## **Learning Outcomes**

After reading this article, you will be able to explain why accounting data must be protected, identify common risks in computerised and cloud-based systems, and describe practical controls such as user access rights, passwords, backups and encryption. You will also be able to explain what change logs (audit trails) are, what they record, and how they help prevent and detect errors and misuse when transactions or standing data are amended.

## **ACCA Recording Financial Transactions (FA1) Syllabus**

For ACCA Recording Financial Transactions (FA1), you must understand:

- key features of computerised accounting systems, including storage on external servers (cloud)
- risks to data security and storage (loss, corruption, unauthorised access)
- data protection procedures and confidentiality when handling personal data
- how segregation of duties and authorisation reduce the risk of error and fraud
- how accounting data is checked and how errors and amendments are dealt with in computerised systems
- why businesses retain documents and data securely for several years

## **Test Your Knowledge**

_Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision._

1. Which control best reduces the risk of a payroll clerk viewing customer receivables data?
   - A. Daily bank reconciliation
   - B. Role-based user access rights
   - C. Sequential invoice numbering
   - D. A wider chart of accounts

2. True or false? If a business uses cloud accounting, it no longer needs its own backup or recovery arrangements.

3. State three items you would expect to see in a good change log entry for an amended supplier bank account.

4. A caller claims to be your bank manager and asks for a customer’s outstanding balance and relationship status. What is the most appropriate response?
   - A. Provide both items because the caller works at a bank
   - B. Provide only the outstanding balance, but not relationship status
   - C. Refuse to disclose and refer the request to a responsible manager using a verified contact method
   - D. Provide both items if the caller can name the customer

5. True or false? Deleting a posted sales invoice is usually safer than posting a credit note.

## **Introduction**

Computerised accounting systems can process large volumes of transactions quickly, and many businesses now store data on remote servers (cloud). That speed and easy access create a risk: if the wrong person can log in, or if data is lost or changed without evidence, the business may produce unreliable figures and lose confidential information.

For FA1, you need to know the main data security risks and the controls used to reduce them. You also need to understand change logs (audit trails): records that show who changed data, what was changed, and when. These logs support checking, error correction and accountability.

## **Data security in computerised accounting systems**

> **Key Term: data security**
> The protection of accounting data against unauthorised access, loss, corruption or destruction so records stay confidential, complete and available.

### What is at risk?

Accounting systems hold valuable information such as sales, receivables, supplier details, payroll and management reports. This includes personal data (for example, employee pay details) and commercially sensitive data (for example, pricing and customer balances). If data is wrong, missing, or disclosed to the wrong person, the business can suffer financial loss and reputational damage.

A computer system may still post equal debits and credits, but that does not guarantee the correct codes, amounts, or customers were selected. Security controls and change logs work together to reduce these risks.

### Common risks you should be able to describe

You should be ready to discuss these categories of risk in exam questions:

- **Accidental loss or corruption** (for example, device failure, incorrect processing, accidental overwrite).
- **Deliberate damage or deletion** (for example, a disgruntled employee).
- **Unauthorised access and misuse** (for example, stolen passwords, hacking, viewing payroll data without permission).
- **Malware and ransomware** (software designed to damage or block access to data).
- **Physical threats** (fire, flood, theft of laptops and backup devices).
- **Third-party risks** where data is hosted externally (for example, cloud provider failure or attack).

### People-based controls (staff and responsibilities)

Many failures start with people rather than technology. Businesses reduce risk by:

- selecting trustworthy staff for sensitive roles
- training staff on secure working practices (password handling, phishing awareness, not sharing logins)
- setting clear procedures for authorising transactions and changes

> **Key Term: segregation of duties**
> Splitting tasks between different people so that one person cannot complete and hide an error or misuse on their own.

Segregation of duties matters in computerised systems because one login with wide permissions can allow posting transactions, amending standing data, and hiding the evidence. A simple example is separating the person who sets up suppliers from the person who approves payments.

### Access controls: who can log in and what they can do

Access control starts with individual user accounts. Each user should have their own login so activity can be traced back to them. Shared logins make it difficult to investigate errors and weaken accountability.

> **Key Term: access control**
> Rules and tools used to limit system access to approved users, and to limit what each user can view or change.
>
> **Key Term: authentication**
> The process of confirming a user’s identity, for example using a password, PIN, security questions or multi-factor login.
>
> **Key Term: authorisation**
> Permission for an authenticated user to perform specific actions, such as posting journals or changing supplier bank details.

Good practice is to give users the minimum rights needed for their job (for example, enter purchase invoices but cannot change supplier bank details). This also reduces the impact if a login is stolen.

#### Security measures commonly used with logins

- strong passwords and regular password changes (where policy requires)
- multi-step login (for example password plus a code to a device)
- automatic screen locks after inactivity
- limiting login attempts to reduce password guessing

### Technical controls to protect data

These controls reduce the chance of data being stolen, damaged or read by outsiders:

- firewalls to restrict network traffic
- anti-malware tools and regular scans
- secure system updates (patches) to fix known weaknesses
- encryption for data stored on devices and data sent over networks

> **Key Term: encryption**
> A method of turning data into unreadable code so it cannot be understood if it is intercepted or stolen, unless the correct key is used.

### Backups and disaster recovery

Backups protect availability: if data is lost or corrupted, you can restore it. A backup arrangement is only useful if it is regular, stored safely, and tested.

> **Key Term: backup**
> A copy of accounting data stored separately so it can be restored if the main data is lost, corrupted or destroyed.

Good backup controls include:

- scheduling backups (daily or more frequent where needed)
- storing copies away from the main location (to reduce fire/theft risk)
- restricting access to backup files (backups can contain the full ledger and payroll)
- testing restores (a backup that cannot be restored is not useful)

### Cloud accounting and remote access risks

Cloud accounting allows access to data and software hosted on external servers via the internet. It can reduce some risks (for example, loss of a laptop may not mean loss of the accounting records if nothing is stored locally). However, it introduces reliance on the provider for uptime, security and compliance with data protection law.

You should expect businesses to:

- check what security controls the provider uses (access controls, encryption, backups)
- control which staff and external parties are granted access, and limit that access to what they need
- monitor user activity and changes using logs and review procedures

### Peer-to-peer (P2P) networks and file sharing

In some businesses, staff share files directly across a network. P2P arrangements can support flexible working, but they increase the need for clear access rights and secure user accounts. Without good control, staff may access or copy files they should not see (for example, payroll reports).

### Data protection and confidentiality

Even when data is needed for normal accounting activities, you must keep it confidential and only use it for proper business purposes. Individuals may have rights to see certain personal data held about them and to request correction if inaccurate.

A typical exam scenario is an external caller asking for customer or employee information. You should not disclose information just because the caller claims to be from a bank or another organisation. Requests should be verified and handled by an authorised person.

### **Worked Example 1.1**

A junior accounts assistant can post purchase invoices. They ask for access to amend supplier bank details “to save time”. The business uses an online accounting system.

> **Answer:**
>
> The assistant should be given authorisation only for purchase invoice entry, not for supplier bank detail changes (role-based access). Supplier standing data changes should require approval by a responsible person, and the system should keep a change log showing the user ID, date/time, the old bank details and the new bank details. This reduces the risk of error and the risk of payments being redirected.

## **Change logs (audit trails) and control of amendments**

> **Key Term: audit trail**
> Evidence that lets you trace a figure in the accounts back to source records, and trace a source record forward into the ledger and reports.
>
> **Key Term: change log**
> A system record of amendments made to data, showing details such as who made the change, what was changed, and when.

### Why change logs matter in accounting systems

Computerised systems can update many records at once (for example, posting a sales invoice updates the general ledger and also customer account records and aged receivables listings). If someone later edits that invoice, many balances and reports can change instantly.

A change log provides evidence of what happened. It supports:

- detecting unauthorised changes
- investigating errors (who changed a code or amount)
- reviewing sensitive changes (supplier bank details, employee pay rates, credit limits)
- supporting internal checks and external audit work

### What should a good change log contain?

You should be able to state typical items recorded, such as:

- unique entry reference number
- user ID (who)
- date and time (when)
- record affected (for example supplier code, invoice number)
- field changed and values before and after (what)
- reason for change (why), where the system captures it
- approval status, if the system uses workflow approval

### Transaction changes vs standing data changes

Change logs are useful for both:

- **Transaction data** (sales invoices, receipts, journals). Risk: changing a posted transaction changes reported results.
- **Standing data** (customer records, supplier records, product prices, tax codes, chart of accounts). Risk: standing data affects many future transactions.

For exam purposes, supplier standing data changes (especially bank details) are normally treated as high risk and should have stronger control and review.

### Period locks and safe correction methods

Many systems allow you to “lock” a period after checks have been completed. This stops users editing transactions in a closed month and protects reported figures.

Where a correction is needed, safer methods often include:

- posting a reversing entry and reposting correctly (journals)
- issuing a credit note and raising a correct invoice (sales corrections)
- keeping the original record and showing the correction clearly, rather than deleting evidence

### **Exam Warning**

Deleting posted transactions can remove evidence and break the audit trail. In many businesses, deletion rights are restricted to senior users, and corrections are made using credit notes or journals with proper references.

### **Worked Example 1.2**

A sales invoice for £2,400 was posted to the wrong customer account because the wrong customer code was entered. You notice the error one week later, after statements have been sent.

> **Answer:**
>
> You should correct the customer balances in a way that leaves evidence. A common approach is to raise a credit note to reverse the invoice on the wrong customer account and then raise a new invoice to the correct customer account (or use the system’s approved correction process). The change log (and related document references) should show who processed the correction and when, so the business can explain why customer statements changed.

### Controlling system changes (software and settings)

Accounting software is updated over time, and businesses also change settings (tax rates, document templates, user permissions). Poor control over changes can cause processing errors or security gaps.

Good controls include:

- only authorised staff can change system settings and user rights
- changes are tested (where possible) before being used live
- records are kept of what was changed and why (change log plus approval evidence)
- a responsible person reviews exception reports and logs for unusual activity

### **Revision Tip**

When revising logs, remember the “who/when/what/before-after/why” checklist. In questions, link change logs to authorisation, segregation of duties, and the ability to investigate errors.

## **Key Point Checklist**

_This article has covered the following key knowledge points:_

- data security risks include loss, corruption, destruction and unauthorised access
- access controls use unique user accounts, authentication and authorisation to limit what users can do
- segregation of duties reduces the chance that one person can both create and hide errors or misuse
- encryption protects data if devices or transmissions are intercepted
- backups and tested restores protect against data loss and disasters
- cloud accounting can reduce some risks but introduces reliance on the provider and internet access
- change logs support checking by recording who changed data, what changed, and when
- safe correction methods keep evidence and protect the audit trail

## **Key Terms and Concepts**

- data security
- segregation of duties
- access control
- authentication
- authorisation
- encryption
- backup
- audit trail
- change log


Controls in computerised systems - Data security and change logs