General accounting system controls

Learning outcome statements

The learning outcome statements relevant for this section are:

1. describe how the segregation of accounting duties can enhance systems security
2. identify threats to information systems, including input manipulation, program alteration, direct file alteration, data theft, sabotage, viruses, Trojan horses, theft, and phishing
3. demonstrate an understanding of how system development controls are used to enhance the accuracy, validity, safety, security, and adaptability of systems input, processing, output, and storage functions
4. identify procedures to limit access to physical hardware

This subsection covers the foundational controls embedded in accounting systems that help ensure system security, accuracy, and integrity. These controls are often implemented at the system-wide level and affect multiple functions and departments across an organization.

Segregation of accounting duties

Dividing responsibilities among multiple individuals (e.g., authorization, custody, recordkeeping, and reconciliation) reduces the risk of fraud or error. This concept was also discussed in detail in the previous section on Internal Control, where segregation of duties was identified as a fundamental control to prevent misappropriation of assets and ensure accurate reporting.

In a systems context, segregation is equally vital as it ensures that no single employee or user has the ability to both initiate and complete a transaction without oversight. For example, in an accounting system, a staff member responsible for entering invoices should not also be responsible for approving payments or reconciling bank statements. By structuring roles within the system and assigning appropriate access rights, organizations can significantly reduce opportunities for error and fraud while strengthening accountability and system integrity.

In IT environments, this includes segregating duties across key roles to avoid conflicts of interest and promote accountability. Examples include:

• System administration: Responsible for managing system infrastructure and user access, but should not be involved in development or audit functions.
• Development: Writes and tests new code or applications, but should not have deployment rights to production environments.
• Operations: Monitors system performance and executes routine processes, but should not have authority to change system settings.
• Security monitoring: Independently reviews system logs, alerts, and user activity, separate from those managing or developing the system.

This structured segregation ensures that changes are authorized, errors are traceable, and potential misuse of access or resources is minimized. For example, the individual who develops a system or writes application code should not be the same person who deploys it to the live environment or monitors its usage logs. This helps to prevent unauthorized changes, detect anomalies, and ensure that access to sensitive data or functions is appropriately restricted and audited.

Information systems threats

General accounting systems must be designed to detect and prevent various threats such as:

• Input manipulation
• Program alteration
• Direct file alteration
• Data theft or sabotage
• Malware threats
• Physical theft or cybercrimes

Input manipulation

This refers to the unauthorized or fraudulent entry or modification of data at the point of input into the system. It can be perpetrated by internal users who intentionally enter false data or by external actors exploiting weaknesses in data entry processes.

Examples of input manipulation:

• Manually adjusting or inflating invoice amounts
• Entering false employee information to divert payroll funds
• Submitting duplicate or fictitious vendor records for payment

Controls to prevent and detect input manipulation include:

• Input validation: Automated checks to ensure data entered meets required formats, ranges, and consistency (e.g., date formatting, mandatory fields).
• Authorization checks: Requiring user credentials and workflow-based approvals for data entry in sensitive fields.
• Audit trails: Logging user actions to track who entered or modified data and when.
• Segregation of duties: Ensuring different people are responsible for inputting, reviewing, and approving data.
• Training and awareness: Educating employees on ethical standards and internal controls.

Program alteration

This refers to unauthorized modifications of application or system code that may alter how software operates or processes transactions. Such alterations can compromise data integrity, system reliability, and financial reporting.

Examples of program alteration:

• Changing the logic of a payroll program to divert funds to a personal account
• Inserting backdoor code that allows unauthorized system access
• Modifying accounting calculations to manipulate financial results

Controls to prevent and detect program alteration include:

• Change management procedures: All system changes must be formally documented, tested, and approved before being implemented.
• Version control systems: Track and manage all changes to source code, including the identity of the person making changes and the time of change.
• Code reviews: Require peer or supervisory review of code before deployment to identify potential risks or unauthorized changes.
• Segregation of duties: Ensure that developers do not have access to deploy changes to production environments.
• Audit logging and monitoring: Record all changes to program files and system settings for review and investigation.

These controls help ensure that software behaves as intended and that any unauthorized or risky changes are promptly identified and addressed.

Direct file alteration

This refers to unauthorized access to and modification of system or data files without going through the intended user interface or processing logic. It poses a serious risk to data integrity and financial reporting, as such changes can go undetected and may circumvent existing input validation or control checks.

Examples of direct file alteration:

• Manually editing financial data in the underlying database to inflate revenue
• Altering audit logs to hide traces of unauthorized access
• Deleting or overwriting configuration files to disrupt system operations

Controls to prevent and detect direct file alteration include:

• File-level permissions and access control: Restrict who can read, write, or delete critical system files using operating system and database-level security.
• Encryption and checksum tools: Protect file contents and use hash functions to detect tampering.
• File integrity monitoring (FIM): Implement automated tools that scan for unauthorized changes and generate alerts.
• Separation of duties: Ensure that individuals responsible for system configuration or maintenance are not the same individuals responsible for data entry or reporting.
• Regular backup and recovery procedures: Maintain frequent and secure backups to enable restoration in the event of file corruption or unauthorized changes.

These controls enhance the integrity of accounting data by ensuring that unauthorized modifications to stored files can be quickly detected and addressed.

Data theft or sabotage

This involves unauthorized access to or destruction of data, often with the intent to steal confidential information or disrupt business operations. It may be perpetrated by internal employees, contractors, or external attackers.

Examples of data theft or sabotage:

• Copying customer credit card data and selling it on the dark web
• Deleting financial data to disrupt operations or hide fraudulent activity
• Introducing malicious scripts to corrupt files or databases

Controls to prevent and detect data theft or sabotage include:

• Access control policies: Limit data access based on job responsibilities using role-based access and the principle of least privilege.
• Encryption: Encrypt sensitive data at rest and in transit to protect it from unauthorized viewing.
• Monitoring and intrusion detection systems (IDS): Detect unusual activity and unauthorized access in real time.
• Employee training and awareness: Educate employees about security protocols and social engineering tactics to reduce internal threats.
• Incident response plans: Establish clear procedures for identifying, reporting, and responding to data breaches or sabotage attempts.

Implementing these controls reduces the risk of data compromise and ensures continuity and trust in financial systems.

Malware threats

Malware refers to malicious software that can infiltrate and damage computer systems, disrupt operations, or steal sensitive data.

Viruses are programs that replicate by attaching themselves to files, while Trojan horses appear to be legitimate software but execute hidden malicious functions when run.

Examples of malware threats:

• A virus embedded in an email attachment that spreads through the network when opened
• A Trojan horse disguised as a software update that installs spyware
• Ransomware that encrypts files and demands payment to unlock them

Controls to prevent and detect malware threats include:

• Antivirus and anti-malware software: Regularly updated security software can detect, block, and remove known threats.
• Email filters and firewalls: Block suspicious attachments, links, and network traffic before they reach users.
• User training: Teach employees to avoid clicking unknown links or downloading attachments from untrusted sources.
• Patch management: Keep all systems and applications up to date with the latest security patches.
• Network segmentation: Limit the spread of malware by isolating critical systems from general-use networks.

Effective malware prevention requires a combination of technical defenses, user awareness, and proactive monitoring to reduce the risk of infection and protect system integrity.

Physical theft or cybercrimes

These threats target both physical assets and user behavior to compromise system security. Physical theft involves the unlawful removal of hardware devices like laptops, servers, or USB drives that may contain sensitive or proprietary information. Phishing, on the other hand, is a type of social engineering attack that tricks users into divulging confidential information (e.g., passwords, financial details) through fake emails, websites, or messages.

Examples of these threats include:

• A stolen company laptop containing unencrypted financial data
• An employee receiving a fraudulent email that appears to be from the IT department, requesting login credentials
• A phishing website that mimics a company portal to collect usernames and passwords

Controls to prevent and detect these threats include:

• Physical security measures: Use locks, secure storage areas, and surveillance systems to protect hardware from unauthorized removal.
• Device encryption: Ensure all portable devices are encrypted so data cannot be accessed if stolen.
• Multi-factor authentication (MFA): Adds an additional layer of protection to user logins beyond just a password.
• Phishing awareness training: Regularly educate employees to recognize suspicious communications and verify sources before clicking links or sharing credentials.
• Email filtering and threat detection tools: Use advanced email security tools to block phishing attempts and alert administrators to potential scams.

Together, these controls help protect both physical assets and sensitive information from loss or compromise due to theft or deceptive cyberattacks.