211021 INF462 2021 10 21 at 10 11 GMT 7

New Section

This section introduces the topic of internal control, governance, and management of information technologies.

Internal Control Framework and Governance

• The discussion covers the internal control framework, including its definition, development, implementation, testing of controls, and the study and application of control objectives.

• Various frameworks such as COBIT and COSO are mentioned as standards in this context.

• Governance of information security is explored along with information security management within organizations.

Security Measures Implementation

• Detailed security measures implementation is discussed, emphasizing access control to prevent unauthorized access through biometric controls or database registration.

• Technical aspects like controlling user access and implementing secure password policies are highlighted.

Technology Management and Monitoring

• The role of technology management in monitoring compliance with governance guidelines is explained.

• Shift from traditional accounting-focused internal controls to modern technology-driven controls due to past scandals related to financial data manipulation is outlined.

Next Section Title

This section delves into restructuring processes, quality management, external audits, outsourcing controls, decentralization of information systems, and data center significance.

Process Restructuring and Quality Management

• Discussion on process reengineering for modifying business processes effectively.

• Total Quality Management's role in ensuring system quality through testing procedures is emphasized.

External Audits and Outsourcing Controls

• Importance of external audits for certification purposes or state audits for compliance verification is highlighted.

Decentralization and Data Center Security

• Decentralization implications on maintaining accurate documentation for changes within a company are discussed.

Data Center Operations

• Significance of data centers in centralizing business information like financial data, human resources details, legal aspects, etc., is explained.

Information Integrity and Security Measures

Dependence on Information Technology and Internal Controls

The discussion revolves around the impact of technology dependence, external attacks, poor decisions, and dissatisfied users on businesses. It also delves into the importance of internal controls in mitigating risks associated with information technology.

Impact of Technology Dependence

• Organizations increasingly rely on technology for operations.

• Challenges arise from the evolving nature of information technology.

• Balancing information availability and integrity is crucial for business operations.

Adaptation to Technological Changes

• Continuous adaptation of equipment and software is necessary.

• Maintenance costs are often underestimated by companies.

Internal Controls in Information Technology

Internal controls play a vital role in ensuring business objectives are met while preventing or detecting risks related to information technology.

Objectives of Internal Controls

• Internal controls aim to achieve business objectives and manage risks effectively.

• Importance of implementing internal controls specific to IT management.

Monitoring Internet Usage

• Monitoring internet access within the organization is essential.

• Common issues like slow internet can be linked to personal use during work hours.

Bandwidth Control and Productivity

• Bandwidth control measures can enhance productivity and reduce costs.

Internet Usage Monitoring in Companies

The discussion revolves around the importance of monitoring internet usage in companies to ensure productivity and security.

Risks of Unrestricted Internet Access

• Employees accessing unsafe websites or receiving harmful emails pose risks to company data security.

• Monitoring internet usage is crucial for technical, cost, and company image reasons.

Impact on Company Productivity

• Controlling internet use by employees is essential for maintaining company image and commercial audience perception.

• Excessive internet use can lead to decreased work capacity and production efficiency.

Implementing Restrictions for Efficiency

• Limiting access through proxies, blocking specific websites, and applying filters are effective measures.

• Regulating email content, restricting chat access, and limiting visits to distracting sites enhance productivity.

Security Measures in Internet Usage

Exploring strategies to mitigate risks associated with unrestricted internet access in the workplace.

Bandwidth Management

• Bandwidth saturation due to excessive downloading impacts operational and economic aspects of a company.

• Limiting access helps prevent delays in transactions and ensures efficient work processes.

Access Control Techniques

• Blocking specific web content based on keywords or categories enhances security.

• Restricting chat access to internal platforms reduces distractions and potential security breaches.

Filtering Content

• Implementing filters for specific websites or keywords minimizes distractions like sports or adult content.

• Preventing excessive browsing on non-work-related sites improves employee focus and overall productivity.

Employee Monitoring Systems

Discusses the necessity of monitoring employee internet usage for organizational efficiency and data security.

Restricting Non-Essential Activities

• Prohibiting access to time-wasting sites such as sports, gossip, or shopping platforms boosts employee focus.

• Implementing strict filters against pornographic content prevents distractions during work hours.

Employee Surveillance Methods

• Identifying top internet users within the organization aids in targeted monitoring efforts without infringing on all employees' privacy.

Regulations and Control in Technology

The discussion revolves around the importance of regulations and control in technology, particularly focusing on the risks associated with leaving devices uncontrolled.

Experience with Regulations

• Organizations are starting to realize the need for controlling and regulating devices due to the risks they pose as entry points for attacks.

Internet Access Control Challenges

• Implementing internet access controls has been a significant challenge, especially in countries with low technological development.

Internal Technological Development Challenges

• Countries with limited internal technological development face challenges in implementing effective IT controls due to a lack of expertise and infrastructure.

Internal IT Controls and Objectives

This section delves into internal IT controls, their significance, and objectives within an organization.

Role of Internal IT Controls

• Internal IT controls monitor daily information system activities to ensure compliance with set standards and procedures.

Ensuring Correctness of Measures

• The primary mission of internal IT controls is to verify the correctness and validity of measures implemented by responsible parties.

Objectives of Internal Control

Exploring the objectives of internal control, emphasizing desired outcomes through control procedures.

Defining Control Objectives

• Control objectives articulate desired results or purposes achieved by implementing control procedures in specific activities.

Technical Aspects of IT Controls

• In technology, control objectives are achieved through technical components like fingerprint readers, firewall rules, or router configurations.

Main Objectives of Control Processes

Highlighting key objectives within control processes related to safeguarding assets, ensuring operational efficiency, and compliance.

Key Objectives Categorized

Integrity and Security in Information Technology Systems

In this section, the speaker discusses the importance of ensuring accuracy, integrity, and security in information technology systems. Various controls such as preventive, detective, and corrective measures are highlighted to maintain the integrity of data and prevent unauthorized access.

Ensuring Accuracy and Integrity

• Data integrity is crucial for databases to ensure operations are processed correctly without errors or omissions.

• Control procedures involve a series of steps to achieve specific goals, emphasizing the need for controls across all functions within an organization.

Types of Controls

• Different types of controls include strategic controls, data access controls, system development controls, quality assurance procedures, physical access controls, continuity plans, and disaster recovery measures.

Preventive Controls

• Preventive controls aim to avoid errors or fraudulent activities by implementing measures like firewalls and biometric access control systems.

• Examples of preventive controls include security software to prevent unauthorized access and controlling physical facility access.

Detective Controls

• Detective controls alert about issues after they occur; examples include monitoring unauthorized server access attempts or error messages in logs.

Types of Controls: Preventive, Detective, Corrective

This section delves into preventive, detective, and corrective controls within information technology systems. Each type plays a vital role in maintaining system integrity by preventing issues before they arise (preventive), detecting problems promptly (detective), or rectifying incidents post occurrence (corrective).

Detective Controls Functionality

• Detective controls identify errors or malicious acts promptly through various means such as error messages in logs or verification checks on calculations.

Corrective Controls Importance

• Corrective controls aid in returning systems to normalcy post-incidents by minimizing threats' impact through actions like recovering damaged files from backups or contingency planning.

Employee Roles & Software Utilization Control

The discussion shifts towards employee roles concerning information technology systems. It emphasizes the significance of segregating duties among employees to enhance security measures. Additionally, controlling sensitive software usage is crucial for effective system management.

Employee Role Segregation

• Employees should have distinct roles without overlapping responsibilities like being both a programmer and a database administrator to mitigate significant security risks.

Software Utilization Control

Detailed Overview of IT Controls

In this section, the speaker discusses the importance of controls in information technology systems, focusing on operational controls, access controls, and segregation of duties.

Operational Controls

• Operational controls involve effective segregation of functions within departments to ensure proper supervision and access control.

• "Controles operativos del departamento de una efectiva segregación de funciones."

• These controls include daily operational supervision of privileged users and manuals for operation and control.

• "Manuales de operación y control operativo diaria supervisión de usuarios privilegiados."

Access Controls

• Access controls are crucial for protecting sensitive software and system development.

• "Control sobre el software sensitivo y controles sobre el desarrollo del sistema."

• Segregation of duties is emphasized to regulate access to different parts of the system, preventing unauthorized actions.

• "Segregación de funciones para el acceso a diferentes partes."

Risk Mitigation through IT Policies

• Implementing controls as part of IT policies helps mitigate risks related to unauthorized data or program access.

• "Implementamos controles como parte de las políticas sobre informática para mitigar los riesgos."

• Unauthorized access by employees or third parties can lead to data breaches with detrimental effects on individuals and organizations.

• "Personas no autorizadas pueden tener acceso directo a archivos de datos o programas."

Ensuring Software Integrity Through Change Control

This segment focuses on maintaining software integrity through change control processes to prevent unauthorized modifications that could compromise financial data reliability.

Change Control Process

• Proper documentation and approval from appropriate managerial levels are essential before implementing any software modifications.

• "Solicitud de modificación deben ser documentadas y aprobadas por un nivel gerencial adecuado."

• Changes should be tested in software trial versions before deployment into production environments to ensure functionality and security.

• "Cambios en primer instancia deben ser introducidos en las versiones de prueba."

Authorization and Documentation

• Only authorized personnel or contracted programmers should execute changes backed by comprehensive documentation for accountability.

• "Cambios solo deben ser realizados por el personal del sistema o por programadores."

• Keeping records of modifications is crucial for tracking changes made to the software over time for auditing purposes.

• "Llevar un registro de las modificaciones."

Control Internal Processes in Business

The discussion delves into the importance of resources and information in case of failure, emphasizing the need for contingency plans to temporarily restore office functionality. It also touches on technological aspects such as internal controls within network structures.

Resource Importance and Contingency Planning

• Emphasizes the critical nature of resources and information in case of failures.

• Discusses the necessity of contingency plans to restore office functionality temporarily.

Technological Aspects and Internal Controls

• Mentions systems like Guaymas and wireless networks for personal use.

• Explores telecommunications, internal control checks, and interventions to achieve objectives within a company.

Understanding Internal Control Processes

This segment focuses on defining internal control processes within organizations, highlighting their role in ensuring operational efficiency, compliance with laws, and safeguarding assets.

Definition and Objectives of Internal Control

• Defines internal control as a process accepted by management to provide reasonable security in achieving objectives.

• Outlines how internal control encompasses various activities aimed at achieving organizational goals effectively.

Implementation and Supervision of Internal Controls

Here, the implementation stages of internal controls are discussed, emphasizing planning, execution, and supervision as integral components for effective control processes.

Implementation Stages

• Details the stages involved in implementing internal controls: planning, execution, and supervision.

• Highlights the cyclical nature of implementing new controls through planning, execution, and supervision phases.

Limitations and Challenges in Internal Control

This part explores limitations inherent in internal control processes due to decision-making constraints, time factors, unintentional errors, intentional misconduct, among other challenges.

Limitations of Internal Control

• Discusses limitations such as decision-making constraints affecting the effectiveness of controls.

• Mentions challenges related to time constraints impacting control measures' efficacy.

Risk Mitigation Through Internal Controls

The focus here is on how internal controls help minimize risks that could affect asset achievement by reducing or eliminating vulnerabilities within organizations.

Risk Mitigation Strategies

• Explores how internal controls mitigate risks by minimizing vulnerabilities within organizations.

Dispositivos Legales y Problemas Empresariales

The discussion delves into legal devices and business problems, focusing on the origin of addresses and issues related to fraudulent data.

Dispositivos Legales y Problemas Empresariales

• Legal devices refer to a different set of problems, particularly concerning the origin of addresses.

• Fraudulent data poses significant challenges, potentially leading to non-compliance with legal provisions within a company.

Riesgos en la Configuración de Control Interno

This section explores risks associated with internal control configurations, emphasizing challenges when third parties are involved.

Riesgos en la Configuración de Control Interno

• Challenges arise in detecting inefficiencies when external third parties intervene in the internal control setup.

• Collaboration among employees due to proximity can lead to issues like conspiracy, where configuration opposes control due to conflicting interests.

Control de Cumplimiento y Auditorías

The focus shifts towards compliance control and audits, highlighting operational categories and their significance.

Control de Cumplimiento y Auditorías

• Compliance control aims at ensuring adherence to regulations through operational and financial information management.

• Compliance controls overlap with audit functions, emphasizing the importance of auditing for regulatory adherence.

Responsabilidades del Control Interno

Responsibilities within internal control structures are discussed, outlining key roles such as executive management and audit committees.

Responsabilidades del Control Interno

• Key figures like top executives and audit committees play crucial roles in overseeing internal controls within an organization.

Facturas y Corrupción de Información

The speaker discusses the importance of managing information and corruption within entities, emphasizing the need for implementing mechanisms to obtain accurate third-party information.

Implementing Mechanisms for Information Management

• Entities must implement necessary mechanisms to prevent corruption in handling information.

• Importance of obtaining accurate third-party information is highlighted.

Grupo de Trabajo y Fechas Importantes

The speaker instructs students to form groups promptly and announces key dates for assignments and presentations.

Group Formation and Assignment Deadlines

• Students are urged to form groups of up to four members quickly.

• Deadline for group formation is set until 3 PM.

• Official student list for the subject will be released soon.

Planificación del Semestre y Evaluaciones

Discussion on semester planning, evaluation activities, and scheduling important dates.

Semester Planning and Evaluation Activities

• Semester ends on Thursday, 28th with further details provided then.

• Final exams likely in late November with presentations scheduled for January.

• Efforts made for evaluations to be conducted in person based on faculty guidance.

Modificaciones en Horarios y Contenido

Changes in class timings discussed along with upcoming topics on IT management tools.

Schedule Modifications and Course Content

• Classes will start at 2 PM from next week without affecting current classes.

• Future topics include governance of IT management followed by practical tool usage sessions.

Clases Prácticas y Tareas Asignadas

Practical classes' structure explained along with assigned tasks related to risk analysis.

Practical Sessions and Assigned Tasks

• Classes will run from 2 PM till 3:30 PM or earlier if content covered.

• Students can leave early if they have a class at 3:45 PM using official subject schedule.

Tareas Pendientes y Cierre de la Clase

Pending tasks mentioned including showcasing tools virtually due to online setup. Closure remarks given before the next class meeting on Tuesday.

Pending Tasks and Class Conclusion

• Virtual demonstration of tools like Talend Linux planned as part of pending tasks.