Cybersafety Connections March 2021 Vol#7
giphy.com
Minimizing Risk of Loss and Ensuring Continuity
It was a year ago when work from home took over our lives. I was not used to the lifestyle of working remotely 5-6 days a week. But I and so many have done it for a year now. My initial fear was that my device may not be secure enough and maybe the weak link in causing a compromise. Luckily my employer provided the work equipment eventually.
Some organizations have had the bandwidth for digital transformation that was forced upon us by COVID-19. Some have survived the uncertainty and now is the time to execute. The race is on and it is Ready, Steady, Go.
For the Small-to-Medium Businesses (SMBs) contending with the impact of COVID-19 and trying to keep their doors open, Internal Controls and cybersecurity still has a place in business continuity. Internal controls and cybersecurity are not optional if you are looking to minimize loss.
How do SMBS keep up with internal Controls with the change in;
Processes
Digital Transformation
Work from home has been impacted by the digital transformation. Because of the abrupt nature of the virtual process implementation due to quarantine, some organization did not have time to implement internal controls as part the digital transformation and this might create opportunity for fraud. The solution is to review the processes to see how internal controls can become part of the processes to prevents loss.
Cybersecurity
The remote work environment has brought concerns of cybersecurity to the forefront. Education and training is key. Educate employees on cyber hygiene relating to passwords and the devices connected to the internet. Personal devices may be used to access company network and this could create huge risk since personal devices may lack malware protection and there maybe failure to install operating system and security updates. Ensure non corporate devices have access to only parts of the network that are controlled. This would limit sensitive data from been exposed if the device is compromised.
Ensure data is being backed up and kept at a secure location. Employees should be made aware of the need to safeguard company data. Employees should be encouraged to encrypt their routers with WI-FI Protected Access2 (WPA2) or WI-FI Protected Access 3 (WPA3). A Virtual Private Network (VPN) should be used for secure access from employees work computers to the company remote server.
Workforce
With remote work life, people are facing pressure from their personal lives like financial difficulties, stress and coping with virtual world which could increase the risk of fraud. Since employees are no longer within sight, those who want to defraud the company may have time to do so. This would be made easy if the access control is not limited. To deter this behavior, keep in touch with co-workers find out what is going on in their lives just like you were still in the office.
Make them aware of the need to have strong internal controls in place especially in the remote environment. Perception of detection will act as a deterrent.
Third Party
Internal controls concerning third-party like customers, agents and vendors may have been pushed aside due to disruption in supply chain that led to scarcity. This scarcity may have a created a situation that led to partnering with customers, agents and vendors that may have been considered risky in the ordinary course of business. Establish due-diligence program consisting of third-party screening and onboarding procedures, risk assessments, ongoing monitoring, and corrective or preventive actions. The due diligence program should be adopted to the virtual world.
SOURCES;
Journal of Accountancy March 2021 – Staying Vigilant against fraud during the pandemic by Cecilia Locati, FCMA, CGMA
Journal of Accountancy March 2021- Fighting Fraud on a Limited Budget- Andi McNeal, CPA, CFE
Insight Winter 2020 –The Ethics of Remote Work- Elizabeth Pittelkow Kittner CPA, CGMA, CITP, DTM
Assessing internal controls amid the new COVID-19 working environment (rsmus.com)
5 Best Practices to Enhance Third-party Due Diligence – Insights (metricstream.com)
Subscribe to get the latest post.
