Novelty Tours Pvt. Ltd. is a small travel company established 4yrs back. It has
Novelty Tours Pvt. Ltd. is a small travel company established 4yrs back. It has many inhouse applications, including Novelty payments app. The Novelty payments app is used for multiple payments related functions such as approving and disbursing funds for vendor invoices. Mary Smith is performing the audit (Audit duration – July 1st, 2021 – December 31st, 2021) of the financial statements of Novelty Tours Pvt. Ltd. . A mid-level management employee in Novelty Tours approached Mary with an anonymous note that had been retrieved from the company’s suggestion box. The note mentioned that in the past 2-3 months many employees were using Novelty Payments app to create and access bogus accounts and were also using accounts of terminated employees to make fraudulent payments. She immediately gets the IT audit team alerted.
Questions:
Part-I
Describe the controls that would be effective in helping IT audit team determine whether unauthorized users got access to the Novelty Payments app
if any accounts of terminated employees were still being used or whether the accounts were deleted on a timely manner.
List the evidence that you will be collecting for testing the above two controls.
Part-II
Test the controls using given data
Provide your audit observations, root cause, recommendations for the management. Also highlight the potential business impact of the observation so that management implements the recommendation.
Data provided:
User access management procedure of Novelty payments app (ToD Discussion.pdf)
List of IDs created in the app in the audit period (population.xlsx)
List of IDs deleted in app in the audit period (population.xlsx)
Email dump of All Access request forms/Emails to application manager of Novelty payments app to allow authorization to users
All Access revocation forms/Emails to application manager of Novelty payments app to remove authorization of users
Confirmation from product manager/product team member of Novelty payments app that the requested user IDs were deleted.