Internal Controls in a Paperless Environment

Internal Controls in a Paperless Environment

Internal Controls in a Paperless Environment By Andrew Laflin and Jim Kreiser CLAconnect.com 2013 CliftonLarsonAllen LLP 2013 CliftonLarsonAllen LLP When people hear the phrase going paperless, they often assume they will no longer be using paper in daily tasks or even have access to it in their office. This obviously is not true or practical. Going paperless means using paper wisely and sparingly, and finding effective alternatives.

2013 CliftonLarsonAllen LLP Going Paperless Switching from a paper-based work environment to electronic sounds like a headache. Maybe you are comfortable with the process Maybe you dont like change Have you ever thought about the number of paper invoices that come into your accounts payable department each month and a like number of paper checks that go out to vendors. but consider these statistics 2013 CliftonLarsonAllen LLP

Going Paperless Is it Cost Effective? Organizations spend on average in labor costs: $20 to file a document $120 to find a misfiled document $220 to reproduce a lost document The average cost to process a single invoice manually is $24. (IOMA) 70% of all accounts payable payments made today are made on paper. It lags most other functional areas in terms of automation.

Of all documents 7.5% get lost 3% of the remainder get misfiled Professionals spend 5-15% of their time reading information, but up to 50% looking for it. (Aberdeen Group) 2013 CliftonLarsonAllen LLP Going Paperless Statistics **When it comes to going paperless, this can significantly improve efficiency and enhance your internal controls** 1. Establish prevention procedures Identify key areas where your organization is most vulnerable and know who is accountable for each. Determine the types of fraud that may occur and how they would likely be concealed. Then

establish internal controls to keep these possibilities from becoming realities. 2. Go paperless Prevent "lost" bills, invoices, documents and reduce the risk of manipulation and information theft. You'll also get an audit trail so you know exactly who accessed, viewed, or changed a document. 3. Enforce separation of duties Clearly define user access to the data, ensuring single users do not authorize, process, and record financial transactions within the organization. 4. Automate work processes Enabling different members of your staff to access bills, invoices, documents; workflow is critical to your productivity. By automating reminders and an audit trail, you ensure that nothing falls through the cracks and that people who are not supposed to be part of the process are kept out. 2013 CliftonLarsonAllen LLP Fundamentals of Internal Controls **When it comes to going paperless, this can significantly improve efficiency enhance your internal controls** 5. Enforce payment controls

By segmenting role-based controls, you make sure that no one person has access to information and the ability to edit accounting data (vendor addresses, etc.). Separation of the approval process from payment and of data entry from payment processing is key. 6. Streamline & control check process (incoming and outgoing) A single check contains every piece of information needed to access your money. By receiving payments electronically you prevent trips to the bank and protect against checks being improperly deposited. 7. Perform more regular internal audits Automated systems make regular audits much easier, creating an online audit trail and review of the entry and approval processes. 2013 CliftonLarsonAllen LLP Fundamentals of Internal Controls (continued) Overcoming the hurdles & Get Buy In Tossing out paper requires cooperation not just from your team, but the organization, and ultimately to go completely paperless need to have buy in from customers, vendors, and 3rd parties.

Start Small Which areas do you have the buy in and try a specific process (maybe banking since easy to get online statements, maybe billing if your software can attach billing detail to it). While vast segments of the finance function have gone electronic, accounts payable remains one of the last to convert. Per IOMA, they call this the paper tsunami. (Dont do account payable first, do something small and that you can get your arms around). It can be as simple as taking the paperless concepts you already embrace in your personal life (e.g. online bank statements, credit card statements) and employing that same mindset to your office. Maybe you like the idea of adding a second computer monitor to help cut down the number of documents you print. 2013 CliftonLarsonAllen LLP The Paperless Plan

Document the Process Document the workflow processes from beginning to end so you know how you want it to look and be done (this will be great for laying out the internal controls). Include Records Retention Policy & Clean up the hard copies for each area as you go through the process. Go Gradual Devise a timeline, include meetings, follow up, pros, cons on each process. Perform Annual Audits on each Paperless Process Review to make sure documentation is in line with actual process, savings, costs, efficiencies, inefficiencies.

2013 CliftonLarsonAllen LLP The Paperless Plan (continued) Clinging to paper, inflates invoice processing costs, ups payment errors and increases the chances of payment fraud. You may miss opportunities to take early payment discounts, miss payment deadlines completely, incurring late fees. All this ties up cash when it could be put to better use growing the organization or spending on program expense. Accounts Payable Scan invoices, attach to check requests, ability to route check requests for approval electronically Dual check signers dont need to be in the same building or even same city to approve checks

Accounts Receivable Scan invoices, backup; send documents via email instead of snail mail Banking Online access, EFTs, ACHs, check scanners instead of running to the bank Payroll Online timesheets & approval system 2013 CliftonLarsonAllen LLP Best Practices around Financial Areas

Implementing Software Cloud-Based Accounting System Attach supporting documentation for Journal Entries, Accounts Payable, Accounts Receivable, and Banking Typically web-based systems are hosted at top tier data warehouses with IT infrastructure comparable to Fortune 100 companies. Many of these companies provide everything from onsite back-ups to disaster recovery plans. This is a much more effective storage facility than rooms full of filing cabinets with no backup. Writing, Editing and Office Work Leverage Adobe and Microsoft Software, users can mark up documents and add notes just like you would on paper. Storage and Archiving Processes Utilize 3rd party archival/storage, or current trends and costs of data/disc storage have become increasingly inexpensive

Multiple Computer Monitors Makes research, drafting, and review much more efficient Office Floor Copier/Scanner VS Individual Desktop Scanners 2013 CliftonLarsonAllen LLP Current Trends We are all creatures of habit and this can seem like an overwhelming process. Just remember, going paperless doesnt have to mean a complete overhaul of your world.

2013 CliftonLarsonAllen LLP Going Paperless is this for you Without paper to hold onto and look at, how can the external auditor get comfortable with internal controls over significant transactions classes and with material balances reported on the f/s? 2013 CliftonLarsonAllen LLP Audit Considerations

Tests of controls include the following: Inquiries of appropriate personnel Observation of application of the control Inspection of documents, reports, or electronic files indicating performance of the control Walkthroughs Reviews of reconciliations and similar bookkeeping routines Re-performance of the application of the control 2013 CliftonLarsonAllen LLP Audit Considerations, continued Application controls apply to the processing of individual transaction applications (such as payroll and purchases) and relate to the use of IT to initiate, authorize, record, process, and report transactions or other financial data. Application controls help ensure that transactions

occurred, are authorized, and are completely and accurately recorded and processed. Examples include edit checks of input data and numerical sequence checks Application controls may be performed by IT, referred to as automated controls, or by individuals, referred to as user controls 2013 CliftonLarsonAllen LLP Audit Considerations, continued Lets look at how tests of operating effectiveness of internal controls and substantive testing over a significant audit area General A/P Disbursements could be achieved in a paperless environment. 2013 CliftonLarsonAllen LLP Audit Considerations, continued

Key Controls: Listing of designated reviewers are programmed into the system and updated regularly based on access rights set up in the system. As P.O.s are generated in the system, the designated reviewer is notified via email indicating the necessary approval required. An invoice cannot be processed for payment unless it is matched with an approved P.O. Testing Step: Observation, re-performance, inspection of documentation (invoice) 2013 CliftonLarsonAllen LLP Audit Considerations, continued Key Controls: Check signers' signatures are stored within the system and are electronically added by ??? once payment is ready for processing (has gone through review and approval for payment). No checks can be manually processed and must go through the

system. In addition, the system automatically assigns and generates check numbers and does not allow entry of duplicate invoice numbers. Check numbering sequence cannot be altered by anyone. BOA Positive Pay is utilized whereby a transmittal file is generated and uploaded to BOA containing all checks issued for a specific time period. A/P staff cannot alter the Safe Pay file. The A/P Supervisor is notified by BOA if any checks received by BOA do not match the transmittal file. Testing Step: Observation, inspection of documentation (check images) corroborative inquiry, walkthrough 2013 CliftonLarsonAllen LLP Audit Considerations, continued Substantive testing includes analytical procedures search for unrecorded liabilities, both of which do not require reviewing paper documents NO PAPER REQUIRED TO COMPLETE OUR AUDIT

PROCEDURES! 2013 CliftonLarsonAllen LLP Audit Considerations, continued Reducing paper over the payroll process 2013 CliftonLarsonAllen LLP Audit Considerations, continued Replace manual timesheets with electronic timekeeping system Do you really need to print out that 400 page pay register each pay period, just so the Payroll Manager can review it and manually sign off on the document? Potential obstacles for local governments: cost of implementationany other obstacles?

Potential concerns of your auditor if paperless: internal controls over approval of time and processing of payroll and recording to the GL 19 A secure system is one we can depend on to behave as we expect. Source: Web Security and Commerce by Simson Garfinkel with Gene Spafford Rules People Confidentiality Integrity Availability ` Tools

2013 CliftonLarsonAllen LLP Definition of a Secure System Trends: Sans 2009 Top Cyber Security Threats September 2009 http://www.sans.org/top-cyber-security-risks/ Intrusion Analysis: TrustWave January 2010 and April 2011 https://www.trustwave.com/GSR Intrusion Analysis: Verizon Business Services July 2010 and April 2011 http://securityblog.verizonbusiness.com/2011/04/19/2011data-breach-investigations-report-released/ 2013 CliftonLarsonAllen LLP Three Security Reports

Client side vulnerabilities Missing operating system patches Missing application patches Apple QuickTime Java Vulnerabilities MS Office Applications Adobe Vulnerabilities (PDF, Flash, etc) Objective is to get the users to Open the door 2013 CliftonLarsonAllen LLP SANS Client Side Vulnerabilities Top Methods of Entry Included: Top Methods of Entry Included:

Remote Access Applications [45%] Default vendor supplied or weak passwords [90%] 3rd Party Connections [42%] SQL Injection [6%] MPLS, ATM, frame relay Web application compromises [90%]

Exposed Services [4%] 2013 CliftonLarsonAllen LLP TrustWave Intrusion Analysis Report 2013 CliftonLarsonAllen LLP Verizon 2010 and 2011 Statistics on Data Breaches: 73% resulted from external sources 18% were caused by insiders ---39% implicated business partners 30% involved multiple parties - 2008 Data Breach Investigations Report conducted by The Verizon Business Risk Team

2013 CliftonLarsonAllen LLP Network Security Trends & Implications While attacks and breach attempts as a percentage of attempts are trending towards external factors, the depth of attacks from insiders are generally of greater impact: Median Number of Records Compromised - 2008 Data Breach Investigations Report conducted by - The Verizon Business Risk Team 2013 CliftonLarsonAllen LLP Insider Threats and Risks The common internal sources of IT Fraud: - 2008 Data Breach Investigations Report conducted by

- The Verizon Business Risk Team 2013 CliftonLarsonAllen LLP How do hackers and fraudsters break in? IT General Controls are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation and integrity of information systems. IT general controls are designed to: Allow for changes to systems, databases, and applications to be properly authorized, tested, and approved before they are implemented Allow for only authorized persons and applications to have access to data and perform specifically defined functions (e.g., inquire, execute, update). IT General Controls (ITGCs) provide: The base of support for reliance on application and IT dependent manual

controls (e.g., reports) related to significant applications Basis for management controls and determinations relative to monitoring, risk assessment and other audit & operational considerations ITGCs Include: Logical Security, Change Control, and certain Operations controls (e.g., backup and recovery, job scheduling, physical/facility controls) 2013 CliftonLarsonAllen LLP Impact of Effective IT General Controls 2013 CliftonLarsonAllen LLP ITGC Examples Logical Security Controls

Program Change Controls Authorization of user access (internal and external) Appropriateness of user rights Segregation of duties Security parameters in operating

system Password parameters Security software settings Security violation logging Authorization and Approval of program changes Testing/Quality Assurance User involvement and sign-off System Development Life Cycle (SDLC)

Source Code Control software access restrictions & version control Emergency Changes approvals Segregation of duties, including programmer access Security is a BUSINESS issue, NOT a technical issue!! Objectives: Confidentiality Integrity Availability Strategy: Administrative Policies / Procedures Physical Access Controls Technical Security Controls 2013 CliftonLarsonAllen LLP

Security = Culture!! 1. Strong Policies Email use Website links Removable media Users vs Admin 2013 CliftonLarsonAllen LLP Nine Things Every Organization Should Have 2. Defined user access roles and permissions Principal of minimum access and least privilege Users should NOT have system administrator rights Local Admin in Windows should be removed (if practical)

2013 CliftonLarsonAllen LLP Keys to Mitigate Risk 3. Hardened internal systems (end points) Hardening checklists Turn off unneeded services Change default password Use Strong Passwords 4. Encryption strategy data centered

Email Laptops and desktops Thumb drives Email enabled cell phones Mobile media 2013 CliftonLarsonAllen LLP Keys to Mitigate Risk 5. Vulnerability management process Operating system patches Application patches Testing to validate effectiveness

2013 CliftonLarsonAllen LLP Keys to Mitigate Risk 6. Well defined perimeter security layers: Network segments Email gateway/filter Firewall Proxy integration for traffic in AND out Intrusion Detection/Prevention for network traffic, Internet facing hosts, AND workstations (end points) 7. Centralized audit logging, analysis, and automated alerting capabilities

Routing infrastructure Network authentication Servers Applications Security unit vs. IT Admins/operations 2013 CliftonLarsonAllen LLP Keys to Mitigate Risk 8. Defined incident response plan and procedures

Be prepared Including data leakage prevention and monitoring Forensic preparedness 2013 CliftonLarsonAllen LLP Keys to Mitigate Risk 9. Know / use Available Tools

Multi-factor authentication Dual control / verification Out of band verification / call back thresholds ACH positive pay ACH blocks and filters Review bank interfaces and contracts relative to all these Monitor account activity daily Isolate the PC used for wires/ACH Segment network for connections to banks, payroll providers, etc. and monitor access to initiate such interfaces 2013 CliftonLarsonAllen LLP

Keys to Mitigate Risk IT Risk Management Program/Processes Are formal IT risk assessment and/or compliance programs/ processes in place? IT Risk Governance Minimum Security Baseline Configurations/Standards IT Internal Audit reviews/enforcement Integration of identify theft risk considerations (i.e. Red Flags, HIPAA) Annual program updates and risk assessment updates based on corporate projects, strategy, and IT changes Is there a formal IT strategic plan within the organization? Align risks and evaluate/measure risks accordingly Define formal IT KPIs for review and monitoring

2013 CliftonLarsonAllen LLP Keys to Mitigate Risk Test, Test, Test Penetration testing Internal and external Social engineering testing Simulate phishing IT General Control testing Test the tools within your organization Test internal processes

2013 CliftonLarsonAllen LLP Keys to Mitigate Risk Go Paperless, Go Green 2013 CliftonLarsonAllen LLP Questions? Jim Kreiser, Principal IT & Risk Management Services [email protected] (717)558-0860 Andrew Laflin, Manager Assurance Services [email protected]

2013 CliftonLarsonAllen LLP Questions?

Recently Viewed Presentations

  • Seguridad Informática

    Seguridad Informática

    SEGURIDAD INFORMÁTICA POSIBLES MANIFESTACIONES a) Amenazas e intimidación, que se puede realizar a través del teléfono móvil, el correo electrónico, los comentarios en la red, las redes sociales, etc. b) Acoso o acecho.
  • Taking A Math Test I love math !

    Taking A Math Test I love math !

    I thought my teacher would be happy, but she was not. She told me that when I yell out the answers, I may make other students feel sad that they are not as good as math as me. I learned...
  • Phonics: Developing your Subject Knowledge (TS3.d) Jo Dobb

    Phonics: Developing your Subject Knowledge (TS3.d) Jo Dobb

    The split digraph. Apart from the plural form (ties) and past tense (tied) it isn't common to find . ie. in the . medial. position in English spellings. Instead, the vowels are ' split ' - but still working. together...
  • Memory Verse Then he said to his disciples,

    Memory Verse Then he said to his disciples,

    Matthew 9:9-13, 18-26, 35-38; 10:1-14 As Jesus went on from there, he saw a man named Matthew sitting at the * tax collector's booth. "Follow me," he told him, and Matthew got up and followed him.
  • Mission  Washington State University is a public research

    Mission Washington State University is a public research

    Titles are Initial Cap Sub-titles are Initial Cap Click the reset button to impose formatting Replace the photo, match size and placement Titles Should be Short and Initial Cap Word Bullet text slide sample Text - the first letter of...
  • Socialisation and Culture - Socsci talk - HOME

    Socialisation and Culture - Socsci talk - HOME

    Refers to the culture of ordinary people, particularly those living in pre-industrialized societies. Examples include traditional folk songs and stories that have been handed down from one generation to another.
  • Amnesia - proiectimpreunareusim.files.wordpress.com

    Amnesia - proiectimpreunareusim.files.wordpress.com

    Amnesia - very active and sometimes noisy. How to playThere are many variants of this game, but the principle remains the same. Everyone has the name of a famous person (fictional or real) stuck onto their back (or forehead) in...
  • Snímek 1 - gym-karvina.cz

    Snímek 1 - gym-karvina.cz

    VY_32_INOVACE_12-12 Comparatives and Superlatives Pre-Intermediate Level 1.Monosyllabic -er (dark-darker, big-bigger) -r (nice-nicer) 2.Disyllabic , more syllables -er, -r adjectives:-y,-ow,-le,-er,-ure (busy-busier, clever-cleverer) - more/less polite, expensive Comparatives 1.Monosyllabic the -est (the darkest, the biggest) the - st (the nicest) 2.Disyllabic, more...