CMGT400 University of Phoenix Security Risk Mitigation Plan Paper A Risk Management Analyst identifies and analyzes potential issues that could negatively

CMGT400 University of Phoenix Security Risk Mitigation Plan Paper A Risk Management Analyst identifies and analyzes potential issues that could negatively impact a business in order to help the business avoid or mitigate those risks.

Take on the role of Risk Management Analyst for the organization you chose in Week 1.

Using the Security Risk Mitigation Plan Template, create a 6- to 8-page Security Risk Mitigation Plan for the organization you chose.

Research and include the following:

Refer to the course materials and additional resources from the Week 3 assignment, additional resources below, and the grading rubric.
Security Risk Mitigation Plan:
Select and document security policies and controls.
Provide authentication recommendations.
Document administrator roles and responsibilities.
Document user roles and responsibilities.
Determine authentication strategy.
Determine intrusion prevention and detection strategy.
Determine virus detection strategies and protection.
Create auditing policies and procedures.
Recommend an education plan for employees on security protocols and appropriate use.
Provide recommendations for managing identified risk
Avoidance
Transference
Mitigation
Acceptance
Address change Management/Version Control.
Outline acceptable use of organizational assets and data.
Present employee policies (separation of duties/training).
Incident response process
Preparation
Detection
Containment/analysis
Eradication
Restoration/Recovery
Lessons learned (root cause analysis and action plan)

Additional Resources

Intrusion prevention begins with an IPS that can automatically detect and stop intrusions. However, no control can stop all intrusions. Consequently, we need strong detection controls, including
Log Management
User Behavior Analysis
Network Behavior Analysis
The purpose of separation of duties is to ensure no one person can perform all tasks associated with a critical business process. This helps prevent fraud and mistakes. A common way to do this is the creation of roles (RBAC) and the assignment of tasks in an access matrix (spreadsheet). This allows data owners to understand who can do what and how to remove one or more tasks to ensure no role can perform all business process tasks. A separation of duties tool is attached below. The tabs along the bottom take you to the various business processes included. Adapt this to any set of business processes.
Employee training is typically focused on the contents of the acceptable use policy.A Risk Management Analyst identifies and analyzes potential issues that could negatively impact a business in order to help the business avoid or mitigate those risks.A Risk Management Analyst identifies and analyzes potential issues that could negatively impact a business in order to help the business avoid or mitigate those risks.Take on the role of Risk Management Analyst for the organization you chose in Week 1.Using the Security Risk Mitigation Plan Template, create a 6- to 8-page Security Risk Mitigation Plan for the organization you chose.Research and include the following:
Refer to the course materials and additional resources from the Week 3 assignment, additional resources below, and the grading rubric.
Security Risk Mitigation Plan:
Select and document security policies and controls.
Provide authentication recommendations.
Document administrator roles and responsibilities.
Document user roles and responsibilities.
Determine authentication strategy.
Determine intrusion prevention and detection strategy.
Determine virus detection strategies and protection.
Create auditing policies and procedures.
Recommend an education plan for employees on security protocols and appropriate use.
Provide recommendations for managing identified risk
Avoidance
Transference
Mitigation
Acceptance
Address change Management/Version Control.
Outline acceptable use of organizational assets and data.
Present employee policies (separation of duties/training).
Incident response process
Preparation
Detection
Containment/analysis
Eradication
Restoration/Recovery
Lessons learned (root cause analysis and action plan)
Additional Resources
Intrusion prevention begins with an IPS that can automatically detect and stop intrusions. However, no control can stop all intrusions. Consequently, we need strong detection controls, including
Log Management
User Behavior Analysis
Network Behavior Analysis
The purpose of separation of duties is to ensure no one person can perform all tasks associated with a critical business process. This helps prevent fraud and mistakes. A common way to do this is the creation of roles (RBAC) and the assignment of tasks in an access matrix (spreadsheet). This allows data owners to understand who can do what and how to remove one or more tasks to ensure no role can perform all business process tasks. A separation of duties tool is attached below. The tabs along the bottom take you to the various business processes included. Adapt this to any set of business processes.
Employee training is typically focused on the contents of the acceptable use policy. University System of Georgia
Separation of Duties Matrix
Introduction
The concept of Segregation of Duties is to separate the major responsibilities of authorizing
transactions, custody of assets, recording of transactions and reconciliation/verification of
transactions for each business process. From a separation of duties perspective, the completion of
more than one of these functions would be considered performing “incompatible duties”. In other
words, no one employee should have responsibility to complete two or more of these major
responsibilities. However, staff limitations may make this impractical and that is when
Compensating controls must be considered.
The attached matrices have been developed to assist you in structuring proper separation of duties and
identifying areas where separation of duties is lacking. They will cover the most common processes that
everyone should have (Cash, Petty Cash, Investments and Treasury, Purchasing, Payroll, Inventory, Fixed
Assets and General Ledger).
When completing these forms, if you identify employees who perform two or more tasks for each
business process area, you will need to determine if those tasks would be considered a performance
of “incompatible duties”. If so, you will need to consider compensating controls or revise duties.
We should always strive for the optimum degree of segregation of duties. However, due to limited staff sizes
at some schools, optimum separation of duties cannot be achieved. In those circumstances you should at
least strive for an acceptable(minimal) level of segregation of duties which when combined with
compensating controls will minimize the impact of control deficiencies and exposure to errors or
irregularities. A minimal level of segregation of duties could possibly be achieved by verifying that no one
employee performs more than two of the “incompatible duties”. For example, an employee might perform
the authorization and verification/reconciliation functions but they should not record the transaction or
maintain custody of assets. A compensating control would be managerial review.
1)
2)
3)
4)
5)
6)
7)
8)
9)
10)
11)
12)
13)
14)
15)
16)
17)
18)
19)
20)
21)
Receives Cash/Deposits
Reconciles Cash Receipts to Daily Cash
Prepares Bank Deposit
Takes Deposit to Bank
Records Deposit Transaction into Banner (or other
Subsidiary ledger)
Reconciles Deposits to amounts recorded in G/L
Reviews Cash Reconciliations
Prepares Voucher Package for payment (Match P0,
receiving evidence, invoice)
Prepares Check Requests
Approves Checks for Payment and affixes signature
Mails Vendor Checks
Initiates Wire Transfers
Approves Wire Transfers
Creates postive pay file and transfers to Bank
Posts Disbursements to Subsidiary ledger
Reconciles Disbursements from Subdiary ledger to G/L
Reviews G/L reconciliations
Maintains Check Stock
Maintains Signature Stamp
Reconciles Bank Statements
Approves Bank Reconciliations
Suggestions for Best Practices
Best practices for separating duties for the receipting function would be to ensure that the
responsibilities of receiving cash, deposit preparation and posting activity to the general ledger are
separated.
Best practices for the disbursing of funds would be to ensure that the responsibilities of preparing
voucher packages, preparing check requests, approving checks for payment and mailing checks are
separated.
Bank reconciliations should be prepared by someone who is not involved in the cash receipts or
disbursement function if at all possible. Also, bank reconciliations should always be approved by
supervisory level personnel who are not involved in the daily cash activities.
When staff size limits separation of duties, the following compensating controls may help limit the
severity of control weaknesses:
Some of the non-technical duties, such as taking deposits to the bank, maintaining check stock,
etc., could be performed by administrative staff not involved in cash or accounting related
functions, possibly even staff from other departments.
Monitoring and review of receipting and disbursement activity by supervisory personnel not
directly involved with daily processing could be added as compensating controls.
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Cash/Check Handling (Receipts, Disbursements, Reconciliation)
Compensating
Controls
1)
2)
3)
4)
Disburses Petty Cash
Reconciles Petty Cash
Replinshes Petty Cash fund
Posts Petty Cash Activity to G/L
Suggestions for Best Practices
Generally one person should be designated as petty cash custodian. This person
disburses petty cash and turns in vouchers to have fund reimbursed.
Petty cash custodian should not have access to post activity to general ledger or
replenish petty cash fund.
Petty cash counts should be made on periodic basis by someone independent of
petty cash process.
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Petty Cash
Compensating
Controls
1)
2)
3)
4)
5)
6)
7)
8)
Initiates request to open bank accounts
Authorizes opening of new bank accounts
Adds new account information to G/L
Initiates invesment transactions
Reviews and approves investment transactions
Posts investment activity to the G/L
Reconciles Investment Accounts to amounts reported on
G/L
Maintains investments (ie, stock certificates, cd’s, etc)
Suggestions for Best Practices
Only members of senior management should be able to authorize opening of new bank accounts.
Treasury type activities such as opening bank accounts and authorizing signatories should not be
performed by employees involved in daily cash activities.
Employee entering investment activity into the General Ledger should not be same person that
initiated and authorized the transactions.
Employee responsible for reconciling investment activity should be independent of investment process.
Investments should be maintained by someone who is not directly involved in day to day investment
process. This might be an area for senior management, because they are usually not directly involved with
day to day processing.
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Investments and Treasury
Compensating
Controls
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Compensating
Controls
Purchasing
1)
2)
3)
4)
5)
6)
7)
8)
Initiates Purchase Order Requisitions
Approves Purchase Requisitions
Prepares Purchase Order
Approves Purchase Order
Modifies Master Vendor file
Receives goods from Vendor
Modifies or Reconciles Inventory Records
Approves Vendor Invoices for Payment
Suggestions for Best Practices
If Purchase Requisitions are utilized, they should be reviewed and approved by someone other than
employee initiating the requisition.
For most effective separation of duties, employees involved in the purchasing function (initiating
requisitions, creating purchase orders, approving purchase orders) should not have disbursement
related responsibilities. These employees should not be able to approve invoices for payment, record
invoices, receive goods, maintain inventories, or modify Vendor Master files.
When staff size limits separation of duties, the following compensating controls may help limit the severity of control weaknesses:
Produce reports of purchase orders and subsequent payments from the accounting system and have a
supervisory level employee independent of the purchasing function review the reports for accuracy. Have
employee pay particular attention to payments to new vendors.
Have person independent of purchasing process check bills of lading and receiving evidence to inventory records.
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Compensating
Controls
Payroll
1)
2)
3)
4)
5)
6)
7)
8)
9)
Responsible for Modifying Employee Master File
Approves modifications to Employee Master File
Prepares payroll file for processing
Approves payroll file
Generates Payroll Checks
Distributes Payroll checks or initiates direct deposits
Reviews and approves final payroll report
Records payroll expense in G/L
Reconciles payroll subsidiary module to G/L
Suggestions for Best Practices
No one employee should have total responsibility for modifications to the Master file. One employee should initiate the change and
a second employee should review and authorize the change. The employee who initiated the change could then make the change.
Since this employee has access to the Employee Master file, this employee should not be directly involved in payroll process.
When a third party service provider is used, best practices would suggest that changes to Master file data should be communicated
to the third party by employee who is not involved in recording of payroll activity, preparing reconciliations or check distribution.
Processing of payroll should be separated from approval function.
Employee not involved in payroll functions should investigate and reconcile returned payroll checks or rejected direct deposits.
Employee outside of direct payroll functions should post payroll journal (initiate jounal generation) to general ledger.
Reconciliations should be performed by employee who does not have ability make journal entries or otherwise modify payroll.
When staff size limits separation of duties, the following compensating controls may help limit the severity of control weaknesses:
Have supervisory level employee who is not directly involved with the payroll process review and approve payroll files prior to
and after final processing.
Utilize Analyticals to verify accuracy of wages by reconciling gross wages to 941 reports and W-2’s. Also, payroll expenses could
be compared to budgeted amounts on periodic basis.
If an employee involved in the payroll process also maintains the Employee Master file, consider generating a report of all
payroll changes and have supervisory level employee review the changes against Personnel Action Request forms.
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Inventory
1)
2)
3)
4)
5)
6)
7)
8)
Receives goods from Vendor
Performs physical inventory counts
Modifies inventory records
Reconcilies physical inventory counts to inventory
records
Reconciles inventory records to G/L
Reviews reconciliation of inventory records to G/L
Disposes of obsolete (scrap) inventory
Records adjustments (journal entries) to inventory
records and G/L
Suggestions for Best Practices
Best practices suggest that employees who receive goods from vendors should not be involved in purchasing or
cash disbursement functions.
Physical Inventory counts should be performed by someone who does not have custody of inventory.
Employee who has access to make modifications to inventory system should not have access to make
adjustments to general ledger
Reconciliation of inventory system to physical counts and the general ledger should be performed by someone
not responsible for maintaining the inventory system.
On inventory disposals, one employee should not be able to initiate and approve the disposal and also record
these adjustments on the inventory system and the general ledger.
When staff size limits separation of duties, the following compensating controls may help limit the severity of
control weaknesses:
If physical counts cannot be performed by employee independent of the inventory process, then spot
checks of inventory counts should be made by employee who is not custodian of inventory assets or
responsible for recording inventory on accounting records.
If unable to adequately separate duties of maintaining inventory system from reconciliation and posting,
one suggestion would be to have supervisory personnel receive reports of changes to inventory balances,
paying particular attention to manual changes and adjustments.
If disposal activities cannot be adequately separated, a supervisory level employee could review and
approve a listing of items identified for disposal against actual disposals recorded and income received
from scrap sales.
Compensating
Controls
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Capital Assets
1)
Initiates Purchase of Capital Assets (This may be covered in
Purchasing Area above)
2) Approves Purchase of Capital Assets
3) Approves Capital Asset Disposals
4) Disposes of Capital Assets
5) Records Capital Asset additions and disposals in Asset
Management module
6) Performs periodic physical counts of Capital Assets
7) Reconciles physical Capital Asset counts to Asset
Management sub-system
8) Makes adjustments to Asset Management sub-system
9) Reconciles Asset Management sub-system to G/L
10) Reviews reconciliation of Asset Management sub-system to
G/L
11) Maintains Capital Asset sub-system (updates Master file for
asset categories, useful lives and depreciation tables)
Suggestions for Best Practices
Master files of asset categories and depreciation tables should be restricted and not available to employees who are
authorizing, recording and reconciling fixed assets.
Employees responsible for authorizing purchases or disposals of capital assets should not have access to recording
transactions in fixed assets ledger.
Peridic physical counts should not be performed by person(s) with authorization or record keeping responsibilities.
Some entities hire outside inventory service agencies if staff is not adequate.
Adjustments to the fixed assets system should be reviewed and approved by a supervisory level employee not
involved in maintaining fixed assets.
Asset management sub-system should be reconciled to general ledger by someone not responsible for the fixed
assets sub-system.
When staff size limits separation of duties, the following compensating controls may help limit the severity of control
weaknesses:
If purchasing and disposition procedures cannot be adequately separated, system reports of all fixed asset
additions, deductions and disposals could be reviewed and approved by a supervisory level employee not
involved in the fixed assets process.
If recording and reconciliation procedures cannot be adequately separated, a supervisory level employee not
involved in the fixed asset process could review reconciliations of the fixed assets sub-system to the general
ledger as well as reviewing a system generated report of all adjustments made to correct discrepiencies
between the sub-system and the general ledger to help substantiate accuracy of recorded amounts.
Compensating
Controls
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Name of Staff and Title
Compensating
Controls
General Ledger
1)
2)
3)
4)
5)
6)
7)
8)
Responsible for modifying (adding, deleting, mapping ) G/L
accounts
Approves changes to G/L accounts
Prepares journal entries for posting
Approves journal entries
Posts journal entries
Prepares financial statements from G/L
Approves financial statements
Suggestions for Best Practices
Generally, the Chief Financial Officer, Controller and accounting department personnel should not have access to
modify general ledger accounts or change mappings for these accounts. Normally these changes should be made by
IT personnel after approval by CFO or Controller.
Employees responsible for preparing/initiating a journal entry should not be able to approve or record the journal entries.
Financial statements should be approved by supervisory personnel at a higher authority level than person preparing the financial
statements.
If the general ledger system is configured so that journals cannot be approved prior to posting a compensating
control would be to print a report of all journal entries at the end of each period and have a supervisory level
employee who does not have access to record transactions review and approve the transactions that have been
recorded.

Purchase answer to see full
attachment