Cilly Stress, a fourth-year honours computer science student at a highly regarded university, was working as part-time cleaning staff at the Classy Manufacturing Company (CMC) when she was expelled from school for misuse of the university’s computer resources. Cilly was able to improve her employment status to fulltime cleaning staff. She enjoyed working the night shift, where she found lots of time and opportunity to snoop around the company’s office and computing centre. She learned from documentation in the recycling bins that CMC was in the process of updating its extensive policy and procedures documentation and placing it online.
Through continued efforts in searching waste bins and documents left on desktops and unlocked cabinets, as well as some careful observation of password entry by people who were working late, Cilly soon learned enough to log in to the company’s information systems and ultimately to print out lists of user identification codes and passwords using a Trojan horse program. She was able to obtain all the passwords she needed to set herself up as a supplier, customer, and systems support technician.
As a customer, she was able to order enough goods so that the inventory procurement system would automatically trigger a need for purchase of products. Then, as a supplier, she was ready to deliver the goods at the specified price (by returning the goods that she had “purchased”). As a supervisor, she was able to write off the uncollected accounts receivable from her customer accounts while being paid as a supplier. On average, she was able to embezzle about $125,000 per month.
Cilly’s fraud was detected by a suspicious delivery person, who wondered why he was delivering goods to an empty building lot.
REQUIRED
a. Describe weaknesses in human resources and access policies at CMC. For each weakness, indicate the impact and provide a recommendation for improvement.
b. Identify routine audit procedures that might have produced evidence that, with further investigation, could have revealed the fraud. Describe the evidence in the test results that would have triggered the investigation.