In computerized systems, digital accounting records are vulnerable to unauthorized and undetected access. This may take the form of an attempt at fraud, an act of malice by a disgruntled employee, or an honest accident. Additional exposures exist in real-time systems, which often maintain accounting records entirely in digital form. Without physical source documents for backup, the destruction of computer files can leave a firm with inadequate accounting records. To preserve the integrity of accounting records, Sarbanes-Oxley legislation requires organization management to implement controls that restrict unauthorized access. Also at risk are the computer programs that make programmed decisions, manipulate accounting records, and permit access to assets. In the absence of proper access controls over pro- grams, a firm can suffer devastating losses from