Controls

Read the Gail Industries Case Study. 

Assess the controls in place for thoroughness, applicability, etc. using the elements of the case study. What evidence should be collected to test these controls?

Don't use plagiarized sources. Get Your Custom Essay on
Controls
Just from $13/Page
Order Essay

Write a 2- to 4-page summary of your assessment.

Format your citations according to APA guidelines.

Gail Industries Case Study

This case study is used to complete your assignments throughout the course. Some sections of the case study will be necessary in multiple assignments. See the assignment instructions for specific assignment requirements.

Introduction to Gail Industries

Gail Industries is a partner to many Fortune 1000 companies and governments around the world. Gail Industries’ role is to manage essential aspects of their clients’ operations while interacting with and supporting the people their clients serve. They manage millions of digital transactions every day for various back office processing contracts.

One of Gail Industries’ clients is the city of Smallville. Smallville, despite its name, is a large metropolis seated in the heart of the nation. The city has 2.5 million residents, and the greater Smallville metropolitan area has a population of about 4 million people. Smallville’s IT department follows the NIST 800-53 standards, and the city requires that all IT service organizations, whether run by city staff or vendors such as Gail Industries, follow these standards.

For this case study, you are to assume the following dates:

·

Audit Period: 1/1/2018 – 12/31/2018

· Audit Field Work Dates: 1/3/2019 – 1/24/2019

Overview of the Operations of Smallville Collections Processing Entity (SCOPE)

Summary of Services Provided

Collections Processing

The Smallville Collections Processing Entity (SCOPE) provides collections processing services to the city of Smallville. SCOPE receives tax payments, licensing fees, parking tickets, and court costs for this major municipality. The city of Smallville sends out invoices and other collections notices, and SCOPE processes payments received through the mail, through an online payment website, and through an interactive voice response (IVR) system. Payments are in the form of checks, debit cards, and credit cards. After processing invoices, SCOPE deposits the monies into the bank account for the city.

SCOPE is responsible for ensuring the security of the mail that comes into the possession of all employees, subcontractors, and agents at its processing facility, located within Smallville. Controls and procedures for money and mail handling are established by SCOPE to ensure payments are accounted for, from the earliest point received through processing and deposit. These controls and procedures provide:

1. Assurances for proper segregation of duties

2. The design and use of satisfactory documentation to ensure proper recording of transactions

3. The safeguarding of access to and use of all assets and records

4. Independent checks on performance

Payment Receipt

The purpose of collections processing is to receive and process various types of payments, post the payment data to the Central Collections System (CCS), and deposit the accompanying funds in the Smallville bank account. This process includes the following types of payment receipts:

· Regular mail – paper checks only

· Website – credit and debit card payments, electronic checks

· IVR – credit and debit card payments

Mail Delivery

A bonded courier picks up the payments from the United States Postal Service (USPS) facility in Smallville. SCOPE uses a subcontractor for courier services. This courier is dedicated, picking up and delivering mail only for SCOPE. This courier is also required to sign for registered, certified, and express delivery envelopes.

Opening and Sorting Mail

The daily success of payment processing depends on receiving mail quickly from the postal service, opening that mail, and properly sorting the contents for processing. Batches contain similar payment types: tax payments are processed together, court collections together, and so forth.

Deposits

Deposits are made daily into the Smallville bank account. Electronic payments (debit cards, credit cards, and paperless checks) are deposited through an interface between CCSys and the bank. Checks are converted to electronic debits and deposited electronically. However, those that cannot be converted to electronic form are deposited in physical form.

Functional Areas of Operations

Gail Industries uses the following specific functional roles of operations:

· Contract manager – responsible for the overall management of contract deliverables of the payment processing operation, including the monitoring of financial expenditures to ensure compliance with contract budgets.

· Operations manager – responsible for planning, managing, and controlling the day-to-day activities of the team that provides operational support for the business unit, including the establishment of operational objectives and work plans and delegation of assignments to subordinate managers.

· Information technology manager – responsible for developing and maintaining the strategy of the future direction of IT infrastructure, including developing plan for the implementation of new IT projects and managing relationships with IT-related vendors and subcontractors.

· Accounting – responsible for performing a variety of routine clerical and accounting functions within the accounting department, including daily balancing of receipts. In addition, the accountant resolves exception transactions, including charged back checks (bounced checks), forgery affidavits, and recoupment.

· Call center – the city of Smallville does not have a centralized call center for handling questions relating to payments and invoices. It is considering adding one to the scope of services offered by Gail Industries.

Information Systems

Services

Gail Industries services are designed around the following tools and technologies:

·

Data Capture and Imaging – real-time instrument imaging and data capture—provides imaging, accountability and reporting of checks and remitted payments.

· Invoice Management and Reporting – data correction and maintenance utilizing automated payment auditing and historical analysis. A browser-based application is available for internal SCOPE and Smallville staff to perform administrative functions. A separate internet-accessible payment portal allows for citizens, business owners, and others to view invoices and make payments.

Processing Platforms

Gail Industries currently utilizes cloud-based servers on the Amazon Web Services (AWS) platform for internet-accessible application. Data capture, imaging, and the payment processing application run on local servers in a secured computer room. Local servers run both Linux and Windows Server operating systems. Data is stored on Microsoft SQL Server to provide storage of payment, image, and balancing data.

The servers supporting the CCS are housed within the SCOPE server room (also known as the data center) and are managed by Gail Industries’ IT staff. The IT staff provides the following services:

· Firewall management – monitoring and management of the firewall systems and networks on a 24/7/365 basis.

· Network monitoring – proactive network and server monitoring services to help maximize system performance and uptime.

· Data backup – data backup services for the production, payment, imaging, and balancing data.

· Incident management – IT incident monitoring, documentation, and resolution management.

Control Objectives and Related Controls

Physical Security (Datacenter)

Control Objective 1: The controls provide reasonable assurance that physical access to computer resources within Gail Industries’ data center is restricted to authorized and appropriate personnel.

To protect physical assets, management has documented and implemented physical access procedures to grant, control, monitor, and revoke access to the on-site SCOPE datacenter.

The datacenter requires two-factor authentication: a biometric credential via retinal eye scanner and a badge access card. Individuals requesting badge access document the request on a standardized employee management form that must be approved by departmental management. Administrative access to the badge access system is restricted to authorized IT personnel.

When an employee is terminated, IT personnel revoke the badge access privileges as a component of the termination process. In addition, the IT manager performs a review of badge access privileges on a monthly basis to help ensure that terminated employees do not retain badge access.

All visitors must sign a logbook upon entering the datacenter, with a picture ID presented to their escort. Access is restricted to authorized IT personnel and equipment technicians.

CCTV surveillance cameras are utilized throughout the facility and the datacenter to record activity; these images are retained for a minimum of 45 days.

Physical Security (Facilities)

Control Objective 2: Controls provide reasonable assurance that physical access to assets within Gail Industries’ facilities is restricted to authorized and appropriate personnel.

To protect physical assets, management has documented and implemented physical access procedures to grant, control, monitor, and revoke access to the on-site SCOPE facility.

A door badge access system is employed to control access to areas within the facility (including the datacenter) through the use of predefined security zones.

Individuals requesting badge access to the facility document the request on a standardized employee management form, accessible through Gail Industries’ employee on-boarding system (known as GEO). All requests must be approved by departmental management. Administrative access to the badge access system is restricted to authorized IT personnel.

Upon termination (voluntary or involuntary), SCOPE IT personnel revoke the badge access privileges as a task in the termination process. In addition, the IT manager performs a monthly review of badge access privileges to ensure that terminated employees do not retain badge access.

Both entrances into the facility are locked and are monitored by administrative personnel. The receptionist must unlock the door for visitor access. Visitors are required to ring a video door bell and announce themselves to the receptionist. Visitors sign a logbook when entering the facility, and they are required to wear a visitor’s badge at all times. Visitors must be escorted by an authorized employee when accessing sensitive facility areas such as the mail room and server room.

CCTV surveillance cameras are utilized throughout the facility and server room to record activity. Video images are retained for a minimum of 45 days.

Environmental Safeguards

Control Objective 3: Controls provide reasonable assurance that environmental safeguards protect physical assets and the data that resides on those assets.

Management has implemented environmental controls to protect physical assets within the datacenter and office facility, including fire detection and suppression controls. The office facility is protected by audible and visual alarms, fire and smoke detectors, a sprinkler system, and hand-held fire extinguishers. A halon-free fire suppression system and smoke detectors protect the datacenter. An uninterruptible power supply (UPS) is in place to provide temporary electricity in the event of a power outage and mitigate the risk of power surges impacting infrastructure to the data center.

Management retains the following inspection reports completed by the third party vendors as evidence of their completion:

· Annual inspection of the fire detection and sprinkler fire suppression system

· Annual inspection of hand-held fire extinguishers located throughout the facility

· Annual inspection of the fire suppression system

· Semi-annual inspection of the UPS systems

Change Management

Control Objective 4: Controls provide reasonable assurance that changes to network infrastructure and system software are documented, tested, approved, and properly implemented to protect data from unauthorized changes and to support user entities’ internal control over financial reporting.

Documented change management policies and procedures are in place to address change management activities. Further, there are provisions for emergency changes to the infrastructure and operating systems. Change requests are documented via a change request (CR) form. CRs include details of the change, including the change requestor, the date of the request, the change description, and change specifications. Management, through the Change Advisory Board (CAB), holds a weekly meeting to review and prioritize change requests. During this meeting, management authorizes change requests by signing off on the CR form.

Detailed testing is performed prior to implementation of the change in test environments that are logically separated from the production environment. The CAB approves the changes prior to implementation. The ability to implement infrastructure and operating system updates to the production systems is restricted to user accounts of authorized IT personnel.

Logical Security

Control Objective 5: Controls provide reasonable assurance that administrative access to network infrastructure and operating system resources is restricted to authorized and appropriate users to support user entities’ internal control over financial reporting.

Information security policies have been documented and are updated annually to assist personnel in the modification of access privileges to information systems and guide them in safeguarding system infrastructure, information assets, and data. Infrastructure and operating system users are authenticated via user account and password prior to being granted access. Password requirements are configured to enforce minimum password length, password expiration intervals, password complexity, password history requirements, and invalid password account lockout threshold, as documented in the IT Procedures and Policies document.

The CCS application authenticates users through the use of individual user accounts and password before granting access to the applications. CCS utilizes predefined security groups for role-based access privileges. The application enforces password requirements of password minimum length, password expiration intervals, password complexity, password history, and invalid password account lockout threshold.

Payment Processing

Control Objective 6: Controls provide reasonable assurance that payments received are processed accurately and timely, and processing exceptions are resolved.

Documented payment processing policies and procedures are in place to guide personnel in the following activities:

· Mailroom processing

· Identification and posting of payments

· Research and processing of unidentified payments

· Financial reporting

· Bank reconciliations

Financial instruments are required to remain within the mailroom during payment processing. When mail is delivered by the courier, both the courier and the mail room supervisor initial the mail receipt log to verify the envelope count received.

Physical access privileges of data entry personnel are segregated from balancing and mailroom personnel. Logical access to processing systems are segregated between data entry, balancing, and mailroom personnel.

Data Transmission

Control Objective 7: Controls provide reasonable assurance that transmitted payment data is complete, accurate, and timely.

SCOPE exchanges payment and invoice information electronically with Smallville via scheduled inbound and outbound data transmissions each day. Smallville provides a list of newly created invoices that were issued on the previous business day. SCOPE receives this information in the CCS application and uses this for processing payments. Each day, all payments processed by SCOPE are sent back to the city of Smallville, which imports this data into its systems.

Deposits

Control Objective 8: Controls provide reasonable assurance that deposits are processed completely, accurately, and in a timely manner.

Documented procedures are in place that addresses the transfer and security of financial instruments, including delivery of the mail from the Post Office (P.O) boxes to the SCOPE mailroom and the delivery of deposits from the SCOPE mailroom to the bank processing center.

A courier pickup and delivery schedule, outlining the date/times of scheduled mail deliveries by the third party courier, is maintained and posted in the mailroom. SCOPE utilizes a third-party courier service for delivery of financial instruments to the city of Smallville’s bank.

Partially Collected Audit Evidence

GEO/SCOPE Active Employees Report

Generated 1/3/2019 8:26 AM

Employee ID

Full Name

Department

Status

Door Badge

10001438

Andrea Bradley

Administrator

Active

1902

10001337

Cesar Lynch

Administrator

Active

1904

10001232

Darin Young

Administrator

Active

2048

10000006

Gina Carmack

Administrator

Active

1900

10000001

Gail Lucas

Administrator

Active

1874

10001232

Ken Smith

Administrator

Active

1999

10001298

Michelle Adams

Administrator

Active

2005

10001396

Susan Larame

Administrator

Active

2010

10001301

Steve Lenzi

Administrator

Active

1871

10001243

Tessa Hammer

Administrator

Active

1801

10001188

Victoria Brown

Administrator

Active

2007

10001156

Yvonne Vasquez

Administrator

Active

1869

12 Employees Listed

GEO/SCOPE Terminated Employees Report

Generated 1/3/2019 8:22 AM

Employee ID

Full Name

Department

Status

Term Date

10001038

Alan McDonald

IT

Termed

6/8/2018

1 Employee Listed

GEO/SCOPE IT Active Employees Report

Generated 1/3/2019 8:55 AM

Employee ID

Full Name

Department

Status

Hire Date

10001232

Ken Smith

IT

Active

1/3/2017

10001396

Susan Larame

IT

Active

7/5/2018

2 Employees Listed

Datacenter Visitor’s Log

Date

Name

Title

Organization

ID presented

Escorted By

3/12/2018

Gail Lucas

President

Gail Industries

 

Alan, IT Specialist

7/2/2018

Kerry Lark

IT Director

City of Smallville

Driver’s Lic.

Ken, IT Manager

7/31/2018

B. Smith

Technician

UPS Fixit

Driver’s Lic.

Susan, IT Specialist

9/8/2018

B. Smith

Technician

UPS Fixit

Driver’s Lic.

Susan, IT Specialist

11/13/2018

John Wilson

Technician

Fire Suppression Inc.

Business Card

Susan, IT Specialist

Windows Domain Group Policy for Passwords

CCS Active Users Report

Generated 1/3/2019 8:26 AM

User ID

Full Name

System Rights

Status

Email

ABradley

Andrea Bradley

Administrator

Active

abradley@scope.smallville.city.us

AMcdonald

Alan McDonald

Administrator

Active

amcdonald@scope.smallville.city.us

CLynch

Cesar Lynch

Administrator

Active

clynch@scope.smallville.city.us

DYoung

Darin Young

Administrator

Active

dyoung@scope.smallville.city.us

GCarmack

Gina Carmack

Administrator

Active

gcarmack@scope.smallville.city.us

GLucas

Gail Lucas

Administrator

Active

glucas@scope.smallville.city.us

KSmith

Ken Smith

Administrator

Active

ksmith@scope.smallville.city.us

MAdams

Michelle Adams

Administrator

Active

madams@scope.smallville.city.us

SLarame

Susan Larame

Administrator

Active

slarame@scope.smallville.city.us

SLenzi

Steve Lenzi

Administrator

Active

slenzi@scope.smallville.city.us

THAMMER

Tessa Hammer

Administrator

Active

thammer@scope.smallville.city.us

VBrown

Victoria Brown

Administrator

Active

vbrown@scope.smallville.city.us

YVasquez

Yvonne Vasquez

Administrator

Active

yvasquez@scope.smallville.city.us

Excerpt from IT Policies and Procedures Manual

Version 1.0, 12/31/2016

Revision History

Date

Author

Notes

12/31/2016

Ken Smith

Version 1.0, accepted by client

Overview

This policy is intended to establish guidelines for effectively creating, maintaining, and protecting passwords at SCOPE.

Scope

This policy shall apply to all employees, contractors, and affiliates of SCOPE, and shall govern acceptable password use on all systems that connect to SCOPE network or access or store SCOPE, city of Smallville, or Gail Industries data.

Policy

Password Creation

1. All user and admin passwords must be at least [8] characters in length. Longer passwords and passphrases are strongly encouraged.

2. Where possible, password dictionaries should be utilized to prevent the use of common and easily cracked passwords.

3. Passwords must be completely unique, and not used for any other system, application, or personal account.

4. Default installation passwords must be changed immediately after installation is complete.

Password Aging

1. User passwords must be changed every 60 days. Previously used passwords may not be reused.

2. System-level passwords must be changed on a monthly basis.

Password Protection

1. Passwords must not be shared with anyone (including coworkers and supervisors), and must not be revealed or sent electronically.

2. Passwords shall not be written down or physically stored anywhere in the office.

3. When configuring password “hints,” do not hint at the format of your password (e.g., “zip + middle name”)

4. User IDs and passwords must not be stored in an unencrypted format.

5. User IDs and passwords must not be scripted to enable automatic login.

6. “Remember Password” feature on websites and applications should not be used.

7. All mobile devices that connect to the company network must be secured with a password and/or biometric authentication and must be configured to lock after 3 minutes of inactivity.

Enforcement

It is the responsibility of the end user to ensure enforcement with the policies above.

If you believe your password may have been compromised, please immediately report the incident to the IT Department and change the password.

Courier Deposit Log

Date

Deposit Items

Time

Courier

SCOPE

1/2/2018

328

3:41 PM

V. Barnes

Mia Liu

1/3/2018

748

3:45 PM

V. Barnes

Mia Liu

1/4/2018

1050

4:30 PM

V. Barnes

Mia Liu

1/5/2018

258

3:31 PM

V. Barnes

Mia Liu

1/8/2018

1238

3:15 PM

V. Barnes

Mia Liu

1/9/2018

208

4:02 PM

V. Barnes

Mia Liu

1/10/2018

1031

3:45 PM

V. Barnes

Mia Liu

1/11/2018

1343

3:56 PM

V. Barnes

Mia Liu

1/12/2018

211

3:01 PM

V. Barnes

Mia Liu

1/15/2018

230

3:02 PM

V. Barnes

Mia Liu

1/16/2018

576

3:02 PM

V. Barnes

Mia Liu

1/17/2018

332

4:02 PM

V. Barnes

Mia Liu

1/18/2018

1204

 

 

Mia Liu

1/19/2018

904

 

 

Mia Liu

1/22/2018

231

 

 

Mia Liu

1/23/2018

441

 

 

Mia Liu

1/24/2018

400

 

 

Mia Liu

1/25/2018

 

 

 

 

1/26/2018

 

 

 

 

1/29/2018

 

 

 

 

1/30/2018

 

 

 

 

1/31/2018

 

 

 

 

2/1/2018

549

4:02 PM

V. Barnes

Mia Liu

2/2/2018

 

 

 

 

2/5/2018

 

 

 

 

2/6/2018

 

 

 

 

2/7/2018

 

 

 

 

2/8/2018

 

 

 

 

2/9/2018

 

 

 

 

2/12/2018

 

 

 

 

2/13/2018

 

 

 

 

2/14/2018

 

 

 

 

(No entries after 2/14/2018)

Fire Extinguisher Inspection Tag

Oldest Camera Image, from September 30, 2018 @3:30 AM

Newest Camera Image, from January 3, 2019

Proposed Call Center Operations Department

Recently, the city of Smallville has asked Gail Industries to expand the scope of the SCOPE contract by starting up a call center operation within the facility. This call center would handle hundreds of telephone calls placed by those who receive invoices from the city on a daily basis. Callers would be able to talk to a customer service representative (CSR) to check their account balance (ensuring payments had posted), dispute invoices received (which will be investigated by city of Smallville personnel), and accept credit card and debit card payments over the telephone.

What Will You Get?

We provide professional writing services to help you score straight A’s by submitting custom written assignments that mirror your guidelines.

Premium Quality

Get result-oriented writing and never worry about grades anymore. We follow the highest quality standards to make sure that you get perfect assignments.

Experienced Writers

Our writers have experience in dealing with papers of every educational level. You can surely rely on the expertise of our qualified professionals.

On-Time Delivery

Your deadline is our threshold for success and we take it very seriously. We make sure you receive your papers before your predefined time.

24/7 Customer Support

Someone from our customer support team is always here to respond to your questions. So, hit us up if you have got any ambiguity or concern.

Complete Confidentiality

Sit back and relax while we help you out with writing your papers. We have an ultimate policy for keeping your personal and order-related details a secret.

Authentic Sources

We assure you that your document will be thoroughly checked for plagiarism and grammatical errors as we use highly authentic and licit sources.

Moneyback Guarantee

Still reluctant about placing an order? Our 100% Moneyback Guarantee backs you up on rare occasions where you aren’t satisfied with the writing.

Order Tracking

You don’t have to wait for an update for hours; you can track the progress of your order any time you want. We share the status after each step.

image

Areas of Expertise

Although you can leverage our expertise for any writing task, we have a knack for creating flawless papers for the following document types.

Areas of Expertise

Although you can leverage our expertise for any writing task, we have a knack for creating flawless papers for the following document types.

image

Trusted Partner of 9650+ Students for Writing

From brainstorming your paper's outline to perfecting its grammar, we perform every step carefully to make your paper worthy of A grade.

Preferred Writer

Hire your preferred writer anytime. Simply specify if you want your preferred expert to write your paper and we’ll make that happen.

Grammar Check Report

Get an elaborate and authentic grammar check report with your work to have the grammar goodness sealed in your document.

One Page Summary

You can purchase this feature if you want our writers to sum up your paper in the form of a concise and well-articulated summary.

Plagiarism Report

You don’t have to worry about plagiarism anymore. Get a plagiarism report to certify the uniqueness of your work.

Free Features $66FREE

  • Most Qualified Writer $10FREE
  • Plagiarism Scan Report $10FREE
  • Unlimited Revisions $08FREE
  • Paper Formatting $05FREE
  • Cover Page $05FREE
  • Referencing & Bibliography $10FREE
  • Dedicated User Area $08FREE
  • 24/7 Order Tracking $05FREE
  • Periodic Email Alerts $05FREE
image

Our Services

Join us for the best experience while seeking writing assistance in your college life. A good grade is all you need to boost up your academic excellence and we are all about it.

  • On-time Delivery
  • 24/7 Order Tracking
  • Access to Authentic Sources
Academic Writing

We create perfect papers according to the guidelines.

Professional Editing

We seamlessly edit out errors from your papers.

Thorough Proofreading

We thoroughly read your final draft to identify errors.

image

Delegate Your Challenging Writing Tasks to Experienced Professionals

Work with ultimate peace of mind because we ensure that your academic work is our responsibility and your grades are a top concern for us!

Check Out Our Sample Work

Dedication. Quality. Commitment. Punctuality

Categories
All samples
Essay (any type)
Essay (any type)
The Value of a Nursing Degree
Undergrad. (yrs 3-4)
Nursing
2
View this sample

It May Not Be Much, but It’s Honest Work!

Here is what we have achieved so far. These numbers are evidence that we go the extra mile to make your college journey successful.

0+

Happy Clients

0+

Words Written This Week

0+

Ongoing Orders

0%

Customer Satisfaction Rate
image

Process as Fine as Brewed Coffee

We have the most intuitive and minimalistic process so that you can easily place an order. Just follow a few steps to unlock success.

See How We Helped 9000+ Students Achieve Success

image

We Analyze Your Problem and Offer Customized Writing

We understand your guidelines first before delivering any writing service. You can discuss your writing needs and we will have them evaluated by our dedicated team.

  • Clear elicitation of your requirements.
  • Customized writing as per your needs.

We Mirror Your Guidelines to Deliver Quality Services

We write your papers in a standardized way. We complete your work in such a way that it turns out to be a perfect description of your guidelines.

  • Proactive analysis of your writing.
  • Active communication to understand requirements.
image
image

We Handle Your Writing Tasks to Ensure Excellent Grades

We promise you excellent grades and academic excellence that you always longed for. Our writers stay in touch with you via email.

  • Thorough research and analysis for every order.
  • Deliverance of reliable writing service to improve your grades.
Place an Order Start Chat Now
image

Order your essay today and save 30% with the discount code Happy