Case1

The local community feels that secondary school education is a necessity in our society and that lack of education leads to a number of social problems. As a result, the local school board has decided to take action to reverse the rising dropout rate. The board has voted to provide funds to encourage students to remain in school and earn their high school diplomas. The idea to treat secondary education like a job and pay students. The board, however, could not agree on the details for implementing this new plan. Consequently, you have been hired to devise a system to compensate students for staying in school and earning a diploma. As you devise your compensation scheme, be sure it meets the following general control objectives for the payroll cycle: All personnel and payroll transactions are properly authorised. All employees are assigned to do productive work, and they do it efficiently and effectively. All transactions are accurately recorded and processed. Accurate records are maintained. All disbursements are proper. Write a proposal that addresses these five questions: a. How should the students be compensated (e.g., for attendance, grades)? b. How and by whom will the payments be authorised? c. How will the payments be processed? d. How should the payments be made (e.g., in cash or other means)? e. When will the payments be made?

case2

Scenario 1: Use the following facts to assess the time-based model of security for the ABC Company; how well does the existing system protect ABC? Assume the best-, average-, and worst-case estimates are independent for each component of the model. Estimated time that existing controls will protect the system from attack (No 5) 14 minutes (best case), 18 minutes (average case), and 22 minutes (Worst case) Estimated time to detect that an attack is happening (No 5) 6 minutes (best case), 9 minutes (average case) and 12 minutes (worst case) Estimated time to respond to an attack (No 5) once it has been detected 5 minutes (best case), 10 minutes (average case), and 15 minutes (worst case) Scenario 2: The company is considering investing an additional $100,000 to improve its security. Given the following possibilities, which single investment would you recommend? Explain your answer. An investment of $100,000 in better perimeter defenses would change the estimates for protection time to 20 minutes (worst case), 24 minutes (average case), and 30 minutes (best case). An investment of $100,000 in better detection systems would change the estimates for detection time to 3 minutes (best case), 5 minutes (average case), and 8 minutes (worst case). An investment of $100,000 in training would change the estimates for response time to 1 minute (best case), 2 minutes (average case), and 4 minutes (worst case). [Answer Hints: Research on 'The time-based model of information security' to have most accurate idea for answer. Time-based model of information security: Using the formula to evaluate if security procedures are effective (if true)... P>D+R, where P=the time it takes an attacker to break through the various controls that protect the organization's information assets, D=the time it takes for the organization to detect that an attack is in progress, and R=the time it takes to respond to and stop the attack. ]

case3

You were asked to investigate extremely high, unexplained merchandise shortages at a department store chain. Classify each of the five situations as a fraudulent act, an indicator of fraud, or an event unrelated to the investigation. Justify your answers. a) The receiving department supervisor owns and operates a boutique carrying many of the same labels as the chain store. The general manager is unaware of the ownership interest. b) The receiving supervisor signs receiving reports showing that the total quantity shipped by a supplier was received and then diverts 5% to 10% of each shipment to the boutique. c) The store is unaware of the short shipments because the receiving report accompanying the merchandise to the sales areas shows that everything was received. d) Accounts Payable paid vendors for the total quantity shown on the receiving report. e) Based on the receiving department supervisor's instructions, quantities on the receiving reports were not counted by sales personnel.