Accounting Information System Security, Case Study Example

Scenario: After a review of the current Accounting Information System was conducted, Max Group Incorporated’s AIS is found to have no security measures in place to remove access for terminated users or to adjust access should users change roles.

• Introduction
  1. Clearly state business problem
     1. Places the company in security risk with increased exposure to insecurity

• Description of Current System (ADP General Ledger program)
  1. Research actual AIS system
     1. What security measures exist?
     2. How are new users given access?

• How is access removed?

• Analysis of Strengths and Weaknesses of Current System
  1. Strengths
     1. Web-based interface – easy to access, nothing to download
     2. Individual/customizable user accounts – maintain separation of duties
  2. Weaknesses
     1. Terminating/changing user accounts is manual process
     2. Too many admin users have access to adding and terminating user accounts

• Recommended Plan of Action
  1. Institute a Security Audit
     1. Formal process of identifying terminated associates
        • Removing security access immediately upon termination
     2. Formal process for changes in security
        • Requests should be made by management if employees are changing roles/responsibilities
     3. External audit annual audit
        1. Annual audit should be conducted to test sample size of security changes
           • Looking for accuracy in security changes
           • Reflecting on procedure for audit and changes

• Cost/Benefit Analysis
  1. Cost/Benefit of implementing new audit and management request procedures
  2. Cost/Benefit of implementing new external audit
  3. Costs involved in not implementing suggested changes – maintain status quo
• Implementation Plan
  1. Develop Formal Audit procedures
     1. Determine notification method(s) for terminated associates
     2. Create implementation timeline

• What parties involved?

1. Implement external audit
   1. Request “RFP” (request for pricing) for external auditor
      • Bid the business to relevant and reputable vendors
   2. Determine material sample size
      • How sample size chosen?

• Determine external audit to review process/procedures

1. Determine annual schedule of audit
2. Document all appropriate changes, sign appropriate documents and implement changes effectively