A Research on the Internal Control for Information Security

“The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.” The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control–Integrated Framework in 1992. As summarized above one can see the importance of the implementation of an effective control environment, as it sets the foundation for the other 4 components of internal control. The control environment is made up fundamental smaller components. The ones that were particularly relevant to BMIS are the use of board of directors and audit committee, management philosophy and operating style, and human resource policies and practices. If management doesn’t prioritize control, then the rest of the organization will not put precedence on following policies and procedures either. This was clearly evident at Bernard L. Madoff Investment Securities LLC (BMIS), and ultimately led to their downfall.

The design and implementation and objectives of company controls are not adequate to meet the control objectives. The control environment control objective is ineffective. This control objective lacks a written policy on ethical conduct, is lacking oversight from the board of directors and audit committee, lacks a consistent style and philosophy from management, and lacks a strong commitment to competence. The risk assessment control objective is effective but lacks any antifraud program and controls. The information and communication control is ineffective. A virus has been detected and is affecting the files of the company. This control is lacking a strong IT department. The general controls financial reporting control objective is effective but is weak in detecting or preventing material misstatement. The monitoring control objective is ineffective; this control has need of an internal auditor.

| “Security controls are the management, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the system and its information” (NIST SP 800, 2009). The control allows the organization to efficiently mitigate the risk coming from the use of information System (IS) to conduct business operations and processes.

Internal control is one of the integral parts of an organization. It is a system which controls different types of risks,

Internal controls represent an organization’s processes and procedures used to meet its goals and objectives and serve as a defense in safeguarding assets and preventing and detecting errors, fraud, and abuse. Effective internal controls provide reasonable assurance that an organization’s objectives are achieved through (1) reliable financial reporting, (2) compliance with laws and regulations, and (3) effective and efficient operations. The passing of the Sarbanes-Oxley Act of 2002, as well as the numerous corporate frauds and bankruptcies over the past decade—including some

Internal controls prevent errors and irregularities from happening. If errors or irregularities do happen to occur internal controls will help ensure that they are detected in a timely manner. Internal controls also encourage adherence to prescribe policies and procedures. Internal control are also put into place in order to protect employees by outlining tasks and responsibilities, providing checks and balances, and also from being accused of misappropriations, errors and irregularities.

The final responsibility for the integrity of an SEC registrant’s internal controls lies on the management team. U.S. companies need to refer to a comprehensive framework of internal control when assessing the quality of financial reporting to determine that financial statements are being presented under General Accepted Accounting Principles, GAAP. The widely used framework is referred as COSO, Committee of Sponsoring Organizations of the Treadway Commission, sponsored by the following organizations American Accounting Association, the American Institute of CPA’s, Financial Executives International, the Institute of Internal Auditors, and the Institute of Management Accountants. COSO’s defines internal control as:

There were a number of factors that contributed to the breach, which had they been addressed or had corresponding mitigation responses in place, would have reduced the likelihood that the breach would have taken place, or at a minimum reduce the impact of the attack. These items range from policy related issues, technology implementations, and security management and maintenance. Although I believe a number of these areas were in the process of being addressed, based on the information gathered regarding the details of the incident, it appears that it was still in many areas insufficient and would not have prevented an incident even if there had been more time available to perform the implementations.

The control environment is what sets the tone for an organization and is the foundation for all other components of internal control. It provides discipline and structure and reflects the ethical values, integrity and competencies of the organization. The control environment is very important to effective internal control over financial reporting to an audit client like WorldCom, because good designs can prevent and detect frauds and errors. But because WorldCom had such a poor control environment, the company would require more testing for an audit. This shows that the board did not exercise oversight responsibilities over financial reporting or internal controls.

“Internal controls are policies and procedures put in place to ensure the continued reliability of accounting systems” (Ingram 2017). WorldCom’s attempts at maintaining internal controls are less than favorable. Segregation of duties enables the division responsibilities to ensure that no employee completes two similar tasks. The CEO’s monitoring of WorldCom’s financial processes shows that the company has a lax segregation of duties, which makes it easier to commit fraud. Access controls protect financial data from unauthorized access, however, WorldCom’s extent is password-protected computers. No access inventories are taken to monitor employee usage, so there is no trail of when employees are doing during work.

ABSTRACT: Information Technology General Controls (ITGCs), a fundamental category of internal controls, provide an overall foundation for reliance on any information produced by a system. Since the relation between ITGCs and the information produced by an organization’s various application programs is indirect, understanding how ITGCs interact and affect an auditor’s risk assessment is often challenging for students. This case helps students assess overall ITGC risk within an organization’s information systems. Students identify

This paper can help in understanding how the board, management, and internal audit each have a significant role in ensuring information security is effective. We can learn that internal auditing can also help prepare the organization for an external regulatory audit (SOX or HIPAA, for example) by evaluating management 's efforts and providing recommendations for improvement prior to the external audit. This can help in understanding that IT security audits contribute to an organization 's regulatory compliance efforts by confirming to senior management and

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.

Effective internal controls protect a company’s assets, maintain compliance, improve operations, prevent fraud, and promote accuracy in financial reporting. In 1992 the

Good cash management is extremely important for ensuring that the company has adequate cash to maintain company functions. As mentioned earlier, internal controls can help protect company assets and improve the reliability and accuracy of company records. The kinds of internal controls that I plan to set in