These packages such as Xero, KashFlow, FreeAgent are maintained and run from a web-based accounting service. So information can be added, changed and accessed from any laptop of PC anywhere in the world. All the data being held on a web based providers servers, somewhere in the world!
These do appear to present us with yet another new set of risks...
This could cause us considerable access problems in the event of the failure of a provider. Who could take our clients finacial records with them.
Or there is a potenial risk in a collect-out situation if we want to seize the cleint's accounting records (or whole computer system) to carry out forensic investigations as we won't have 'hands-on' access. This also leaves the way wide open for a fraudulent cleint to delete records from anywhere even after we have shut down the office location.
We will start to need , when coming across such systems, at survey/audit to obtain additonal information... such as...
- deatils of provider and where data is held
- access codes to prevent a wiping of data in the event of fraud
- ensure that cleints have strict and workable back-up policy - even if again virtually held, hopefully by a different provider.
- access to the provider to take over control if we needed to...!
I am sure that other areas will occur to me as I think more about these issues.
I will be looking at the three identifed packages (shown above) over the next week or so and will place a brief analsysis of each on the blog.
No comments:
Post a Comment