Volume 3, Issue 3 March 29, 2011 – Security role assignments impact internal controls Management must achieve two critical Relationship Manager (ARM) or agency Fraud risk is reduced by objectives when assigning security roles. internal auditor/internal control specialist segregating First, employees must be granted the access for clarification and to discuss options. incompatible to systems, programs, and data needed to duties. Plan to implement compensating perform their specific job functions. Failure Appropriately controls, such as management to provide sufficient access could result in assigning SWIFT transactional reviews, when is it not security roles business disruption or inability to deliver possible to completely separate helps achieve critical services. Second, management must adequate incompatible duties. maintain adequate separation between segregation of incompatible duties. Providing incompatible If you have questions, please contact Mike duties. access to employees increases financial risk, Thone, Internal Control Specialist at Compensating since these employees have the ability to Mike.Thone@state.mn.us or 651-201-8132. controls are required when it is create and conceal fraud, misstatements, or not possible to errors in the course of their normal job segregate duties. incompatible duties. Ideal segregation of duties is achieved when the following functional responsibilities are In only a few separated between business units, or at least months, the state’s between different individuals within a unit: new accounting and Authorization or approval to execute procurement system, transactions SWIFT, will go-live. Right now, in every Recording transactions in accounting state agency, records managers are Custody of assets involved in the making SWIFT transactions security role decisions that will Periodic reconciliation of existing significantly impact assets to recorded amounts the internal control To assist agencies in making appropriate structure of their security role decisions, a SWIFT Security organizations, and Role Conflict Matrix is included with the collectively all of Agency Assignment 7-2 materials. The Minnesota matrix identifies combinations of security government. It is roles that should be avoided to maintain therefore essential separation between the four functional that managers responsibilities. consider the internal control implications Suggested Action Steps: when assigning Resist the temptation to assign excessive security roles to security roles in an attempt to ensure individual sufficient system access. employees during the completion of Avoid assigning security role SWIFT Security combinations identified in the Security Role Mapping, Role Conflict Matrix. If you have Assignment 7-2. questions, consult your SWIFT Agency
Security role assignments impact internal controls Volume 3, Issue 3 – March 29, 2011 Fraud risk is reduced by segregating incompatible duties. Appropriately assigning SWIFT security roles helps achieve adequate segregation of duties. Compensating controls are required when it is not possible to segregate incompatible duties. In only a few months, the state’s new accounting and procurement system, SWIFT, will go-live. Right now, in every state agency, managers are making SWIFT security role decisions that will significantly impact the internal control structure of their organizations, and collectively all of Minnesota government. It is therefore essential that managers consider the internal control implications when assigning security roles to individual employees during the completion of SWIFT Security Role Mapping, Assignment 7-2. Management must achieve two critical objectives when assigning security roles. First, employees must be granted the access to systems, programs, and data needed to perform their specific job functions. Failure to provide sufficient access could result in business disruption or inability to deliver critical services. Second, management must maintain adequate separation between incompatible duties. Providing incompatible access to employees increases financial risk, since these employees have the ability to create and conceal fraud, misstatements, or errors in the course of their normal job duties. Ideal segregation of duties is achieved when the following functional responsibilities are separated between business units, or at least between different individuals within a unit: Authorization or approval to execute transactions Recording transactions in accounting records Custody of assets involved in the transactions Periodic reconciliation of existing assets to recorded amounts To assist agencies in making appropriate security role decisions, a SWIFT Security Role Conflict Matrix is included with the Agency Assignment 7-2 materials. The matrix identifies combinations of security roles that should be avoided to maintain separation between the four functional responsibilities. Suggested Action Steps: Resist the temptation to assign excessive security roles in an attempt to ensure sufficient system access. Avoid assigning security role combinations identified in the Security Role Conflict Matrix. If you have questions, consult your SWIFT Agency Relationship Manager (ARM) or agency internal auditor/internal control specialist for clarification and to discuss options. Plan to implement compensating controls, such as management transactional reviews, when is it not possible to completely separate incompatible duties. If you have questions, please contact Mike Thone, Internal Control Specialist at Mike.Thone@state.mn.us or 651-201-8132.