CH 8 - Information System Controls

INFORMATION SYSTEM
CONTROLS
Chapter 8
INFORMATION TECHNOLOGY (IT)
CONTROLS AND THE BUSINESS
In today’s world, information technology plays a vital

role. Almost all businesses depend on it. Hence,
management should ensure that information it
produced is reliable and accurate. Appropriate IT
controls should be in place to minimize the risks of
using this information technology. The Control
Objectives for Information and related Technology
(COBIT) framework provides the comprehensive view
of the controls necessary for systems reliability in IT.
CATEGORIES OF INFORMATION
SYSTEM CONTROLS
• There are five categories of information system controls developed by the
American Institute of Certified Public Accountants and the Canadian
Institute of Chartered Accountants that most directly relate to systems
reliability: security, confidentiality, privacy, processing integrity and
availability.
• Information security controls are divided into three types: preventive,
detective and corrective. Preventive controls include training, user access
controls (authentication and authorization), physical access controls (locks,
guards etc.), network access controls (firewalls, intrusion prevention systems,
etc.) and device and software hardening controls (configuration options).
Detective controls on the other hand include log analysis, intrusion detection
systems, security testing and audits and managerial reports. Corrective
controls include Computer incident response teams (CIRT), Chief information
security officer (CISO) and patch management.
• Confidentiality and privacy controls include actions such as identification
and classification of the information to be protected, encryption of sensitive
information, controlling access to sensitive information and training.
• Processing integrity and availability or the so-called application controls
prevent, detect and correct errors and irregularities in processing
transactions. These are divided into three: input, processing and output
controls.
APPLICATION CONTROLS ARE
DIVIDED INTO THREE:
• 1. Input controls help ensure the validity, accuracy and completeness of data entered
into an AIS.
• Examples: forms design, cancellation and storage of documents, authorization and
segregation of duties controls, visual scanning, data entry controls
• 2. Processing controls focus on the manipulation of accounting data after they are input
to the computer system.
• Examples: data matching, file labels, batch totals, cross-footing and zero-balance tests,
write protection mechanisms, database processing integrity controls
• 3. Output controls ensure the output’s validity, accuracy and completeness
• Examples: reviews and reconciliations, encryption and access controls, parity checks,
message acknowledgement techniques
USER ACCESS CONTROLS
• 1. Authentication controls
a. Passwords – the most commonly used authentication method which could
be a series of letters, numbers or both that must be entered to access
and use system resources
b. Biometric identification – uses distinctive user physical characteristics such
as voice patterns, fingerprints, facial patterns and features, retina prints
and signature dynamics to identify people.
• 2. Authorization controls
Access control matrix – an internally maintained table indicating what
actions users can execute in the system and which portion of it they are
authorized to access
NETWORK ACCESS CONTROLS
• 1. Border router –connect an organization’s information system and the

internet which, together with a firewall act as filter to control which
information is allowed to enter and leave organization’s information system.
• 2. Firewall – acts as filter to control which information is allowed to enter and
leave the organization’s information system
• 3. Intrusion prevention systems – a new type of security technology that
monitors patterns in the traffic flow to identify and automatically block
attacks.
• Encryption – the process of transforming normal content, called plaintext into
unreadable gibberish called ciphertext. Decryption reverses this process.
• Parity checking - a process in which a computer, as it reads or receives a set
of characters, verifies that the proper number of magnetized bits is in each
character received. Otherwise, the corresponding character may contain
an error.
• Message acknowledgement techniques - techniques that let the sender of
an electronic message know that a message was received which include
echo checks, trailer records and numbered batches.

CH 8 - Information System Controls

Uploaded by

Copyright:

Available Formats

CH 8 - Information System Controls

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CH 8 - Information System Controls

Uploaded by

Copyright:

Available Formats

INFORMATION SYSTEM

In today’s world, information technology plays a vital

• 1. Border router –connect an organization’s information system and the

You might also like