You are the manager of the internal audit of a savings and loan association that has decided to install a bill payment by telephone system for its customers. The system will allow customers to telephone a number to enter the system, record bill payment transactions they wish to make within the next 30 days, and transfer funds between savings and checking accounts. A voice feedback system will instruct customers on how to complete each step of a transaction; for example, record the date of a payment and the amount to be paid. Note, all data is to be entered using a Touch-Tone telephone.

Required: Because you are the senior information systems auditor for the savings and loan association, the manager of the information systems department has asked you to advise her on the access controls you think should exist in the system. Prepare a brief report with your recommendations. Be sure to consider how the system will ensure that:

a. It is dealing with a valid customer

b. It is allowing customers to transfer funds to or from authorized accounts only

c. Customers do not overdraw accounts

d. Payments are made only to creditors that the customer has authorized