Internal Control

Internal Control:

Basically internal control is a process to ensure fraud prevention and maintaining safety of the organization’s information from negative aspects and false play.

Internal controls can be considered as a common instincts like what the things that can go wrong are and what type of actions should be taken to control it.

Internal controls for the Fanshawe Risks are:

• Data Theft

This can occur during lab hours in homework lab where individual can stole or track down the other students credentials due to lack of partitioning between PCs. Other possible risk is printing of the documents on campus because the printer is physically accessible by each students and person can see and print other student’s data when they go through the access process.

• System Access Control Security ( Individual should only able to see and print their data )

• Physical Audits ( Printer should  accessible physically by the lab authorities and the documents will be provided to the card holder only)

• Attendance Manipulation

This risk can occur in-class as per current physical attendance procedure students can add false signature of other students and manipulate the data.

• Access control ( Digital access should be provided like QR codes and QR scanners to track and record the individual students data )
• Data Monitoring ( The captured data report will be generated when needed )

• Misuse of Storage/Locker Facility on campus

The non-allocated lockers at Fanshawe are not locked and protected with locks so any student can use it without paying for it until the authorities get complain, this can affect the college fund.

• Increase Complexity and Security ( The locks should be allocated with each locker with bit more charges so un-authorized person can’t use it )
• Regular Monitoring ( The regular monitoring of the unallocated lockers should be done by the authorities to prevent the misuse )

Image Explanation justifying our Identified Risks:

Data Theft:

The given image shows the lab arrangement where we can clearly see that there are no partitioning between the two PCs, so if person is entering his/her credentials the person on next system can able to identify that or misuse it if he/she wants.