Program Program alteration requires Programmers should not be allowed to alteration programming skills and make changes to actual production knowledge of the program. source programs and data files. Program coding is revised for Segregation of Duties fraudulent purposes. For Programmers should not have access to example: production programs or data files. Ignore certain transactions such as overdrafts against the Periodic Comparisons programmers' account Internal Audit or an independent group Grant excessive discounts to should periodically process actual data, specified customers and compare the output with output from normal operations. Differences indicate unauthorized program changes. Periodic comparisons of on-line programs to off-line backup copies to detect changes. Independent file librarian function who controls custody/access to programs Defrauder revises specific data or Restrict Access to Equipment/Files File manipulates data files. For example: access to computer center. alteration Using program instructions to and analysts should not fraudulently change an have direct access to production data employee’s pay rate in the payroll files. master file a librarian maintain production Transferring balances among data in a library. dormant accounts to conceal computer operator access to improper withdrawals of funds. applications documentation, except needed to perform their duties, to minimize their ability to modify programs and data files. Data theft Smuggling out data on: Electronic sensitization of all library Hard copies of reports/files. materials to detect unauthorized Magnetic devices in briefcases, removals. employees' pockets, etc. Encrypt sensitive data transmissions. Tap or intercept data transmitted by data communication lines
Program alteration Program alteration requires programming skills and knowledge of the program. Program coding is revised for fraudulent purposes. For example: Ignore certain transactions such as overdrafts against the programmers' account Grant excessive discounts to specified customers Programmers should not be allowed to make changes to actual production source programs and data files. Segregation of Duties Programmers should not have access to production programs or data files. Periodic Comparisons Internal Audit or an independent group should periodically process actual data, and compare the output with output from normal operations. Differences indicate unauthorized program changes. Periodic comparisons of on-line programs to off-line backup copies to detect changes. Independent file librarian function who controls custody/access to programs File alteration Defrauder revises specific data or manipulates data files. For example: Using program instructions to fraudulently change an employee’s pay rate in the payroll master file Transferring balances among dormant accounts to conceal improper withdrawals of funds. Restrict Access to Equipment/Files access to computer center. and analysts should not have direct access to production data files. a librarian maintain production data in a library. computer operator access to applications documentation, except needed to perform their duties, to minimize their ability to modify programs and data files. Data theft Smuggling out data on: Hard copies of reports/files. Magnetic devices in briefcases, employees' pockets, etc. Tap or intercept data transmitted by data communication lines Electronic sensitization of all library materials to detect unauthorized removals. Encrypt sensitive data transmissions.
rais12_SM_CH05.docx