Accounting Information Systems: The Processes and Controls, 2nd Edition

SUMMARY OF STUDY OBJECTIVES

An overview of internal controls for IT systems. Threats and risks that interrupt or stop computer operations can be severely damaging to the organization. Not only can they disrupt or shut down normal operations, but they also can lead to incorrect or incomplete accounting information. There are three important areas of knowledge regarding threats and risks to IT systems: The first is the description of the general controls and application controls that should exist in IT systems. The second is the type and nature of risks in IT systems. Third, and most important, is the recognition of how these controls can be used to reduce the risks to IT systems.

General controls for IT systems. These are controls on the overall IT system and can be categorized by the following risk areas they are intended to lessen: unauthorized access, hacking and other network break-ins, exposures in organizational structure, threats in the physical environment and physical security of the system, and disruption to business continuity.

General controls from a Trust Services Principles perspective. The AICPA Trust Services Principles define five objectives for IT controls: security, availability, processing integrity, confidentiality, and online privacy. Security means that the system is protected against unauthorized (physical and logical) access. Availability means the system is available for operation and use as committed or agreed. Processing integrity means that the system ...