ACC 542 Week 4 Internal Control and Risks in Information Systems Example

A Spoofed Email, a Changed Wire and a Locked Server: Assessing Information System Risks and Controls at a Composite Title and Escrow Company Using COSO and COBIT

[Student Name]

University of Phoenix

ACC/542: Accounting Information Systems

Week 4 Assignment

[Instructor Name]

[Date]

The company, its incidents and all figures are composites written for a model paper; frameworks and research findings come from the sources listed.

A composite title and escrow company handles about 4,200 residential and commercial closings a year across two states. On a typical day, its escrow accounts hold $30 to $60 million of buyers' deposits, lenders' funds and sellers' proceeds, and it sends dozens of wires. Last spring, an escrow officer got a message, seemingly from a seller, with new wire instructions for $186,000 of proceeds. The officer changed the instructions and sent the wire. The seller's email had been spoofed, and most of the money was never recovered. The loss did not come from a failure of technology alone; it came from a process that let an email change where money went. This paper assesses the company's information system risks and designs controls.

The Company's Systems and Data

The company uses a title production system to manage closings, an escrow accounting system that tracks every dollar held for each file, a banking portal for wires, email for communication with parties and a document system storing nonpublic personal information such as Social Security and bank account numbers. Staff work at eight offices and from home.

Risks by Security Objective

Risks can be organized by the objectives they threaten. Confidentiality is threatened by theft of client data through phishing or lost devices. Integrity is threatened by unauthorized changes to wire instructions or escrow records, as in the spring incident. Availability is threatened by ransomware that could lock the title production system and stop closings. Processing integrity is threatened by errors in disbursement calculations or reconciliation.

Mapping to COSO and COBIT

The COSO framework's five components, control environment, risk assessment, control activities, information and communication and monitoring, provide the overall structure (Committee of Sponsoring Organizations of the Treadway Commission, 2013). Its principle on technology general controls calls for control activities over technology infrastructure, security and acquisition and maintenance. COBIT 2019 provides more specific governance and management objectives for information and technology, such as managing security services, managing changes and managing continuity (ISACA, 2018). Wire instruction changes fall under COSO control activities and COBIT's objectives for managing business process controls and security services; ransomware falls under continuity and security.

Existing Controls

The company already requires dual approval for wires over $500,000, uses email filtering, reconciles each escrow account daily to the bank and backs up the title system nightly. Those controls address large wires, some phishing and reconciliation errors. But the spring wire was below the dual approval threshold, the spoofed email passed the filter because it came from a lookalike domain and the backups were stored on the same network as production systems.

Preventive Controls

The company will require that any change in payment instructions be verified by calling the party at a phone number already on file from the opening of the file, never one in the email. It will require dual approval for all outgoing wires, with the second approver reviewing the callback record. It will enable multifactor authentication on email and the banking portal, block lookalike domains and mark external emails. It will limit who can edit wire instructions in the escrow system and review that access quarterly.

Detective Controls

Daily escrow reconciliations will be supplemented by a report of every change to payee or bank information, reviewed each afternoon by the escrow manager. Email and system logs will be monitored by an outside security provider, with alerts for logins from unusual locations. Customers will receive a notice at file opening that the company never changes wire instructions by email, so they can report suspicious messages.

Corrective Controls

Backups will be copied daily to storage disconnected from the network and tested quarterly by restoring the title system in a test environment. The company will adopt an incident response plan naming who contacts the bank to attempt a wire recall, who notifies law enforcement and clients and how closings continue manually if systems are down. Its cyber insurance will be reviewed to confirm coverage for social engineering losses.

People and Training

Most attacks on title companies begin with a person, not a server. The company will require quarterly training for all staff on recognizing phishing and payment fraud, with simulated phishing emails and follow-up coaching for anyone who clicks. Escrow officers will receive additional training on the callback procedure and on the pressure tactics fraudsters use, such as urgent requests on the day of closing. New hires will complete training before they receive access to the escrow system. The owners will sign an annual statement reaffirming that no one, including them, may bypass the callback procedure, which strengthens the control environment component of COSO.

Vendors and Remote Work

The title production system and the banking portal are hosted by vendors. The company will obtain each vendor's service organization controls report annually, review it for exceptions and confirm that it performs the complementary controls the reports assign to customers, such as reviewing user access. Staff working from home will use company laptops with disk encryption and a virtual private network, and personal devices will not be allowed to access client data.

Cost and Practicality

The callback procedure costs staff time, about five minutes per wire, and may delay some closings. Multifactor authentication and monitoring cost about $60,000 a year. Offline backups and testing cost about $25,000 a year. Against a single loss of $186,000 and the reputational harm of losing client funds, the costs are justified.

Evaluating the Deficiency

The lost wire revealed a deficiency: no control required independent verification of changed payment instructions. Given the frequency of wires and the size of possible losses, the likelihood and magnitude of a material loss of client funds are both significant. For the company's auditors, who audit its financial statements and escrow accounts, the deficiency would be at least a significant deficiency. Li et al. (2012) found that companies reporting IT control weaknesses also showed lower quality in management's own forecasts, evidence that such weaknesses affect the information managers rely on, not only the financial statements.

Regulatory and Contractual Duties

Beyond its own losses, the company has duties to others. State insurance regulators oversee title agents, lenders impose security requirements in their closing instructions and federal privacy rules require safeguards for customers' nonpublic personal information, including a written information security program. The new controls also help the company meet those obligations and document that it has done so.

Monitoring

The controller will report quarterly to the owners on wire exceptions, access reviews, backup tests and training completion, and an outside firm will perform an annual assessment against COBIT objectives.

Conclusion

The title and escrow company's systems face risks to confidentiality, integrity and availability, with wire fraud and ransomware the most severe. Existing controls covered large wires and reconciliations but not changed instructions or offline recovery. Preventive callbacks and dual approval, detective change reports and monitoring and corrective offline backups and an incident plan, mapped to COSO and COBIT, address the risks at a cost well below the loss already suffered.

References

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control, integrated framework.

ISACA. (2018). COBIT 2019 framework: Introduction and methodology.

Li, C., Peters, G. F., Richardson, V. J., & Watson, M. W. (2012). The consequences of information technology control weaknesses on management information systems: The case of Sarbanes-Oxley internal control reports. MIS Quarterly, 36(1), 179-203. https://doi.org/10.2307/41410413