Cybersecurity, Ethics and Digital Governance

Introduction and Context

Accounting is increasingly performed within interconnected digital environments. Enterprise resource-planning systems, cloud platforms, banking portals, spreadsheet models, payroll applications and artificial-intelligence tools allow financial information to be created, processed and communicated rapidly. The same connectivity also creates exposure to unauthorized access, fraud, data loss, manipulation, privacy violations and operational disruption.

For accounting and finance professionals, cybersecurity is not merely an information-technology concern. A compromised user account can alter a supplier bank account; a hidden spreadsheet formula can misstate profit; an incorrectly configured cloud folder can expose payroll records; and an unavailable accounting system can prevent financial reporting. Consequently, accountants must understand the technical, ethical and governance controls that protect the confidentiality, integrity and availability of financial information.

This chapter examines practical controls for accounting environments, including access management, privacy, backup and recovery, segregation of duties, spreadsheet governance, data quality and ethical conduct. It also considers the role of digital governance: the policies, responsibilities, decision rights and monitoring arrangements through which an organization directs and controls its use of digital systems.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the confidentiality, integrity and availability objectives of cybersecurity.
2. Apply access-control principles to accounting systems and spreadsheets.
3. Distinguish authentication, authorization, accountability and non-repudiation.
4. Design appropriate backup and recovery arrangements.
5. Apply segregation of duties to reduce fraud and error risk.
6. Identify risks in spreadsheets and propose proportionate governance controls.
7. Evaluate financial data using data-quality dimensions and validation procedures.
8. Apply privacy, professional-ethics and confidentiality requirements.
9. Analyse a cybersecurity and governance problem in an accounting setting.

1. Cybersecurity in the Accounting Environment

Cybersecurity is the protection of information systems, data and services from unauthorized use, disruption, alteration or destruction. In accounting, the protected assets include:

• general-ledger data and journal entries;
• customer, supplier and employee information;
• bank details and payment instructions;
• budgets, forecasts and valuation models;
• tax records and supporting documentation;
• audit trails, passwords, encryption keys and system configurations.

The central security objectives are commonly expressed as the CIA triad:

These objectives can conflict. Strong access restrictions may improve confidentiality but reduce availability if legitimate users cannot work. A sound control environment balances security with operational requirements through risk assessment, proportionality and documented exceptions.

Threats, vulnerabilities and controls

A threat is a potential cause of harm, such as phishing, malware, insider fraud or equipment failure. A vulnerability is a weakness that a threat may exploit, such as a shared password, unpatched application or unprotected spreadsheet. A control is a measure designed to prevent, detect or correct an undesirable event.

Controls may be classified as:

• Preventive controls: stop an event before it occurs, such as multi-factor authentication or input validation.
• Detective controls: identify an event after or while it occurs, such as exception reports, reconciliations and log reviews.
• Corrective controls: restore or repair operations, such as data recovery, password resets and reversal procedures.

Effective governance uses layers of controls rather than relying on one safeguard. For example, a payment process may use role-based access, dual approval, supplier-master change alerts, bank reconciliation and independent review.

2. Access Control and Identity Management

Access control determines who may use a system, what they may do and which records they may view. The principle of least privilege requires each user to receive only the access necessary for assigned duties, for only as long as it is necessary. Least privilege reduces the potential impact of compromised credentials and limits accidental changes.

Authentication and authorization

Authentication answers, “Who are you?” Authorization answers, “What are you allowed to do?” Authentication may use:

• something the user knows, such as a password;
• something the user has, such as a security token or mobile device;
• something the user is, such as a fingerprint.

Multi-factor authentication combines two or more different categories. Two passwords are not normally two-factor authentication because both are knowledge factors.

Authorization may be implemented through:

• Role-based access control: permissions are assigned to roles such as accounts payable clerk, financial controller or auditor.
• Attribute-based access control: access depends on attributes such as department, location, transaction value or time.
• Privileged-access management: administrative accounts are restricted, monitored and often used only for approved tasks.

Accountability requires that actions can be traced to an identifiable user. Therefore, shared accounts are poor practice because they weaken audit trails and make investigation difficult. Systems should record relevant events, including user identity, date, time, action, affected record and outcome. Logs must themselves be protected from unauthorized alteration.

Access lifecycle

Access management should cover the complete user lifecycle:

1. Joiner: access is approved according to the user’s role.
2. Mover: permissions are reviewed and changed when duties change.
3. Leaver: access is removed promptly when employment or assignment ends.
4. Periodic review: managers confirm that access remains appropriate.

A useful access matrix records roles against permitted activities.

The matrix is a governance document, not merely a technical configuration. Changes should be supported by documented business need and approval.

3. Segregation of Duties and Fraud Risk

Segregation of duties (SoD) divides incompatible responsibilities among different people or systems. A basic transaction cycle separates:

1. authorization;
2. custody of assets;
3. recording of transactions; and
4. reconciliation or review.

For example, the employee who creates a supplier should not independently approve a payment to that supplier and reconcile the bank account. Separating these activities reduces the opportunity for concealment.

SoD is a risk-based principle, not an absolute requirement that every task be performed by a different employee. Small organizations may have insufficient staff. In such cases, compensating controls can include owner review, approval thresholds, independent bank statements, monthly exception reports and restricted system permissions.

A practical SoD analysis identifies combinations that create risk. Examples include:

SoD controls must be reviewed when processes, staffing, software or organizational structures change.

4. Privacy, Confidentiality and Ethical Conduct

Privacy concerns the appropriate collection, use, storage, disclosure and disposal of information about identifiable individuals. Accounting records may contain names, addresses, salaries, tax identifiers, bank accounts and performance information. Such data should be handled according to applicable law, organizational policy and professional obligations.

Important privacy principles commonly include:

• Lawfulness and fairness: information is processed on a valid and transparent basis.
• Purpose limitation: data is collected for specified legitimate purposes.
• Data minimization: only necessary information is collected or retained.
• Accuracy: incorrect personal data is corrected promptly.
• Storage limitation: information is not retained indefinitely without justification.
• Security: appropriate technical and organizational safeguards are applied.
• Accountability: the organization can demonstrate compliance.

The precise legal requirements vary by jurisdiction. Students and professionals must therefore consult applicable privacy legislation, regulatory guidance, contractual terms and professional codes rather than assuming that one jurisdiction’s rules apply universally.

Confidentiality means protecting information obtained through professional work. It does not mean concealing fraud or ignoring lawful disclosure duties. A finance professional who receives evidence of suspected misconduct should follow the organization’s reporting, whistleblowing and escalation procedures. Information should be shared only with persons who have a legitimate need to know.

Ethical decision-making is especially important when financial information is confidential. A useful framework is:

1. identify the facts and affected parties;
2. identify applicable laws, policies and professional principles;
3. recognize threats such as self-interest, intimidation or undue influence;
4. evaluate alternatives and likely consequences;
5. consult an appropriate independent authority;
6. document the reasoning and decision;
7. escalate or withdraw if the conflict cannot be resolved.

Core professional values include integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. For example, an analyst should not alter a forecast to satisfy a manager merely because the request is commercially convenient.

5. Backup, Recovery and Business Continuity

A backup is a separate copy of data maintained so that information can be restored after deletion, corruption, ransomware, hardware failure or another disruptive event. Backup is not the same as synchronization. Synchronization may replicate an unwanted deletion or encrypted file, whereas a controlled backup may provide historical recovery points.

A useful planning model distinguishes:

• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time. An RPO of four hours means that, after recovery, the organization can tolerate losing up to approximately four hours of recent changes.
• Recovery time objective (RTO): the target time within which a service should be restored.
• Maximum tolerable period of disruption (MTPD): the longest period the process can be unavailable before unacceptable consequences arise.

If a payroll system has an RTO of eight hours, restoration should be planned to return the service to operation within eight hours of the disruption, subject to the organization’s defined measurement point and assumptions.

Backup quality depends on more than making copies. A sound program considers:

• frequency and retention periods;
• protection against unauthorized alteration;
• encryption in transit and at rest;
• geographic or logical separation from production systems;
• access restrictions and separate credentials;
• restoration testing;
• documentation of responsibilities;
• legal and business retention requirements.

The widely used “3-2-1” principle recommends at least three copies of important data, on at least two different media or storage types, with at least one copy separated from the primary environment. It is a planning heuristic, not a guarantee of recovery.

Recovery procedures should be tested. A backup that has never been restored is an assumption, not evidence. Tests may include file-level restoration, application recovery and a full business-continuity exercise. Results should record recovery time, missing data, errors and corrective actions.

6. Spreadsheet-Risk Governance

Spreadsheets are powerful because they combine data, formulas, assumptions and presentation in an accessible format. They are also vulnerable to accidental overwriting, incorrect references, hidden sheets, inconsistent versions, hard-coded values, weak passwords and undocumented assumptions.

Spreadsheet risk is greatest when a workbook is financially significant, complex, frequently reused, connected to external data or maintained by several people. Common risks include:

• formulas copied incorrectly across rows or periods;
• numbers entered as text or dates interpreted incorrectly;
• hard-coded assumptions embedded in formulas;
• circular references or unintended iterative calculations;
• hidden rows, columns or worksheets;
• obsolete links to external workbooks;
• unauthorized changes to formulas;
• unclear version ownership;
• insufficient documentation and testing.

A proportionate spreadsheet-governance framework should include:

1. Inventory: identify critical spreadsheets and their owners.
2. Risk classification: rate workbooks according to financial impact, complexity and likelihood of error.
3. Design standards: separate inputs, calculations and outputs; use consistent labels, units and formatting.
4. Documentation: record purpose, source data, assumptions, formulas, version and preparer.
5. Validation: use control totals, reasonableness checks, reconciliations and independent review.
6. Change control: record changes, approvals and testing before release.
7. Access protection: restrict editing and protect formulas, without treating worksheet protection as a complete security solution.
8. Archiving: retain approved versions and prevent confusion between current and obsolete files.

Worked spreadsheet-control example

A budget workbook calculates operating profit as revenue less operating costs. The preparer enters revenue of CU 500,000 and operating costs of CU 360,000. The expected operating profit is:

Here, CU means currency units. The calculation assumes that all operating costs are included once, revenue and costs use the same accounting period, and no other adjustment is required. A control check might compare the spreadsheet result with the independently calculated amount. If the workbook displays CU 410,000, the discrepancy signals a likely formula, reference or input error; it does not by itself identify the cause.

A stronger workbook would include a visible control cell showing that the result agrees with a separately prepared reconciliation. It would also identify the source of each input and protect the profit formula from casual editing.

7. Data Quality and Governance

Reliable decisions depend on reliable data. Data quality is multidimensional:

Validation rules may include mandatory fields, permitted-value lists, range checks, duplicate detection and reconciliation to authoritative records. For example, a supplier record may require a valid tax identifier, approved bank details and a unique supplier code.

Data governance assigns ownership and accountability. A data owner determines acceptable use and risk; a data steward supports quality and process controls; a system custodian manages technical operation. These responsibilities may be performed by different people or combined in small organizations, but they should be explicit.

Data lineage is particularly important in reporting. Users should be able to determine where a reported number originated, which transformations were applied and who approved the final output. This supports auditability and reduces disputes about competing versions of information.

8. Digital Governance and the Role of AI

Digital governance connects organizational strategy, risk management, compliance and technology operations. It establishes who may make decisions about systems, data, cybersecurity investments, vendors, acceptable use and incident response.

A governance structure commonly includes:

• board or senior-management oversight;
• risk and compliance responsibilities;
• information-security policies;
• system and data ownership;
• documented approval authority;
• internal audit or independent assurance;
• incident-reporting and escalation procedures;
• monitoring, metrics and periodic review.

Artificial intelligence can assist with anomaly detection, invoice classification, forecasting and reconciliation. However, AI-generated outputs may contain errors, fabricated explanations, biased results or inappropriate disclosure of confidential information. Accounting professionals should not upload confidential data to an unapproved tool or accept an AI-generated journal, forecast or explanation without appropriate review.

AI governance should address data protection, model accountability, human oversight, access permissions, record retention, explainability appropriate to the use, and testing against representative cases. Human review is particularly important where outputs affect financial statements, tax obligations, employment, credit or regulatory reporting.

9. Incident Response

No control environment eliminates all incidents. Incident response limits damage and supports recovery. A general response cycle is:

1. Preparation: policies, contacts, training, tools and tested procedures.
2. Identification: determine whether unusual activity is a security incident.
3. Containment: limit spread while preserving evidence.
4. Eradication: remove the cause, such as malicious software or compromised credentials.
5. Recovery: restore systems, validate data and return to normal operation.
6. Lessons learned: identify control improvements and required notifications.

A suspected payment diversion should not be handled by simply deleting emails or overwriting logs. Relevant evidence should be preserved, the transaction process should be paused where appropriate, financial institutions and authorized management should be contacted, and legal or regulatory reporting requirements should be considered.

Illustrative Case: The Misdirected Supplier Payment

Background

Northbridge Components, a medium-sized manufacturer, uses a cloud accounting system and several Excel workbooks for purchasing and cash forecasting. One accounts-payable employee receives an email appearing to come from a regular supplier. The message requests a change to the supplier’s bank account.

Problem

The employee updates the supplier record and prepares a payment. The same employee can also approve payments below a specified threshold. The company has no callback procedure, no alert for bank-detail changes and no periodic review of privileged access. A payment of CU 48,000 is sent to the fraudulent account.

Analysis

The incident combines social engineering, weak authentication of change requests and inadequate segregation of duties. The employee’s account may also have been compromised. The absence of an independent review allowed the change and payment to proceed without challenge. The accounting system’s audit trail can establish who made the change, but accountability after the event does not prevent the loss.

Approach and solution

Northbridge immediately contacts its bank, preserves email and system evidence, resets affected credentials and investigates related transactions. It then introduces the following controls:

• multi-factor authentication for finance users;
• independent verification of supplier bank changes using a known contact method;
• separation of supplier-master maintenance from payment approval;
• dual approval for all new or changed bank details;
• automated alerts for unusual changes and payments;
• quarterly access reviews;
• staff training on phishing and payment fraud;
• a documented incident-response procedure;
• a reconciliation and exception review before payment release.

The company also classifies the supplier-master file and payment process as high-risk and includes them in internal-audit testing.

Outcome

The bank recovers part of the funds, while the company strengthens controls and improves detection. The final review finds that technology alone would not have solved the problem: the decisive improvements were independent verification, SoD, user awareness and management oversight.

Learning points

1. A legitimate-looking email is not sufficient evidence for changing payment data.
2. Access should reflect duties, not convenience.
3. Audit trails support investigation but do not replace preventive controls.
4. Incident response should protect evidence as well as restore operations.
5. Cybersecurity, accounting control and professional ethics are interdependent.

Challenges and Limitations

Controls create cost and can slow legitimate work. Excessive restrictions may lead employees to create unauthorized workarounds, such as personal spreadsheets or shared accounts. Conversely, convenience-driven access may create unacceptable risk. The appropriate response is risk-based design, user consultation, monitoring and periodic adjustment.

Small entities may lack specialist security staff, redundant systems or independent personnel for complete SoD. Compensating controls can reduce, but not always eliminate, residual risk. Cloud providers may secure infrastructure while the customer remains responsible for user access, data classification and configuration. Compliance with a standard or policy also does not guarantee that controls operate effectively.

Finally, digital risks evolve. New malware, synthetic identities, deepfake communications, supply-chain attacks and AI-enabled fraud require continuing education and review. Governance must therefore be treated as a continuing management process rather than a one-time implementation project.

Best-Practice Checklist

Before approving a financial process, ask:

• Are users uniquely identified and authenticated appropriately?
• Does each role have only the access it needs?
• Are incompatible duties separated or subject to compensating controls?
• Are sensitive data collection, use, retention and disclosure justified?
• Are backups protected, separated and regularly restored in tests?
• Are critical spreadsheets inventoried, documented, reviewed and version-controlled?
• Are data-quality rules, ownership and lineage defined?
• Can unusual activity be detected and escalated?
• Are incidents, changes and approvals recorded?
• Is confidential information protected when using cloud services or AI tools?

Chapter Summary

Cybersecurity in accounting protects the confidentiality, integrity and availability of financial information. Effective protection combines preventive, detective and corrective controls. Access management requires strong authentication, least privilege, role-based authorization, unique accounts, audit trails and timely review throughout the user lifecycle. Segregation of duties reduces fraud and error by separating authorization, custody, recording and review; where complete separation is impractical, compensating controls are necessary.

Privacy and professional ethics require lawful, fair and limited use of personal information, careful confidentiality, objectivity and appropriate escalation of misconduct. Backup and recovery planning uses concepts such as RPO, RTO and disruption tolerance, supported by protected copies and tested restoration. Spreadsheet governance addresses inventory, documentation, validation, change control, access and independent review. Data governance establishes quality dimensions, ownership, lineage and accountability. Digital governance integrates these practices with management oversight, risk assessment, incident response and responsible use of AI.

The central professional lesson is that reliable financial reporting depends not only on accounting technique but also on trustworthy systems, disciplined behaviour and accountable governance.

Key Terms

Access control: The process of restricting system or data access to authorized users.

Authentication: Verification of a user’s identity.

Authorization: Assignment of permitted actions or resources to an authenticated user.

Availability: The ability of authorized users to access systems and data when required.

Confidentiality: Protection of information from unauthorized disclosure.

Data governance: Policies, responsibilities and processes for managing data as an organizational asset.

Data lineage: The traceable path from a data source through transformations to a reported output.

Integrity: Protection of information from unauthorized or inappropriate alteration.

Least privilege: Providing only the minimum access necessary for a task.

Multi-factor authentication: Authentication using two or more different factor categories.

Recovery point objective (RPO): The maximum tolerable period of data loss measured backward from disruption.

Recovery time objective (RTO): The target time for restoring a service after disruption.

Segregation of duties: Division of incompatible responsibilities among people or systems.

Spreadsheet governance: Controls governing the creation, use, review, change and retention of spreadsheets.

Threat: A potential cause of harm to systems, data or operations.

Vulnerability: A weakness that may be exploited by a threat.

Preventive control: A control intended to stop an undesirable event before it occurs.

Detective control: A control intended to identify an event or deviation.

Review Questions

Short Answer Questions

1. What are the three objectives of the CIA triad?
2. Distinguish authentication from authorization.
3. Define least privilege and explain why it matters in accounting systems.
4. What is the difference between RPO and RTO?
5. State four important dimensions of data quality.

Long Answer Questions

1. Explain how segregation of duties reduces fraud risk in the procure-to-pay cycle. Include possible compensating controls for a small organization.
2. Discuss the main privacy and ethical responsibilities of an accountant handling employee payroll data.
3. Develop a governance framework for a spreadsheet used to prepare monthly management accounts.
4. Explain why backup creation alone does not demonstrate recoverability. Discuss restoration testing and recovery objectives.
5. Analyse how digital governance connects cybersecurity, data quality, professional ethics and financial reporting.

Analytical / Application Questions

1. An accounts-payable clerk can create suppliers, change bank details, enter invoices and release payments under CU 10,000. Identify the principal risks and redesign the control structure.
2. A forecast workbook contains hidden worksheets, hard-coded assumptions and links to three personal files. Propose a prioritized remediation plan and explain how you would validate the revised workbook.
3. A finance manager wants to upload identifiable employee payroll data to a public AI tool to classify expenses. Evaluate the proposal using privacy, confidentiality, governance and professional-ethics principles.

Multiple Choice Questions with Answers

Question 1

Which objective of the CIA triad concerns preventing unauthorized disclosure of payroll information?

A. Availability

B. Confidentiality

C. Integrity

D. Recoverability

Correct Answer: B. Confidentiality

Question 2

Which control best represents the principle of least privilege?

A. Giving every finance employee administrator access

B. Using one shared account for the finance department

C. Giving a clerk only the permissions required to enter invoices

D. Allowing former employees to retain access for convenience

Correct Answer: C. Giving a clerk only the permissions required to enter invoices

Question 3

What is the primary purpose of segregation of duties?

A. To increase the number of accounting entries

B. To prevent all use of accounting software

C. To reduce the opportunity for error or fraud to remain concealed

D. To eliminate the need for reconciliations

Correct Answer: C. To reduce the opportunity for error or fraud to remain concealed

Question 4

A recovery point objective of four hours indicates that the organization should plan to tolerate no more than approximately:

A. Four hours of service restoration time

B. Four hours of data changes lost

C. Four days of system unavailability

D. Four backup copies

Correct Answer: B. Four hours of data changes lost

Question 5

Which action is the strongest control over a request to change a supplier’s bank details?

A. Accepting the request because the email uses the supplier’s logo

B. Verifying the request through a trusted, independently obtained contact method

C. Allowing the requester to approve the payment

D. Deleting the original email after making the change

Correct Answer: B. Verifying the request through a trusted, independently obtained contact method

Question 6

Which spreadsheet practice most directly improves auditability?

A. Hiding all formulas

B. Using personal files as undocumented data sources

C. Documenting assumptions, sources, versions and approvals

D. Removing control totals to simplify presentation

Correct Answer: C. Documenting assumptions, sources, versions and approvals

Question 7

Which data-quality dimension asks whether the same transaction has been recorded more than once?

A. Uniqueness

B. Timeliness

C. Validity

D. Confidentiality

Correct Answer: A. Uniqueness

Question 8

Which statement about authentication and authorization is correct?

A. Authentication determines what actions a user may perform

B. Authorization verifies the user’s identity

C. Authentication verifies identity, while authorization determines permitted actions

D. They are two names for encryption

Correct Answer: C. Authentication verifies identity, while authorization determines permitted actions

Question 9

Why should backup restoration be tested?

A. Because making a backup guarantees that every application will restore correctly

B. Because testing provides evidence that data and services can actually be recovered

C. Because testing eliminates the need for access controls

D. Because a test automatically increases the RPO

Correct Answer: B. Because testing provides evidence that data and services can actually be recovered

Question 10

What is the most appropriate response before uploading identifiable payroll data to an unapproved public AI tool?

A. Upload it immediately if the task is urgent

B. Remove only the employee names and upload all other identifiers

C. Assess authorization, privacy, confidentiality and approved-tool requirements first

D. Ask the AI tool to decide whether the upload is ethical

Correct Answer: C. Assess authorization, privacy, confidentiality and approved-tool requirements first