Internal Control, Audit, Security and Data Governance

Introduction and Context

Accounting information systems do more than record transactions. They determine who may create, approve, alter, inspect and report financial information. In Tally ERP 9, internal control therefore depends on both accounting policy and system configuration. A poorly controlled company may produce technically correct-looking reports while remaining exposed to unauthorised alterations, fictitious suppliers, duplicate payments, concealed errors, data loss and privacy breaches.

For a Chartered Certified Accountant, Tally ERP 9 should be viewed as a controlled information environment rather than merely a bookkeeping package. Effective governance connects five elements:

1. Preventive controls that restrict unauthorised activity.
2. Detective controls that identify unusual or unauthorised activity.
3. Corrective controls that restore data and remedy deficiencies.
4. Audit evidence that supports conclusions about transactions and controls.
5. Governance policies that establish accountability, ethical conduct and legal compliance.

The strategic objective is not to eliminate every risk. It is to reduce risk to an acceptable level while preserving efficient business operations and reliable reporting.

Learning Objectives

After studying this chapter, the learner should be able to:

• design user roles, passwords and security levels in Tally ERP 9;
• explain the purpose and limitations of TallyVault;
• establish controls over voucher entry, alteration, approval and cancellation;
• use audit features and audit trails as evidence;
• formulate backup, restoration and retention policies;
• analyse fraud risk using segregation of duties;
• address privacy, ethics and regulatory governance;
• evaluate a Tally-based control environment through a professional case analysis.

1. Internal Control as a Governance System

Internal control is a process designed and operated by those charged with governance, management and employees to provide reasonable—not absolute—assurance regarding reliable reporting, operational effectiveness, protection of assets and compliance. The COSO framework commonly groups control into five mutually related components:

A useful control principle is that the person who initiates a transaction should not normally be the only person who authorises, records, pays and reviews it. Tally can support this principle through security levels and workflow procedures, but software cannot create segregation of duties where an organisation has only one employee performing all functions.

Control objectives for accounting data

A sound Tally control framework seeks to protect:

• Existence: recorded transactions represent genuine events.
• Completeness: all authorised transactions are recorded.
• Accuracy: amounts, dates, tax classifications and ledgers are correct.
• Cut-off: transactions are recorded in the correct accounting period.
• Authorisation: entries are approved by an appropriately responsible person.
• Validity: users cannot create fictitious or unsupported transactions.
• Confidentiality: sensitive financial and personal information is disclosed only to authorised users.
• Availability: authorised users can access current and recoverable data.

2. Tally ERP 9 Security Architecture

2.1 Company security control

Tally ERP 9 provides security control at company level. When security control is enabled, the administrator can define users and assign them security levels. The administrator should create named accounts rather than shared accounts. A named account creates individual accountability and makes investigation more meaningful.

A basic implementation sequence is:

1. Create or alter the company and enable security control.
2. Define the administrator account with a strong password.
3. Create user groups or security levels according to job responsibilities.
4. Assign named users to appropriate levels.
5. Restrict access to companies, reports, vouchers and administrative functions.
6. Test access using each role before deployment.
7. Review access periodically and immediately remove leavers.

Menu names can vary slightly by release and configuration, so the organisation should validate the precise settings in its installed version and document them in a configuration register.

2.2 User roles and security levels

Security levels should be based on responsibilities, not seniority alone. A common design is shown below.

A security level should follow the least-privilege principle: users receive only the access necessary for their assigned duties. Excessive access increases the probability and impact of fraud. Access should also be segregated across the following dimensions:

• transaction creation;
• transaction approval;
• master-data creation or alteration;
• payment processing;
• reporting and review;
• system administration;
• backup and restoration.

A practical access review compares each user’s actual permissions with their job description. Exceptions should be documented, approved by management and reviewed more frequently.

2.3 Password management

Passwords are control mechanisms, not substitutes for governance. A policy should require unique user credentials, adequate length, confidentiality, prompt change after suspected compromise and immediate disabling after employment ends. Passwords should never be written near the workstation or shared among staff.

Where Tally ERP 9 is accessed through a shared operating-system account or a common network folder, application-level passwords alone may be insufficient. Operating-system permissions, physical security, network controls and antivirus protection must support the Tally configuration.

2.4 TallyVault

TallyVault is intended to protect company data by encrypting it so that the data is not readily readable outside the authorised Tally environment. It is particularly relevant where financial data is stored on portable media, shared servers or computers accessible to multiple people.

TallyVault does not replace:

• user-level access control;
• secure operating-system accounts;
• backups;
• audit review;
• malware protection;
• legal and privacy policies.

The TallyVault password must be controlled as a critical security secret. If it is lost, recovery may not be possible through ordinary administrative procedures. The organisation should therefore establish a secure, authorised password-recovery arrangement without placing the password in an openly accessible file. Encryption also does not prevent an authorised user from entering fraudulent transactions; it protects confidentiality and data access, not transaction integrity by itself.

3. Voucher and Master-Data Controls

3.1 Voucher life cycle

A controlled voucher process normally includes:

1. source document generation;
2. preparation or entry in Tally;
3. independent review;
4. approval or authorisation;
5. posting to the ledger;
6. reconciliation and exception review;
7. archival according to the retention policy.

The control objective is to ensure that a voucher is supported, correctly classified and approved before it affects financial reporting. Supporting evidence may include invoices, purchase orders, goods-received notes, contracts, bank advice and management approvals.

3.2 Alteration, cancellation and deletion

The ability to alter or cancel vouchers is operationally necessary but creates audit risk. Controls should include:

• restricting alteration and deletion to designated roles;
• requiring documented reasons for material changes;
• using reversal or adjustment entries rather than deleting evidence where appropriate;
• reviewing cancelled, altered and back-dated vouchers;
• locking completed accounting periods when practicable;
• reconciling voucher sequences and investigating gaps;
• preserving original documents and approval evidence.

Tally’s audit and alteration information should be interpreted in the context of the specific release and enabled features. An audit listing is evidence for investigation, not proof that every unauthorised act has been detected. Controls are weakened if users share credentials, if data files are replaced outside the application, or if audit information is not independently reviewed.

3.3 Master-data controls

Fraud often begins with master data rather than with a single voucher. Supplier bank details, customer credit limits, tax classifications, inventory units and ledger groups can materially affect reports and payments. Recommended controls include:

• maker-checker approval for new suppliers and customers;
• independent verification of bank-account changes;
• restricted access to alter ledger and stock-item masters;
• periodic review for dormant, duplicate or suspicious masters;
• documented evidence for tax-rate and classification changes.

4. Audit Features and Audit Trails

4.1 Tally audit functionality

Tally ERP 9 includes audit-oriented functionality that can help identify transactions altered or entered by users other than the auditor, depending on the edition, release and configuration. Audit users may review audit listings, mark entries for review and record audit-related observations. Such features support risk-based examination but do not replace professional judgement, substantive testing or statutory audit requirements.

An auditor should establish:

• the population of companies and periods under review;
• the user list and permission structure;
• the meaning of each audit status or exception;
• the completeness of the data supplied for audit;
• procedures for investigating alterations and exceptions;
• the retention and protection of audit evidence.

4.2 Audit trail interpretation

An audit trail should answer, as far as the system permits:

• Who entered or altered the item?
• What was changed?
• When did the event occur?
• Which voucher, ledger or master was affected?
• Was the change authorised?
• What supporting evidence exists?
• What was the effect on financial statements, tax or management reports?

A control deficiency exists when an organisation relies on a trail that is incomplete, editable by the same person under investigation, or not regularly reviewed. Audit trails are most useful when linked to documented exception thresholds and follow-up responsibilities.

4.3 Risk-based review

Review should focus on unusual patterns, including:

• entries posted outside normal working hours;
• transactions immediately before period end;
• round-number journals;
• repeated reversals or cancellations;
• changes to supplier bank details followed by payments;
• transactions posted by inappropriate users;
• negative inventory or unusual margin movements;
• duplicate invoice numbers or amounts.

These indicators do not establish fraud. They identify matters requiring corroboration and professional investigation.

5. Backup, Recovery and Business Continuity

A backup is a separate copy of data from which operations can be restored. Copying a damaged or infected file to another location is not an effective backup policy. A formal policy should specify frequency, responsibility, media, retention, encryption, testing and recovery objectives.

Two useful continuity measures are:

• Recovery Point Objective (RPO): the maximum acceptable amount of data loss measured in time.
• Recovery Time Objective (RTO): the maximum acceptable time to restore service.

For example, an organisation with an RPO of one business day must be able to restore data with no more than approximately one day’s transactions lost. An organisation with an RTO of four hours must plan to resume critical processing within four hours of a disruptive event. These are management requirements, not properties automatically guaranteed by Tally ERP 9.

A robust policy commonly includes:

• daily or risk-based backups;
• at least one copy stored separately from the primary system;
• encrypted off-site or cloud storage where lawful and appropriate;
• rotation of backup media;
• restricted access to backup files;
• documented restoration procedures;
• periodic restoration tests;
• reconciliation of restored data to control totals;
• retention periods based on tax, company-law, contractual and audit requirements.

A backup is trustworthy only when restoration has been tested. A restoration test should use a controlled environment, preserve the original data, record the date and result, and verify ledgers, stock, vouchers, reports and user access after restoration.

6. Fraud Risk and Segregation of Duties

Fraud risk is often analysed through the fraud triangle: pressure or incentive, opportunity and rationalisation. Tally security primarily addresses opportunity; it does not remove pressure or rationalisation. Management must therefore combine system controls with ethical leadership, supervision and reporting mechanisms.

Applied segregation example

Suppose one employee can create a supplier, alter the supplier’s bank account, enter a purchase invoice and prepare the payment file. The employee may create a fictitious supplier and direct payment to a personal account. Even if the ledger appears balanced, the control environment is weak.

A stronger arrangement is:

• procurement requests the supplier;
• an independent officer verifies supplier identity and bank details;
• accounts payable records the invoice;
• a manager approves payment;
• treasury executes the payment;
• an independent reviewer reconciles the bank account.

If staffing limitations prevent complete segregation, compensating controls may include owner review, payment alerts, monthly supplier-master reports, independent bank reconciliation and surprise audits. Compensating controls reduce but do not eliminate risk.

7. Privacy, Ethics and Regulatory Governance

Financial data may contain personal information, salaries, addresses, tax identifiers, bank accounts and commercially sensitive information. The organisation should apply principles of purpose limitation, data minimisation, accuracy, restricted access, secure retention and lawful disclosure. The exact legal obligations depend on the jurisdiction, but accounting professionals should consider company law, tax law, data-protection law, employment law, electronic-record requirements and professional ethical codes.

Ethical governance requires accountants to maintain integrity, objectivity, professional competence, confidentiality and professional behaviour. It is unethical to manipulate dates, conceal alterations, backdate documents, share passwords, suppress adverse reports or use confidential data for personal advantage.

A data-governance register should identify:

Artificial intelligence and analytics may assist anomaly detection, but they should not be treated as autonomous proof of fraud. Models can produce false positives, embed biased assumptions or expose confidential data through unauthorised external services. Human review, explainability, access controls and documented accountability remain essential.

8. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd. uses Tally ERP 9 for inventory, sales, purchases and banking. The company has grown rapidly, but it uses a shared administrator password. The accounts clerk can create suppliers, alter vouchers and prepare payment instructions. Backups are made irregularly to the same computer on which the live data is stored.

Problem

A month-end review identifies three cancelled purchase vouchers, a new supplier with a bank account changed shortly before payment, and unexplained inventory adjustments. Management initially assumes the issues are clerical errors.

Analysis

The shared password prevents reliable attribution. Excessive privileges create an opportunity for concealment. The backup arrangement exposes the company to simultaneous loss of live and backup data. There is no documented review of altered or cancelled vouchers, and supplier-master changes are not independently verified.

Approach and solution

The finance director implements the following programme:

1. Enable company security control and create named user accounts.
2. Establish clerk, supervisor, manager, auditor and administrator roles.
3. Remove supplier-master and payment authority from the data-entry clerk.
4. Require independent verification of bank-account changes.
5. Review Tally audit listings and cancelled vouchers weekly during the first three months.
6. Reconcile inventory adjustments to approved stock-count documents.
7. Create encrypted daily backups, with a separate off-site copy.
8. Test restoration monthly for three months and quarterly thereafter.
9. Require documented approval for period-end journals and reversals.
10. Train employees on confidentiality, password use and whistleblowing procedures.

Outcome

The investigation establishes that two vouchers were entered incorrectly, while the supplier bank change lacked evidence of approval. Payment is suspended pending verification. The company also discovers that one former employee’s account remained active. The revised controls improve accountability and reduce the likelihood that a single person can create and conceal a fictitious transaction.

Learning points

The case demonstrates that security configuration, audit review, master-data governance and backup policy are interdependent. A sophisticated feature cannot compensate for weak procedures, shared credentials or absent management review.

9. Implementation and Evaluation Framework

A professional implementation should proceed through a documented risk assessment:

1. Identify valuable data, critical processes and regulatory obligations.
2. Map transaction flows and incompatible duties.
3. Define roles and minimum required permissions.
4. Configure Tally security and test positive and negative access cases.
5. Establish voucher, master-data, backup and audit procedures.
6. Train users and obtain documented acceptance of responsibilities.
7. Monitor exceptions and report deficiencies to management.
8. Reassess controls after system changes, staff changes, incidents or regulatory developments.

Control effectiveness should be evaluated through both design and operating-effectiveness testing. Design testing asks whether the control could prevent or detect the relevant risk. Operating testing asks whether it operated consistently during the period. Evidence may include access reports, approval records, audit listings, restoration-test results, reconciliations and incident reports.

Limitations

Tally ERP 9 is an older enterprise resource-planning platform, and capabilities may differ by release, edition and deployment architecture. It may not provide the same degree of centralised logging, workflow integration, encryption management or continuous monitoring found in newer systems. Organisations should not claim compliance solely because a menu option exists. Compliance depends on configured controls, documented procedures, competent operation and persuasive evidence.

Chapter Summary

Internal control in Tally ERP 9 is a governance system that combines software configuration, accounting procedures, ethical behaviour and independent review. Security control, named users, strong passwords, least privilege and TallyVault protect access and confidentiality, but they do not by themselves ensure transaction integrity. Voucher and master-data controls must address creation, approval, alteration, cancellation and review. Audit features and audit trails support investigation, yet their reliability depends on individual accounts, complete data and independent follow-up. Backup policies must define RPO, RTO, retention, security and restoration testing. Fraud risk is reduced through segregation of duties and compensating controls. Privacy, professional ethics and jurisdiction-specific regulation must guide the collection, use, retention and disclosure of accounting data. Effective governance is therefore continuous: assess risk, configure controls, monitor exceptions, test recovery and improve the system.

Key Terms

Audit trail: Evidence showing activity affecting a transaction, master or record.

Backup: A separate copy of data used for recovery.

Compensating control: An alternative control used when an ideal control cannot operate.

Confidentiality: Protection of information from unauthorised disclosure.

Control environment: The organisational culture, leadership and accountability supporting controls.

Data governance: Policies and responsibilities governing data ownership, access, quality, retention and disposal.

Detective control: A control designed to identify an event after it occurs.

Least privilege: Giving a user only the access necessary for assigned duties.

Maker-checker control: Independent preparation and verification by different individuals.

Master data: Relatively stable records such as ledgers, suppliers, customers and stock items.

Preventive control: A control designed to stop an error or unauthorised act.

Recovery Point Objective: Maximum acceptable data loss measured in time.

Recovery Time Objective: Maximum acceptable time to restore service.

Segregation of duties: Division of incompatible responsibilities among different people.

TallyVault: A Tally facility intended to encrypt and protect company data.

User role: A defined set of permissions assigned according to job responsibility.

Voucher: A transaction record supported by documentary evidence.

Whistleblowing: Reporting suspected misconduct through an authorised channel.

Review Questions

Short Answer Questions

1. What is the least-privilege principle, and why is it important in Tally ERP 9?
2. Distinguish between RPO and RTO.
3. State two limitations of TallyVault.
4. Why should supplier-master changes be independently verified?
5. What is the purpose of reviewing cancelled and altered vouchers?

Long Answer Questions

1. Explain how security levels, passwords and named users contribute to accountability in Tally ERP 9.
2. Discuss the relationship between internal control, audit trails and professional audit evidence.
3. Design a backup and restoration policy for a medium-sized trading company using Tally ERP 9.
4. Explain how segregation of duties can reduce fictitious-supplier and unauthorised-payment risk.
5. Evaluate the privacy, ethical and regulatory responsibilities of an accountant managing Tally data.

Analytical / Application Questions

1. A clerk can create suppliers, alter bank details, enter invoices and prepare payment instructions. Analyse the risks and propose a revised control structure.
2. A company has daily backups stored on the same computer as its live Tally data. Evaluate the policy against availability and recovery objectives and recommend improvements.
3. An audit listing shows several period-end journal alterations by a senior user. Develop an investigation plan that distinguishes error, authorised adjustment and possible fraud.

Multiple Choice Questions with Answers

Question 1

Which principle requires that a Tally user receive only the permissions necessary for assigned duties?

A. Least privilege

B. Open access

C. Data duplication

D. Continuous availability

Correct Answer: A. Least privilege

Question 2

What is the primary purpose of TallyVault?

A. To approve purchase vouchers

B. To encrypt and protect company data

C. To reconcile bank accounts automatically

D. To replace audit procedures

Correct Answer: B. To encrypt and protect company data

Question 3

Which combination represents a strong segregation of duties arrangement?

A. One employee creates suppliers and approves payments

B. One employee enters and independently reviews the same voucher

C. One employee records invoices while another approves payment

D. All users share the administrator password

Correct Answer: C. One employee records invoices while another approves payment

Question 4

What does the Recovery Point Objective measure?

A. Maximum acceptable time to restore service

B. Maximum acceptable amount of data loss measured in time

C. Number of users permitted to access data

D. Time required to approve a voucher

Correct Answer: B. Maximum acceptable amount of data loss measured in time

Question 5

Why are named user accounts preferable to shared accounts?

A. They eliminate the need for backups

B. They provide individual accountability

C. They prevent all accounting errors

D. They make encryption unnecessary

Correct Answer: B. They provide individual accountability

Question 6

Which is a detective control?

A. Restricting voucher alteration permissions

B. Requiring a password at login

C. Reviewing reports of cancelled and altered vouchers

D. Disabling a former employee’s account

Correct Answer: C. Reviewing reports of cancelled and altered vouchers

Question 7

A backup stored only on the same computer as live Tally data is weak primarily because it may be lost through:

A. Independent bank reconciliation

B. The same failure or incident affecting the live data

C. Use of named accounts

D. A maker-checker review

Correct Answer: B. The same failure or incident affecting the live data

Question 8

Which activity is most directly associated with master-data governance?

A. Verifying a supplier’s bank-account change

B. Printing a financial statement

C. Counting the number of login attempts only

D. Changing the office lighting

Correct Answer: A. Verifying a supplier’s bank-account change

Question 9

An unusual period-end journal identified in an audit listing should be treated as:

A. Automatic proof of fraud

B. Evidence requiring investigation and corroboration

C. Irrelevant because it is in Tally

D. A reason to delete the journal immediately

Correct Answer: B. Evidence requiring investigation and corroboration

Question 10

Which statement about internal control is most accurate?

A. It provides absolute assurance against fraud

B. It depends only on software features

C. It provides reasonable assurance and requires people and procedures

D. It eliminates the need for professional judgement

Correct Answer: C. It provides reasonable assurance and requires people and procedures