AIS Audit, Cybersecurity, Privacy and Resilience

Introduction and Context

An accounting information system (AIS) is trusted only when its information is reliable, protected and available when required. Financial reporting, taxation, payroll, purchasing, inventory, banking and management decisions increasingly depend on integrated enterprise resource planning (ERP) platforms and interconnected cloud services. This integration creates efficiency, but it also creates concentration of risk: a compromised identity, poorly configured interface or unavailable database can affect many processes simultaneously.

AIS audit therefore extends beyond checking ledger balances. It examines whether technology controls support the confidentiality, integrity and availability of information; whether transactions are authorized and traceable; whether privacy obligations are respected; and whether the organization can continue operating after disruption. The auditor’s task is not simply to determine whether controls exist, but to assess whether they are suitably designed, implemented and operating effectively.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and components of IT general controls and application controls.
2. Evaluate identity and access management, segregation of duties and audit trails.
3. Select appropriate computer-assisted audit techniques (CAATs).
4. Analyze common cybersecurity threats affecting AIS and ERP environments.
5. Explain privacy principles and governance responsibilities.
6. Distinguish incident response, backup, disaster recovery and business continuity.
7. Apply these concepts to an integrated audit and recommend proportionate improvements.

1. The Control Environment of an AIS

An AIS control environment comprises policies, procedures, technologies and people that reduce the risk of inaccurate, unauthorized, incomplete or unavailable information. A useful control objective is to ensure that transactions are:

• Authorized: initiated and approved by appropriate personnel.
• Complete: all valid transactions are captured.
• Accurate: data and processing are correct.
• Valid: recorded transactions represent real events.
• Timely: information is processed within the required period.
• Secure: information is protected from unauthorized access or alteration.
• Traceable: activity can be reconstructed through evidence.

Controls are commonly classified as preventive, detective or corrective. A password policy is primarily preventive; an exception report is detective; restoration from a verified backup is corrective. A single control rarely provides complete assurance. Effective control systems combine automated and manual controls, assign responsibility and produce evidence that can be reviewed.

IT General Controls and Application Controls

IT general controls (ITGCs) operate across systems and support the reliable operation of applications. The principal categories are:

Application controls operate within a particular system or transaction cycle. Examples include purchase-order approval limits, duplicate invoice detection, field validation, three-way matching and automated posting rules. Application controls depend on ITGCs. For example, a three-way match may be well designed, but its reliability is weakened if a user can alter the program without approval or change vendor bank details without review.

A distinction must also be made between design effectiveness and operating effectiveness. A control is design-effective when, if performed as specified, it could address the relevant risk. It is operating-effective when it actually operated consistently during the period, by a competent person, with appropriate evidence. Inquiry alone is generally weaker evidence than inspection, observation, reperformance or data analysis.

2. Identity and Access Management

Identity and access management (IAM) governs who may access which resources, under what conditions and for what purpose. The access lifecycle includes request, approval, provisioning, authentication, use, review, modification and timely removal.

Core IAM Principles

Least privilege grants only the access required for assigned duties. Need to know limits access to information necessary for a legitimate task. Default deny means access is not granted unless explicitly authorized. Separation of duties (SoD) prevents one person from controlling incompatible stages of a transaction. For example, the same employee should not create a supplier, approve a payment and release the payment without compensating controls.

Authentication verifies identity; authorization determines permitted actions; accountability links actions to an identifiable user. Strong authentication commonly combines two or more factors: something known, possessed or inherent. Multi-factor authentication reduces the effect of stolen passwords, although phishing, session theft and device compromise can still defeat it.

Privileged accounts require special attention because administrators can bypass ordinary application controls. Good practice includes separate administrative accounts, just-in-time or time-limited privilege, approval and logging of privileged actions, strong authentication and periodic independent review. Shared accounts undermine accountability and should be prohibited except where technically unavoidable and tightly monitored.

Access Review and SoD Analysis

An auditor should compare HR records, role assignments and actual activity. Important tests include:

• employees terminated in the period who still have active accounts;
• users with incompatible roles;
• dormant, generic or shared accounts;
• excessive failed logins and unusual authentication locations;
• privileged changes outside approved maintenance windows;
• emergency access that was not subsequently reviewed.

SoD is not absolute. Small organizations may need compensating controls such as independent review of vendor-master changes, payment reports and bank reconciliations. Risk depends on the likelihood and impact of misuse, the value of transactions and the strength of detective controls.

3. Audit Trails and Evidence

An audit trail is a chronological record that connects an event to a user, time, system, data change and relevant approval. In an ERP, it may include document creation, workflow approval, master-data changes, posting, reversal and export activity.

A reliable audit trail should be:

• Complete: relevant events are captured.
• Accurate: recorded details reflect what occurred.
• Chronological: timestamps are consistent and synchronized.
• Protected: users cannot erase or alter records without detection.
• Retained: records are preserved for legal, operational and audit needs.
• Readable: authorized reviewers can interpret and analyze them.

Audit logs are not automatically trustworthy. An administrator may disable logging, system clocks may differ, logs may be overwritten, and excessive data may hide significant events. Controls should therefore include centralized log collection, restricted log administration, time synchronization, alerting, retention rules and periodic review. Evidence should also preserve chain of custody where an investigation may lead to litigation or disciplinary action.

4. Computer-Assisted Audit Techniques

Computer-assisted audit techniques use software and structured procedures to examine large volumes of electronic evidence. CAATs support, but do not replace, professional judgment and understanding of the business process.

Common techniques include:

1. Data extraction and reconciliation: agree subledger totals to the general ledger and investigate differences.
2. Completeness testing: identify gaps in invoice, journal or document sequences.
3. Duplicate testing: search for repeated invoice numbers, amounts, dates or supplier details.
4. Exception analysis: identify transactions outside thresholds, periods or approval rules.
5. Benford-style analysis: examine digit patterns as a screening procedure, not proof of fraud. It is less suitable for assigned numbers, constrained prices and highly selected data.
6. Stratification: group transactions by value, date, user or business unit to focus testing.
7. Continuous auditing: run recurring tests close to real time, such as alerts for unusual payment changes.
8. Reperformance: independently recalculate or reproduce an automated control’s result.

Before using extracted data, the auditor should establish its population, source, extraction logic, fields, time period and completeness. Hash values, control totals and reconciliations can help demonstrate that a working file was not altered and represents the intended population. Data privacy must also be considered: auditors should minimize copied personal data, restrict access and securely dispose of temporary files.

5. Cybersecurity Threats to AIS and ERP Systems

Cybersecurity risk is the possibility that technology-dependent resources will be compromised, causing loss of confidentiality, integrity or availability. Threats may originate from criminals, insiders, contractors, nation-state actors, accidental actions or supply-chain weaknesses.

Cybersecurity is a risk-management discipline rather than a single product. A layered approach combines governance, secure architecture, endpoint protection, network segmentation, encryption, vulnerability management, monitoring, user education and tested response procedures. Security controls should protect financial reporting without creating uncontrolled manual workarounds.

Artificial intelligence can assist with anomaly detection, phishing analysis and prioritization of alerts. However, AI-generated alerts may contain false positives, and models can be biased, manipulated or trained on sensitive data. Human review, explainability appropriate to the use case, access restrictions and documented validation remain necessary.

6. Privacy and Responsible Information Governance

Privacy concerns how personal information is collected, used, shared, retained and deleted. AIS data may include employee identifiers, bank details, tax information, customer contact details, transaction histories and authentication records. Privacy obligations vary by jurisdiction, but widely recognized principles include:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimization;
• accuracy;
• storage limitation;
• confidentiality and security;
• accountability.

Organizations should identify the purpose and legal basis for processing, provide appropriate notices, limit access, manage vendors, address individual rights where applicable and document retention and deletion decisions. Sensitive information should be encrypted in transit and at rest when appropriate, but encryption does not remove the need for access governance and secure key management.

Privacy by design incorporates privacy controls before a system or process is deployed. A privacy impact assessment can identify data flows, risks, recipients, retention periods and mitigation measures. Cross-border transfers and cloud processing require careful review of applicable law and contractual arrangements. Privacy and audit objectives may conflict: retaining detailed logs supports accountability, while indefinite retention increases privacy risk. Proportionate retention schedules and restricted investigative access help balance these objectives.

7. Incident Response

An incident is an event that threatens confidentiality, integrity or availability. Incident response is the organized process for detecting, analyzing, containing, eradicating and recovering from such events, followed by lessons learned.

A practical response lifecycle is:

1. Preparation: define roles, contacts, playbooks, authority and exercises.
2. Detection and analysis: validate alerts, determine scope, preserve evidence and classify severity.
3. Containment: isolate affected accounts, endpoints or networks while preserving critical operations.
4. Eradication: remove malware, close vulnerabilities, reset credentials and eliminate persistence.
5. Recovery: restore services carefully, validate data and increase monitoring.
6. Post-incident review: identify root causes, control failures, reporting needs and improvements.

Finance personnel are often early detectors because they notice unusual suppliers, payments or journal entries. They should know how to report suspected fraud or compromise without destroying evidence. Communication plans should identify internal management, legal advisers, insurers, regulators, law enforcement, customers and suppliers as appropriate. Notification duties depend on the facts and applicable law; organizations should avoid speculative public statements while meeting mandatory deadlines.

8. Backup, Disaster Recovery and Business Continuity

A backup is a recoverable copy of data or configurations. Disaster recovery (DR) restores technology services after disruption. Business continuity (BC) maintains or resumes critical business processes, which may involve manual procedures, alternate facilities, substitute suppliers and prioritized services. These concepts are related but not interchangeable.

Two planning measures are central:

• Recovery point objective (RPO): the maximum tolerable amount of data loss measured in time. An RPO of four hours means the organization aims to recover data to a point no more than four hours before the disruption.
• Recovery time objective (RTO): the target time to restore a service after disruption.

Recovery requirements should be based on a business impact analysis. Critical processes, dependencies, legal obligations, maximum tolerable downtime and acceptable data loss should be identified. Recovery strategies may include redundant infrastructure, cloud failover, alternate work sites, replicated databases and documented manual procedures.

Backups should be protected from the systems they support. Important practices include multiple copies, different storage media or environments, geographic separation, encryption, restricted administrative access, immutability where appropriate and regular restoration tests. A backup that has never been restored is an assumption, not evidence of recoverability. Testing should cover applications, interfaces, master data, access credentials, reports and reconciliation to the general ledger.

9. Integrated AIS Audit Approach

An effective audit links business risks to controls and evidence. A typical approach is:

1. Understand the environment: identify ERP modules, interfaces, hosting arrangements, key reports and external providers.
2. Map risks and assertions: connect threats to authorization, completeness, accuracy, validity, confidentiality and availability.
3. Evaluate ITGCs: test access, change management, operations, backup and security administration.
4. Evaluate application controls: inspect configuration and test representative transactions.
5. Use CAATs: analyze populations for unusual activity and control exceptions.
6. Assess incidents and resilience: review logs, response records, recovery tests and continuity exercises.
7. Conclude and report: distinguish deficiencies in design, implementation and operation; assess severity and recommend feasible action.

Audit findings should state the condition, criterion, cause, consequence and recommendation. For example, “terminated users retained access” is a condition; the access policy is the criterion; delayed HR notification may be the cause; unauthorized transactions are a possible consequence; and automated daily termination feeds with independent exception review may be a recommendation. Clear ownership and deadlines convert findings into risk reduction.

Illustrative Case: Northstar Components

Background

Northstar Components is a mid-sized manufacturer using a cloud ERP for purchasing, inventory, sales and payments. A finance analyst identified three urgent supplier payments to a new bank account. The payments had been approved electronically and appeared in the payment register.

Problem

The supplier’s email account had been compromised. An attacker sent changed bank details to an accounts-payable employee. The employee created a new bank account in the ERP, while a second employee approved the payment. The organization had MFA for ordinary users, but the supplier-master role was broadly assigned. The bank-change report was generated monthly, and the audit log was retained in the ERP for only 30 days.

Analysis

The immediate issue was payment fraud, but the control weakness was systemic. Access provisioning did not enforce least privilege; supplier-bank changes were not independently verified; monitoring was delayed; and short log retention limited investigation. The payment approval control was not sufficient because both users were operating within a poorly designed process. The incident also created privacy and evidence-preservation concerns.

Approach and Solution

Northstar froze the payments, contacted the bank and preserved available logs and email evidence. It reset credentials, reviewed privileged access and required independent callback verification using a trusted supplier contact. Management then introduced a restricted supplier-master role, dual approval for bank changes, daily exception reporting, centralized log retention, phishing-resistant MFA for privileged users and quarterly access reviews. A recovery exercise tested restoration of the ERP interface and reconciliation of payments after a simulated outage.

Outcome

The bank recovered two payments; one remained under investigation. The audit committee accepted the remediation plan and required monthly reporting until controls operated effectively for three consecutive months.

Learning Points

1. A control can be formally present yet ineffective when the surrounding access and master-data controls are weak.
2. Fraud prevention requires verification through an independent channel, not reliance on email alone.
3. Logging, retention and incident response are interconnected.
4. Resilience testing must include interfaces and reconciliations, not merely server restoration.
5. Audit recommendations should address root causes and assign measurable accountability.

Challenges and Limitations

No control framework eliminates risk. Strong controls may be expensive, slow legitimate work or encourage users to create shadow spreadsheets. Automated controls can fail because of defective configuration, poor input data or unauthorized changes. Continuous monitoring produces alerts that require skilled interpretation. Cloud providers may operate key infrastructure controls, but the customer generally retains responsibility for configuration, user access, data classification and appropriate oversight. Small organizations may lack specialists and must prioritize high-impact risks and compensating controls.

Auditors also face limitations in completeness of logs, reliance on service organizations, evolving regulations and the difficulty of distinguishing sophisticated attacks from legitimate unusual activity. Professional skepticism requires corroboration rather than treating system output as inherently reliable.

Best-Practice Checklist

A mature AIS security and resilience program should:

• maintain an inventory of systems, interfaces, data and owners;
• classify financial and personal information;
• enforce least privilege, MFA and timely deprovisioning;
• review privileged access and incompatible roles;
• control, test and document system changes;
• centralize and protect audit logs;
• monitor vulnerabilities and remediate according to risk;
• reconcile important interfaces and investigate exceptions;
• maintain tested, protected and appropriately separated backups;
• exercise incident response and business continuity plans;
• assess vendors and cloud providers;
• document privacy purposes, retention and disclosures;
• report significant deficiencies to responsible governance bodies.

Chapter Summary

AIS audit evaluates whether technology and process controls support reliable financial information and resilient operations. IT general controls—especially access management, change management, operations, security administration and backup—provide the foundation on which application controls depend. IAM applies least privilege, need to know, MFA, accountability and segregation of duties. Audit trails create evidence, but their reliability depends on completeness, protection, retention and review.

CAATs allow auditors to examine complete populations, identify anomalies and reperform automated processing, while requiring validation of data completeness and protection of personal information. Cybersecurity threats include credential theft, ransomware, fraud, insider misuse, vulnerabilities and supply-chain compromise. Privacy requires lawful, transparent, minimal and secure processing with accountable retention. Incident response coordinates preparation through lessons learned. Backup, disaster recovery and business continuity address different but connected aspects of resilience, guided by RPO, RTO and business-impact analysis. Effective professionals integrate audit, cybersecurity, privacy and continuity rather than treating them as isolated activities.

Key Terms

Audit trail: Chronological evidence linking system events to users, times and changes.

Application control: Control embedded in a particular business application or transaction process.

Business continuity: Capability to continue or resume critical processes during disruption.

CAAT: Computer-assisted audit technique used to analyze electronic data or reperform processing.

Confidentiality: Protection of information from unauthorized disclosure.

Disaster recovery: Restoration of technology services and data after disruption.

IT general control: Broad technology control supporting reliable operation of applications.

Identity and access management: Governance of identities, authentication and permissions.

Incident response: Organized handling of cybersecurity or technology incidents.

Integrity: Protection of information from unauthorized or improper alteration.

Least privilege: Granting only the access necessary for assigned duties.

Multi-factor authentication: Authentication using two or more different factor categories.

Recovery point objective: Maximum targeted period of data loss measured in time.

Recovery time objective: Target time for restoring a service after disruption.

Resilience: Capacity to withstand, recover from and adapt to disruption.

Segregation of duties: Allocation of incompatible responsibilities among different people or controls.

Privacy by design: Incorporating privacy protections into systems and processes from the outset.

Privileged account: Account with elevated administrative or configuration rights.

Review Questions

Short Answer Questions

1. What is the difference between an IT general control and an application control?
2. Explain least privilege and segregation of duties.
3. What characteristics make an audit trail reliable?
4. Define RPO and RTO.
5. Why should backups be tested through restoration?

Long Answer Questions

1. Explain how access management, change management and application controls interact in an ERP audit.
2. Discuss the benefits and limitations of CAATs in testing financial transaction populations.
3. Analyze the principal cybersecurity threats to an AIS and propose layered controls.
4. Explain how privacy principles affect the collection, retention and auditing of AIS data.
5. Compare incident response, disaster recovery and business continuity, showing how they should be integrated.

Analytical / Application Questions

1. An employee can create suppliers, modify bank details and approve payments. Identify the risks, propose compensating controls and describe audit evidence you would obtain.
2. A company’s ERP is available within two hours after an outage, but the latest recoverable data is 18 hours old. Analyze the situation using RTO and RPO and recommend improvements.
3. Using the Northstar Components case, distinguish immediate corrective actions from sustainable preventive controls and explain how an auditor could test whether remediation operates effectively.

Multiple Choice Questions with Answers

Question 1

Which control is an IT general control?

A. A three-way match between purchase order, receipt and invoice

B. A review of ERP program changes before deployment

C. A validation that an invoice number is numeric

D. An approval limit for a purchase requisition

Correct Answer: B. A review of ERP program changes before deployment

Question 2

Which principle grants a user only the access needed for assigned duties?

A. Least privilege

B. Open access

C. Data replication

D. Storage limitation

Correct Answer: A. Least privilege

Question 3

Which feature most directly strengthens accountability for system activity?

A. A shared administrator account

B. An unreviewed spreadsheet

C. A uniquely identified user account with protected logs

D. A monthly deletion of all logs

Correct Answer: C. A uniquely identified user account with protected logs

Question 4

What is the principal purpose of a CAAT that searches for duplicate invoice numbers and amounts?

A. To encrypt the database

B. To identify potentially duplicated payments

C. To assign user privileges

D. To restore a disaster site

Correct Answer: B. To identify potentially duplicated payments

Question 5

Which event is an example of business email compromise?

A. A failed backup restoration test

B. A supplier’s email account being used to send fraudulent bank details

C. A scheduled software upgrade

D. A legitimate password change

Correct Answer: B. A supplier’s email account being used to send fraudulent bank details

Question 6

Which privacy principle limits collection to information necessary for a stated purpose?

A. Data minimization

B. Unlimited retention

C. Default disclosure

D. Privilege escalation

Correct Answer: A. Data minimization

Question 7

What should generally occur first after a suspected ransomware incident is validated?

A. Delete all available logs

B. Contain affected systems while preserving evidence

C. Publish unverified details externally

D. Restore every system simultaneously

Correct Answer: B. Contain affected systems while preserving evidence

Question 8

An RPO of four hours indicates that the organization aims to:

A. Restore the service within four hours

B. Lose no more than four hours of data

C. Retain logs for four years

D. Test access every four hours

Correct Answer: B. Lose no more than four hours of data

Question 9

Which statement best distinguishes business continuity from disaster recovery?

A. Business continuity concerns only backups

B. Disaster recovery concerns only privacy notices

C. Business continuity maintains critical processes, while disaster recovery restores technology services

D. They are identical terms

Correct Answer: C. Business continuity maintains critical processes, while disaster recovery restores technology services

Question 10

Why is a three-way match not sufficient by itself to assure reliable purchasing information?

A. It cannot operate unless all invoices are handwritten

B. It depends on trustworthy configuration, access and change controls

C. It eliminates the need for authorization

D. It prevents every form of phishing

Correct Answer: B. It depends on trustworthy configuration, access and change controls