1. Chapter 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control Accounting Information Systems, 9e Gelinas ►Dull ► Wheeler © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

2. Learning Objectives  Summarize the eight elements of COSO’s Enterprise Risk Management—Integrated Framework.  Understand that management employs internal control systems as part of organizational and IT governance initiatives.  Describe how internal control systems help organizations achieve objectives and respond to risks. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

3. Learning Objectives (cont’d)  Describe fraud, computer fraud, and computer abuse.  Enumerate control goals for operations and information processes.  Describe the major categories of control plans. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

4. Suggested Exercise Questions  P 7-1 on page 250  P 7-3 on page 251  P 7-4 on page 253 © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

5. Why are Controls Needed? 1.To provide reasonable assurance that the goals of each business process are being achieved. 2.To mitigate the risk that the enterprise will be exposed to some type of harm, danger, or loss (including loss caused by fraud or other intentional and unintentional acts). 3.To provide reasonable assurance that the company is in compliance with applicable legal and regulatory obligations. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

6. A Control Hierarchy © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use. Chapter 7 Besides the internal control topics by the textbook, we will also study about IS analysis, design, and maintenance related control topics as well.

7. Governance  Organizational governance Highest level of control mechanism process by which organizations select objectives, establish processes to achieve objectives, and monitor performance. Enterprise Risk Management (ERM): a framework that has been proven to be an effective process for organizational governance © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

8. Governance example © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

9. Risk Management  Enterprise Risk Management (ERM): process, effected by an entity’s board of directors, management, and other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

10. Eight Components of Enterprise Risk Management (ERM) – on page. 221  Internal Environment  Objective Setting  Event Identification  Risk Assessment  Risk Response  Control Activities  Information and Communication  Monitoring © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.  Another reason why ERM is necessary because of “Sarbanes-Oxley Act of 2002 (SOX)”

11. Sarbanes-Oxley Act (SOX) of 2002  Created due to failure of governance (i.e., Enron)  Detail from financial accounting and auditing courses Created public company accounting oversight board (PCAOB). Strengthened auditor independence rules. Increased accountability of company officers and directors. Mandated upper management to take responsibility for the company’s internal control structure. Enhanced the quality of financial reporting. Increased white collar crime penalties. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

12. Key Elements of SOX (AIS perspective)  Section 201—prohibits audit firms from providing a wide array of nonaudit services to audit clients in particular, the act prohibits consulting engagements involving the design and implementation of financial information systems.  Section 302—CEOs and CFOs must certify quarterly and annual financial statements.  Section 404—Mandates the annual report filed with the SEC include an internal control report. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

13. Outline of SOX (AIS perspective)  Outline on page 226  Title III—Corporate Responsibility: Company’s CEO and CFO must certify quarterly and annual reports stating: They are responsible for establishing, maintaining, and reporting on the effectiveness of internal controls, including significant deficiencies, frauds, or changes in internal controls. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

14. Outline of SOX (AIS perspective)  Title IV— Section 409 requires that companies disclose information on material changes in their financial condition or operations on a rapid and current basis. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

15. Outline of SOX (AIS perspective)  Title VIII—Corporate and Criminal Fraud Accountability: Makes it a felony to knowingly destroy, alter, or create records or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation (example on the next slide). Offers legal protection to whistleblowers who provide evidence of fraud. Provides criminal penalties for those who knowingly execute, or attempt to execute, securities fraud. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

16. Recovered E-Mail between Enron and Andersen Consulting

17. Outline of SOX (AIS perspective)  Title IX—White-Collar Crime Penalty Enhancements: Requires that CEOs and CFOs certify that information contained in periodic reports fairly presents, in all material respects, the financial condition and results of the company’s operations. Sets criminal penalties applicable to CEOs and CFOs if they knowingly or willfully falsely so certify. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

18. Your Computer Usage Pattern  Your property? Computer files, email by your personal email system  Talking about your boss or peers by email  Web shopping during lunch break  Visiting adult website  All files are deleted…are you safe now?  When leaving the company? Access to your computer © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

19. Definition of Internal Control  Internal control is a process—effected by an entity’s board of directors, management, and other personnel—designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness & efficiency of operations Reliability of financial reporting Compliance with applicable laws & regulations © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

20. COSO Influence on Defining Internal Control (most current COSO framework on the class website) © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

21. Matrix for Evaluating Internal Controls © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

22. Fraud and its Relationship to Control  Fraud: deliberate act or untruth intended to obtain unfair or unlawful gain. Management charged with responsibility to prevent and/or disclose fraud. Instances of fraud undermine management’s ability to convince various authorities that it is upholding its stewardship responsibility. Control systems enable management to do this job. Management is responsible for an internal control system per the Foreign Corrupt Practices Act of 1977. Section 1102 of the Sarbanes-Oxley Act specifically addresses corporate fraud. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

23. Consideration of Fraud in a Financial Statement Audit (SAS 99)  The accounting profession has been proactive in dealing with corporate fraud, as it has launched an anti-fraud program.  One of the manifestations of this initiative is Statement on Auditing Standards (SAS) No. 99.  SAS 99 emphasizes brainstorming fraud risks, increasing professional skepticism, using unpredictable audit test patterns, and detecting management override of internal controls. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

24. 2010 ACFE Report to the Nation on Occupational Fraud and Abuse  Median loss from frauds was $160,000.  One quarter of lasses at least $1 million.  Projected global losses would be $2.9 trillion.  Typical fraud was underway 18 months.  Frauds were more likely detected by tips.  Over 80 percent of the frauds were committed by individuals within the organization.  Small businesses are disproportionately victimized by fraud (31 percent of cases). © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

25. PwC Economic Crime Survey  30% of companies reported frauds in the previous 12 months and 43% reported an increase from the previous year.  Larger companies reported a greater number of frauds.  Collateral damage—described as damage or significant damage to their business—was reported in 100% of frauds. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

26. PwC Economic Crime Survey (cont’d)  Frauds were detected by internal audit (17%), internal tip-offs (16%) and fraud risk management (14%).  There was a strong correlation between fraud risk management activities and higher chances of detecting frauds. © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

27. Computer Fraud and Abuse  Digital forensics  Computer crime  Malware  Computer virus © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

28. DIGITAL FORENSICS  Digital forensics – the collection, authentication, preservation, and examination of electronic information for presentation in court  Two phases 1.Collecting, authenticating, and preserving electronic evidence 2.Analyzing the findings

29. Phase 1: Collection – Places to look for Electronic Evidence

30. Phase 1: Preservation  If possible, hard disk is removed without turning computer on  Special forensics computer is used to ensure that nothing is written to drive  Forensic image copy – an exact copy or snapshot of all stored information Mod H-30

31. Phase 1: Authentication  Authentication process necessary for ensuring that no evidence was planted or destroyed MD5 hash value  It is like a fingerprint of the file.  There is a very small possibility of getting two identical hashes (fingerprint) of two different files.  This feature can be useful both for comparing the files and their integrity control. Mod H-31

32. Forensic Hardware and Software Tools  Forensics computers usually have a lot of RAM and very fast processors  EnCase – software that finds all information on disks  Quick View Plus and Conversions Plus – read files in many formats  Mailbag Assistant – reads most e-mail Mod H-32

33. Forensics Hardware and Software Tools  Gargoyle – software that identifies encrypted files and may decrypt them  Irfan View – reads image files  Ingenium – semantic analysis software that searches for meaning rather than an exact match Mod H-33

34. Cell Phones  In 2004 - 200 countries with more than 1.5 billion users of GSM cell phones (Cingular and most of Europe) GSM: Global System for Mobile Communications  Cell phones can be used for Illegal drug deals Storing stolen data Fraudulently securing goods and services Setting off explosives Mod H-34

35. Cell Phones and Other Handheld Devices Files Can Be Recovered from… Mod H-35

36. Phase 2: Analysis  Interpretation of information uncovered  Recovered information must be put into context  Digital forensic software pinpoints the file’s location on the disk, its creator, the date it was created and many other features of the file Mod H-36

37. Where Data is Hiding Mod H-37

38. History of Disk Activity

39. Live Analysis  Examination of a system while it is still running  Disadvantage - not possible to get an MD5 hash value  Advantages include – the ability to retrieve information from RAM  Helix – program to collect information during live analysis Mod H-39

40. RECOVERY AND INTERPRETATION  Snippets of e-mail, when put into context, often tell an interesting story Mod H-40

41. E-Mail between engineers about the Spaceship Columbia Mod H-41

42. E-Mail between Enron and Andersen Consulting Mod H-42

43. E-Mail from Arresting Officer in the Rodney King Beating Mod H-43

44. Internal E-Mail from Bill Gates to Microsoft Employee Mod H-44

45. Places to Look for Useful Information  Deleted files and slack space Slack space – the space between the end of the file and the end of the cluster  System and registry files Controls virtual memory on hard disk Has records on installs and uninstalls Has MAC address (unique address of computer on the network) Mod H-45

46. Places to Look for Useful Information  Unallocated space – set of clusters that has been marked as available to store information but has not yet received any  Unused disk space  Erased information that has not been overwritten Mod H-46

47. Anti-Forensics  New branch of digital forensics  Set of tools and activities that make it hard or impossible to track user activity  Three categories Configuration settings Third party tools Forensic defeating software Mod H-47

48. Configuration Settings Examples:  Delete files: By passing the recycle bin  Rename the file with a different extension  Clear out virtual memory  Use Defrag to rearrange data on the hard disk and overwrite deleted files  Use Disk Cleanup to delete ActiveX controls and Java applets Mod H-48

49. Configuration Settings Examples:  Delete temporary Internet files  Hide information by making it invisible with Hidden feature in Word or Excel  Redact – black out portions of a document  Protect your files with passwords Mod H-49

50. Configuration Settings Examples:  Make the information invisible  Use Windows to hide files  Protect file with password Mod H-50

51. Third-Party Tools to  Alter your registry  Hide Excel files inside Word documents and visa versa  Change the properties like creation date in Windows  Replace disk contents with 1’s and 0’s – called wiping programs Mod H-51

52. Third Party Tools  Encryption – scrambles the contents of a file so that you can’t read it without the decryption key  Steganography – hiding information inside other information The watermark on dollar bills is an example  U3 Smart drive – stores and can launch and run software without going through the hard disk thus leaving no trace of itself Mod H-52

53. Forensic Defeating Software  Software on the market specially designed to evade forensic examination  Such software would include programs to remove data in slack space data in cache memory cookies, Internet files, Google search history, etc. Mod H-53

54. WHO NEEDS DIGITAL FORENSICS INVESTIGATORS?  Digital forensics is used in The military for national and international investigations Law enforcement, to gather electronic evidence in criminal investigations Corporations and not-for-profits for internal investigations Consulting firms that special in forensics Mod H-54

55. Organizations Use Digital Forensics in Two Ways 1.Proactive education to educate employees 2.Reactive digital forensics for incident response Mod H-55

56. Proactive Education to Educate Employees  Proactive Education for Problem Prevention What to do and not to do with computer resources such as  The purposes for which e-mail should be used  How long it may be saved  What Internet sites are may be visited Mod H-56

57. Reactive Digital forensics for Incident Response  What to do if wrong-doing is suspected and how to investigate it Encouraged by the Sarbanes-Oxley Act, which expressly requires implementation of policies to prevent illegal activity and to investigate allegations promptly Mod H-57

58. A Day in the Life…  As a digital forensics expert you must Know a lot about computers and how they work Keep learning Have infinite patience Be detail-oriented Be good at explaining how computers work Be able to stay cool and think on your feet Mod H-58

59. Computer Crime  Computer crime – a crime in which a computer, or computers, play a significant part  Computers are involved in crime in two ways As the targets of misdeeds As weapons or tools of misdeeds  Computer crimes can be committed Inside the organization Outside the organization Mod H-59

60. Examples of Computer Crimes Mod H-60

61. Crimes in Which Computers Usually Play a Part Mod H-61

62. Outside the Organization  Financial loss stemmed from Virus and worm attacks Unauthorized access Theft of hardware Theft of information Malware Mod H-62

63. Types of Malware  Malware – software designed to harm you computer or computer security Viruses Worms Misleading e-mail  Types of Malware Denial-of-service attacks  Distributed Denial-of-Service Attack Web defacing Malware bots Mod H-63

64. Viruses  Computer virus (virus) – software that was written with malicious intent to cause annoyance or damage  Worm – a computer virus that replicates and spreads itself from computer to computer Mod H-64

65. Recent Problems  The most common type of worm was a botnet in 2007 and 2008  Botnet –collection of computers that have been infected with blocks of code (called bots) that can run automatically by themselves.  A botnet can Collect e-mail addresses from infected machines Distribute vast amounts of e-mail Lie dormant to be used at a later date by crooks Mod H-65

66. The Love Bug Worm Mod H-66

67. Stand-Alone Viruses  Spoofing – forging of return address on e- mail so that it appears to come from someone other than sender of record  Klez family of worms Introduced spoofing of sender and recipient Mod H-67

68. Trojan Horse Viruses  Trojan horse virus – hides inside other software, usually an attachment or download  Examples: Key logger (key trapper) software – program that, when installed on a computer, records every keystroke and mouse click Ping-of-Death DoS attack designed to crash Web sites Mod H-68

69. Misleading E-mail: Virus Hoax  Objective is to cause damage to your system  Virus hoax is an e-mail telling you of a non- existent virus Makes recipients believe that they already have a virus and gives instructions on removal which actually delete a Windows file Often purports to come from Microsoft -Microsoft always sends you to a Web site to find the solution to such a problem Mod H-69

70. Denial-of-Service Attacks  Denial-of-Service (DoS) attack – floods a Web site with so many requests for service that it slows down or crashes  Objective is to prevent legitimate customers from using Web site Mod H-70

71. Distributed DoS  Distributed denial-of-service attack (DDoS) – attacks from multiple computers that flood a Web site with so many requests for service that it slows down or crashes. Mod H-71

72. Distributed Denial-of-Service Attack Mod H-72

73. Malware Bots  Bot – a computer program that runs automatically.  Malware bots – bots that are used for fraud, sabotage, denial-of-service attacks, or some other malicious purpose  Zombies (or drones) – malware-bot-infected computers Mod H-73

74. Rootkits  Rootkit – software that gives you administrator rights to a computer or network and its purpose is to allow you to conceal processes, files, or system data from the operating system. Mod H-74

75. Web Defacing  Web defacing – maliciously changing another’s Web site  Electronic equivalent of graffiti Mod H-75

76. Players  Hackers – knowledgeable computer users who use their knowledge to invade other people’s computers  Thrill-seeker hackers – break into computer systems for entertainment  White-hat (ethical) hackers – computer security professionals who are hired by a company to uncover vulnerabilities in a network Mod H-76

77. Players  Black hat hackers – cyber vandals. They’re the people who exploit or destroy information  Crackers – hackers for hire, are the people who engage in electronic corporate espionage Social engineering – acquiring information that you have no right to by means of deception Mod H-77

78. Players  Hacktivists – politically motivated hackers who use the Internet to send a political message  Cyberterrorists – those who seek to cause harm to people or destroy critical systems or information Mod H-78

79. Players  Script kiddies (or bunnies) – people who would like to be hackers but don’t have much technical expertise Are often used by experienced hackers as shields Mod H-79

80. COSO Influence on Defining Internal Control © 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.