10.7 Which control(s) would best mitigate the following threats?
a. The hours worked field in a payroll transaction record contained the value 400
instead of 40. As a result, the employee received a paycheck for $6,257.24 instead
of $654.32.
b. The accounts receivable file was destroyed because it was accidentally used to
update accounts payable.
c. During processing of customer payments, the digit 0 in a payment of $204 was
mistakenly typed as the letter “O.” As a result, the transaction was not processed
correctly and the customer erroneously received a letter that the account was
delinquent.
d. A salesperson mistakenly entered an online order for 50 laser printers instead of
50 laser printer toner cartridges.
e. A 20-minute power brownout caused a mission-critical database server to crash,
shutting down operations temporarily.
f. A fire destroyed the data center, including all backup copies of the accounts
receivable files.
a. After processing sales transactions, the inventory report showed a negative
quantity on hand for several items.
b. A customer order for an important part did not include the customer’s address.
Consequently, the order was not shipped on time and the customer called to
complain.
c. When entering a large credit sale, the clerk typed in the customer’s account
number as 45982 instead of 45892. That account number did not exist. The
mistake was not caught until later in the week when the weekly billing process
was run. Consequently, the customer was not billed for another week, delaying
receipt of payment.
d. A visitor to the company’s Web site entered 400 characters into the five-digit Zip
code field, causing the server to crash.
e. Two traveling sales representatives accessed the parts database at the same time.
Salesperson A noted that there were still 55 units of part 723 available and
entered an order for 45 of them. While salesperson A was keying in the order,
salesperson B, in another state, also noted the availability of 55 units for part 723
and entered an order for 33 of them. Both sales reps promised their customer
next-day delivery. Salesperson A’s customer, however, learned the next day that
the part would have to be back-ordered. The customer canceled the sale and
vowed to never again do business with the company.
f. The warranty department manager was upset because special discount coupons
were mailed to every customer who had purchased the product within the past 3
years, instead of to only those customers who had purchased the product within
the past 3 months.
g. The clerk entering details about a large credit sale mistakenly typed in a
nonexistent account number. Consequently, the company never received
payment for the items.
h. A customer filled in the wrong account number on the portion of the invoice
being returned with payment. Consequently, the payment was credited to
another customer’s account.
i. A batch of 73 time sheets was sent to the payroll department for weekly
processing. Somehow, one of the time sheets did not get processed. The mistake
was not caught until payday, when one employee complained about not receiving
a paycheck.
q. Sunspot activity resulted in the loss of some data being sent to the regional office.
The problem was not discovered until several days later when managers
attempted to query the database for that information.
10.8 MonsterMed Inc. (MMI) is an online pharmaceutical firm. MMI has a small
systems staff that designs and writes MMI’s customized software. The data center is
installed in the basement of its two-story headquarters building. The data center is
equipped with fire suppression equipment and an uninterruptible power supply
system.
Because the programming staff is small and the work demands have increased,
backups are only made whenever time permits. The backup files are stored in a
locked cabinet in the data center. Recently, due to several days of heavy rains,
MMI’s building recently experienced serious flooding that destroyed not only the
computer hardware but also all the data and program files that were on-site.
Required
Identify at least five weaknesses in MonsterMed Inc.’s backup and DRP procedures.
1. No written backup.
2. No written disaster recovery plan.
(Adapted from CMA Exam)
10.9 Excel Problem
Create data validation rules in a spreadsheet to perform each of the following controls:
a. Limit check – that values in the cell are < 70
e. Size check – that cell accepts no more than 40 characters of text
f. Reasonableness check – that cell’s value is less than 75% of cell to its left
g. Validity check – that a value exists in a list of allowable values
h.
i.
j.
l.
m.
n.
p.
q.