Enterprise Information Systems and Strategic Management: Content


 Navigate Content

Enterprise Information Systems and Strategic Management
Financial and Accounting Systems | Mock Test Papers | May 2018
Question 1
Describe Role Based Access Control (RBAC) in Enterprise Resource Planning (ERP) System.
[MTP- March ‘18, 2 Marks]
Answer 1
Role Based Access Control (RBAC) in ERP System: In computer systems security, role-based
access control is an approach to restricting system access to authorized users. It is used by most
enterprises and can implement mandatory access control or discretionary access control. RBAC is
sometimes referred to as Role-Based Security. Role-Based-Access-Control (RBAC) is a policy
neutral access control mechanism defined around roles and privileges. The components of RBAC
such as role- permissions, user-role and role-role relationships make it simple to perform user
assignments. RBAC can be used to facilitate administration of security in large organizations with
hundreds of users and thousands of permissions.
Roles for staff are defined in organization and access to the system can be given according to the
role assigned. For example - A junior accountant in accounting department is assigned a role of
recording basic accounting transactions, an executive in human resource department is assigned a
role of gathering data for salary calculations on monthly basis, etc.
Question 2
As an IS Auditor, determine a checklist for the audit of ERP system in an organization. Also,
summarize the auditing aspects of ERP systems. (6 Marks March ‘18)
Answer 2
Checklist to be followed by an IS Auditor for the audit of ERP Systems are as follows:
Does the system process according to GAAP (Generally Accepted Accounting

Principles) and GAAS (Generally Accepted Auditing Standards)?
Does it meet the needs for reporting, whether regulatory or organizational?
Were adequate user requirements developed through meaningful interaction?
Does the system protect confidentiality and integrity of information assets?
Does it have controls to process only authentic, valid, accurate transactions?
Are effective system operations and support functions provided?

 Are all system resources protected from unauthorized access and use?
Are user privileges based on what is called ‘role-based access?’
Is there an ERP system administrator with clearly defined responsibilities?
Is the functionality acceptable? Are user requirements met? Are users happy?
Have workarounds or manual steps been required to meet business needs?
Are there adequate audit trails and monitoring of user activities?
Can the system provide management with suitable performance data?
Are users trained? Do they have complete and current documentation?
Is there a problem-escalation process?
Auditing aspects in case of any ERP system can be summarized as under:
i. Auditing of Data
Physical Safety – Ensuring physical control over data.
Access Control – Ensuring access to the system is given on “need to know” (a
junior accountant need not view Profit & Loss Account of the business) and “need
to do basis” (HR executive need not record a Purchase Order).
ii. Auditing of Processes
Functional Audit - This includes testing of different functions / features in the
system and testing of the overall process or part of process in the system and its
comparison with actual process. E.g. Purchase Process, Sales Process, Salary
Calculation Process, Recruitment Process, etc. Auditor may check this process in
the system and compare it with actual process. It is quite possible that all the
aspect present in the actual process may not be integrated in the ERP system.
There may be some manual intervention.
Input Validations - This stands for checking of rules for input of data into the
system. E.g. a transaction of cash sales on sales counter must not be recorded in a
date other than today (not a future date or a back date), amount field must not be
zero, stock item field shall not be empty, etc. Input validations shall change
according to each data input form.
Question 3
Discuss the peculiarities that must be considered while allotting a voucher number to a
voucher. [MTP- March-2018-4 Marks]
Answer 3
A Voucher Number or a Document Number is a unique identity of any voucher /document. A

 may be identified or searched using its unique voucher number. The peculiarities that must
voucher
be considered while allotting a voucher number to a voucher are as follows:
Voucher number must be unique.

Every voucher type shall have a separate numbering series
A voucher number may have prefix or suffix or both, e.g. ICPL/2034/17 -18. In this
case, “ICPL” is the prefix, “17-18” is the suffix and “2034” is the actual number of the
voucher.
All vouchers must be numbered serially, i.e. 1,2,3,4,5,6 and so on.
All vouchers are recorded in chronological order and hence voucher recorded earlier
must have an earlier number, i.e. if voucher number for a payment voucher having
date as 15th April 2017 is 112, voucher number for all the vouchers recorded after
this date shall be more than 112 only.
Previous Page Next Page



Enterprise Information Systems and Strategic Management: Content

Uploaded by

Copyright:

Available Formats

Enterprise Information Systems and Strategic Management: Content

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Enterprise Information Systems and Strategic Management: Content

Uploaded by

Copyright:

Available Formats



Does the system process according to GAAP (Generally Accepted Accounting

Auditing aspects in case of any ERP system can be summarized as under:

Voucher number must be unique.

Previous Page Next Page

You might also like