Processing Integrity and Availability Controls

Processing Integrity Controls

  • Implemented to ensure information is trustworthy for decision-making.
  • Input Process Stage:
    • Forms design: sequentially prenumbered, turnaround documents.
    • Cancelation and storage of source documents.
    • Data entry controls.

Data Entry Controls

  • Field check: Proper data type.
  • Sign check: Appropriate arithmetic sign.
  • Limit check: Numerical amount vs. fixed value.
  • Range check: Numerical amount within limits.
  • Size check: Input data fits field.
  • Completeness check: All required data entered.
  • Validity check: Data exists in master file.
  • Reasonableness test: Logical relationship between data items.
  • Check digit verification: Recalculate check digit.

Additional Data Entry Controls

  • Batch processing:
    • Sequence check: Proper numerical/alphabetical sequence.
    • Batch totals: Financial, hash, record count.
  • Online data entry controls:
    • Prompting: System prompts for input.
    • Closed-loop verification: Retrieves and displays related information.

Processing Controls

  • Data matching: Match items before action.
  • File labels: Correct, updated file used.
    • Header records: Beginning of file.
    • Trailer records: End of file.
  • Recalculation of batch totals.
  • Cross-footing: Verifies accuracy by comparing two alternative ways of calculating the same total.
  • Zero-balance tests: Proper value in control accounts.
  • Write-protection mechanisms: Protect against overwriting.
  • Concurrent update controls: Prevent errors from simultaneous updates.

Output Controls

  • User review of output.
  • Reconciliation procedures: Reconcile to control reports; external data.
  • Data transmission controls:
    • Checksum: Hash to verify accuracy.
    • Parity bit: Extra bit added to each character.
    • Blockchain: Ensure validated documents aren't altered.

Availability

Key Objectives

  • Minimize system downtime.
  • Quick, complete recovery and resumption.

Key Controls to Minimize Downtime

  • Preventive maintenance.
  • Fault tolerance: RAID for redundant data copies.
  • Data center location and design:
    • Raised floor, fire suppression, air conditioning.
    • UPS: Alternative power.
    • Surge protection.
  • Training.
  • Patch management, antivirus software.

Strategic Choice of System Availability

  • Trade-off between cost and time.
  • Consider data loss willingness and tolerable downtime.
  • Recovery Point Objective (RPO): How much data are we willing to recreateHow \ much \ data \ are \ we \ willing \ to \ recreate
  • Recovery Time Objective (RTO): How long can we function without our information system?How \ long \ can \ we \ function \ without \ our \ information \ system?

Key Controls to Recover Normal Operations - Backup Strategies

  • Full backup: Exact copy.
  • Incremental backup: Changes since last partial backup.
  • Differential backup: All changes since last full backup.
  • Multiple backups, off-site storage.

Key Controls to Recover Normal Operations - Disaster Recovery

  • Disaster recovery plan (DRP) to restore IT function.
  • Real-time mirroring: 100% redundant in real-time.
  • Hot site: Fully operational alternative site.
  • Cold site: Prewired site, needs hardware/software.

Key Controls to Recover Normal Operations - Business Continuity

  • Business continuity plan (BCP) to resume all business processes.
  • Regularly test BCP.

Effect of Virtualization, Remote Work, and Cloud Computing

  • Virtual machines run environments from a server; enables remote work.
  • Cloud computing allows real-time collaboration.
  • Risks: Failure to maintain IT practices, potential data loss.