Internal Controls


Despite making progress in safeguarding sensitive or confidential information, the SEC still lacks consistency in implementing key data controls, the GAO said in its annual audit released in April. Information security control weaknesses identified included 13 that remained unresolved from the previous year’s audit, plus 15 new ones, the GAO said. They included insufficient testing and evaluation of controls for a major data system as required by a certification and accreditation process, as well as inconsistent implementation of policies and procedures, including parts of the SEC’s information-security program.

The SEC had corrected 58 of the 71 weaknesses identified in 2005, the GAO noted, and by the completion of its 2006 audit had taken action on 11 of the newly identified faults. But the commission had not adequately guarded identification and authentication of users of data systems, leaving critical information in some instances vulnerable to hacking or unauthorized use or modification, the GAO said. For instance, requests for new or upgraded access to the EDGAR company financial reporting system weren’t always properly reviewed, and records of user privileges didn’t always reflect current information about users’ roles within the SEC.

FEATURE

Tackling TCJA changes this tax season

Return preparers must be ready for how the Tax Cuts and Jobs Act has modified many common features of individual and business returns.

PODCAST

Why CPAs can’t wait on automation tools

What do accounting firms waiting on others to develop AI, automation, and data analytics tools have in common with a baseball fan sitting in a stadium filling with water at an exponential rate? The answer could determine your firm’s fate.