Reference no: EM132557155

Your audit firm was recently engaged by Bomba Ltd, a manufacturer of industrial pipes to review the general controls at the company.

The report on the review which was presented to you contained, inter alia the following:

• 'The company employs three computer technicians. They are responsible for ensuring that the company's network functions satisfactorily. The technicians report to Jeff Jillo, the financial director. However, he does not interact very much with the technicians, as he is by his own admission, not strong on computer technology. The technicians are responsible for making programme changes as they see fit, training new staff members to use the company's computerised system, operating the help desk and managing the database. The three technicians are all on the same employment grade and generally work well as a team allocating the various tasks amongst themselves. The three technicians are located in a general office in the accounting section in which the network servers and various other pieces of computer equipment are located.

• Jeff Jillo is the senior financial employee in the company. There are two executive directors and one non-executive director but all three of these individuals are from a manufacturing background and have little interest in the financial/administrative side of the business which is left up to Jeff Jillo.

• All employees at Bomba Ltd are given access to the network. Factory personnel can access the network from two terminals in the staff canteen if, for example they want to send emails or browse the internet during tea or lunch breaks. To get into a particular application, the employee must enter a unique password. Controls over passwords are as follows;

• With the help of one of the technicians, the employee accesses a 'new password file' which is resident on the system. A list of 200 four letter passwords then appear on the screen and the employees must select one password by 'clicking on 'it. If a password has already been taken, it appears in bold italics and cannot be selected. A new list of passwords is produced every six months and employees must select a new password using the same procedure. Passwords of staff who have left the company are also invalidated at this time. The password file is encrypted and only the three technicians, all of whom have root access/super user access, can access the password file. This password application software was written by one of the three technicians.

• Other supplementary access controls such as shut down after three access violations, time out facilities and access logs are in operation. The company has a fire wall in place and makes use of anti-virus software. There is a suitable disaster recovery plan and back up strategies appear to be effective'

You are required to:

Question 1: Discuss weaknesses in the general controls of Bomba Ltd based on the information given above.