Please enable JavaScript.

Coggle requires JavaScript to display documents.

General Computer Controls - Coggle Diagram

- - - - basic controls that you can implement to ensure things like unauthorised access cannot be obtained. Here you will implement access controls
    - - are the controls that you build into the computer programme to ensure you have maximum controls.
  - - - A computerised environment where users change from preparers/processors of data to users of output
      - Computers are used to enhance controls, saving time and easing workload
    - - Man-made Disasters
        
        Terrorism: can cause physical damage to equipment and infrastructure, disrupt communication systems, and cause panic and fear. War: can cause destruction of infrastructure and communication systems, and disrupt the supply chain.
      - Intentional Damage
        
        Fraud: can cause financial losses and damage to the organization's reputation. Hacking: can result in data breaches, theft of sensitive information, and damage to the organization's reputation.
      - Natural Disasters
        
        Floods: can cause water damage to equipment and infrastructure. Fire: can destroy or damage equipment and infrastructure. Storms: can cause power outages, damages to infrastructure, and disrupt communication systems. Heat waves: can cause equipment to overheat and malfunction.
      - Unintentional Error
        
        Human Error: can result in accidental deletion of important data, misconfiguration of systems, and other mistakes that can cause damage or disruption.
- - - - cyberbullying
      - cyberstalking
      - identity theft
      - phishing scams
      - hacking
- - - - System design and programming standards needed to:
        
        Ensure there is supervision over system design;
        
        Comply with predetermined standards;
        
        Ensure that appropriate control-related programmed procedures are built in;
        
        Done on program library not live data.
        
        Ensure system interacts properly with existing systems and system software;
    - - Testing of a self-developed system should be carried out in 3 stages:
        
        System testing
        
        Ensure the logic of various individual programs links together to form a system in-line with the detailed system description.
        
        Live testing:
        
        Parallel running:
        
        New system in parallel with old system;
        
        Problem: cost of double processing, difficulty of comparison (e.g. additional info).
        
        Pilot running:
        
        Introduce system for only small portion.
        
        Program testing
        
        Checking the logic of the program to their specs.
    - - Two methods of specifying systems
        
        Prototype systems
        
        User department try out
        
        Refine the design through a series of prototypes
        
        Design prototype
        
        Traditional method
        
        Written systems specification by means of discussions between the data processing department and users
      - Definition
        
        Defining the way the system must work
        
        To meet the specification of users and business
    - - Update system documentation:
        
        System flowcharts;
        
        System descriptions;
        
        Operating manuals.
      - Control over conversion of data by data control group:
        
        Supervision by senior management;
        
        Auditor involvement
      - Testing:
        
        Balancing old files with new files;
        
        Third party confirmations
        
        Follow up of exception reports;
        
        Comparison with data run on old system (parallel)
        
        Manual comparison of data
        
        Approval by users.
      - Planning and preparation:
        
        Prepare data files for conversion (e.g. Standing data);
        
        Training of staff
        
        Determine cut-off dates;
        
        Balance files on old system ;
        
        Define methods used (e.g. parallel / pilot);
        
        Balance files on old system ;
        
        Prepare timetables for conversion
      - Backup of new system.
      - Post-implementation review.
    - - Involvement from :
        
        Data processing department
        
        Compatibility with other systems
        
        Operational aspects
        
        Technical soundness
        
        Quality control department
        
        Standard of design
        
        Testing
        
        Documentation
        
        User department
        
        Departmental requirements
        
        Internal / external auditors
      - Perform feasibility study
        
        Buy / self-developed
        
        Cost / benefit analysis
      - Steering committee must ensure that :
        
        Timetables are adhered to
        
        Budgets are achieved
        
        Project authorized
        
        Quality requirements
      - Steering committee
        
        Made up of senior management from both user and computer departments
      - Project team
        
        Day to day management of project
        
        Ensure project is developed in stages
        
        Prepare timetables for each stage
      - Development plan authorized
      - Project authorised after feasibility study/analysis before commence
  - - - Specification and selection of packages
        
        About
        
        Discussions with other users
        
        Observing operation of package
        
        Questioning other users of package:
        
        Speed and efficiency
        
        Ease of use
        
        Freedom from program errors
        
        Quality of support.
        
        Facilities offered by program
      - Implementation and testing of packages
        
        2.) System maintenance controls
        
        Why do we need system change controls? To ensure that all changes we make to our systems are:
        
        All changes are valid
        
        All changes are properly tested
        
        Complete
        
        All information is backed-up and recovery procedures are in place
        
        Objective
        
        To ensure changes to the system is authorised and meet the user’s needs.
        
        Some examples of these types of controls are (See this as a process):
        
        Any change requests made by the users of the system must be approved by the Line Manager of the user and a reason as to why the change is necessary must be provided
        
        All change forms need to be signed by Management or the Computer Steering Committee prior to the change being effected
        
        Change forms are to be pre-numbered and locked away when not required
        
        After the change has been made, an IT expert is to test the change to determine if it has been made as per the approved change request and is working effectively
        
        1.) System development and implementation controls
        
        Implementation:
        
        Involvement of:
        
        User departments
        
        Data processing
        
        Management
        
        Quality assurance
        
        Advantages of purchased systems:
        
        Lower cost and cost is predetermined
        
        Tested thoroughly – thus very reliable
        
        Less implementation time (immediate implementation)
        
        Testing:
        
        Independent testing
        
        Review of experiences of other users.
        
        Disadvantages of purchased systems:
        
        Too general /inflexible to cater for needs
        
        Change maintenance difficult/impossible
        
        Dependent on vendors for maintenance
        
        Written overseas (Vat and Tax differs).
        
        3.) Organisational and management controls
        
        About
        
        IT Governance (King IV) should be adhered to/implemented
        
        Management should be committed to controls such as:
        
        Data file protection
        
        Staff should be informed of dangers
        
        Controls against viruses
        
        Supervision and Review
        
        Segregation of duties
        
        There should be proper reporting levels;
        
        Objective:
        
        Organisational framework such as segregation of duties (SOD), supervision and review and virus protection.
        
        Examples of these types of controls include, but are not limited to the following:
        
        Computer steering committee set IT policies and exercise control over IT activities
        
        The rotation of operator duties
        
        System development staff not assigned to operator duties
        
        Top Management should be committed to controls and to implement management controls such as establishing an Internal Audit department
        
        At least two operators per shift (scheduling of staff)
        
        CIS manager should report to senior management
        
        Staff should take regular leave
        
        Computer department is to be represented on the Board of Directors/Governing Body
        
        Training of staff and career development
        
        Supervision and review
        
        Controls against computer viruses
        
        Data file protection:
        
        Install virus detection software
        
        Test data files for viruses before use
        
        Regular backups
        
        Staff:
        
        Train users of microcomputers
        
        Reporting procedures in case of infection
        
        Inform staff members against dangers
        
        Limit the use of microcomputers to authorised staff
        
        Software protection:
        
        Take care with use of “free” of “public domain” programs
        
        Do not lend out program disks
        
        Software purchases from should be done from a reputable supplier
        
        Do not use illegal copies
        
        Supervision and review:
        
        By CIS manager, divisional managers, section heads
        
        System investigations by internal and external audit
        
        4.) Access controls
        
        Objective:
        
        Restrict unauthorised access to terminals and data
        
        Programmed access controls:
        
        3.) Authorisation of users
        
        4.) Monitor of access & processing
        
        2.) Identification of users
        
        5.) Communication lines & networks
        
        6.) Password control
        
        7.) Programme libraries
        
        1.) Terminals
        
        8.) Utlilities
        
        1.) Terminals:
        
        Limited access to system (to specific applications)
        
        Automatic log off after 5 minutes of non-use
        
        TINS (Terminal identification numbers) (Username)
        
        Shut down after 3 unsuccessful login attempts
        
        Limited to 1 workstation log on;
        
        Investigation into each disconnection;
        
        Simultaneous login prohibited
        
        2.) Identification of users
        
        Verify IP address
        
        Magnetic cards
        
        User ID’s & passwords
        
        Voice recognition / fingerprints (use of biometric data).
        
        3.) Authorisation of users:
        
        Passwords
        
        Multilevel passwords
        
        Logon ID’s
        
        User matrixes
        
        Passwords for specific authorised levels
        
        4.) Monitor access and processing:
        
        Console logs and activity registers
        
        Application software (unauthorised access)
        
        Audit trails reviewed for daily activities
        
        Firewalls
        
        5.) Communication lines and networks:
        
        Identification data
        
        Different routes for sensitive data
        
        Dial & dial back
        
        Encryption of data
        
        Passwords
    - - Package must meet user requirements:
        
        Prepare statement of requirements
        
        Measure available packages against requirements.
      - Keep in mind:
        
        If modifications is necessary, use normal rules w.r.t. system development;
        
        Possibility of future amendments (e.g. tax updates);
        
        Minimum changes should be made to package;
        
        Quality of maintenance service from supplier.