1. Automated Business Process

Enterprise Information System
Prepared By: Ashish Desai
7383381111
IPCC 1. Automated Business Process
CATEGORIES OF BUSINESS PROCESSES
OBJECTIVES OF BPA
BENEFITS OF AUTOMATION OF BUSINESS PROCESS
IMPLEMENTATION OF BPA
BENEFITS OF ENTERPRISE RISK MANAGEMENT
COMPONENTS OF ENTERPRISE RISK MANAGEMENT
RISKS OF BUSINESS PROCESS AUTOMATION
TYPES OF BUSINESS RISKS
INTERNAL CONTROL
COMPONENTS OF INTERNAL CONTROL
LIMITATIONS OF INTERNAL CONTROL SYSTEM

Enterprise Information System
Prepared By: Ashish Desai
7383381111
IPCC 1. Automated Business Process
INTRODUCTION TO FLOWCHARTS
INTRODUCTION TO DATA FLOW DIAGRAMS (DFDS)
DIAGRAMMATIC REPRESENTATION OF SPECIFIC BUSINESS
PROCESSES
BUSINESS PROCESSES - RISKS AND CONTROLS
PROCURE TO PAY (P2P) - RISKS AND CONTROLS
INVENTORY CYCLE – RISK AND CONTROL
HUMAN RESOURCES - RISKS AND CONTROLS
FIXED ASSETS – RISKS AND CONTROLS
GENERAL LEDGER - RISKS AND CONTROLS
THE COMPANIES ACT, 2013
INFORMATION TECHNOLOGY ACT (IT ACT)

Financial and Accounting System
A large organization typically has several different kinds of Information systems built around
diverse functions, organizational levels, and business processes that can automatically exchange
information.
This fragmentation of data in hundreds of separate systems, degrades organizational efficiency
and business performance.
For instance - sales personnel might not be able to tell at the time they place an order whether
the ordered items are in inventory, and manufacturing cannot easily use sales data to plan for
next production.
Enterprise Information Systems solve this problem by collecting data from numerous crucial
business processes in manufacturing and production, finance and accounting, sales and marketing,
and human resources and storing the data in single central data repository.
An Enterprise Information System (EIS) may be defined as any kind of information system which
improves the functions of an enterprise business processes by integration.
This means classically offering high quality services, dealing with large volumes of data and
capable of supporting some huge and possibly complex organization or enterprise.
An EIS provides a single system that is central to the organization that ensures information can
be shared across all functional levels and management hierarchies. It may be used to
amalgamate existing applications.
A Business Process is an activity or set of activities that will accomplish a specific organizational
goal.
Business Process
Management (BPM) is a
systematic approach to
improving these processes.
The details of these
processes are shown in the
Fig. below:
CATEGORIES OF BUSINESS PROCESSES
Operational Processes (or Primary Processes)
Operational or Primary Processes deal with the core business and value chain.

These processes deliver value to the customer by helping to produce a product or service.
Operational processes represent essential business activities that accomplish business
objectives, eg. Generating revenue - Order to Cash cycle, procurement - Purchase to Pay
cycle.
Order to Cash Cycle(Example)
Order to Cash (OTC or O2C) is a set of business processes that involves receiving and
fulfilling customer requests for goods or services.
An order to cash cycle consists of multiple sub-processes as shown in the Fig.
Customer Order: Customer order received is documented.
Order Fulfilment: Order is fulfilled or service is scheduled.
Delivery Note: Order is shipped to customer or service is performed with
delivery note.
Invoicing: Invoice is created and sent to customer.
Collections: Customer sends payment /collection.
Accounting: Collection is recorded in general ledger.
Supporting Processes (or Secondary Processes)
Supporting Processes back core processes and functions within an organization.
One key differentiator between operational and support processes is that support
processes do not provide value to customers directly.
However, it should be noted that hiring the right people for the right job has a direct
impact on the efficiency of the enterprise.
Human Resource Management (Example)
The main HR Process Areas are grouped into logical functional areas and they are as
follows:
Recruitment and Staffing
Goal Setting
Training and Development
Compensation and Benefits
Performance Management
Career Development
Leadership Development

Management Processes
Management processes measure, monitor and control activities related to business
procedures and systems.
Examples of management processes include internal communications, governance,
strategic planning, budgeting, and infrastructure or capacity management.
Like supporting processes, management processes do not provide value directly to the
customers.
However, it has a direct impact on the efficiency of the enterprise.
Budgeting (Example)
Referring to the Fig. in any enterprise, budgeting needs to be driven by the vision (what
enterprise plans to accomplish) and the strategic plan (the steps to get there).
Business Process Automation (BPA) is the technology-enabled automation of activities or services
that accomplish a specific function and can be implemented for many different functions of
company activities, including sales, management, operations, supply chain, human resources,
information technology, etc.
In other words, BPA is the tactic a business uses to automate processes to operate efficiently
and effectively.
It consists of integrating applications and using software applications
throughout the organization.
BPA is the tradition of analyzing, documenting, optimizing and then automating business
processes.
OBJECTIVES OF BPA
To ensure that data is only available to persons who have right to see
the same;
To ensure that no un-authorized amendments can be made in the data;
To ensure that data is available when asked for; and
To ensure that data is made available in at the right time.

BENEFITS OF AUTOMATION OF BUSINESS PROCESS
IMPLEMENTATION OF BPA
Step 1: Define why we plan to implement a BPA?
The primary purpose for which an enterprise implements automation may vary from
enterprise to enterprise.
A list of generic reasons for going for BPA may include any or combination of the
following:
Errors in manual processes leading to higher costs.
Payment processes not streamlined, due to duplicate or late payments, missing early
pay discounts, and losing revenue.
Paying for goods and services not received.
Poor debtor management leading to high invoice aging and poor cash flow.
Not being able to find documents quickly during an audit or lawsuit or not being able
to find all documents.
Lengthy or incomplete new employee or new account on-boarding.
Unable to recruit and train new employees, but where employees are urgently
required.
Lack of management understanding of business processes.
Poor customer service.
Step 2: Understand the rules / regulation under which
enterprise needs to comply with?
One of the most important steps in automating any business process is to understand the
rules of engagement, which include following the rules, adhering to regulations and
following document retention requirements.
This governance is established by a combination of internal corporate policies, external
industry regulations and local, state, and central laws.

Regardless of the source, it is important to be aware of their existence and how they
affect the documents that drive the processes.
It is important to understand that laws may require documents to be retained for specified
number of years and in a specified format.
Entity needs to ensure that any BPA adheres to the requirements of law.
Step 3: Document the process, we wish to automate
At this step, all the documents that are currently being used need to be documented.
The following aspects need to be kept in mind while documenting the present process:
What documents need to be captured?
Where do they come from?
What format are they in: Paper, FAX, email, PDF etc.?
Who is involved in processing of the documents?
What is the impact of regulations on processing of these documents?
Can there be a better way to do the same job?
How are exceptions in the process handled?
The benefit of the above process for user and entity being:
It provides clarity on the process.
It helps to determine the sources of inefficiency, bottlenecks, and problems.
It allows tore-design the process to focus on the desired result with workflow
automation.
An easy way to do this is to sketch the processes on a piece of paper, possibly in a
flowchart format. Visio or even Word can be used to create flowcharts easily.
It is important to understand that no automation shall benefit the entity, if the process
being automated is error-prone.
Investment in hardware, workflow software and professional services, would get wasted
if the processes being automated are not made error-free.
Use of technology needs to be made to realize the goal of accurate, complete and
timely processing of data so as to provide right information to the right people safely
and securely at optimum cost.
Step 4: Define the objectives/goals ta be achieved by
implementing BPA
Once the above steps have been completed, entity needs to determine the key objectives
of the process improvement activities.
When determining goals, remember that goals need to be SMART:
Specific: Clearly defined,
Measurable: Easily quantifiable in monetary terms,
Attainable: Achievable through best efforts,
Relevant: Entity must be in need of these, and

Timely: Achieved within a given time frame.
Step 5: Engage the business process consultant
This is again a critical step to achieve BPA. To decide as to which company/ consultant to
partner with, depends upon the following:
Objectivity of consultant in understanding/evaluating entity situation.
Does the consultant have experience with entity business process?
Is the consultant experienced in resolving critical business issues?
Whether the consultant is capable of recommending and implementing a combination
of hardware, software and services as appropriate to meeting enterprise BPA
requirements?
Does the consultant have the required expertise to clearly articulate the business value
of every aspect of the proposed solution?
Step 6: Calculate the RoI for project
The right stakeholders need to be engaged and involved to ensure that the benefits of
BPA are clearly communicated and implementation becomes successful.
Hence, the required business process owners have to be convinced so as to justify the
benefits of BPA and get approval from senior management.
A lot of meticulous effort would be required to convince the senior management about
need to implement the right solution for BPA.
The right business case has to be made covering technical and financial feasibility so as
to justify and get approval for implementing the BPA.
The best way to convince would be to generate a proposition that communicates to the
stakeholders that BPA shall lead to not only cost savings for the enterprise but also
improves efficiency and effectiveness of service offerings.
Some of the methods for justification of a BPA proposal may include:
Cost Savings, being clearly computed and demonstrated.
How BPA could lead to reduction in required manpower leading to no new recruits
need to be hired and how existing employees can be re-deployed or used for further
expansion.
Savings in employee salary by not having to replace those due to attrition.
The cost of space regained from paper, file cabinets, reduced.
Eliminating fines to be paid by entity due to delays being avoided.
Reducing the cost of audits and lawsuits.
Taking advantage of early payment discounts and eliminating duplicate payments.
Ensuring complete documentation for all new accounts.
New revenue generation opportunities.
Collecting accounts receivable faster and improving cash flow.
Building business by providing superior levels of customer service.
Charging for instant access to records (e.g. public information, student transcripts,
medical records)

Step 7: Developing the BPA
Once the requirements have been document, ROI has been computed and top
management approval to go ahead has been received, the consultant develops the
requisite BPA.
The developed BPA needs to meet the objectives for which the same is being developed.
Step 8: Testing the BPA
Once developed, it is important to test the new process to determine how well it works
and identify where additional “exception processing” steps need to be included.
The process of testing is an iterative process, the objective being to remove all problems
during this phase.
Testing allows room for improvements prior to the official launch of the new process,
increases user adoption and decreases resistance to change.
Documenting the final version of the process will help to capture all of this hard work,
thinking and experience which can be used to train new people.
In implementing controls, it is important to adapt a holistic and comprehensive approach.
Hence, ideally it should consider the overall business objectives, processes, organization
structure, technology deployed and the risk appetite.
Based on this, overall risk management strategy has to be adapted, which should be designed
and promoted by the top management and implemented at all levels of enterprise operations
as required in an integrated manner.
The Sarbanes Oxley Act (SOX) in the US, which focuses on the implementation and review of
internal controls as relating to financial audit.
Enterprise Risk Management (ERM) may be defined as a process, effected by an entity’s
Board of Directors, management and other personnel, applied in strategy setting and across
the enterprise, designed to identify potential events that may affect the entity, and manage
risk to be within its risk appetite, to provide reasonable assurance regarding the achievement
of entity objectives.
The underlying premise of Enterprise Risk Management (ERM) is that every entity, whether for
profit, not-for-profit, or a governmental body, exists to provide value for its stakeholders.
ERM provides a framework for management to effectively deal with uncertainty and associated
risk and opportunity and thereby enhance its capacity to build value.
IT security and controls are a sub-set of the overall enterprise risk management strategy and
encompass all aspects of activities and operations of the enterprise.

BENEFITS OF ENTERPRISE RISK MANAGEMENT
Align risk appetite and strategy
Risk appetite is the degree of risk, on a broad-based level that an enterprise (any type
of entity) is willing to accept in pursuit of its goals.
Management considers the entity’s risk appetite first in evaluating strategic alternatives,
then in setting objectives aligned with the selected strategy and in developing mechanisms
to manage the related risks.
Link growth, risk and return
Entities accept risk as part of value creation and preservation, and they expect return
commensurate with the risk.
ERM provides an enhanced ability to identify and assess risks, and establish acceptable
levels of risk relative to growth and return objectives.
Enhance risk response decisions: ERM provides the rigor to identify and select among
alternative risk responses - risk avoidance, reduction, sharing and acceptance. ERM
provides methodologies and techniques for making these decisions.
Minimize operational surprises and losses
Entities have enhanced capability to identify potential events, assess risk and establish
responses, thereby reducing the occurrence of surprises and related costs or losses.
Identify and manage cross-enterprise risks
Every entity faces a myriad (many) of risks affecting different parts of the enterprise.
Management needs to not only manage individual risks, but also understand interrelated
impacts.
Provide integrated responses to multiple risks
Business processes carry many inherent risks, and ERM enables integrated solutions for
managing the risks.
Seize opportunities
Management considers potential events, rather than just risks, and by considering a full
range of events, management gains an understanding of how certain events represent
opportunities.
Rationalize capital
More robust information on an entity's total risk allows management to more effectively
assess overall capital needs and improve capital allocation.

COMPONENTS OF ENTERPRISE RISK MANAGEMENT
Internal Environment
The internal environment sets the basis for how risk is viewed and addressed by an
entity’s people, including risk management philosophy and risk appetite, integrity
and ethical values, and the environment in which they operate.
The internal environment sets the foundation for how risk and control are viewed and
addressed by an entity's people.
The core of any business is its people – their individual attributes, including integrity,
ethical values and competence – and the environment in which they operate. They are the
engine that drives the entity and the foundation on which everything rests.
Objective Setting
ERM ensures that management has a process in place to set objectives and that the chosen
objectives support and align with the entity’s mission/vision and are consistent with the
entity’s risk appetite.
Event Identification
Potential events that might have an impact on the entity should be identified.
Event identification includes identifying factors - internal and external - that influence how
potential events may affect strategy implementation and achievement of objectives.
Management identifies interrelationships between potential events and may categorize
events to create and reinforce (supports) a common risk language across the entity and
form a basis for considering events from a portfolio perspective.
Risk Assessment
Risks are assessed on both an inherent and a residual basis, and the assessment considers
both risk likelihood and impact.
A range of possible results may be associated with a potential event, and management
needs to consider them together.
Risk Response
Management selects an approach or set of actions to align assessed risks with the entity's
risk tolerance and risk appetite, in the context of the strategy and objectives.
Personnel identify and evaluate possible responses to risks, including avoiding, accepting,
reducing and sharing risk.
Control Activities
Policies and procedures are established and executed to help ensure that the risk
responses management selected, are effectively carried out.

Information and Communication
Relevant information is identified, captured and communicated in a form and time frame
that enable people to carry out their responsibilities.
Information is needed at all levels of an entity for identifying, assessing and responding
to risk. Personnel need to receive clear communications regarding their role and
responsibilities.
Monitoring
The entire ERM process should be monitored, and modifications made as necessary. In this
way, the system can react dynamically, changing as conditions warrant.
Risk is any event that may result in a significant deviation from a planned objective resulting in
an unwanted negative consequence.
The planned objective could be any aspect of an enterprise's strategic, financial, regulatory
and operational processes, products or services.
The degree of risk associated with an event is determined by the likelihood (uncertainty,
probability) of the event occurring, the consequences (impact) if the event were to occur and it's
timing.
RISKS OF BUSINESS PROCESS AUTOMATION
However, it should be noted that it does have some inherent risks which should be understood.
The risks are classified below:
All input transaction data may not be accurate, complete and
authorized.
All files and data transmitted may not be processed
accurately and completely, due to network error.
Valid input data may not have been processed accurately and
completely due to program error or bugs.
Is not complete and accurate due to program error or bugs and is distributed
to unauthorized personnel due to weak access control
Master data and transaction data may be changed by unauthorized personnel
due to weak access control.
All data & programs could be lost if there is no proper backup in
the event of a disaster and the business could come to a standstill.

TYPES OF BUSINESS RISKS
Risk that would prevent an organization from accomplishing its objectives (meeting its
goals).
Risk that could result in a negative financial impact to the organization (waste or
loss of assets).
Risk that could expose the organization to fines and penalties from a regulatory
agency due to non-_compliance with laws and regulations.
Risk that could expose the organization to negative publicity.
Risk that could prevent the organization from operating in the most effective and efficient
manner or be disruptive to other operations
Control is defined as policies, procedures, practices and organization structure that
are designed to provide reasonable assurance that business objectives are achieved
and undesired events are prevented or detected and corrected.
SA-315 defines the system of internal control as the plan of enterprise and all the
methods and procedures adopted by the management of an entity to assist in achieving
management' s objective of ensuring, as far as practicable, the orderly and efficient
conduct of its business, including adherence to management policies, the safeguarding
of assets, prevention and detection of fraud and error, the accuracy and completeness
of the accounting records, and the timely preparation of reliable financial information.
The internal audit function constitutes a separate component of internal control with the objective
of determining whether other internal controls are well designed and properly operated.
The system of internal control is said to be well designed and properly operated when:
All transactions are executed in accordance with management's general or specific
authorization;
All transactions are promptly recorded in the correct amount, in the appropriate
accounts and in the accounting period.
Assets are safeguarded from Unauthorized access, Use or disposition; and
The recorded assets are compared with the existing assets at reasonable intervals and
appropriate action is taken to reconcile any differences.
Based on the mode of implementation, these controls can be in various type. The objective of a
control is to mitigate the risk.

Manual Control: Manually verify that the goods ordered in PO (A) are received (B) in good
quality and the vendor invoice (C) reflects the quantity & price are as per the PO (A).
Automated Control: The above verification is done automatically by the computer system
by comparing (D), (E) & (F) and exceptions highlighted.
Semi-Automated Control: Verification of Goods Receipt (E) with PO (D) could be
automated but the vendor invoice matching could be done manually in a reconciliation
process (G).
EXAMPLE - PURCHASE TO PAY:
Given below is a simple example of controls for the Purchase to pay cycle, which is broken
down to four main components as shown in the Fig.
Purchases:
When an employee working in a specific department (i.e., marketing, operations, sales, etc.)
wants to purchase something required for carrying out the job, he/she will submit a purchase
Requisition (PR) to a manager for approval.
Based on the approved PR a Purchase Order (PO) is raised. The PO may be raised
manually and then input into the computer system or raised directly by the computer system.
Goods Receipt:
The PO is then sent to the vendor, who will deliver the goods as per the specifications
mentioned in the PO When the goods are received at the warehouse, the receiving staff
checks the delivery note, PO number etc. and acknowledges the receipt of the material.
Quantity and quality are checked and any unfit items are rejected and sent back to the
vendor.
A Goods Receipt Note (GRN) is raised indicating the quantity received. The GRN may be
raised manually and then input into the computer system or raised directly by the computer
system.
Invoice Processing:
The vendor sends the invoice to the
accounts payable department who
will input the details into the
computer system.
The vendor invoice is checked with
the PO to ensure that only the
goods ordered have been invoiced
and at the negotiated price.
Further the vendor invoice is
checked with the GRN to ensure
that the quantity ordered has been
received.

Payment:
If there is no mismatch between the PQ GRN and vendor invoice, the payment is released to
the vendor based on the credit period negotiated with the vendor.
INTERNAL CONTROL
Internal Controls are a system consisting of specific policies and procedures designed to
provide management with reasonable assurance that the goals and objectives it believes
important to the entity will be met.
"Internal Control System" means all the policies and procedures adopted by the
management of an entity to assist in achieving management's objective of ensuring, as far
as practicable, the orderly and efficient conduct of its business.
It including adherence to management policies, the safeguarding of assets, the prevention
and detection of fraud and error, the accuracy and completeness of the accounting records,
and the timely preparation of reliable financial information.
Facilitates the effectiveness and efficiency of operations.
Helps ensure the reliability of internal and external financial reporting.
Assists compliance with applicable laws and regulations.
Helps safeguarding the assets of the entity.
Effective Internal Control
The control environment includes the governance and management functions and the
attitudes, awareness, and actions of those charged with governance and management
concerning the entity's internal control and its importance in the entity.
Evaluating the design of a control involves considering whether the control, individually
or in combination with other controls, is capable of effectively preventing, or detecting
and correcting, material misstatements.
An improperly designed control may represent a material weakness or significant
deficiency in the entity's internal control.
An entity's mix of manual and automated elements in internal control varies with the
nature and complexity of the entity's use of information technology.
Manual elements in internal control may be more suitable where judgment and discretion
are required such as for the following circumstances:
Large, unusual or non-recurring transactions.
Circumstances where errors are difficult to define, anticipate or predict.
In changing circumstances that require a control response outside the scope of
an existing automated control.
In monitoring the effectiveness of automated controls.

COMPONENTS OF INTERNAL CONTROL
The Control Environment is the set of standards, processes, and structures that provide
the basis for carrying out internal control across the organization.
The board of directors and senior management establish the tone at the top regarding
the importance of internal control, including expected standards of conduct.
The resulting control environment has a pervasive impact on the overall system of internal
control.
Every entity faces a variety of risks from external and internal resources.
Risk may be defined as the possibility that an event will occur and adversely affect the
achievement of objectives.
Risk assessment involves a dynamic and iterative process for identifying and assessing
risks to the achievement of objectives.
Thus, risk assessment forms the basis for determining how risks will be managed. A
precondition to risk assessment is the establishment of objectives, linked at different
levels of the entity.
Risk assessment also requires management to consider the impact of possible changes in
the external environment and within its own business model that may render internal
control ineffective.
Control Activities are the actions established through policies and procedures that
help ensure that management's directives to mitigate risks to the achievement of
objectives are carried out.
Segregation of Duties (SOD)
It is the process of assigning different people the responsibilities of authorizing
transactions, recording transactions, and maintaining custody of assets.
Segregation of duties is intended to reduce the opportunities to allow any person to
be in a position to both perpetrate and conceal errors or fraud in the normal course
of the person's duties.
General Controls
It include controls over information technology management, information technology
infrastructure, security management and software acquisition, development and
maintenance.
These controls apply to all systems - from mainframe to client/server to desktop

computing environments.
Application Controls
They are designed to ensure completeness, accuracy, authorization and validity of
data capture and transaction processing.
Individual applications may rely on effective operation of controls over information
systems to ensure that interface data are generated when needed, supporting
applications are available and interface errors are detected quickly.
Management obtains or generates and uses relevant and quality information from both
internal and external sources to support the functioning of other components of internal
control.
Communication is the continual, iterative process of providing, sharing, and obtaining
necessary information.
Internal communication is how information is disseminated throughout the enterprise,
flowing up, down, and across the entity.
It enables personnel to receive a clear message from senior management that control
responsibilities should be taken seriously.
External communication is two-fold: it enables inbound communication of relevant external
information and provides information to external parties in response to requirements and
expectations.
Ongoing evaluations built into business processes at different levels of the entity, provide
timely information.
Separate evaluations, conducted periodically, will vary in scope and frequency depending
on assessment of risks, effectiveness of ongoing evaluations, and other management
considerations.
Findings are evaluated against management's criteria and deficiencies are communicated
to management and the board of directors as appropriate.
LIMITATIONS OF INTERNAL CONTROL SYSTEM
Management's consideration that the cost of an internal control does not exceed the
expected benefits to be derived.
The fact that most internal controls do not tend to be directed at transactions of unusual
nature. The potential for human error, such as, due to carelessness, distraction, mistakes of
judgement and misunderstanding of instructions.
The possibility of circumvention of internal controls through collusion with employees or with
parties outside the entity.

The possibility that a person responsible for exercising an internal control could abuse that
responsibility, for example, a member of management overriding an internal control.
Manipulations by management with respect to transactions or estimates and judgements
required in the preparation of financial statements.
INTRODUCTION TO FLOWCHARTS
Flowcharts are used in designing and documenting simple processes or programs.
It help visualize what is going on and thereby help understand a process, and perhaps also
find flaws, bottlenecks, and other less-obvious features within it.
The two most common types of boxes in a flowchart are as follows:
A processing step, usually called activity, and denoted as a rectangular box.
A decision, usually denoted as a diamond
A Flowchart is described as "cross-functional" when the page is divided into different swim
lanes describing the control of different organizational units.
A symbol appearing in a particular "lane" is within the control of that organizational unit.
This technique allows the author to locate the responsibility for performing an action or deciding
correctly, showing the responsibility of each organizational unit for different parts of a single
process.
Flowcharting Symbols

Steps for creating flowcharts for business processes
Identify the business process
Based on inputs obtain a complete understanding of the process flow.
Prepare an initial rough diagram and discuss with the business process owner.
Obtain additional information about the business process.
Identify the activities in each process step and who is responsible for each activity.
Identify the starting point of the process.
In other words, it is the input that the business seeks to convert into an output.
External events:
These include the initiation of a transaction or a transmitted alert from another
business system.
For example, creation of a purchase order in a computer system or a sales order
alerting a production system that a product should be manufactured due to lack of
available stock.
Content arrival:
For content management systems, the starting point might be the arrival of a new
document or other form of content.
Human intervention:
This includes customer complaints and other human intervention within or outside of
the business.
In traditional Business Process Modelling Notation (BPMN), the steps are represented by
different shapes depending on their function.
Advantages of Flowcharts
The relationship between various elements of the application program/business
process must be identified.
Flowchart can help depict a lengthy procedure more easily than by describing it by
means of written notes.
The flowchart becomes a blue print of a system that can be broken down into

detailed parts for study. Problems may be identified and new approaches may be
suggested by flowcharts.
Flowcharts aid in communicating the facts of a business problem to those whose skills
are needed for arriving at the solution.
Flowcharts serve as a good documentation which aid greatly in future program
conversions.
In the event of staff changes, they serve as training function by helping new
employees in understanding the existing programs.
Flowcharts act as a guide during the system analysis and program preparation phase.
Instructions coded in a programming language may be checked against the flowchart
to ensure that no steps are omitted.
1. Program Debugging
Flowcharts serve as an important tool during program debugging. They help in
detecting, locating and removing mistakes.
2. Efficient program maintenance
The maintenance of operating programs is facilitated by flowcharts.
The charts help the programmer to concentrate attention on that part of the
information flow which is to be modified.
3. Identifying Responsibilities
Specific business processes can be clearly identified to functional departments
thereby establishing responsibility of the process owner.
4. Establishing Controls
Business process conflicts and risks can be easily identified for recommending
suitable controls.
Limitations of Flowchart
Flowchart becomes complex and clumsy where the problem logic is complex. The
essentials of what is done can easily be lost in the technical details of how it is done.
If modifications to a flowchart are required, it may require complete re-drawing.
Reproduction of flowcharts is often a problem because the symbols used in flowcharts
cannot be typed.

Sometimes it becomes difficult to establish the linkage between various conditions and
the actions to be taken there upon for a condition.
Program flowcharts, although easy to follow, are not such a natural way of expressing
procedures as writing in English, nor are they easily translated into Programming
language.
Example 1: Draw a Flowchart for finding the sum of first
100 odd numbers.
INTRODUCTION TO DATA FLOW DIAGRAMS (DFDS)
Data Flow Diagrams (DFD) show the flow of data or information from one place to another.
DFDs describe the processes showing how these processes link together through data stores
and how the processes relate to the users and the outside world.
The processes are
specifically identified to
the function using
swimlanes".
Each lane represents a
specific department
where the business
process owner can be
identified.
The business process
owner is responsible for ensuring that adequate controls are implemented, to mitigate any
perceived business process risks.

DFD basically provides an overview of:
What data a system processes;
What transformations are perform
What results are produced and where they flow.
It is mainly used by technical staff for graphically communicating between systems
Main Symbol used in DFD
Example
Processes are identified to functional departments.
Given below in Fig. is a simple scenario depicting a book borrowed from a library being
returned and the fine calculated, due to delay?
The book is represented as an external entity and the input is the bar code.
The process is the scanning of the bar code and giving an output of the Book ID.
The next process calculates the fine based on accessing the "library database" and
establishing the "due back" date.
Finally, the fine is communicated to the borrower who is also shown as an external entity.

DIAGRAMMATIC REPRESENTATION OF SPECIFIC BUSINESS PROCESSES
Customer Order Fulfilment
Order ta Cash

Procure to Pay
BUSINESS PROCESSES - RISKS AND CONTROLS
These controls can be manual, automated or semi-automated provided the risk is mitigated.
Based on the scenario, the controls can be Preventive, Detective or Corrective.
In computer systems, controls should be checked at three levels, namely Configuration,
Master & Transaction level.
Configuration

Configuration refers to the way a software system is set up.
When the any software is installed, values for various parameters should be set up
(configured) as per policies and business process work flow and business process rules
of the enterprise.
Configuration will define how software will function and what menu options are
displayed.
Some examples of configuration are given below:
Mapping of accounts to front end transactions like purchase and sales
Control on parameters: Creation of Customer Type, Vendor Type, and year-end
process
User activation and deactivation
User Access & privileges - Configuration & its management
Password Management
Masters
Masters refer to the way various parameters are set up for all modules of software,
like Purchase, Sales, Inventory, Finance etc.
These drives how the software will process relevant transactions. The masters are set up
first time during installation and these are changed whenever the business process rules
or parameters are changed.
The way masters are set up will drive the way software will process transactions of that
type.
For example: The Customer Master will have the credit limit of the customer. When an
invoice is raised, the system will check against the approved credit limit and if the amount
invoiced is within the credit limit the invoice will be created if not the invoice will be put
on "credit hold" till proper approvals are obtained.
Some examples of masters are given here:
Vendor Master: Credit period, vendor bank account details, etc.
Customer Master: Credit limit, Bill to address, Ship to address, etc.
Material Master: Material type, Material description, Unit of measure, etc.
Employee Master: Employee name, designation, salary details, etc.
SN RISK CONTROL OBJECTIVE
1 Unauthorized changes to authorized file.
Only valid changes are made to the
supplier master file.
2
All valid changes to the supplier master
file are not input and processed.
All valid changes to the supplier master
file are input and processed.

3
Changes to the supplier master file are
not correct.
not correct.
4
delayed and not proceed in timely
manner.
proceed in timely manner.
5 Supplier master data is not up to date.
Supplier master data remain up to
date.
6
System access to maintain vendor master
has not been restricted to the authorized
users.
System access to maintain vendor
master has been restricted to the
authorized users.
Transactions
Transactions refer to the actual transactions entered through menus and functions
in the application software, through which all transactions for specific modules
are initiated, authorized or approved.
For example:
Sales transactions
Purchase transactions
Stock transfer transactions
Journal entries
Payment transactions
In case of risk perspective, we need to consider each of the key sub-processes or activities
performed in a business process and look at existing and related control objectives and
existing controls and the residual risks after application of controls.
The residual risk should be knowingly accepted by the management.
If we review this from a control objective perspective, implementing controls and then
evaluate whether risks are mitigated by controls which are implemented at
present.
The checklist provided below are illustrative. It is not necessary that all the sub-
processes/ activities given below are applicable for all enterprises.
However, they are provided to build an understanding of the sub-processes, risk and
related controls and control objectives.
This list can be practically used for implementation/evaluation of risk/ controls of
business processes detailed below.
The checklist given below is categorized into Configuration, Masters and Transactions.

1 Unauthorized purchase requisitions are
Ordered.
Purchase orders are placed only for
approved requisitions.
2 Purchase orders are not entered
correctly in the system.
Purchase orders are accurately
entered.
3 Purchase orders issued are not input and
processed.
All purchase orders issued are input
and Processed.
4 Amounts are posted in accounts payable
for goods or service not received.
Amount posted to accounts payable
represent goods or service received.
5 Amount posted to accounts payable are
not properly calculated and recorded.
Amount posted to accounts payable
are accurately calculated and
recorded.
6 Amounts for goods and services received
are not input and proceed in accounts
payable.
Amounts for goods and services
received are input and proceed in
accounts payable.
7 Amounts for goods or service received
are recorded in the wrong period.
Amounts for goods or service received
are recorded in the appropriate
period.
8 Accounts payable amount are adjusted
based on unacceptable reason.
Accounts payable amount are adjusted
based on the valid reason only.
9 Credit notes and other adjustments are
not accurately calculated and recorded.
Credit notes and other adjustments are
accurately calculated and recorded.
10 All valid Credit notes and other
adjustments related to accounts payable
are not input and processed.
All valid Credit notes and other
adjustments related to accounts
payable are input and processed.
11 Credit notes and other adjustments are
recorded in the wrong period.
Credit notes and other adjustments are
recorded in the appropriate period.
12 Disbursement are made for goods and
services that have not been received.
Disbursement are made for goods and
services that have been received.
13 Disbursement are distributed to
unauthorized supplier.
Disbursement are distributed to
appropriate supplier.
14 Disbursement are not accurately
calculated and recorded.
Disbursement are accurately calculated
and recorded.

15 All Disbursement are not recorded. All Disbursement are recorded.
16 Disbursement are recorded for an
inappropriate period.
Disbursement are recorded for an in
period in which they are issued.
17 Adjustment to inventory prices or
quantities are not recorded promptly
and not done in the appropriate period.
Adjustment to inventory prices or
quantities are recorded promptly and
done in the appropriate period.
18 System access to process transaction has
not been restricted to the authorized
users.
System access to process transaction
has been restricted to the authorized
users.
PROCURE TO PAY (P2P) - RISKS AND CONTROLS
Procure to Pay (Purchase to Pay or P2P) is the process of obtaining and managing the raw
materials needed for manufacturing a product or providing a service.
It involves the transactional flow of data that is sent to a supplier as well as the data that
surrounds the fulfilment of the actual order and payment for the product or service.
Using automation, it should be possible to have a seamless procure to pay process covering the
complete life-cycle from point of order to payment.
ORDER TO CASH (O2C) - RISKS AND CONTROLS
Order to Cash (OTC or O2C) is a set of business processes that involve receiving and fulfilling
customer requests for goods or services.
It is a set of business processes that involve receiving and fulfilling customer requests for goods
or services.
An order to cash cycle consists of multiple sub-processes including:
Customer order is documented;
Order is fulfilled or service is scheduled;
Order is shipped to customer or service is performed;
Invoice is created and sent to customer;
Customer sends payment /Collection; and
Payment is recorded in general ledger.
INVENTORY CYCLE – RISK AND CONTROL
The Inventory Cycle is a process of accurately tracking the on-hand inventory levels for an
enterprise.
An inventory system should maintain accurate record of all stock movements to calculate the
correct balance of inventory.
The term "inventory cycle" means different things to companies in different verticals.
The typical phases of the Inventory Cycle for Manufacturers are as follows:

The ordering phase: The amount of time it takes to order and receive raw materials.
The production phase: The work in progress phase relates to time it takes to convert the
raw material to finished goods ready for use by customer.
The finished goods and delivery phase: The finished goods that remain in stock and
the delivery time to the customer. The inventory cycle is measured in number of days.
Masters
Risks and Control Objectives (Masters-Inventory)
1 Invalid changes are made to the inventory
management master file.
inventory management master file.
2 Invalid changes to the inventory
management master file are input and
processed.
All valid changes to the inventory
management master file are input and
processed.
3 Changes to the inventory management
master file are not accurate.
Changes to the inventory management
master file are accurate.
4 Changes to the inventory management
master file are not promptly processed.
Changes to the inventory management
master file are promptly processed.
5 Inventory management master file data is
not up to date.
Inventory management master file data
remain up to date.
6 System access to maintain inventory
masters has not been restricted to the
authorized users.
System access to maintain inventory
masters has been restricted to the
authorized users.
Transactions
Risks and Control Objectives (Transactions-Inventory)
1 Adjustments to inventory prices or
quantities are not recorded accurately.
Adjustments to inventory prices or
quantities are recorded accurately.
2 Raw materials are received and accepted
without valid purchase orders.
Raw materials are received and
accepted only if they have valid
purchase orders.
3 Raw materials received are not recorded
accurately.
Raw materials received are recorded
accurately.
4 Raw materials received are not recorded
in system.
All raw materials received are recorded.

5 Receipts of raw materials are not
recorded promptly and not in the
appropriate period.
Receipts of raw materials are recorded
promptly and in the appropriate period.
6
Defective raw materials are not returned
promptly to suppliers.
Defective raw materials are returned
promptly to suppliers.
7
Transfers of raw materials to production
are not recorded accurately and are not
in the appropriate period.
All transfers of raw materials to
production are recorded accurately and
8
Direct and indirect expenses associated
with production are not recorded
accurately and are posted in an
All direct and indirect expenses
associated with production are recorded
accurately and in the appropriate
period.
9
Transfers of completed units of production
to finished goods inventory are not
recorded completely and accurately and
are posted in an inappropriate period.
All transfers of completed units of
production to finished goods inventory
are recorded completely and accurately
10
Finished goods returned by customers are
not recorded completely and accurately
and are posted in an inappropriate
period.
Finished goods returned by customers
11
Finished goods received from production
are not recorded completely and
accurately and are posted in an
Finished goods received from production
12 Shipments are not recorded in the system. All shipments are recorded.
13 Shipments are not recorded accurately. Shipments are recorded accurately.
14
Shipments are not recorded promptly and
are in an inappropriate period.
Shipments are recorded promptly and in
the appropriate period.
15
Inventory is reduced when goods are not
shipped and made based on unapproved
customer orders.
Inventory is reduced only when goods
are shipped with approved customer
orders.
16
Costs of shipped inventory are not
transferred from inventory to cost of sales.
Costs of shipped inventory are
transferred from inventory to cost of
sales.
17
accurately recorded.
accurately recorded.

18
Amounts posted to cost of sales does not
represent those associated with shipped
inventory.
Amounts posted to cost of sales represent
those associated with shipped inventory.
19
transferred from inventory to cost of sales
promptly and not done in the appropriate
period.
transferred from inventory to cost of
sales promptly and in the appropriate
period.
20
System access to process inventory
related transactions has not been
restricted to the authorized users.
System access to process inventory
related transactions has been restricted
to the authorized users.
HUMAN RESOURCES - RISKS AND CONTROLS
The Human Resources life cycle refers to human resources management and covers all the
stages of an employee's time within a specific enterprise and the role the human resources
department plays at each stage.
Typical stage of HR cycle includes the following:
Recruiting is the process of hiring a new employee. The role of the human resources
department in this stage is to assist in hiring.
This might include placing the job ads, selecting candidates whose resumes look
promising, conducting employment interviews and administering assessments such as
personality profiles to choose the best applicant for the position.
On boarding is the process of getting the successful applicant set up in the system as
a new employee.
Orientation is the process by which the employee becomes a member of the
company's work force through learning her new job duties, establishing relationships
with co-workers and supervisors and developing a niche.
Career planning is the stage at which the employee and her supervisors work out her
long-term career goals with the company.
The human resources department may make additional use of personality profile
testing at this stage to help the employee determine her best career options with the
company.
Career development opportunities are essential to keep an employee engaged with
the company over time.
After an employee, has established himself at the company and determined his long-

term career objectives, the human resources department should try to help him meet
his goals, if they're realistic.
The company also assesses the employee's work history and performance at this
stage to determine whether he has been a successful hire.
Some employees will leave a company through retirement after a long and successful
career. Others will choose to move on to other opportunities or be laid off.
Whatever the reason, all employees will eventually leave the company.
The role of HR in this process is to manage the transition by ensuring that all policies
and procedures are followed, carrying out an exit interview if that is company policy
and removing the employee from the system.
These stages can be handled internally or with the help of enterprises that provide
services to manage the employee life cycle.
Configuration
Risks and Control Objectives (Configuration-Human Resources)
1 Employees who have left the company
continue to have system access.
System access to be immediately
removed when employees leave the
company.
2 Employees have system access in excess of
their job requirements.
Employees should be given system access
based on a "need to know" basis and to
perform their job function.
Masters
Risks and Control Objectives (Masters-Human Resources)
1 Additions to the payroll master files do not
represent valid employees.
Additions to the payroll master files
represent valid employees.
2 New employees are not added to the
payroll master files.
All new employees are added to the
3 Terminated employees are not removed
from the payroll master files.
Terminated employees are removed
from the payroll master files.
4 Employees are terminated without
following statutory requirements.
Employees are terminated only within
statutory requirements.

5 Deletions from the payroll master files do
not represent valid terminations.
Deletions from the payroll master files
represent valid terminations.
6
Invalid changes are made to the payroll
master files.
7
Changes to the payroll master files are
not accurate.
accurate.
8
not processed in a timely manner.
processed in a timely manner.
9
Payroll master file data is not up to date. Payroll master file data remain up to
date.
10
Payroll is disbursed to inappropriate
employees.
Payroll is disbursed to appropriate
employees.
11
System access to process employee
master changes has not been restricted to
the authorized users.
System access to process employee
master changes has been restricted to
FIXED ASSETS – RISKS AND CONTROLS
Fixed Assets process ensures that all the fixed assets of the enterprise are tracked for the
purposes of financial accounting, preventive maintenance, and theft deterrence.
Fixed assets process ensures that all fixed assets are tracked and fixed asset record maintains
details of location, quantity, condition, and maintenance and depreciation status.
Typical steps of fixed assets process are as follows:
An asset is most often entered into the accounting system; when the invoice for the asset
is entered; into the accounts payable; or purchasing module of the system.
Most of the information needed to set up the asset for depreciation is available at the
time the invoice is entered.
Information entered at this stage could include; acquisition date, placed-in-service date,
description, asset type, cost basis, depreciable basis etc.
Adjustments to existing asset information is often needed to be made. Events may occur
that can change the depreciable basis of an asset.
Further, there may be improvements or repairs made to asset that either adds value to
the asset or extend its economic life.

A fixed asset maybe sold or transferred to another subsidiary, reporting entity, or
department within the company.
These intercompany and intra-company transfers may result in changes that impact the
asset's depreciable basis, depreciation, or other asset data.
This needs to be reflected accurately in the fixed assets management system.
The decline in an asset's economic and physical value is called depreciation.
Depreciation is an expense which should be periodically accounted on a company's
books, and allocated to the accounting periods, to match income and expenses.
Sometimes, the revaluation of an asset, may also result in appreciation of its value
When a fixed asset is, no longer in use, becomes obsolete, is beyond repair, the asset
is typically disposed.
When an asset is taken out of service, depreciation cannot be charged on it.
There are multiple types of disposals, such as abandonments, sales, and trade-ins.
Any difference between the book value, and realized value, is reported as a gain or
loss.
MASTERS
Risks and Control Objectives (Masters-Fixed Assets)
1 Invalid changes are made to the fixed
asset register and/or master file.
fixed asset register and/or master file.
2 Valid changes to the fixed asset register
and/ or master file are not input and
processed.
All valid changes to the fixed asset
register and/or master file are input and
processed.
3 Changes to the fixed asset register
and/or master file are not accurate.
Changes to the fixed asset register
and/or master file are accurate.
4
and/or master file are not promptly
processed.
and/or master file are promptly
processed.
5 Fixed asset register and/or master Ale Fixed asset register and/or master Ale

data are not kept up to date. data remain up to date.
6
System access to Axed asset master Ale /
system configuration is not restricted to the
authorized users.
System access to Axed asset master Ale
/ system configuration is restricted to the
authorized users.
7
System configuration pertaining to
definition of the depreciation base,
depreciation rate, life of asset and
accounting of transactions has not been
correctly defined
System configuration pertaining to
definition of the depreciation base,
depreciation rate, life of asset and
accounting of transactions has been
correctly defined
TRANSACTIONS
Risks and Control Objectives (Transactions-Fixed Assets)
1 Fixed asset acquisitions are not accurately
recorded.
Fixed asset acquisitions are accurately
recorded.
2 Fixed asset acquisitions are not recorded
Fixed asset acquisitions are recorded in
3 Fixed asset acquisitions are not recorded. All Axed asset acquisitions are recorded.
4 Depreciation charges are not accurately
Depreciation charges are accurately
5 Depreciation charges are not recorded in
All depreciation charges are recorded in
6
Fixed asset disposals/transfers are not
recorded.
All Axed asset disposals/transfers are
recorded.
7
Fixed asset disposals/transfers are
8
Fixed asset disposals/transfers are
9
Records of Axed asset maintenance
activity are not accurately maintained.
Records of Axed asset maintenance
activity are accurately maintained.
10
Fixed asset maintenance activity records
are not updated in a timely manner.
Fixed asset maintenance activity records
are updated in a timely manner.
11
Accounting entries pertaining to
acquisition, disposals, transfers, retirement
Accounting entries pertaining to
acquisition, disposals, transfers,

are not recorded in the correct GL account
retirement are recorded in the correct
GL account
12
System access to process Axed asset
transactions has not been restricted to the
authorized users.
System access to process Axed asset
transactions has been restricted to the
authorized users.
GENERAL LEDGER - RISKS AND CONTROLS
General Ledger (GL) process refers to the process of recording the transactions in the system
to finally generating the reports from financial transactions entered in the system.
The input for GL Process Flow is the financial transactions and the outputs are various types of
financial reports such as balance sheet, profit and loss a/c, funds flow statement, ratio analysis,
etc.
The typical steps in general ledger process flow are as follows:
1. Entering financial transactions into the system
2. Reviewing Transactions
3. Approving Transactions
4. Posting of Transactions
5. Generating Financial Reports
Configuration
Risks and Control Objectives (Configuration-General Ledger)
1 Unauthorized general ledger entries
could be passed
Access to general ledger entries is
appropriate and authorized.
2 System functionality does not exist to
segregate the posting and approval
functions.
System functionality exists to segregate
the posting and approval functions.
3 Interrelated balance sheets and income
statement accounts do not undergo
automated reconciliations to confirm
accuracy of such accounts.
Interrelated balance sheets and income
statement accounts undergo automated
reconciliations to confirm accuracy of
such accounts.
4
Systems do not generate reports of all
recurring and non recurring journal entries
for review by management for accuracy.
Systems generate reports of all recurring
and nonrecurring journal entries for
review by management for accuracy.
5
Non standard journal entries are not
tracked and are inappropriate.
All non standard journal entries are
tracked and are appropriate.
6
Out-of-balance entries are not
prohibited.
Out-of-balance entries are prohibited.

7
Enterprise wide consolidation, including
standard inter company eliminations, is
not automated and not performed.
Enterprise wide consolidation, including
standard inter company eliminations, is
automated and performed.
8
Variance reports are not generated for
use to identify posting errors/out-of-
balance conditions.
Variance reports are generated for use
to identify posting errors/out-of-
balance conditions.
9
System controls are not in place for
appropriate approval ofwrite-offs.
System controls are in place for
appropriate approval of write-offs.
10
Journal entries of exceptional amount that
were posted to the general ledger during
the month are not flagged by the system
and not subsequently reviewed for
accuracy and approved by the controller
or CFO after month-end.
Journal entries of exceptional amount
that were posted to the general ledger
during the month are flagged by the
system and subsequently reviewed for
accuracy and approved by the
controller or CFO after month-end.
11
Automated amortization timing, periods
and methods are not appropriate and not
accurately entered.
Automated amortization timing, periods
and methods are appropriate and
accurately entered.
12
Standard, recurring period-endjournal
entries submitted from subsidiary ledger
systems are not automated, not
appropriately approved and not entered
accurately.
Standard, recurring period-endjournal
entries submitted from subsidiary ledger
systems are automated, appropriately
approved and entered accurately.
13
Transactions can be recorded outside of
financial close cutoff requirements.
Transactions cannot be recorded outside
of financial close cutoff requirements.
14
The sources of all entries are not readily
identifiable.
The sources of all entries are readily
identifiable.
15
Transactions are not rejected, accepted
and identified, on exception reports in the
event of data exceptions.
Transactions are rejected, or accepted
and identified, on exception reports in
the event of data exceptions.
16 Account mappings are not up to date. Account mappings are up to date.
17
Adding to or deleting general ledger
accounts is not limited to authorized
accounting department personnel.
Adding to or deleting general ledger
accounts is limited to authorized
accounting department personnel.

MASTERS
Risks and Control Objectives (Masters-General Ledger)
1 General ledger master file change
reports are not generated by the system
and are not reviewed as necessary by an
individual who does not input the changes.
General ledger master file change
reports are generated by the system
and reviewed as necessary by an
individual who does not input the
changes.
2 A standard chart of accounts has not been
approved by management and is not
utilized within all entities ofthe corporation
A standard chart of accounts has been
approved by management and is not
utilized within all entities of the
corporation
TRANSACTIONS
Risks and Control Objectives (Transactions-General Ledger)
1
General ledger balances are not
reconciled to sub ledger balances and
such reconciliation are not reviewed for
accuracy and not approved by
supervisory personnel.
General ledger balances reconcile to
sub ledger balances and such
reconciliation are reviewed for accuracy
and approved by supervisory personnel.
2
statement accounts do not undergo
automated reconciliation to confirm
accuracy of such accounts.
statement accounts undergo automated
reconciliation to confirm accuracy of
such accounts.
3
Account codes and transaction amounts
are not accurate and not complete, and
exceptions are not reported.
Account codes and transaction amounts
are accurate and complete, with
exceptions reported.
4
A report of all journal entries completed
as part of the closing process is not
reviewed by management to confirm the
completeness and appropriateness of all
recorded entries.
A report of all journal entries completed
as part of the closing process is reviewed
by management to confirm the
completeness and appropriateness of all
recorded entries.
5
Actual-to-actual, actual-to-budget and
yield reports are not produced from the
general ledger system on a monthly basis
prior to the final close of the general
ledger. Reports are not distributed to and
reviewed by the controller and CFO.
Unusual amounts or variances are not
investigated and reclassified when
Actual-to-actual, actual-to-budget and
yield reports are produced from the
general ledger system on a monthly
basis prior to the final close of the
general ledger. Reports are distributed
to and reviewed by the controller and
CFO. Unusual amounts or variances are
investigated and reclassified when

applicable. applicable.
6
Entries booked in the close process are not
complete and accurate.
Entries booked in the close process are
complete and accurate.
Major corporations worldwide have used Information Technology (IT) to stay ahead in business.
The efficiency of an enterprise depends on the quick flow of information across the complete
supply chain i.e., from the customer to manufacturers to the suppliers.
The core to any enterprise's success is to have an efficient and effective financial information
system to support decision-making and monitoring.
The risks, controls and security of such systems should be clearly understood in order to pass an
objective opinion about the adequacy of control in an IT environment.
THE COMPANIES ACT, 2013
Section 134
Section 134 of the Companies Act, 2013 on "Financial statement, Board's report,
etc." states inter alia:
The Directors' Responsibility Statement referred to in clause (c) of sub-section (3) shall
state that:
The Directors had taken proper and sufficient care for the maintenance of adequate
accounting records in accordance with the provisions of this Act for safeguarding the
assets of the company and for preventing and detecting fraud and other
irregularities;
The directors, in the case of a listed company, had laid down internal financial
controls to be followed by the company and that such internal financial controls are
adequate and were operating effectively.
Explanation:
The term "internal financial controls" means the policies and procedures adopted by
the company for ensuring the orderly and efficient conduct of its business, to ensure
compliance with the provisions of all applicable laws and that such systems were
adequate and operating effectively.
Section 143
Section 143, of the Companies Act 2013, on "Powers and duties of auditors and
auditing standards" states inter alia:
Section 143(3) contains the auditor's report which states:

"whether the company has adequate internal financial controls system in place and
the operating effectiveness of such controls";
When we talk in terms of "adequacy and effectiveness of controls"; it refers to the
adequacy of the control design and whether the control has been working effectively
during the relevant financial year.
The impact of this statement is that it involves continuous control monitoring during the
year and not a review "as at" a particular date.
As per ICAI's "Guidance Note on Audit of Internal
Financial Controls over Financial Reporting":
The 2013 Act has significantly expanded the scope of internal controls to be
considered by the management of companies to cover all aspects of the operations
of the company.
Clause (e) of Sub-section 5 of Section 134 to the Act requires the directors'
responsibility statement to state that the directors, in the case of a listed company,
had laid down internal financial controls to be followed by the company and that
such internal financial controls are adequate and were operating effectively.
Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board of
Directors' report of all companies to state the details in respect of adequacy of
internal financial controls with reference to the financial statements.
The auditor's objective in an audit of internal financial controls over financial
reporting is to express an opinion on the effectiveness of the company's internal
financial controls over financial reporting and the procedures in respect thereof are
carried out along with an audit of the financial statements.
Because a company's internal controls cannot be considered effective if one or more
material weakness exists.
Corporate Governance is the framework of rules and practices by which a board
of directors ensures accountability, fairness, and transparency in a company's
relationship with its all stakeholders (financiers, customers, management, employees,
government, and the community).
The corporate governance framework consists of:
Explicit and implicit contracts between the company and the stakeholders for
distribution of responsibilities, rights, and rewards.
Procedures for reconciling the sometimes-conflicting interests of stakeholders in

accordance with their duties, privileges, and roles, and
Procedures for proper supervision, control, and information-flows to serve as a
system of checks-and-balances
(ERM) in business includes the methods and processes used by organizations to
manage risks and seize opportunities related to the achievement of their objectives.
ERM provides a framework for risk management, which typically involves identifying
particular events or circumstances relevant to the organization's objectives (risks and
opportunities), assessing them in terms of likelihood and magnitude of impact,
determining a response strategy, and monitoring progress.
Management selects a risk response strategy for specific risks identified and
analyzed, which may include:
Avoidance: exiting the activities giving rise to risk.
Reduction:
taking
action to
reduce the
likelihood or
impact
related to
the risk.
Alternative
Actions: deciding and considering other feasible steps to minimize risks.
Share or Insure: transferring or sharing a portion of the risk, to finance it.
Accept: no action is taken, due to a cost/benefit decision.
INFORMATION TECHNOLOGY ACT (IT ACT)
This Act aims to provide the legal infrastructure for e-commerce in India.
The IT Act, 2000 (as amended in 2008) also aims to provide for the legal framework so
that legal sanctity is accorded to all electronic records and other activities carried out by
electronic means.
Advantages of Cyber Laws
The IT Act 2000 attempts to change outdated laws and provides ways to deal with
cyber-crimes.
We need such laws so that people can perform purchase transactions over the Net
without fear of misuse.
The Act has also proposed a legal framework for the authentication and origin of
electronic records/ communications through digital signature.

From the perspective of e-commerce in India, the IT Act 2000 and its provisions contain
many positive aspects which are as follows:
The implications for the e-businesses would be that email would now be a valid and
legal form of communication in India that can be duly produced and approved in a
court of law.
Companies shall now be able to carry out electronic commerce using the legal
infrastructure provided by the Act.
Digital signatures have been given legal validity and sanction in the Act.
The Act throws open the doors for the entry of corporate companies in the business
of being Certifying Authorities for issuing Digital Signatures Certificates.
The Act now allows Government to issue notification on the web thus heralding e-
governance.
The Act enables the companies to file any form, application or any other document
with any office, authority, body or agency owned or controlled by the appropriate
Government in electronic form by means of such electronic form as may be prescribed
by the appropriate Government.
The IT Act also addresses the important issues of security, which are so critical to the
success of electronic transactions.
The Act has given a legal definition to the concept of secure digital signatures that
would be required to have been passed through a system of a security procedure,
as stipulated by the Government at a later date.
Computer Related Offences
Let us look at some common cyber-crime scenarios which can attract prosecution as
per the penalties and offences prescribed in IT Act 2000 (amended via 2008) Act.
A fake profile of a person is created on a social networking site with the correct
address, residential information or contact details but he/she is labelled as
'prostitute' or a person of 'loose character'. This leads to harassment of the victim.
If victim's email account is hacked and obscene emails are sent to people in victim's
address book.
Unsuspecting victims would use infected computers to make online transactions.
The homepage of a website is replaced with a pornographic or defamatory page.
Government sites generally face the wrath of hackers on symbolic days.

All of the above are some sort of malicious programs which are used to destroy or
gain access to some electronic information.
Many terrorists use virtual (Drive, FTP sites) and physical storage media (USB's, hard
drives) for hiding information and records of their illicit business.
Where sale of narcotics, drugs weapons and wildlife is facilitated by the Internet.
Among the largest businesses on Internet, pornography may not be illegal in many
countries, but child pornography is.
Phishing involves fraudulently acquiring sensitive information through masquerading
a site as a trusted entity (e.g. Passwords, credit card information).
Many business organizations store their confidential information in computer systems.
This information is targeted by rivals, criminals and disgruntled employees.
A Source code generally is the most coveted and important "crownjewel" asset of a
company.
Privacy
The main principles on data protection and privacy enumerated under the IT Act, 2000
are:
defining 'data', 'computer database', 'information', 'electronic form', 'originator',
'addressee' etc.
Creating civil liability if any person accesses or secures access to computer, computer
system or computer network
Creating criminal liability if any person accesses or secures access to computer,
computer system or computer network
Declaring any computer, computer system or computer network as a protected
system.
Imposing penalty for breach of confidentiality and privacy.
Setting up of hierarchy of regulatory authorities, namely adjudicating officers, the
Cyber Regulations Appellate Tribunal etc.
Cyber crime
'A' thief enters in B's house and steals an object kept in the house.

'A' Cyber Criminal sitting in his own house, through his computer hacks the computer
of 'B' and steals the data saved in B's computer without physically touching the
computer or entering in B's house. Hence Cyber Crime is a Computer related crime.
Definitions
with its grammatical variations and cognate expressions means gaining
entry into, instructing or communicating with the logical, arithmetical, or memory function
resources of a computer, computer system or computer network;
"Computer" means any electronic, magnetic, optical or other high-speed data
processing device or system which performs logical, arithmetic, and memory functions
by manipulations of electronic, magnetic or optical impulses, and includes all input,
output, processing, storage, computer software, or communication facilities which are
connected or related to the computer in a computer system or computer network;
means the interconnection of one or more Computers or
Computer systems or Communication device through-
the use of satellite, microwave, terrestrial line, wire, wireless or other communication
media; and
terminals or a complex consisting of two or more interconnected computers or
communication device whether or not the interconnection is continuously maintained;
means a representation of information, knowledge, facts, concepts or
instructions which are being prepared or have been prepared in a formalized manner,
and is intended to be processed, is being processed or has been processed in a computer
system or computer network and may be in any form (including computer printouts
magnetic or optical storage media, punched cards, punched tapes) or stored internally in
the memory of the computer;
includes data, message, text, images, sound, voice, codes,
computer programmers, software and databases or micro film or computer generated
micro fiche;
Sensitive Personal Data Information(SPDI)
Reasonable Security Practices and Procedures and Sensitive Personal Data or
Information Rules 2011 formed under section 43A of the Information Technology Act
2000 define a data protection framework for the processing of digital data by Body
Corporate.
Currently the Rules apply to Body Corporate and digital data.
As per the IT Act, Body Corporate is defined as "Any company and includes a firm,
sole proprietorship or other association of individuals engaged in commercial or
professional activities."

The present scope of the Rules excludes from its purview a number of actors that do
or could have access to Big Data or use Big Data practices.
The Rules would not apply to government bodies or individuals collecting and using
Big Data. Yet, with technologies such as IoT (Internet of Things) and the rise of Smart
Cities across India - a range of government, public, and private organizations and
actors could have access to Big Data.
Rule 2(i) defines personal information as "information that relates to a natural person
which either directly or indirectly, in combination with other information available or
likely to be available with a body corporate, is capable of identifying such person."
Rule 3 defines sensitive personal information as:
Passwords
Financial information
Physical/physiological/mental health condition
Sexual orientation
Medical records and history; and
Biometric information
The present definition of personal data hinges on the factor of identification (data
that is capable of identifying a person). Yet this definition does not encompass
information that is associated to an already identified individual - such as habits,
location, or activity.
The definition of personal data also addresses only the identification of 'such person'
and does not address data that is related to a particular person but that also reveals
identifying information about another person – either directly or when combined with
other data points.
Consent:
Rule 5(1) requires that Body corporate should, prior to collection, obtain consent
in writing through the letter or fax or email from the provider of sensitive personal
data regarding the use of the data.

1. Automated Business Process

More Related Content

What's hot (20)

Similar to 1. Automated Business Process (20)

More from Ashish Desai (11)

Recently uploaded (20)

1. Automated Business Process