Internal Control Questionnaires and Verification Procedures

Physical Security

1. Is access to the wire transfer area restricted to authorized personnel?

2. Are visitors to the wire transfer area required to:

   1. Be identified?

   2. Sign in?

   3. Continuously display identification?

   4. Be accompanied at all times?

3. Are personnel who are permitted entry to the operating area properly identified and required to continuously display identification?

4. Is written authorization given to those employees who remain in the wire transfer area after normal working hours? Who gives such authority? Are security guards informed?

5. Are the terminals controlled by key lock or password protected to prevent unauthorized access?

6. Are terminals in the wire transfer area regulated by:

   1. Automatic time-out controls?

   2. Time-of-day controls?

7. Are terminals and other hardware in the wire transfer area shut down after normal working hours?

8. Is terminal operator training conducted in a manner that will not jeopardize the integrity of live data or memo files?

9. Are passwords suppressed when entered in terminals?

10. Are operator passwords frequently changed? If so, how often?

11. Do correcting and reversing entries, as well as overrides, require supervisory approval?

12. Is supervisory approval required for terminal access made at other than authorized times?

13. Are passwords restricted to different levels of access, such as data files and transactions, that can be initiated?

14. Are employees prohibited from taking keys for sensitive equipment out of the wire transfer area?

Previous: Testing Next: Module B