IT controls: access rights in the warehouse system

Even the best-written rule does not work if it is not enforced in the software. In many warehouses 1C or another program is installed for eight or ten staff, but nobody has thought about access rights: whatever someone was given on day one is what they still have. As a result the storekeeper corrects a balance, deletes a document and changes a price, and no trace is left. IT control sorts this out: each person can perform only the actions their work needs, and every action leaves a trace.

A separate account for each person

The first rule is one person, one login. If three people work under a shared account such as "sklad", "admin" or "user1", then when a shortage appears it is impossible to say who did what. Accountability disappears as well. A password is personal: it must not be told to anyone or written on a sticker on the monitor. The auditor's first test is of that kind too: does the log show work under a single user name from different computers at the same time?

Example: an evening adjustment in the log

In the log the auditor found that on a Sunday at 22:40, under the login "sklad", balances for 14 items were adjusted. The adjustments mostly covered a shortage. Because the login is shared, it is unknown who signed in: the storekeeper, the deputy, or a former employee who still knows the password. If everyone had their own login, the question would be settled in a minute. So the recommendation is simple: close the shared login, give each person a separate account and leave the right to adjust balances with one responsible person.

Joiners, movers and leavers

Access must be refreshed along an employee's career:

• A new employee: access is granted on a written request, the manager approves it, and what was granted is recorded.
• Moved to another job: new access is added and the old removed. This is exactly where "accumulated" rights come from: a sales manager becomes a storekeeper and keeps the rights of both roles.
• Left the company: the account is blocked the same day. It is not deleted, because the author's name must remain in the log and in old documents.

The test is simple: compare the HR list with the list of active users in the system. If a departed employee's account is still active, that is an immediate finding.

Roles and the access table

Access is tied to roles, not to people. A simple table is enough: roles in the rows (storekeeper, receiving clerk, manager, accountant), actions in the columns (receipt, issue, adjustment, deleting a document, changing a price, settings).

The most dangerous actions deserve special attention:

• manual adjustment of a balance;
• deleting or cancelling a posted document;
• entering a document with a back date;
• allowing negative stock.

Only one or two responsible people should be able to perform these actions. Segregation of duties is a separate subject; here the point is how to implement it in the software.

Administrator rights

An administrator can do everything: change settings, clear the log, grant others' rights. Often these rights sit with the director or with the employee "who understands computers", who uses that account for everyday work. The right arrangement:

• the administrator has a separate restricted account for ordinary work;
• the administrative account is used only for configuration;
• its password is kept in a safe place and is not known to many;
• an outside programmer is given access temporarily, and it is closed when the job ends.

Settings, the log and backups

A few tick-boxes in the program define the whole control. The auditor looks at:

1. Whether negative stock is prohibited.
2. Whether entering documents into a closed period is prohibited (the data change prohibition date).
3. Whether the change history is switched on and who can clear it.
4. Whether a backup is made every day, kept elsewhere, and whether restoring from it has been tested.

What the auditor asks for

• the list of users and their roles;
• a comparison with the HR list;
• the number of accounts with administrator rights;
• active accounts that have not logged in for more than 90 days;
• whether shared logins exist;
• documents entered or corrected at night and at weekends, from the log.

Conclusion

Access rights in the program are a lock, and the log is a surveillance camera. Without them even a good procedure stays on paper. OmborAudit checks the list of users, the access roles and the key settings, and shows exactly where there is a risk of loss.