ATM Risk Management and Controls - EuroJournals

167 European Journal of Economics, Finance and Administrative Sciences - Issue 21 (2010)
Measures to Reduce the Losses
a). The ATM Audit Log
The ATM audit log provides information that is recorded after the incident. The ATM audit log is
useful as it identifies and diagnoses security violation. It traces figures contained in a report back to the
point of processing and from processing to the source of the input.
b). Encryption
Encryption is an effective technique for protecting the ATM system. This technique is to make
intercepted data useless to the interceptor by making it too difficult or too expensive to decipher. This
means there is little risk if disclosure.
c). Software Auditing
R.M Richards and J. Yestingsmer (1986) indicated that “software audit techniques include a review of
program listing, use to test input/output data with expected results and auditing of the ATM system
processing program using error detectors built into the system. Tracing is software used by the auditor
to identify which instructions were used in a program and in what order”. The advantage is that it helps
to analyse the way in which the ATM program operates.
Software auditing provides system integrity to management and also provides an opportunity
for management to identify security and control weakness. There are several good security packages
that can monitor an ATM software execution to detect possible tampering with the programs.
These ATM utility programs provide the opportunity for management to examine that the ATM
programs are being properly executed and are not being overridden or by-passed. By using the audit
software, frauds and misuses can be detected in a timely manner.
Controls
In general the process should ensure Confidentiality, Integrity and Availability (CIA). This
requirement should be addressed with controls implemented at different levels of the ATM
implementation, such as General Application controls, business process controls, applications controls
and Platform controls.
1. General ATM Operation and Organisation Controls
The operation and organisational controls are designed to ensure that functions are segregated among
individuals. There are two main important elements in an ATM system; firstly the magnetic card and
secondly the PINs. Making of the PINs is not to be carried out by people who are processing the cards.
Miklos A Vasarhelyi and Thomas W Lin (1988) indicated that “there should be segregation” in order
to limit an individual to only one interface with the system.
Most ATM systems rely heavily on programmed controls within the ATM system software;
hence it is important to separate the system development individuals, e.g
To separate:-
• application testing from systems design and programming and
• System software programming from application programming.
Risks/Threats
• Mailed cards being intercepted before reaching the authorised address.
• Uncollected cards not only take up valuable space for storage but also pose a security risk to the
bank through fraudulent use of these cards by bank staff.