I am employed at a small accounting firm. We use various forms of
AIS. One thing we use is an EDP (electronic data processing system.
We use primarily QuickBooks for the accounting process for
recording financial transactions and preparing financial statements. b
We also use another Intuit product called ProSeries for processing
individual, trust, estate, nonprofit, partnership and corporate tax
returns. b We have several other systems but primarily use software. b
We collect and use a lot of sensitive data like financial information,
employee personal information, bank information, tax returns, and
financial reports. b We even have to collect legal documents from time
to time like parenting plans, death certificates, birth certificates,
social security cards, and divorce decrees. b
As the accounting manager, I would make some changes. b We have a
security plan and monitor daily but its our staff that need more
internal controls and upper management follow through. I hear
people sharing passwords all the time which is a against our policy.
Two-factor authentication is used but they still find ways to login to
our system as someone else if they don't have access to the data that
they need. It is frustrating at times. I feel like an audit of AIS security
is warranted on a regular basis by management and certainly more
training/education about internal control.
