We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byBlaise Laity
Modified about 1 year ago
Copyright © 2015 Pearson Education, Inc. Computer Fraud Chapter 5 5-1
Copyright © 2015 Pearson Education, Inc. Introduction Information systems are becoming increasingly more complex and society is becoming increasingly more dependent on these systems. ▫Companies also face a growing risk of these systems being compromised. ▫Recent surveys indicate 67% of companies suffered a security breach in the last year with almost 60% reporting financial losses. 5-2
Copyright © 2015 Pearson Education, Inc. Threats to AIS Natural and political disasters Include: –Fire or excessive heat –Floods –Earthquakes –High winds –War and terrorist attack 5-3
Copyright © 2015 Pearson Education, Inc. Threats to AIS Natural and political disasters Software errors and equipment malfunction Include: –Hardware or software failures –Software errors or bugs –Operating system crashes –Power outages and fluctuations –Undetected data transmission errors 5-4
Copyright © 2015 Pearson Education, Inc. Threats to AIS Natural and political disasters Software errors and equipment malfunction Uninte ntional acts Include –Accidents caused by: Human carelessness Failure to follow established procedures Poorly trained or supervised personnel –Innocent errors or omissions –Lost, destroyed, or misplaced data –Logic errors –Systems that do not meet needs or are incapable of performing intended tasks 5-5
Copyright © 2015 Pearson Education, Inc. Threats to AIS Natural and political disasters Software errors and equipment malfunction Unintentional acts Intentional acts (computer crime) Include: –Sabotage –Computer fraud –Misrepresentation, false use, or unauthorized disclosure of data –Misappropriation of assets –Financial statement fraud Information systems are increasingly vulnerable to these malicious attacks. 5-6
Copyright © 2015 Pearson Education, Inc. Fraud Any means a person uses to gain an unfair advantage over another person; includes: ▫A false statement, representation, or disclosure ▫A material fact, which induces a victim to act ▫An intent to deceive ▫Victim relied on the misrepresentation ▫Injury or loss was suffered by the victim Fraud is white collar crime 5-7
Copyright © 2015 Pearson Education, Inc. Two Categories of Fraud Misappropriation of assets ▫Theft of company assets which can include physical assets (e.g., cash, inventory) and digital assets (e.g., intellectual property such as protected trade secrets, customer data) ▫Largest factors for theft of assets: Absence of internal control system Failure to enforce internal control system 5-8
Copyright © 2015 Pearson Education, Inc. Two Categories of Fraud Fraudulent financial reporting ▫“cooking the books” (e.g.,booking fictitious revenue, McCormick grocery products Booking revenue before it is earned Xerox overstating assets, etc. Crazy Eddies) 5-9
Copyright © 2015 Pearson Education, Inc. Reasons for Fraudulent Financial Statements 1.Deceive investors or creditors 2.Increase a company’s stock price 3.Meet cash flow needs 4.Hide company losses or other problems 5-10
Copyright © 2015 Pearson Education, Inc. Treadway Commission Actions to Reduce Fraud 1.Establish environment which supports the integrity of the financial reporting process. 2.Identification of factors that lead to fraud. 3.Assess the risk of fraud within the company. 4.Design and implement internal controls to provide assurance that fraud is being prevented. 5-11
Copyright © 2015 Pearson Education, Inc. SAS #99 Auditors responsibility to detect fraud ▫Understand fraud ▫Discuss risks of material fraudulent statements Among members of audit team ▫Obtain information Look for fraud risk factors ▫Identify, assess, and respond to risk ▫Evaluate the results of audit tests Determine impact of fraud on financial statements ▫Document and communicate findings ▫Incorporate a technological focus 5-12
Copyright © 2015 Pearson Education, Inc. Conditions for Fraud These three conditions must be present for fraud to occur: Pressure ▫Employee Financial Lifestyle Emotional ▫Financial Statement Financial Management Industry conditions Opportunity to: ▫Commit ▫Conceal ▫Convert to personal gain Rationalize ▫Justify behavior ▫Attitude that rules don’t apply ▫Lack personal integrity 5-13
Copyright © 2015 Pearson Education, Inc. Fraud Triangle 5-14
Copyright © 2015 Pearson Education, Inc. PRESSURES THAT LEAD TO EMPLOYEE FRAUD FINANCIAL Living beyond means High personal debt/expenses “Inadequate” salary/income Poor credit ratings Heavy financial losses Bad investments Tax avoidance Meet unreasonable quotas/goals EMOTIONAL Greed Unrecognized performance Job dissatisfaction Fear of losing job Power or control Pride or ambition Beating the system Frustration Non-conformity Envy, resentment Arrogance, dominance Non-rules oriented LIFESTYLE Support gambling habit Drug or alcohol addiction Support sexual relationships Family/peer pressure 5-15
Copyright © 2015 Pearson Education, Inc. 16
Copyright © 2015 Pearson Education, Inc. Opportunity Condition or situation that allows a person or organization to: 1.Commit the fraud 2.Conceal the fraud 3.Convert the theft or misrepresentation to personal gain 5-17
Copyright © 2015 Pearson Education, Inc. OPPORTUNITIES PERMITTING EMPLOYEE AND FINANCIAL STATEMENT FRAUD Internal Control Factors ▫Failure to enforce/monitor internal controls ▫Management not involved in control system ▫Management override of controls and guidelines ▫Managerial carelessness/inattention to details ▫Dominant and unchallenged management ▫Ineffective oversight by board of directors ▫No effective internal auditing staff ▫Infrequent third-party reviews ▫Insufficient separation of authorization, custody, and record-keeping duties ▫Too much trust in key employees ▫Inadequate supervision ▫Unclear lines of authority 18
Copyright © 2015 Pearson Education, Inc. OPPORTUNITIES PERMITTING EMPLOYEE AND FINANCIAL STATEMENT FRAUD ▫Lack of proper authorization procedures ▫No independent checks on performance ▫Inadequate documents and records ▫Inadequate system for safeguarding assets ▫No physical or logical security system ▫No audit trails ▫Failure to conduct background checks ▫No policy of annual vacations, rotation of duties 19
Copyright © 2015 Pearson Education, Inc. OPPORTUNITIES PERMITTING EMPLOYEE AND FINANCIAL STATEMENT FRAUD Other Factors ▫Large, unusual, or complex transactions ▫Numerous adjusting entries at year end ▫Related-party transactions ▫Accounting department understaffed and overworked ▫Incompetent personnel ▫Rapid turnover of key employees ▫Lengthy tenure in a key job ▫Unnecessarily complex organizational structure ▫No code of conduct, conflict of interest statements, or definitions of unacceptable behavior ▫Frequently changing auditors/legal counsel ▫Operating on a crisis basis ▫Close association with suppliers/customers 20
Copyright © 2015 Pearson Education, Inc. OPPORTUNITIES PERMITTING EMPLOYEE AND FINANCIAL STATEMENT FRAUD ▫Assets highly susceptible to misappropriation ▫Questionable accounting practices ▫Pushing accounting principles to the limit ▫Unclear company policies and procedures ▫Failing to teach and stress corporate honesty ▫Failure to prosecute dishonest employees ▫Low employee morale and loyalty 21
Copyright © 2015 Pearson Education, Inc. Rationalizations Justification of illegal behavior 1.Justification I am not being dishonest. I am only borrowing and will pay it back 2.Attitude I don’t need to be honest. 3.Lack of personal integrity Theft is valued higher than honesty or integrity. 5-22
Copyright © 2015 Pearson Education, Inc. Computer Fraud If a computer is used to commit fraud it is called computer fraud. Computer fraud is classified as: ▫Input ▫Processor ▫Computer instruction ▫Data ▫Output 5-23
Copyright © 2015 Pearson Education, Inc. Computer Fraud In using a computer, fraud perpetrators can steal: ▫More of something ▫In less time ▫With less effort They may also leave very little evidence, which can make these crimes more difficult to detect. 5-24
Copyright © 2015 Pearson Education, Inc. Computer Fraud Computer systems are particularly vulnerable to computer crimes for several reasons: ▫Company databases can be huge and access privileges can be difficult to create and enforce. Consequently, individuals can steal, destroy, or alter massive amounts of data in very little time. ▫Organizations often want employees, customers, suppliers, and others to have access to their system from inside the organization and without. This access also creates vulnerability. ▫Computer programs only need to be altered once, and they will operate that way until: The system is no longer in use; or Someone notices. 5-25
Copyright © 2015 Pearson Education, Inc. Computer Fraud Modern systems are accessed by PCs, which are inherently more vulnerable to security risks and difficult to control. ▫It is hard to control physical access to each PC. ▫PCs are portable, and if they are stolen, the data and access capabilities go with them. ▫PCs tend to be located in user departments, where one person may perform multiple functions that should be segregated. ▫PC users tend to be more oblivious to security concerns. 5-26
Copyright © 2015 Pearson Education, Inc. Computer Fraud Computer systems face a number of unique challenges: ▫Reliability (accuracy and completeness) ▫Equipment failure ▫Environmental dependency (power, water damage, fire) ▫Vulnerability to electromagnetic interference and interruption ▫Eavesdropping ▫Misrouting 5-27
Copyright © 2015 Pearson Education, Inc. Rise of Computer Fraud 1.Definition is not agreed on 2.Many go undetected 3.High percentage is not reported 4.Lack of network security 5.Step-by-step guides are easily available ▫Next 3 slides 6.Law enforcement is overburdened 7.Difficulty calculating loss 5-28
Copyright © 2015 Pearson Education, Inc. Copyright 2012 © Pearson Education, Inc. publishing as Prentice Hall 5-29
Copyright © 2015 Pearson Education, Inc. Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 30 Easier if WPS enabled
Copyright © 2015 Pearson Education, Inc. Computer Fraud Classifications Input Fraud ▫The simplest and most common way to commit a fraud is to alter computer input. Requires little computer skills. Perpetrator only needs to understand how the system operates ▫Can take a number of forms, including: Disbursement frauds Inventory frauds Payroll frauds Cash receipt frauds Fictitious refund fraud 5-31
Copyright © 2015 Pearson Education, Inc. Computer Fraud Classifications Processor fraud ▫Involves computer fraud committed through unauthorized system use. ▫Includes theft of computer time and services. ▫Incidents could involve employees: Using the company computer to conduct personal business; or Using the company computer to conduct a competing business. 5-32
Copyright © 2015 Pearson Education, Inc. Computer Fraud Classifications Computer instructions fraud ▫Involves tampering with the software that processes company data. ▫May include: Modifying the software Making illegal copies Using it in an unauthorized manner ▫Also might include developing a software program or module to carry out an unauthorized activity. 5-33
Copyright © 2015 Pearson Education, Inc. Computer Fraud Classifications Data fraud ▫Involves: Altering or damaging a company’s data files; or Copying, using, or searching the data files without authorization. ▫In many cases, disgruntled employees have scrambled, altered, or destroyed data files. ▫Theft of data often occurs so that perpetrators can sell the data. Most identity thefts occur when insiders in financial institutions, credit agencies, etc., steal and sell financial information about individuals from their employer’s database. 5-34
Copyright © 2015 Pearson Education, Inc. Computer Fraud Classifications Output fraud ▫Involves stealing or misusing system output. ▫Output is usually displayed on a screen or printed on paper. ▫Unless properly safeguarded, screen output can easily be read from a remote location using inexpensive electronic gear. ▫This output is also subject to prying eyes and unauthorized copying. ▫Fraud perpetrators can use computers and peripheral devices to create counterfeit outputs, such as checks. 5-35
Copyright © 2015 Pearson Education, Inc. Preventing and Detecting Fraud 1. Make Fraud Less Likely to Occur OrganizationalSystems Create a culture of integrity Adopt structure that minimizes fraud, create governance (e.g., Board of Directors) Assign authority for business objectives and hold them accountable for achieving those objectives, effective supervision and monitoring of employees Communicate policies Develop security policies to guide and design specific control procedures Implement change management controls and project development acquisition controls 5-36
Copyright © 2015 Pearson Education, Inc. Preventing and Detecting Fraud 2. Make It Difficulty to Commit OrganizationalSystems Develop strong internal controls Segregate accounting functions Use properly designed forms Require independent checks and reconciliations of data Restrict access System authentication Implement computer controls over input, processing, storage and output of data Use encryption Fix software bugs and update systems regularly Destroy hard drives when disposing of computers 5-37
Copyright © 2015 Pearson Education, Inc. Preventing and Detecting Fraud 3. Improve Detection OrganizationalSystems Assess fraud risk External and internal audits Fraud hotline Audit trail of transactions through the system Install fraud detection software Monitor system activities (user and error logs, intrusion detection) 5-38
Copyright © 2015 Pearson Education, Inc. Preventing and Detecting Fraud 4. Reduce Fraud Losses OrganizationalSystems Insurance Business continuity and disaster recovery plan Store backup copies of program and data files in secure, off-site location Monitor system activity 5-39
PLANNING THE AUDIT Individual audits must be properly planned to ensure: Appropriate and sufficient evidence is obtained to support the auditors opinion;
Logical IT Security By Prashant Mali.
Internal Controls… They Are Not For Wimps Presented by: Billy Morehead, Ph.D., CPA, CGFM, CPM AGA Past National President and Associate Professor of Accountancy.
PwC Rogue Trading How to successfully manage this risk Informational presentation for our clients February 2008 Strictly private and confidential *connectedthinking.
Internal Control Chapter 7 McGraw-Hill/Irwin Copyright © 2010 by The McGraw-Hill Companies, Inc. All rights reserved.
Information Systems Using Information (Higher and Intermediate 2)
FINANCIAL & BUSINESS SERVICES Welcome & Thank you for Attending Financial and Business Services Internal Controls Workshop.
Internal Control Workshop Kenneth Wilson, Associate Comptroller Deb Martin, Internal Auditor.
Copyright © 2011 Pearson Education, Inc. publishing as Prentice Hall 14-1 MANAGING INFORMATION TECHNOLOGY 7 th EDITION CHAPTER 14 INFORMATION SECURITY.
1 ©2008 by the Association of Certified Fraud Examiners, Inc.
FLORIDA COURT CLERKS AND COMPTROLLERS ANNUAL CONFERENCE JUNE 12, 2013 SAM M. MCCALL, PHD, CPA, CGFM, CIA, CGAP, CHIEF AUDIT OFFICER FLORIDA STATE UNIVERSITY.
1 Information Systems Using Information (Higher).
1 CHAPTER 9 INFORMATION SECURITY Management Information Systems, 9 th edition, By Raymond McLeod, Jr. and George P. Schell © 2004, Prentice Hall, Inc.
1 Information Security and Privacy Training for [the Agency] Information System Security Officers June 12 & 13, 2000.
McGraw-Hill/Irwin Copyright © 2008, The McGraw-Hill Companies, Inc. All rights reserved.McGraw-Hill/Irwin Copyright © 2008 The McGraw-Hill Companies, Inc.
The External Auditors Perspective and use of Internal Audit Brent Currey Live Seminar 9:00am – 4:30pm October 12, 2011 Relationships backed by performance.
Dentistar Inc. GROUP 4A NIRAV BHATT ERIKA GARCIA MANISHA SUCKOO ROXANA VALLIMOR.
Electronic Presentations in Microsoft ® PowerPoint ® Prepared by Brad MacDonald SIAST © 2003 McGraw-Hill Ryerson Limited.
Computer Vulnerabilities 1. 1.Overview 2. 2.Threats to Computer Systems 3. 3.How Hackers Work 4. 4.Using the Internet Securely 5. 5.How We Make It Easy.
SECURITY AWARENESS. The Importance of Security Awareness Training Security Awareness Training provides the knowledge to protect information systems and.
Colors I Like (in this presentation) Anti-Fraud and the Internal Audit Function Proactive Measures for Finding Fraud, Waste, and Abuse Washington, D.C.
« In Confidence » Putting in Place a Trade Secret Protection Program in an SME Najmia Rahimi Senior Program Officer, SMEs Division, World Intellectual.
Internal Controls 101 and ARMICS An Auditor’s Perspective Deane Hennett Director of Internal Audit, Old Dominion University.
Workshop: Governance, Risk, Compliance (GRC) & Identity Management , 09:00-12:30, Track: Workshop I Dr. Horst Walther, Kuppinger Cole + Partner.
SAS 99 – Consideration of Fraud in a Financial Statement Audit The New Fraud Standards Impact on Auditors and Financial Managers.
UNIT I FUNDAMENTAL OF E-COMMERCE 1.1INTRODUCTION TO E-COMMERCE 1.2 DRIVING FORCES OF E-COMMERCE 1.3 BENEFITS AND LIMITATIONS OF E-COMMERCE 1.4 DATA MINING.
McGraw-Hill McGraw-Hill The Challenges of the Digital Age.
Alter – Information Systems 4th ed. © 2002 Prentice Hall 1 Understanding Systems From a Business Viewpoint.
© 2016 SlidePlayer.com Inc. All rights reserved.