control objective DS5.11 addresses the use of encryption during the transmission of information. This should include procedures concerning: Procedures to ensure information is encrypted prior to transmission Specification of approved encryption algorithms Access controls over incoming encrypted information Secure storage of encryption keys SUGGESTED SOLUTIONS TO THE CASES Case 9-1 Protecting Privacy of Tax Returns The department of taxation in your state is developing a new computer system for processing individual and corporate income-tax returns. The new system features direct data input and inquiry capabilities. Identification of taxpayers is provided by using the Social Security number for individuals and federal tax identification number for corporations. The new system should be fully implemented in time for the next tax season. The new system will serve three primary purposes: 1 Data will either be automatically input directly into the system if the taxpayer files electronically or by a clerk at central headquarters scanning a paper return received in the mail. 2 The returns will be processed using the main computer facilities at central headquarters. Processing will include four steps: a. Verifying mathematical accuracy b. Auditing the reasonableness of deductions, tax due, and so on, through the use of edit routines, which also include a comparison of current and prior years’ data. c. Identifying returns that should be considered for audit by department revenue agents d. Issuing refund checks to taxpayers 3 Inquiry services. A taxpayer will be allowed to determine the status of his or her return or get information from the last three years’ returns by calling or visiting one of the department’s regional offices, or by accessing the department’s web site and entering their social security number. The state commissioner of taxation and the state attorney general are concerned about protecting the privacy of personal information submitted by taxpayers. They want to have potential problems identified the system is fully developed and implemented so that before
control objective DS5.11 addresses the use of encryption during the transmission of information. This should include procedures concerning: Procedures to ensure information is encrypted prior to transmission Specification of approved encryption algorithms Access controls over incoming encrypted information Secure storage of encryption keys SUGGESTED SOLUTIONS TO THE CASES Case 9-1 Protecting Privacy of Tax Returns The department of taxation in your state is developing a new computer system for processing individual and corporate income-tax returns. The new system features direct data input and inquiry capabilities. Identification of taxpayers is provided by using the Social Security number for individuals and federal tax identification number for corporations. The new system should be fully implemented in time for the next tax season. The new system will serve three primary purposes: 1 Data will either be automatically input directly into the system if the taxpayer files electronically or by a clerk at central headquarters scanning a paper return received in the mail. 2 The returns will be processed using the main computer facilities at central headquarters. Processing will include four steps: a. Verifying mathematical accuracy b. Auditing the reasonableness of deductions, tax due, and so on, through the use of edit routines, which also include a comparison of current and prior years’ data. c. Identifying returns that should be considered for audit by department revenue agents d. Issuing refund checks to taxpayers 3 Inquiry services. A taxpayer will be allowed to determine the status of his or her return or get information from the last three years’ returns by calling or visiting one of the department’s regional offices, or by accessing the department’s web site and entering their social security number. The state commissioner of taxation and the state attorney general are concerned about protecting the privacy of personal information submitted by taxpayers. They want to have potential problems identified before the system is fully developed and implemented so that
rais12_SM_Ch09.docx