Part B - Accounting information systems

What is the MMoL to remember the steps of the relational database

1. Separate based on the primary key. For what is the primary key put a PK next to it and then add things related to that under it called the “attributes” put this in a table.

2. Any attribute not related leave out

3. Connect the tables with the knowledge of being either optionality (does__ have to connect to this) and cardinality (how many __ can ___ have to___)

4. Create bridging table if needed. Add the two primary key together and label it composite PK. Put the two primary key before under it and lable it as FK. Add any attributes to the bridging table.

5. Connect the bridging table with optionality and cardinality.

6. Delete any old connections without the bridging table.

MMoL Story

• So we need to assign it based on who can reproduce with who relational database

• We have a pakistani and indians determine the PK

• we seperate them and put them in differnte areas put PK into appororaite seperate tables.

• We see someone whos afghani and sri lankan and we put them in their relevant table put attribute in their table

• We see a white person and leave him out those with no attribute leave out

• A person with a fork bites the two people and spits them out see based on the optionality and cardinalityi

• The person gets high adn runs to a bridge and pushes many people off briding table if there is a many to many relationship

• he meets another person like him and becomes composite with him add the two primary key together and they become composite key label

• they then go back to teh original primary key and throw a globe at it put primary key under it and label it as foreign key

• After that they get the white guy and incporate him attribute not attribted last time gets added to the bridging table

• They get a fork and card and turn the white guy into glue aand use it to make a massive bridge connect the database based on the bridging table optionality and cardinality

• the people then die afterwards delete the old connection

What is data validity and how is it an advantages over traditional ledgers from a data perspective

Miners verify validation of transactions
by a majority consensus prior to entry in
a blockchain ledger

What is data retention and how is it an advantages over traditional ledgers from a data perspective

Each node can potentially back up the
entire blockchain ledger to provide
multiple copies.

What is Data
integrity and how is it an advantages over traditional ledgers from a data perspective

A transaction is immutable once entered
into a blockchain ledger and cannot be
changed or deleted.

What is data security and how is it an advantages over traditional ledgers from a data perspective

A majority of participants in a blockchain
must generally engage in fraud
malfeasance for it to happen

what is data transparency and how is it an advantages over traditional ledgers from a data perspective

A blockchain is widely distributed,
whereas a traditional ledger is not.

How do you MMoL the system flowchart1

1. Where does the data come from

   1. is it electronic or non-electronic where it comes form

   2. draw this

2. Identify the main processing activity

   1. is it performed by humans or by computer

3. Identify the database

   1. draw this

4. identify the output if applicable

   1. draw this

swirl - document

stakced swirl - multiple documents

condom - electronic output

electronic data entry - slant

rectangle - computer processing

upsdie down trapzium - manualy complete process

cylinder - database

snail shell - magnetic tape

traingle letter “NAD” - filing of paper document

rhombus - paper journal

arrow - flow

lighting arrow - change geographical area

oval - terminal

slanted kite - decision

MMOL Story

• i want to see how to get flow haircut system flowchart

• i then see whether i can ge tit through the diffuser or prodcut is it electronic or non-electronic data

• i then note it down draw

• dr justin sung sees me and asks if i did it manually or used ai human or computer process

• he sends me to ics database

• i look for an exit output

• i find the exit and leave but then i begin feeling sick and swirl

• i lose all the documents because of the swirl

• then i begin levitating and swirling even more stacked wril

• the paper startrs going all around me as a result multiple documents

• then i find a condom condom

• and then i blow into it electrical output

• someon in the sky does data entry

• i fall down onto a slant

• i notice a tv remote rectange

• i click on it and the sky says processsing computer processing

• then i turn upside down and theres a trap house upside down trapezium

• i decide to menually remove the shoes on the electric pole manulaly complete the process

• i then fall as im doing this and notice a bong in teh huose cyclinder

• i wonder wahts something like that doing in icanstudy database

• i take a hit and notice a snail shell and grab it

• its magnetic and im attatched to it magnetic tape

• the upside down traingel of NAD is there

• it has papers all around it paper filing

• then a rhino charges through rhombus

• it has the journal old of mine there paper journal

• i decide to go after it usign teh arrrow

• its too slwo so i hit it and it becomes lighting but i get teleportteed lighting arrowb

• i arrive at a random oval

• tehre is an airport terminal rihgt next oit

• i see a kite going up form it ktie

• i think should i go or not decision

What is the segregation of duties

Custodial Function

• Handling cash or funds at the bank

• Approving the release of funds

• Receiving cash in the mail

Authorization function

• authorizing the transaction

Recording function

• preparing source documents

• maintaining journals, ledgers etc.

What are the two types of data encryption methods

Symmetric

• Uses a single key to encrypt and decrypt data.

• Both parties must know the shared key and securely exchange it beforehand.

• A separate key is required for each party communicating with the organization; the same key cannot be securely shared among multiple parties.

Assymetric

• Uses two keys: Public key (accesible to everyone) and private key ( kept secret and used to decrypt)

• Public ckey can be used by all trading partners

Why do we use encryption

• It’s a preventive control used to protect confidentiality and privacy

• it’s the process of transforming normal text (plaintext) into unreadable gibberish (ciphertext). This can be reved via decryption.

Why does hashing not encrypt

Hashing in blockchain does not encrypt data because hashing and encryption have different purposes.

• Hashing converts data into a fixed-length hash to verify data integrity and detect tampering. It is a one-way process and cannot normally be reversed to recover the original data.

• Encryption converts readable data into unreadable ciphertext using a key to keep information confidential. It can be reversed using the appropriate decryption key.

Case: Reef Retail

Reef Retail is an online store that keeps customer names, addresses and payment details in one database. Management estimates a 4% chance per year of a data breach. If a breach occurs, the firm expects to lose $500,000 (legal costs, customer compensation, lost sales).

The IT manager is considering one of two security packages:

• Package A, “ShieldPro”: from a large, established security vendor with 24/7 support. It reduces the likelihood of a breach from 4% to 1% and costs $9,000 per year.

• Package B, “QuickGuard”: from a start-up that launched six months ago, with email-only support. It reduces the likelihood from 4% to 2% and costs $3,000 per year.

(a) Calculate the net expected benefit of each package. (4 marks)

(a) First find the expected loss with no package: $500,000 × 4% = $20,000.

	No package	Package A	Package B
Likelihood	4%	1%	2%
Expected loss	$20,000	$5,000	$10,000
Reduction in expected loss	n/a	$15,000	$10,000
Less annual cost	n/a	($9,000)	($3,000)
Net expected benefit	n/a	$6,000	$7,000

remember to compare it based on the benefic you get, the $5 000 reduction is sitll a loss but hte benefit you get is of $15 000 of it not happpening in the first place.

Question 2: One of the firm’s warehouse areas is located in a climate-vulnerable area. The likelihood of an extreme climate event (e.g., earthquakes, floods, typhoons) to occur and damage the warehouse area is estimated as small as 1%; however, once the event(s) occur(s), the firm is estimated to suffer an annual loss of 800,000 in the affected financial year. Concerned with the extreme climate event(s), the firm owner has considered purchasing one of the following insurance plans:

Plan #1: The “Full-Protect” plan offered by a small local insurance company established just one month ago. This insurance plan promises to compensate the firm $750,000, once the warehouse area is damaged by any extreme climate event(s). The insurance plan, however, will cost the firm an annual premium of $5,000.

Plan #2: The “Eco-Save” offered by an experienced large insurance company. This insurance plan promises to compensate the firm $400,000, once the warehouse area is damaged by any extreme climate event(s). The insurance plan, however, will cost the firm an annual premium of $1,700.

Please advise the firm owner which plan to purchase based on (a) the net expected benefits brought by the two plans,

Formula: expected value = impact × likelihood.

(a) Net expected benefit of each plan

The benefit of a plan is the compensation it is expected to pay, which is the payout multiplied by the 1% likelihood. Subtract the premium to get the net benefit.

	Plan #1 (Full-Protect)	Plan #2 (Eco-Save)
Compensation if event occurs	$750,000	$400,000
Likelihood	1%	1%
Expected compensation	$7,500	$4,000
Less annual premium	($5,000)	($1,700)
Net expected benefit	$2,500	$2,300

1. List the numbers: impact, likelihood, and each option’s cost.

2. Work out each option’s expected benefit:

   • Insurance: payout × likelihood

   • Control that lowers likelihood: impact × (old % − new %)

   • Control that lowers impact: (old impact − new impact) × likelihood

3. Subtract the cost: net benefit = expected benefit − cost.

4. Decide: positive means worth it. When comparing options, the higher net benefit wins financially.

5. Add ONE non-financial point tied to the case (e.g. the insurer’s reliability, uncovered loss, support quality), then give a clear recommendation.

BrightPay is a small payroll service that stores clients’ employee data on a cloud server. The IT manager has set up a security package and estimates the following:

• Attackers would need 2 days to break through the firewall and login controls.

• The intrusion detection system would spot an attack in progress within 18 hours.

• The incident response team would then need 1 day to contain and stop the attack.

(a) Using the time-based model, is the security package effective? Show your calculation. (2 marks)

(a)

• P = 2 days = 48 hours

• D = 18 hours

• C = 1 day = 24 hours

• D + C = 18 + 24 = 42 hours

48 > 42, so P > D + C and the package is effective. The attack would be stopped 6 hours before the attacker breaks through.

p = time it takes for an attack to break through the preventative controls

D = the time it takes to detect the breach

C = the time it takes to correct the attack and stop the attack

PawPlace is an online pet-supplies store. Its website holds customer accounts and card payment records. The owner has had a security review done, and the estimates are:

• Attackers would need 2 days to get through the firewall and password controls.

• The store’s monitoring software would flag an attack in progress within 1.5 days, because alerts are only reviewed by staff once a day.

• Once an attack is flagged, the outsourced IT provider would need 18 hours to stop it.

(a) Using the time-based model, are the store’s security controls effective? Show your calculation. (2 marks)

a)

• P = 2 days = 48 hours

• D = 1.5 days = 36 hours

• C = 18 hours

• D + C = 36 + 18 = 54 hours

48 < 54, so P > D + C is not satisfied and the controls are not effective. An attacker would have about 6 hours (54 − 48) of access before being stopped.

What is the difference between the inherent risk and residual risk

Inherent risk

the risk that exists before management does anything to control its likelihood or impact.

Residual risk

the risk that remains after management implements internal controls or some other response.

A firm estimates a 20% chance of payroll data errors, costing $10,000 each time. After adding a validation step, the chance falls to 2%. (a) State the inherent and residual expected loss. (b) Explain the difference between inherent and residual risk.

• (a) Inherent = $10,000 × 20% = $2,000. Residual = $10,000 × 2% = $200.

• (b) Inherent risk is the risk before controls; residual risk is what remains after controls are applied. The control reduced the expected loss by $1,800.

Outline the meaning of the four risk responses and examples of it

Reduce (mitigate)

Implement effective internal controls

Policies, procedures, monitoring

Accept

Do nothing; live with the likelihood and impact

Low-risk items not worth controlling

Share (transfer)

Pass part of the risk to someone else

Buy insurance, outsource, hedge

Avoid

Don’t engage in the activity

Sell off a division, drop a product line

For each situation, identify the risk response used. (i) A firm buys flood insurance for its warehouse. (ii) A firm stops selling a product line because of legal exposure. (iii) A firm installs a firewall and trains staff on phishing. (iv) A firm decides the cost of protecting a $200 stationery cupboard isn’t worth it.

Answer:
(i) share/transfer,
(ii) avoid
, (iii) reduce,
(iv) accept.

Outline what are the preventative, detective or corrective controls

• Preventive: acts before, to stop or deter the event. Examples from the slides: locked doors, passwords and PINs, firewalls, encryption, restricting access.

• Detective: acts during or after, to identify the event. Examples: security cameras, intrusion detection systems, log analysis, honeypots.

• Corrective: acts after, to fix the damage and recover. Examples: computer incident response team (CIRT), Chief Information Security Officer (CISO), recovering stolen assets.

Classify each control as preventive, detective or corrective. (i) Requiring a password to log in. (ii) Reviewing system logs weekly for unusual activity. (iii) A computer incident response team restoring systems after a ransomware attack. (iv) A decoy server that alerts staff when someone browses it.

(i) preventive, (ii) detective, (iii) corrective, (iv) detective.

What are the three conditiosn of the fraud trianlge

• Pressure: the motive, either personal (debts) or organisational (targets to hit).

• Opportunity: a weak control that lets someone commit and conceal the act. The slides’ example is lapping: stealing customer A’s payment, then using customer B’s later payment to cover A’s balance, and so on.

• Rationalisation: the excuse used to justify it (“I’ll pay it back”).

A sales clerk with gambling debts is the only person who opens customer cheques and also posts them to accounts receivable. She keeps one cheque and covers the shortfall with the next customer’s payment. She tells herself she’s “just borrowing it”. Identify the pressure, opportunity and rationalisation, and name the technique.

• Pressure: gambling debts.

• Opportunity: she both handles cash and records it, with no segregation of duties or review.

• Rationalisation: “just borrowing it”.

• Technique: lapping.

Name the technique in each case. (i) An email, worded and signed exactly like the firm’s IT consultant, asks staff to confirm passwords. (ii) A USB labelled “Staff bonuses” is left in the car park. (iii) A mass text claims an unpaid parcel fee. (iv) A pop-up warns of spyware and urges a download. (v) An email to the CEO demands an urgent payment. (vi) Typing the bank’s correct web address lands you on a fake login page.

(i) spear phishing, (ii) baiting, (iii) phishing, (iv) scareware, (v) whaling, (vi) pharming.

Name the malware. (i) Records a user’s passwords as they type. (ii) Locks files until Bitcoin is paid. (iii) Spreads across a network on its own. (iv) Looks like a free PDF converter but steals data. (v) Hides itself from the system owner.

Answer: (i) keylogger, (ii) ransomware, (iii) worm, (iv) Trojan horse, (v) rootkit.

What are hte IT Controls

• Physical: tangible barriers (locks, guards, server-room access codes).

• Technical: technology-based measures (firewalls, encryption, antivirus, two-factor authentication, cloud backup, complex passwords, software updates).

• Administrative: policies and behaviour rules (awareness training, security policy, being careful on free WiFi, checking bank statements weekly).

Classify each as physical, technical or administrative. (i) Security guard at the data centre. (ii) Installing antivirus. (iii) Mandatory annual phishing training. (iv) Two-factor login. (v) Lock on the server room.

Answer: (i) physical, (ii) technical, (iii) administrative, (iv) technical, (v) physical.

ClickCart’s developer left a remote admin backdoor in the sales system that is protected only by a shared password. The same administrator can add suppliers, approve payments and edit system logs. For the backdoor: (a) name the weakness, (b) say what could go wrong, (c) give one specific fix.

• (a) An unprotected administrator backdoor.

• (b) An attacker could gain unauthorised access, install malware, change payments or leak customer data.

• (c) Disable the backdoor when it’s not needed, require multi-factor authentication for remote access, and run regular penetration tests to confirm it’s closed.

Repeat for the administrator’s access. The weakness is that one person holds authorisation, recording and system-control powers. They could create a fake supplier, pay it, and delete the logs. The fix is least-privilege access plus an independent review of logs.

Classify each. (i) A report showing last month’s expenses. (ii) Analysis finding that late shipments caused the drop in repeat customers. (iii) A model forecasting bad debts. (iv) A system recommending which customers to offer discounts.

Answer: (i) descriptive, (ii) diagnostic, (iii) predictive, (iv) prescriptive.

What are the steps for ETL

• Extract:

  1. Understand data needs and what’s available.

  2. Obtain and perform the extraction.

  3. Verify quality and document.

• Transform:

  1. Understand the data and desired outcome.

  2. Standardise, structure and clean.

  3. Validate quality.

  4. Document (update the data dictionary).

• Load: store the data in a format the receiving software accepts, check how that software interprets it, and update the data dictionary.

A bar chart shows sales of $9,800 versus $10,000, but the y-axis starts at $9,700, so one bar looks three times as tall. (a) Identify the problem. (b) Give one fix. (c) Name the ETL step where you’d check that two datasets use consistent date formats

• (a) The truncated axis makes a tiny difference look large, which is data deception.

• (b) Start the y-axis at zero.

• (c) Transform, at the standardise and clean step.