Sunshine Credit Union is a small credit union based in San Diego. In the past financial year, it has moved from using a microcomputer-based package to using the services of a computer service bureau to carry out its data processing (outsourcing its data processing). The bureau provides a popular generalized package to support the data processing needs of credit unions. Individual credit unions access this package via microcomputer terminals located in their offices. In addition, the service bureau machine has access to various financial networks. Thus, with the move to the service bureau, Sunshine has been able to offer an expanded range of services to its members.

Since the move to the bureau, the directors of the credit union have appointed a new director of financial services, Timothy Swan, with a view to improving the services offered to members. At the outset, Swan undertook a thorough review of Sunshine's accounting systems with the objective of streamlining the systems and improving control. In particular, he took advantage of the access controls provided within the credit union package and set up a system of passwords to restrict the action privileges of each employee to those commensurate with their responsibilities.

Swan still had some doubts about controls within the credit union package used by Sunshine, although the system appeared to provide good controls and to restrict the activities of credit union staff to their assigned action privileges. Because he had little technical knowledge of computer systems, however, he hired an information systems audit consultant, Helen Webb, to examine controls within the service bureau's system.

At their first meeting, Webb indicated that she was familiar with the operating system used by the service bureau, although she was not familiar with the package used to carry out the basic data processing. Nevertheless, as an initial step she asked Swan to sign on at a terminal and to show her the system. Once he had signed on, she asked him to attempt to call up the system editor. Swan indicated that he did not understand what she meant by the editor as he had never used the program before. She described the nature of the editor and gave him the command to invoke the editor. Swan noted her concern when the editor was successfully activated.

Next she asked him to attach the editor to a specific file, and she gave him the command to carry out the action. Again, he noted her concern when the system indicated the command had been successfully executed. When he queried her about her obvious concerns, she indicated that the editor had been successfully attached to the password file.

Finally, Webb asked Swan to attempt to invoke two other programs. She gave him the commands to use, and again the system indicated that the programs were available for use. When Swan asked Webb about the nature of these two programs, she indicated they were the copy and delete utilities provided by the operating system.

Required: Why is Webb concerned about the results obtained so far? What exposures does Sunshine face? Given that Sunshine is using a service bureau for its data processing activities, what actions would you recommend be taken to overcome the problems that exist?