MARCH 21, 2017 Presenter Colin Wallace, CPA/CFF, CFE, CIA, CISA Partner Colin has provided management consulting and internal
More informationGRC SURVEY RESULT Please indicate your profession
COPENHAGEN?=! CO?=! MPLIANCE T o p i c a l a n d T i m e l y Riskability GRC Controllers Governance, Risk & Compliance COPENHAGEN?=! CHARTER Bribery, Fraud & Corruption GRC SURVEY RESULT. Please indicate
More informationChapter 2 Introduction to Transaction Processing
Chapter 2 Introduction to Transaction Processing TRUE/FALSE 1. Processing more transactions at a lower unit cost makes batch processing more efficient than real-time systems. T 2. The process of acquiring
More informationSecuring Information Systems
Chapter 7 Securing Information Systems 7.1 2007 by Prentice Hall STUDENT OBJECTIVES Analyze why information systems need special protection from destruction, error, and abuse. Assess the business value
More information4. The portion of the monthly bill from a credit card company is an example of a turn-around document.
Chapter 2 Introduction to Transaction Processing Introduction to Accounting Information Systems, 8e Test Bank, Chapter 2 TRUE/FALSE 1. Processing more transactions at a lower unit cost makes batch processing
More informationA Framework for Managing Crime and Fraud
A Framework for Managing Crime and Fraud ASIS International Asia Pacific Security Forum & Exhibition Macau, December 4, 2013 Torsten Wolf, CPP Head of Group Security Operations Agenda Introduction Economic
More informationNORTH AMERICAN SECURITIES ADMINISTRATORS ASSOCIATION Cybersecurity Checklist for Investment Advisers
Identify Protect Detect Respond Recover Identify: Risk Assessments & Management 1. Risk assessments are conducted frequently (e.g. annually, quarterly). 2. Cybersecurity is included in the risk assessment.
More informationCITADEL INFORMATION GROUP, INC.
CITADEL INFORMATION GROUP, INC. The Role of the Information Security Assessment in a SAS 99 Audit Stan Stahl, Ph.D. President Citadel Information Group, Inc. The auditor has a responsibility to plan and
More informationIT Auditing, Hall, 3e
IT Auditing, an economic event that affects the assets and equities of the firm, is reflected in its accounts, and is measured in monetary terms. similar types of transactions are grouped together into
More information[Utility Name] Identity Theft Prevention Program
[Utility Name] Identity Theft Prevention Program Effective beginning, 2008 Minnesota Municipal Utilities Association Sample Red Flag policy I. PROGRAM ADOPTION The [Utility Name] ("Utility") developed
More informationJuniper Vendor Security Requirements
Juniper Vendor Security Requirements INTRODUCTION This document describes measures and processes that the Vendor shall, at a minimum, implement and maintain in order to protect Juniper Data against risks
More informationInternational Standard on Auditing (Ireland) 505 External Confirmations
International Standard on Auditing (Ireland) 505 External Confirmations MISSION To contribute to Ireland having a strong regulatory environment in which to do business by supervising and promoting high
More informationAGREEMENT FOR RECEIPT AND USE OF MARKET DATA: ADDITIONAL PROVISIONS
EXHIBIT C AGREEMENT FOR RECEIPT AND USE OF MARKET DATA: ADDITIONAL PROVISIONS 21. NYSE DATA PRODUCTS (a) SCOPE This Exhibit C applies insofar as Customer receives, uses and redistributes NYSE Data Products
More informationSummary Comparison of Current Data Security and Breach Notification Bills
Topic S. 117 (Nelson) S. (Carper/Blunt) H.R. (Blackburn/Welch) Comments Data Security Standards The FTC shall promulgate regulations requiring information security practices that are appropriate to the
More informationSecuring Information Systems
Chapter 7 Securing Information Systems 7.1 Copyright 2011 Pearson Education, Inc. STUDENT LEARNING OBJECTIVES Why are information systems vulnerable to destruction, error, and abuse? What is the business
More informationChapter 2 Introduction to Transaction Processing
Chapter 2 Introduction to Transaction Processing TRUE/FALSE 1. Processing more transactions at a lower unit cost makes batch processing more efficient than real-time systems. T 2. The process of acquiring
More informationINTERNATIONAL STANDARD ON AUDITING 505 EXTERNAL CONFIRMATIONS CONTENTS
INTERNATIONAL STANDARD ON AUDITING 505 EXTERNAL CONFIRMATIONS (Effective for audits of financial statements for periods beginning on or after December 15, 2009) CONTENTS Paragraph Introduction Scope of
More informationTHE INTERNATIONAL INSTITUTE OF CERTIFIED FORENSIC ACCOUNTANTS, INC. USA. CERTIFIED IN FRAUD & FORENSIC ACCOUNTING (Cr.
THE INTERNATIONAL INSTITUTE OF CERTIFIED FORENSIC ACCOUNTANTS, INC. USA CERTIFIED IN FRAUD & FORENSIC ACCOUNTING (Cr.FFa) BROCHURE Contents INTRODUCTION... 3 THE IICFA... 4 Basic Entry qualifications...
More informationSDR Guide to Complete the SDR
I. General Information You must list the Yale Servers & if Virtual their host Business Associate Agreement (BAA ) in place. Required for the new HIPAA rules Contract questions are critical if using 3 Lock
More informationMASTER OF SCIENCE IN ACCOUNTANCY
MASTER OF SCIENCE IN ACCOUNTANCY FACULTY Department Chair: Gerald D. Healy, M.B.A. Administrative Assistant: Carmen Diaz Department Office: Wilson 414 Department Telephone: (413) 572-5590 Graduate Advisor:
More informationEXTERNAL CONFIRMATIONS SRI LANKA AUDITING STANDARD 505 EXTERNAL CONFIRMATIONS
SRI LANKA STANDARD 505 EXTERNAL CONFIRMATIONS (Effective for audits of financial statements for periods beginning on or after 01 January 2014) CONTENTS Paragraph Introduction Scope of this SLAuS... 1 External
More informationSeattle University Identity Theft Prevention Program. Purpose. Definitions
Seattle University Identity Theft Prevention Program Purpose The purpose of the program is to establish an Identity Theft Prevention Program designed to detect, prevent and mitigate identity theft in connection
More informationFRAMEWORK MAPPING HITRUST CSF V9 TO ISO 27001/27002:2013. Visit us online at Flank.org to learn more.
FRAMEWORK MAPPING HITRUST CSF V9 TO ISO 27001/27002:2013 Visit us online at Flank.org to learn more. HITRUST CSF v9 Framework ISO 27001/27002:2013 Framework FLANK ISO 27001/27002:2013 Documentation from
More informationIASM Support for FISMA
Introduction Most U.S. civilian government agencies, and commercial enterprises processing electronic data on behalf of those agencies, are concerned about whether and how Information Assurance products
More informationAltius IT Policy Collection
Altius IT Policy Collection Complete set of cyber and network security policies Over 100 Policies, Plans, and Forms Fully customizable - fully customizable IT security policies in Microsoft Word No software
More informationINFORMATION TECHNOLOGY ( IT ) GOVERNANCE FRAMEWORK
INFORMATION TECHNOLOGY ( IT ) GOVERNANCE FRAMEWORK 1. INTRODUCTION The Board of Directors of the Bidvest Group Limited ( the Company ) acknowledges the need for an IT Governance Framework as recommended
More informationHIPAA Compliance Checklist
HIPAA Compliance Checklist Hospitals, clinics, and any other health care providers that manage private health information today must adhere to strict policies for ensuring that data is secure at all times.
More informationIntroduction. Controlling Information Systems. Threats to Computerised Information System. Why System are Vulnerable?
Introduction Controlling Information Systems When computer systems fail to work as required, firms that depend heavily on them experience a serious loss of business function. M7011 Peter Lo 2005 1 M7011
More informationIT Audit Process Prof. Liang Yao Week Two IT Audit Function
Week Two IT Audit Function Why we need IT audit A Case Study What You Can Learn about Risk Management from Societe Generale? https://www.cio.com/article/2436790/security0/what-you-can-learn-about-risk-management-fromsociete-generale.html
More informationIT Attestation in the Cloud Era
IT Attestation in the Cloud Era The need for increased assurance over outsourced operations/ controls April 2013 Symeon Kalamatianos M.Sc., CISA, CISM Senior Manager, IT Risk Consulting Contents Introduction
More informationWeighing in on the Benefits of a SAS 70 Audit for Third Party Administrators
Weighing in on the Benefits of a SAS 70 Audit for Third Party Administrators With increasing oversight and growing demands for industry regulations, third party assurance has never been under a keener
More informationSection 3.9 PCI DSS Information Security Policy Issued: November 2017 Replaces: June 2016
Section 3.9 PCI DSS Information Security Policy Issued: vember 2017 Replaces: June 2016 I. PURPOSE The purpose of this policy is to establish guidelines for processing charges on Payment Cards to protect
More informationTerms of Reference for the. IFMS Security review consultancy
Ministry of Finance Planning & Economic Development Terms of Reference for the IFMS Security review consultancy Table of Contents 1 Introduction... 1 1.1 Background... 1 1.2 The IFMS Environment... 1 1.3
More informationWHEN TO HOLD YOUR TONGUE - THE BENEFITS AND RISKS OF SELF-DISCLOSURE. WHAT IS A PHYSICIAN PRACTICE TO DO? October 13, 2009
, II C II EA i :1'11 C.\Il C(HI l' I.L\ '" C..\SSOCIATI \"'l\lull...... Ii \ ~ L~ WHEN TO HOLD YOUR TONGUE - THE BENEFITS AND RISKS OF SELF-DISCLOSURE WHAT IS A PHYSICIAN PRACTICE TO DO? October 13, 2009
More informationCybersecurity The Evolving Landscape
Cybersecurity The Evolving Landscape 1 Presenter Zach Shelton, CISA Principal DHG IT Advisory Zach.Shelton@DHG.com Raleigh, NC 14+ years of experience in IT Consulting 11+ years of experience with DHG
More informationIT General Controls and Why We Need Them -Dennis McLaughlin, CISA (Cyber AIT) Dennis McLaughlin - Cyber AIT 1
IT General Controls and Why We Need Them -Dennis McLaughlin, CISA (Cyber AIT) 1 Agenda Background ICOFR need for IT General Controls IT General Control Areas Financial Process Example Project Governance
More informationREPORT 2015/149 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2015/149 Audit of the information and communications technology operations in the Investment Management Division of the United Nations Joint Staff Pension Fund Overall results
More informationTrust Services Principles and Criteria
Trust Services Principles and Criteria Security Principle and Criteria The security principle refers to the protection of the system from unauthorized access, both logical and physical. Limiting access
More informationBalancing Between Risk and Compliance
Balancing Between Risk and Compliance Dave Mann, Ph.D. Senior Security Strategist BindView Development Business is risky! Want low risk? Get a savings account Risk Appetite = Organizational need for risk
More informationSecret Server HP ArcSight Integration Guide
Secret Server HP ArcSight Integration Guide Table of Contents Meeting Information Security Compliance Mandates: Secret Server and ArcSight SIEM Integration... 1 The Secret Server Approach to Privileged
More informationQuickBooks Online Security White Paper July 2017
QuickBooks Online Security White Paper July 2017 Page 1 of 6 Introduction At Intuit QuickBooks Online (QBO), we consider the security of your information as well as your customers and employees data a
More informationHow technology changed fraud investigations. Jean-François Legault Senior Manager Analytic & Forensic Technology June 13, 2011
How technology changed fraud investigations Jean-François Legault Senior Manager Analytic & Forensic Technology June 13, 2011 The Changing Cyberfraud Landscape Underground Economy Malware Authors Organized
More informationPrevention of Identity Theft in Student Financial Transactions AP 5800
Reference: Fair and Accurate Credit Transactions Act (Pub. L. 108-159) The Board recognizes that some activities of the Shasta-Tehama-Trinity Joint Community College District, "District," are subject to
More informationBaseline Information Security and Privacy Requirements for Suppliers
Baseline Information Security and Privacy Requirements for Suppliers INSTRUCTION 1/00021-2849 Uen Rev H Ericsson AB 2017 All rights reserved. The information in this document is the property of Ericsson.
More informationPlenary Session: Branch Cybersecurity Controls Thursday, February 22 1:15 p.m. 2:15 p.m.
Plenary Session: Branch Cybersecurity Controls Thursday, February 22 1:15 p.m. 2:15 p.m. Cybersecurity is a top priority for the financial services industry. Firms dedicate significant resources every
More informationThe Common Controls Framework BY ADOBE
The Controls Framework BY ADOBE The following table contains the baseline security subset of control activities (derived from the Controls Framework by Adobe) that apply to Adobe s enterprise offerings.
More informationCOSO ERM. To improve organizational performance & Governance COSO ERM. COSO Internal Control. COSO ERM_prepared by Nattapan T. 2
COSO ERM COSO Internal Control COSO ERM To improve organizational performance & Governance COSO ERM_prepared by Nattapan T. 2 COSO ERM Definition of Enterprise Risk Management (ERM) A process applied in
More informationNEW YORK CYBERSECURITY REGULATION COMPLIANCE GUIDE
COMPLIANCE ADVISOR NEW YORK CYBERSECURITY REGULATION COMPLIANCE GUIDE A PUBLICATION BY THE EXCESS LINE ASSOCIATION OF NEW YORK One Exchange Plaza 55 Broadway 29th Floor New York, New York 10006-3728 Telephone:
More informationTexas Lottery Commission Internal Audit. Mailroom Processes. August 30, 2018 Report # An Internal Audit of. Prepared by:
Texas Lottery Commission Internal Audit An Internal Audit of Mailroom Processes August 30, 2018 Report #18-005 Prepared by: This report provides management with information about the condition of risks
More informationCIS 444: Computer. Networking. Courses X X X X X X X X X
4012 Points Courses * = Can include a summary justification for that section. FUNCTION 1 - GRANT FINAL ATO A. Responsibilities 1. Aspects of Security *Explain the importance of SSM role in (IA) 2. Accreditation
More informationSTOCKTON UNIVERSITY PROCEDURE DEFINITIONS
STOCKTON UNIVERSITY PROCEDURE Identity Theft Prevention Program Procedure Administrator: Director of Risk Management and Environmental/Health/Safety Authority: Fair and Accurate Credit Transactions Act
More informationUnderstanding and Evaluating Service Organization Controls (SOC) Reports
Understanding and Evaluating Service Organization Controls (SOC) Reports Kevin Sear, CPA, CIA, CISA, CFE, CGMA Agenda 1. Why are SOC reports important? 2. Understanding the new SOC-1, SOC-2, and SOC-3
More informationCONTROLLING COMPUTER-BASED INFORMATION SYSTEMS, PART I
CHAPTER CONTROLLING COMPUTER-BASED INFORMATION SYSTEMS, PART I The basic topic of internal control was introduced in 3. These next two chapters discuss the implications of automating the accounting information
More informationChecklist: Credit Union Information Security and Privacy Policies
Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC
More informationIs your privacy secure? HIPAA Compliance Workshop September Presented by: Andrés Castañeda, Senior Manager Steve Nouss, Partner
Is your privacy secure? HIPAA Compliance Workshop September 2008 Presented by: Andrés Castañeda, Senior Manager Steve Nouss, Partner Agenda Have you secured your key operational, competitive and financial
More informationHIPAA Technical Safeguards and (a)(7)(ii) Administrative Safeguards
HIPAA Compliance HIPAA and 164.308(a)(7)(ii) Administrative Safeguards FileGenius is compliant with all of the below. First, our data center locations (DataPipe) are fully HIPAA compliant, in the context
More informationNIPPON VALUE INVESTORS DATA PROTECTION POLICY
NIPPON VALUE INVESTORS DATA PROTECTION POLICY INTRODUCTION Nippon Value Investors KK and Nippon Value Investors, Inc. (together NVI ) are committed to protecting the privacy of individuals whose data they
More informationDefinition of Internal Control
Definition of Internal Control - To address and limit potential risks - designed, implemented and maintained by those charged with governance to provide reasonable assurance about the achievement of the
More informationIntegrating HIPAA into Your Managed Care Compliance Program
Integrating HIPAA into Your Managed Care Compliance Program The First National HIPAA Summit October 16, 2000 Mark E. Lutes, Esq. Epstein Becker & Green, P.C. 1227 25th Street, N.W., Suite 700 Washington,
More informationPosition Description IT Auditor
Position Title IT Auditor Position Number Portfolio Performance and IT Audit Location Victoria Supervisor s Title IT Audit Director Travel Required Yes FOR OAG HR USE ONLY: Approved Classification or Leadership
More informationRisk Advisory Academy Training Brochure
Academy Brochure 2 Academy Brochure Cyber Security Our Cyber Security trainings are focused on building your internal capacity to leverage IT related technologies more confidently and manage risk and uncertainty
More informationWhat are PCI DSS? PCI DSS = Payment Card Industry Data Security Standards
PCI DSS What are PCI DSS? PCI DSS = Payment Card Industry Data Security Standards Definition: A multifaceted security standard that includes requirements for security management, policies, procedures,
More informationInformation Technology Risks & Controls for Financial Systems PEM-PAL Treasury CoP Workshop 2011 Kristin Lado Tufan
Information Technology Risks & Controls for Financial Systems PEM-PAL Treasury CoP Workshop 2011 Kristin Lado Tufan 1 Introduction IT Risk and Compliance Officer in Information Management and Technology
More informationThe risk of SQL forms within the Oracle Applications- How did that Happen?
The risk of SQL forms within the Oracle Applications- How did that Happen? Alfredo Pantaleon, Sr. Principal- GRC Services, KBACE Jeffrey Hare, CPA CISA CIA - ERP Seminars March 26, 2009 1. Presenter Alfredo
More informationInformation Security Management
Information Security Management BS ISO/ IEC 17799:2005 (BS ISO/ IEC 27001:2005) BS 7799-1:2005, BS 7799-2:2005 SANS Audit Check List Author: Val Thiagarajan B.E., M.Comp, CCSE, MCSE, SFS, ITS 2319, IT
More information