AIS Attacks and Failures: Who to Blame
ACC564
February 17, 2013

AIS Attacks and Failures: Who to Blame Accounting information system (AIS) is defined as a system that collects, records, stores, and processes data to produce information for decision makers (Romney and Steinbart, 2012). AIS adds value to an organization by improving the quality and reducing the costs of products or services, improving efficiency, knowledge, improving the efficiency and effectiveness of a company’s supply chain, improving the internal control structure, and improving a company’s decision making. The responsibility for establishing and maintaining a system of effective internal controls resides with management. Management’s responsibilities include the documentation, testing, and assessment of internal controls, including relevant general IT controls and appropriate application-level controls designed to ensure that financial information generated from an organization’s information system can be reasonably relied upon according to www.sec.gov. therefore management should be held liable for losses sustained in a successful attack made on their AIS by outside sources. Security is a management issue and not a technology issue. The Foreign Corrupt Practices Act of 1977 and the Sarbanes-Oxley Act of 2002 (SOX) assign important legal responsibilities to management. Section 404 of SOX mandates a statement of management’s responsibility for establishing and maintaining adequate internal controls over financial reporting and an assessment of the effectiveness of those internal controls: preventive controls, which include techniques designed to reduce the frequency of undesirable or devastating actions; detective controls, which include devices, techniques, and procedures designed to expose undesirable or devastating actions that elude preventive controls; and