1

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If so, I think a set of tests should be developed with IT and Finance Dpt.

So, What are the competencies of a Information Security Office related to financial risks? Is there any certification or academic path Information Security professional should follow in order to develop skills to respond to financial risks (like fraud)? Does CRISC cover this type of risks for instance?

2

This is certainly security related and if the transactions involved are done by electronic means, then it is certainly part of estimating risk and determining appropriate security measures that should be taken. Information Security doesn't exist in a vacuum. It is dependent on all the surrounding factors, all the way down to physical security of the building that the computers are located in.

Fraud is a type of security incident from misuse of your system, having systems to limit the risk of such incidents is well within the bounds of Information Security documentation, though the exact acceptable level of risk likely needs to come from finance or management.

Many technical measures (such as identity and/or credit checks) may also come in to place to prevent fraudulent activity as well, so Information Security needs to be specifically involved in the process rather than being brought in at the last minute.

I don't think that it is necessary to expect an Information Security person to have in-depth knowledge of particular financial fraud risks (that is why there is a finance department) but it is important to get how systems and policies should respond to those threat documented in a consistent response plan for the entire organization.

0

I agree with the previous answer. Typically controls either fall under an information security team or a controls team that is focused on developing and maintaining controls for the entire organization. Controls are typically created (as you mentioned) from a combination of Finance and IT, but should be owned/developed more from Finance since they understand the actual risk when considering all controls that are already in place in the organization (ex.the Finance department may already be doing reconciliations as part of their months close process....this is actually a control that should be documented).

As far as certifications, CRISC will definitely help. Additionally, you should seek out the assistance of a Big 4 firm, which typically has resources that specialize in this area.

Finally, there are conferences that occur annually that you can look into attending. The ISACA North America ISRM Conference this has a session on Securing your SAP system. If SAP is your ERP, you should consider attending the session as part of this will be discussed.

0

What are the competencies of a Information Security Office related to financial risks?

With financial risks as these risks relate to information security, I find through my experience as an IT auditor, the human factor to be critical. Internal controls have limitations, and two major limitations are collusion and management override.

Technical security controls (logical access controls, encryption etc.) can be both designed and operating perfectly, yet if two individual with malicious intent were to collude to cause financial harm or cook the accounting records of a financial system, it does not matter how well the technical security controls are working. Similarly, if the control environment (i.e: tune at the top) is weak and management is lax, then any effort underneath such as from the Internal Audit function, is most likely going to be fruitless.

Hence, I believe a core competency of an IT Security department in mitigating financial risks as these risks derive from IT, is promoting an environment and controls that mitigate negative human incentives, such as enforcing proper SoD so incompatible tasks (ex: accounts payables management / accounts set up) are done by at least 2 different individuals.

With segregation of duties, there are several areas to look at in which the Information Security team could be helpful. Financial records are the end products that come out of a accounting / ERP system. There are certain roles that due to their nature carry higher inherent risk such as database administrators. Therefore having well-designed security controls around the DBA function so principle of least privileged access is enforced would be one way in which IT Security can improve the financial reporting internal controls environment.

In order for financial fraud to be successful, malicious activity must not be easily detected. Therefore, implementing stringent auditing of data changes reviewing those logs regularly would be another way in which IT Security can help strengthen control environment. As a complement to security logging, you may also want to look at other processes such as incident response to remediate and investigate unaccounted changes in production.

You can also link assertions in financial reporting to the CIA model of Security to map how threats to a CIA principle threatens the achievement of a financial assertion. Let me with illustrate with the financial statement assertions of completeness and cutoff and the CIA principles of Integrity and Availability.

Completeness Assertion in Financial Reporting

As stated in the link, the completeness assertion in financial reporting is concerned with whether all journal entries that should have been recorded to the GL were recorded. If security controls are not adequate to protect the Integrity principle (i.e: vulnerability exists), then a threat agent, such as a disgruntled employee, can exploit such vulnerability, perhaps to delete / alter financial records, resulting in in misstatement of the completeness assertion.

Cutoff Assertion in Financial Reporting

The cutoff assertion in financial reporting is concerned with whether financial transactions have been booked to the GL in the correct accounting time period. If a threat agent such as a disgruntled insider employee were to launch a DOS / DDOS attack against an application processing financial data, then the downtime could result in financial data not being processed timely, resulting in misstatement of the cutoff assertion.

So yes, such a request is absolutely within the realm of information security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.