# Presentation: 676640

## Entity Controls (EC) over Local Information Systems

**DOE A-123 Targeted Training Program**

## EC: Information Systems Topics

**Role of Information Systems **
**Systems Ownership Scope and Responsibilities**
**A-123 Entity Controls Documentation Requirements  **
**Local Applications Walkthrough**
**Helpful Resources**

## Entity Controls over Information Systems

**Information Systems ECs ensure the integrity of:**
- Communications
- Data
- Processing of financial transactions

## Role of Information Systems

**Automate transactions**
**Establish and maintain interfaces**
**Information systems produce reports for business**

## Scope of System Ownership

**CIO**
**Computing** **Infrastructure**
**BEA Web Logic Portal**

## Scope of System Ownership

**CIO**
**Computing** **Infrastructure**
**BEA Web Logic Portal**

**Shared Systems**

**CFO – STARS**
**HR - CHRIS**
**Procurement - STRIPES**

## Scope of System Ownership

**CIO**
**Computing** **Infrastructure**
**BEA Web Logic Portal**

**Shared Systems**

**Local** **Applications**

**CFO – STARS**
**HR - CHRIS**
**Procurement - STRIPES**

**BEARS, Excel Spreadsheets, Access Database**

## Scope of System Ownership

**Local** **Applications**

**BEARS, Excel Spreadsheets, Access Database**

## Objectives for A-123 ECs for Local Systems 

**We evaluate ECs for Information Systems to assure:**
- Timely availability of accurate information
- Reliability of the systems involved
- Documentation supporting the evaluation exists

## A-123 Local Systems EC Responsibilities

**System Owners**
- Ensure controls are in place and working
- Provide documentation
- Work with A-123 Team for EC Evaluation

## Spreadsheet Management

**Spreadsheets:**
- Manually controlled
- Subject to higher Inherent Risk
- for errors, data integrity
**Key Controls for Spreadsheet Management:**
- Change and Version Control
- Back-up and Security
- Manual Review and Approval

## Local System Change Control Example

**Inherent Risk:**
**	**The spreadsheet is not password protected so any user may make changes to data or formulas, resulting in errors in the data and formulas
**Control: **
- 	Spreadsheet is locked and password protected to ensure unauthorized users are not changing data and formulas

## Local System Back-up &Security Example

**Inherent Risk:**
- 	Data is backed up to the computer hard drive where the Access Database is housed; resulting in a loss of critical data if the computer fails
**Control:**
- 	Data is saved to hard drive and back-ups of data files are stored on the network drive to minimize impact of hard drive failure. The files can easily be accessed from the network drive in order to re-establish the database quickly with minimal interruption

## Local System Review & Approval Example

**Inherent Risk:**
- 	Spreadsheet review is performed via email without having changes tracked and logged, resulting in out-dated changes and error prone data
**Control: **
- 	The organization has a secure repository and a process in which only one person has the authority to approve or reject a particular version.  All review, approvals, and comments are tracked in an audit log and further changes are prevented once a version is approved

## Additional Resources

**Information Systems Controls Table**
**Checklist for Evaluation**
**PMT resources **

## Slide 16

## Checklist for Evaluation

## Takeaways

**We are all system owners**
**System Owners are at all DOE organization Levels **
**A-123 requires risks and controls to be documented and evaluated for each information system**
**Resources are available to assist you. **

## DOE A-123 PMT Contact Information

**Helpdesk Phone:  **(301) 903-3937
**Helpdesk Email:  **A-123Helpdesk@hq.doe.gov
**Website:  **www.cfo.doe.gov/cf1-2/doeA123/index.htm

## Slide 20