General accounting system controls

Learning outcome statements

The learning outcome statements relevant for this section are:

1. describe how the segregation of accounting duties can enhance systems security
2. identify threats to information systems, including input manipulation, program alteration, direct file alteration, data theft, sabotage, viruses, Trojan horses, theft, and phishing
3. demonstrate an understanding of how system development controls are used to enhance the accuracy, validity, safety, security, and adaptability of systems input, processing, output, and storage functions
4. identify procedures to limit access to physical hardware

This subsection covers the foundational controls embedded in accounting systems that help ensure system security, accuracy, and integrity. These controls are often implemented at the system-wide level and affect multiple functions and departments across an organization.

Segregation of accounting duties

Dividing responsibilities among multiple individuals (e.g., authorization, custody, recordkeeping, and reconciliation) reduces the risk of fraud or error. This concept was also discussed in detail in the previous section on Internal Control, where segregation of duties was identified as a fundamental control to prevent misappropriation of assets and ensure accurate reporting.

In a systems context, segregation is equally vital as it ensures that no single employee or user has the ability to both initiate and complete a transaction without oversight. For example, in an accounting system, a staff member responsible for entering invoices should not also be responsible for approving payments or reconciling bank statements. By structuring roles within the system and assigning appropriate access rights, organizations can significantly reduce opportunities for error and fraud while strengthening accountability and system integrity.

In IT environments, this includes segregating duties across key roles to avoid conflicts of interest and promote accountability. Examples include:

• System administration: Responsible for managing system infrastructure and user access, but should not be involved in development or audit functions.
• Development: Writes and tests new code or applications, but should not have deployment rights to production environments.
• Operations: Monitors system performance and executes routine processes, but should not have authority to change system settings.
• Security monitoring: Independently reviews system logs, alerts, and user activity, separate from those managing or developing the system.

This structured segregation ensures that changes are authorized, errors are traceable, and potential misuse of access or resources is minimized.

Information systems threats

General accounting systems must be designed to detect and prevent various threats such as:

• Input manipulation
• Program alteration
• Direct file alteration
• Data theft or sabotage
• Malware (viruses and Trojan horses)
• Physical theft and phishing

Input manipulation

This refers to the unauthorized or fraudulent entry or modification of data at the point of input into the system. It can be perpetrated by internal users who intentionally enter false data or by external actors exploiting weaknesses in data entry processes.

Examples of input manipulation:

• Manually adjusting or inflating invoice amounts
• Entering false employee information to divert payroll funds
• Submitting duplicate or fictitious vendor records for payment

Controls to prevent and detect input manipulation include:

• Input validation: Automated checks to ensure data entered meets required formats, ranges, and consistency (e.g., date formatting, mandatory fields).
• Authorization checks: Requiring user credentials and workflow-based approvals for data entry in sensitive fields.
• Audit trails: Logging user actions to track who entered or modified data and when.
• Segregation of duties: Ensuring different people are responsible for inputting, reviewing, and approving data.
• Training and awareness: Educating employees on ethical standards and internal controls.

Program alteration

This refers to unauthorized modifications of application or system code that may alter how software operates or processes transactions. Such alterations can compromise data integrity, system reliability, and financial reporting.

Examples of program alteration:

• Changing the logic of a payroll program to divert funds to a personal account
• Inserting backdoor code that allows unauthorized system access
• Modifying accounting calculations to manipulate financial results

Controls to prevent and detect program alteration include:

• Change management procedures: All system changes must be formally documented, tested, and approved before being implemented.
• Version control systems: Track and manage all changes to source code, including the identity of the person making changes and the time of change.
• Code reviews: Require peer or supervisory review of code before deployment to identify potential risks or unauthorized changes.
• Segregation of duties: Ensure that developers do not have access to deploy changes to production environments.
• Audit logging and monitoring: Record all changes to program files and system settings for review and investigation.

Change management, version control, and code review are examples of system development controls, which protect the accuracy, validity, security, and adaptability of system input, processing, output, and storage; they’re covered in depth in System development controls.

Direct file alteration

This refers to unauthorized access to and modification of system or data files without going through the intended user interface or processing logic. It poses a serious risk to data integrity and financial reporting, as such changes can go undetected and may circumvent existing input validation or control checks.

Examples of direct file alteration:

• Manually editing financial data in the underlying database to inflate revenue
• Altering audit logs to hide traces of unauthorized access
• Deleting or overwriting configuration files to disrupt system operations

Controls to prevent and detect direct file alteration include:

• File-level permissions and access control: Restrict who can read, write, or delete critical system files using operating system and database-level security.
• Encryption and checksum tools: Protect file contents and use hash functions to detect tampering.
• File integrity monitoring (FIM): Implement automated tools that scan for unauthorized changes and generate alerts.
• Separation of duties: Ensure that individuals responsible for system configuration or maintenance are not the same individuals responsible for data entry or reporting.
• Regular backup and recovery procedures: Maintain frequent and secure backups to enable restoration in the event of file corruption or unauthorized changes.

Where these threats occur

• Input manipulation happens at the point of data entry, before processing - input validation is the most direct control.
• Program alteration happens in the application code that processes transactions - change management and code review are the most direct controls.
• Direct file alteration happens directly in stored data or system files, bypassing the application entirely - file-level access controls and file integrity monitoring are the most direct controls.

Data theft or sabotage

This involves unauthorized access to or destruction of data, often with the intent to steal confidential information or disrupt business operations. It may be perpetrated by internal employees, contractors, or external attackers.

Examples of data theft or sabotage:

• Copying customer credit card data and selling it on the dark web
• Deleting financial data to disrupt operations or hide fraudulent activity
• Introducing malicious scripts to corrupt files or databases

Controls to prevent and detect data theft or sabotage include:

• Access control policies: Limit data access based on job responsibilities using role-based access and the principle of least privilege.
• Encryption: Encrypt sensitive data at rest and in transit to protect it from unauthorized viewing.
• Monitoring and intrusion detection systems (IDS): Detect unusual activity and unauthorized access in real time.
• Employee training and awareness: Educate employees about security protocols and social engineering tactics to reduce internal threats.
• Incident response plans: Establish clear procedures for identifying, reporting, and responding to data breaches or sabotage attempts.

Malware threats

Malware refers to malicious software that can infiltrate and damage computer systems, disrupt operations, or steal sensitive data.

Viruses are programs that replicate by attaching themselves to files, while Trojan horses appear to be legitimate software but execute hidden malicious functions when run.

Examples of malware threats:

• A virus embedded in an email attachment that spreads through the network when opened
• A Trojan horse disguised as a software update that installs spyware
• Ransomware that encrypts files and demands payment to unlock them

Controls to prevent and detect malware threats include:

• Antivirus and anti-malware software: Regularly updated security software can detect, block, and remove known threats.
• Email filters and firewalls: Block suspicious attachments, links, and network traffic before they reach users.
• User training: Teach employees to avoid clicking unknown links or downloading attachments from untrusted sources.
• Patch management: Keep all systems and applications up to date with the latest security patches.
• Network segmentation: Limit the spread of malware by isolating critical systems from general-use networks.

Physical theft and phishing

These threats target both physical assets and user behavior to compromise system security. Physical theft involves the unlawful removal of hardware devices like laptops, servers, or USB drives that may contain sensitive or proprietary information. Phishing, on the other hand, is a type of social engineering attack that tricks users into divulging confidential information (e.g., passwords, financial details) through fake emails, websites, or messages.

Examples of these threats include:

• A stolen company laptop containing unencrypted financial data
• An employee receiving a fraudulent email that appears to be from the IT department, requesting login credentials
• A phishing website that mimics a company portal to collect usernames and passwords

Controls to prevent and detect these threats include:

• Physical security measures: Use locks, secure storage areas, and surveillance systems to protect hardware from unauthorized removal.
• Device encryption: Ensure all portable devices are encrypted so data cannot be accessed if stolen.
• Multi-factor authentication (MFA): Adds an additional layer of protection to user logins beyond just a password.
• Phishing awareness training: Regularly educate employees to recognize suspicious communications and verify sources before clicking links or sharing credentials.
• Email filtering and threat detection tools: Use advanced email security tools to block phishing attempts and alert administrators to potential scams.

Limiting physical access to hardware

Beyond the general controls above, several procedures specifically limit physical access to hardware:

• Restricted entry: Require keycard, PIN, or biometric access to server rooms and other areas housing critical hardware.
• Authorized personnel only: Limit access to hardware to employees whose job duties require it.
• Visitor logs and escorts: Require visitors to sign in and be escorted while in restricted areas.
• Video surveillance and security guards: Monitor entry points and sensitive areas to deter and detect unauthorized access.
• Cable locks and asset tags: Physically secure laptops and other portable devices, and tag them for tracking.
• Environmental controls: Protect data centers and server rooms with fire suppression, climate control, and backup power to prevent hardware damage or loss.