Kelly Wessel
Neighborhood Watch: Become an HOA watchdog

Homeowners associations are a blessing and a curse. But one thing they shouldn’t be is unmonitored. You may have to become a watchdog to protect yourself and your neighbors. Here’s how.

Neighborhood Watch: Become an HOA watchdog
Kelly Wessel
What Does Your Annual Audit Opinion Really Mean?
What Does Your Annual Audit Opinion Really Mean?
Fraud, Non-Profit
Kelly Wessel
5 Controls for Very Small Non-Profits

Strong internal controls dictate a separation of responsibiities to provides checks, balances and oversight. For small businesses and nonprofits, that can be unrealistic. But there are some basic procedures that even very small offices can manage to protect themselves from fraud.

5 Controls for Very Small Non-Profits
Business, Fraud
Kelly Wessel
Praise the Lord and Pass the Internal Control

Do you go to church? Have you ever been to a church? I’m not asking because I’m worried about your soul. Have you ever wondered what happens to the collection that is taken during the service? You should find out. If you tithe, do you carefully check your record of tithes against the statement sent to you by your church? If not, you need to start.

Business, Fraud
Kelly Wessel
Case Studies: The Fraud Triangle and the South ...

The fraud triangle is a model that is frequently used to illustrate the factors that can cause someone to commit occupational (workplace) fraud. Most occupational fraud isn’t committed by seasoned or experienced criminals. It is rather an issue of three factors: opportunity, pressure, and rationalization.

Data Security

, ,

Improving Data Security for Your Business: A 12-Step Program

, ,

In the wake of the data breach at the South Carolina Department of Revenue, I would like to mention some steps that businesses can take to protect themselves, their customers, and their employees from possible intrusions from this breach and other potential breaches or disasters.

1) All individuals  should  take advantage of the free credit monitoring being offered by South Carolina through Experian.  The link to get this protection is:  www.experian.com/scdor. The access code is scdor123. Also, place a fraud alert and a credit freeze on your credit report with the Experian, Equifax, and Transunion credit reporting agencies.

2) South Carolina businesses should take advantage of the free credit monitoring offered by Dun & Bradstreet.

3) Monitor banking and credit card accounts on-line  daily.

4) If you (or your business) have  provided your banking information (account and routing number) to the state, talk to your banker about how your bank is protecting its customer accounts.  If you are not comfortable with protection provided by the bank, discuss changing your account number.

5) If your business does not already have a written security policy that sets up the company standards  and responsibility for security of on-line data and off-line documents, get one.  Be sure to address secure document disposal,  data back-ups and the security of the back-ups.  The policy should also include consequences for violations and it must be enforced.

6) Know what kind of consumer and employee information you are collecting, where it is, and who has access to it. Access should be limited to as few as possible on a need-to-know basis. Likewise, know who you are giving YOUR information to, why they need it, and how they protect it.

7)  If you accept credit cards make sure customer credit card information that is stored  in your system is encrypted by you or your processor.  For recurring charges, it is preferable to store those card numbers in a data vault provided by your processor. Customer credit card numbers and other consumer information  should never be stored on unsecured  documents .   And don’t blow off the annual PCI questionnaire (SAQ).  Complete it honestly.  This questionnaire should show you where you may be exposed.  Your merchant account provider should be willing to help you with this.

8) Develop a strict password policy that addresses assigning passwords, levels of access, routine password changes, prohibits password sharing, and sets up procedures for immediate password deactivation when appropriate.

9) Hire an IT security specialist to review your system security if you don’t have a qualified employee to do this.   If an employee designed the security, the review should be independent.

10) If you keep hard/paper copies with sensitive employee or customer information, they should be adequately protected, secured, and  protected during disposal.

11) Restrict access to your facilities.  Know who can enter and what they can access. Restrict key distribution and change locks/keys in appropriate situations (lost keys, employee termination, etc.).

12) Have a disaster recovery plan.  This plan should specifically address each step to  be taken, and by whom,  in the event you have a data breach or a physical disaster (e.g., your building burns down).  A data breach will require notification and damage control procedures for your employees and customers.  A physical disaster plan will address steps and responsibility  to work with your insurance company,  acquire an alternate facility and equipment,   and restore the data from back-ups.

I realize that the above procedures can be costly and sometimes cumbersome.  Each business needs to weigh the costs of implementing such procedures against the benefits that will be derived from the protection provided. The State of South Carolina is going to spend at least $12,000,000 repairing the damage from the recent data breach. That doesn’t include what they’ll spend to prevent it from happening again.  I’m sure many are wondering if the State would have been better served by spending that money years ago to strengthen system security.  But hindsight is 20/20.