Internal Controls


Despite making progress in safeguarding sensitive or confidential information, the SEC still lacks consistency in implementing key data controls, the GAO said in its annual audit released in April. Information security control weaknesses identified included 13 that remained unresolved from the previous year’s audit, plus 15 new ones, the GAO said. They included insufficient testing and evaluation of controls for a major data system as required by a certification and accreditation process, as well as inconsistent implementation of policies and procedures, including parts of the SEC’s information-security program.

The SEC had corrected 58 of the 71 weaknesses identified in 2005, the GAO noted, and by the completion of its 2006 audit had taken action on 11 of the newly identified faults. But the commission had not adequately guarded identification and authentication of users of data systems, leaving critical information in some instances vulnerable to hacking or unauthorized use or modification, the GAO said. For instance, requests for new or upgraded access to the EDGAR company financial reporting system weren’t always properly reviewed, and records of user privileges didn’t always reflect current information about users’ roles within the SEC.

PODCAST

What’s next for potential CPA licensure changes

A new model proposed by NASBA and the AICPA is designed with an eye on the future for newly licensed CPAs. The AICPA's Carl Mayes, CPA, provides background on the project and a look ahead to 2020.

VIDEO

What RPA is and how it works

Robotic process automation is like an Excel macro that can work on multiple applications, says Danielle Supkis Cheek, CPA. RPA can complete routine, repetitive tasks such as data entry, freeing up employee time from lower-level chores.