What are the competencies of a Information Security Office related to
With financial risks as these risks relate to information security, I find through my experience as an IT auditor, the human factor to be critical. Internal controls have limitations, and two major limitations are collusion and management override.
Technical security controls (logical access controls, encryption etc.) can be both designed and operating perfectly, yet if two individual with malicious intent were to collude to cause financial harm or cook the accounting records of a financial system, it does not matter how well the technical security controls are working. Similarly, if the control environment (i.e: tune at the top) is weak and management is lax, then any effort underneath such as from the Internal Audit function, is most likely going to be fruitless.
Hence, I believe a core competency of an IT Security department in mitigating financial risks as these risks derive from IT, is promoting an environment and controls that mitigate negative human incentives, such as enforcing proper SoD so incompatible tasks (ex: accounts payables management / accounts set up) are done by at least 2 different individuals.
With segregation of duties, there are several areas to look at in which the Information Security team could be helpful. Financial records are the end products that come out of a accounting / ERP system. There are certain roles that due to their nature carry higher inherent risk such as database administrators. Therefore having well-designed security controls around the DBA function so principle of least privileged access is enforced would be one way in which IT Security can improve the financial reporting internal controls environment.
In order for financial fraud to be successful, malicious activity must not be easily detected. Therefore, implementing stringent auditing of data changes reviewing those logs regularly would be another way in which IT Security can help strengthen control environment. As a complement to security logging, you may also want to look at other processes such as incident response to remediate and investigate unaccounted changes in production.
You can also link assertions in financial reporting to the CIA model of Security to map how threats to a CIA principle threatens the achievement of a financial assertion. Let me with illustrate with the financial statement assertions of completeness and cutoff and the CIA principles of Integrity and Availability.
Completeness Assertion in Financial Reporting
As stated in the link, the completeness assertion in financial reporting is concerned with whether all journal entries that should have been recorded to the GL were recorded. If security controls are not adequate to protect the Integrity principle (i.e: vulnerability exists), then a threat agent, such as a disgruntled employee, can exploit such vulnerability, perhaps to delete / alter financial records, resulting in in misstatement of the completeness assertion.
Cutoff Assertion in Financial Reporting
The cutoff assertion in financial reporting is concerned with whether financial transactions have been booked to the GL in the correct accounting time period. If a threat agent such as a disgruntled insider employee were to launch a DOS / DDOS attack against an application processing financial data, then the downtime could result in financial data not being processed timely, resulting in misstatement of the cutoff assertion.
So yes, such a request is absolutely within the realm of information security.