Don't write checks your...accounting system can't cash

I recently read a startling whitepaper titled “Cash is King: Who’s Wearing Your Crown?” in which two researchers simulated an attack on an accounting system, making changes to the underlying data structure and ultimately causing the system to send payments to malicious parties. In one of the more disturbing examples, the researchers changed customer address and check name records, causing the system to send refund checks made out in their name to an address they specified.

Here are a few steps your accounting system users can take to reduce such a risk:

• Positive Pay – many commercial banks offer this service. When checks are issued, a file is created listing each check and the amount, and is transmitted to the bank. When checks are processed for payment, they are reconciled to the list provided by your business. If the check is not on the list, the bank will not process that check.
• Activate and monitor the audit files that are inherent in your accounting system. By tracking what changes were made, by whom, and for what reason, data change management apps may help foil an otherwise damaging attack.  Some tools notify specified users when certain changes are made to the system. Any time a vendor name or address is changed, an email can be sent to notify a group of individuals. Data change management software like KnowledgeSync or Rockton Auditor run in the background and can facilitate this process, requiring human effort only during initial setup and configuration (as well as follow-up on automated alerts).
• At a minimum, you should reconcile your bank accounts monthly, but with the increasing speed and sophistication of fraudsters, monthly reconciliation may not be adequate.  Reconciling bank accounts more frequently may sound like a daunting task, but many accounting applications have built-in bank reconciliation functionality. If your system lacks this functionality, consider looking for a third-party tool. This is particularly important for businesses with high transaction volume or multiple cash accounts.

Schneider Downs Technology Advisors provides risk assessment and security vulnerability services. Please contact Schneider Downs Technology Advisors for a confidential consultation.

© 2014 Schneider Downs. All rights-reserved. All content on this site is property of Schneider Downs unless otherwise noted and should not be used without written permission.

This advice is not intended or written to be used for, and it cannot be used for, the purpose of avoiding any federal tax penalties that may be imposed, or for promoting, marketing or recommending to another person, any tax related matter.