The control implications of movie from centralized, host-based computer sys- ing tems to a networked or Intemet.based system have not been fully uadento Many companies have not realized that data security is crucial to their sur viva. Information is a strategic resource. ard protecting it must be a strategic requirement. For example, one company lost millions of dollars a period of several years over because it did not its data transmissions. A competitor protect tapped into its phone lines and obtained faxes of new product designs sent to an offshore plant. Productivity and cost pressures have motivated manageme forgo time. consuming nt to control measures. Any potential adverse occurrence or unwanted event that could be injurious to either the Als or the organization is referred to as a threat or an event. The potential dollar loss should a particular threat become a reality is referred to the exposure or as impact of the threat, and the probability that the threat will n is te likelihood associated with the threat. Why Control and Security Are Important Fortunately. companies are taking positive to better control companies and steps increase computer control and security. They are devoting full-time staff to security and control concerns and educating their employees about control measures. Many are establishing and enforcing formal information security policies. They are making con trols a part of the applications development process and are moving sensitive data to more secure environments. As an accountant, you must understand how to protect systems from the threats they face. You must also have good understanding of IT and its capabilities and risks. a This knowledge can help you use rr to achieve organization's control objectives. an Achieving adequate security and control over information resources should be a top management priority. Although internal control objectives remain te same regard less of the data processing method a computer-based Als requires different internal control policies and procedures. For example, although processing reduces computer the potential for clerical errors, it may increase the risks of unauthorized access to or modification of data files. In addition, segregating the authorization, recording. and asset custody functions within an As must be achieved differently. as computer pro- grams may be responsible for one or more of these functions. Fortunately. computers also provide opportunities for an organization to enhance its internal controls. One of the primary objectives of an AIS is to catrol a business organization. The accountant can help achieve this objective by designing effective control systems and by auditing or reviewing control systems to ensure their effectiveness. Management expects accountants to (1) take a proactive approach to eliminating system threats and (2) detect. corect, and recover from threats when they occur It is much easier to build controls into a system at the initial design stage than to add them after the fact. For that reason, accountants and other control experts should be important members of the team that develops or modifies an information system Overview of Control Concepts In today's dynamic business environment. companies must react quickly to changing conditions and markets. One good way to do this is to hire creative and innovative employees and give them te power and flexibility to satisfy changing customer demands, pursue new opportunities to add organizational value, and implement process improvements. At the same time, companies need control systems so they are not exposed to excessive risk or behaviors that might harm their reputation for honesty and integrity