Oklahoma A&M Board of Regents

System User Access for Financial Information Systems

A. Introduction
To ensure the integrity of financial data, accuracy of financial reporting and to minimize the risk of fraud, it is important to establish a clear system access provisioning and segregation of duties (“SoD”) policy for information technology financial systems.

B. Provisioning User Access
Proper provisioning of user access to financial information systems shall be establishedsuch that no user is given system access that allows the user to both initiate and approve a transaction. Specifically, user system access in one or across multiple system(s) shall be granted such that no one user has system access that allows sole control over any one transaction. Applicable transactions include but are not limited to:
• the receipt of funds
• disbursement of funds
• transfer of funds
• journal entries
• human resources and payroll activity, including but not limited to establishment of an employee and/or changes in pay rates and/or benefits
• budget entries and transfers; etc.

C. Least Privilege
The principle of least privilege states users shall be granted the minimum level of access to information systems that is necessary to perform the user’s assigned tasks. User access to financial information systems shall be configured in accordance with the least privilege principle.

D. User Authentication Controls
Strong user authentication controls shall be implemented in accordance with Uniform Information Security Governance guidelines, or the applicable industry standard for information security at the time, including, but not limited to the use of complex passwords, limits to unsuccessful login attempts, and session timeouts; provided, however, authentication controls may change over time in accordance with industry standards. User IDs and passwords shall be kept confidential and changed regularly. Employees with administrative access to financial information systems shall not utilize administrative access accounts for operational or financial tasks.

E. Monitoring
Each Vice President that has financial information systems in their area shall be responsible for establishing procedures to ensure the security and integrity of financial information systems accessed by their employees and to ensure employees are appropriately trained on such procedures. These procedures shall specify that user activity will be monitored routinely to ensure all users are appropriately provisioned to establish proper segregation of duties and configured in accordance with the least privilege principle.

F. Audit Trails
Audit trails and audit logs shall be implemented to track and record all financial transactions and system access. A user access change log shall also be maintained that records when user access permissions have been changed and by whom. The audit trails/logs shall be reviewed regularly by management and retained in accordance with records retention requirements. These records shall be protected against unauthorized access, modification, and deletion.

G. Deprovisioning User Access
Each Vice President that has financial information systems in their area shall establish procedures to immediately terminate user access to financial information systems when a user leaves the organization or changes roles. Additionally, these procedures shall include a periodic review (not less than annually) of all user access to ensure it is appropriately assigned.

H. Conclusion
This policy is intended to ensure that system access controls related to financial transactions are implemented and maintained to protect the integrity, security, and confidentiality of system data. By implementing this policy, institutions can reduce the risk of errors, fraud and unauthorized activities and increase the effectiveness of their internal control systems. Non-compliance with this policy may result in disciplinary action.

Approved Date: 
June 16, 2023