ABSTRACT

CHAPTER ONE

INTRODUCTION

1.1     Background of the Study

Control  being  one  of  the  five  main  functions  of  management,  is  a  process  of  monitoring  operations so as to detect whether the operations fulfill their functions as planned or not, and if there is a deviation, the control process determines the reasons of this deviation and takes the necessary steps to eliminate it (Aysel, 2013). The main purpose of control is to raise concern over errors, and detect the points of failure in order to prevent their re-emergence.

Internal control system can be generally defined as a system which as the features of maintaining the assets of a company, ensuring accuracy and reliability of information and reports related to accounting and other operations, and increasing the effectiveness of the operations. (Aysel, 2013).

The Commission of Sponsoring Organization (COSO) defined the internal control “as a process, effected by the entity’s board of directors, management and other personnel designed to provide reasonable assurance regarding achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations” (COSO, 2010). This definition points to the fact that internal controls create a basis of amount of work to be carried out by the professionals charged with the function, as they are expected to ensure the safeguard of the organization’s funds, ensure that there is efficient and effective management of assets and that financial statements are accurate at all time.

Though internal controls system cannot eliminate all errors and irregularities, it is expected that they can alert management to potential problems, which can be controlled before they escalate to big problems (Campbell et al, 2010).

Internal control system (ICS) can be effective if its components are present and are functioning effectively for operations, financial reporting and compliance. The highest management level (board of directors) in the organization and its audit committee have responsibilities of making sure that the ICS within the organization is sufficient to ensure efficient and smooth operations in the organization. These responsibilities include determining the extent to which internal controls are evaluated and the parties involved. In many successive evaluations of ICS, the internal and external auditors are involved to ensure independence in advising the management. The internal control system (ICS) need to be evaluated regularly so as to provide management with some confidence regarding its effectiveness (Campbell et al, 2010).

Financial problems experienced in recent time have demonstrated that in some organizations mostly in financial institutions, risk-management and internal control practices were ineffective or imperfect. It is feared that the inability of management to ensure effective enforcement of rules and regulation have rendered that operations of internal control system in the banking industry open to abuse (Tunji, 2013).

1.2     Statement of the Problem

Shoulder-surfing or observation attacks, including card skimming and video recording with hidden cameras while users perform PIN-based authentication at Automated Teller Machine (ATM) terminals is one of the most common threats for common ATM users around the world today. In this case, the attacker simply observes the entry procedure of the PIN by the authorized user to get hold of the secret information which can then be used whenever the card is stolen.

This has however created drawbacks in the financial sector as individuals lose funds due to users being exposed of their credit card information. This research work is an attempt to tackle this problem by developing a system that will send an OTP to the user’s phone at point of operation.

1.3     Aim and Objectives of the Study

The aim of this research document is to design and implement an internal control system for ATM transactions that will tackle the challenges of shoulder-surfing and observation attacks that are being carried out by fraudulent individuals on ATM users in ATM galleries.

The objectives of this study include the following;

1. To design an internal control system model for ATM around the world.
2. Analyze the impact of an internal control system on ATMs.
3. Reduce the rate of fraud in the financial sector.
4. Improve on the system security integrity of ATMs.
5. Encourage clients’ trust in Financial Technology (FinTech).

1.4     Significance of the Study

The global financial crisis highlighted the importance of well-functioning and healthy banking sector for macro stability (Aysel, 2013). One of the main reasons of banking failures which results in major financial loss and even bankruptcy is due to high risks taken by the bank management on an excessive scale and inability of controlling them. The lack of an internal control system which duty is to keep the risks under control or major breakdowns within an existing internal control system pose a threat against the success of the banking sector. Some points are listed below on why this study is significantly important.

1. It will identify possible defects and loopholes in the financial system.
2. It will offer useful recommendation based on the findings on how best to                 prevent the occurrence of fraud through an effective internal control system.
3. It will help to examine the relevance and appropriateness of the presently adopted control measures in preventing fraud.
4. The result would also help the banks to access their overall performance through    internal control checks.

1.5     Scope of the Study

This research work covers the development of an internal control system for ATM transactions that will allow banks to verify users’ financial transactions that are done through ATM systems automatically using a One Time Pin (OTP) technology.

1.6     Limitation of the Study

The researcher faced some limitations during the course of this research. Some of this limitations/constraint includes;

1. Time constraint: Time factor were also the major factors as the timeframe to submit the project was too short for an extensive research.
2. Financial constraint:  Lack of adequate finance to fund the researcher as to visit many places was another major setback.

1.7     Definition of Terms

• ATM: An automated teller machine (ATM) is an electronic banking outlet that allows customers to complete basic transactions without the aid of a branch representative or teller.
• Authorization: This is a security mechanism to determine access levels or user/client privileges related to system resources including files, services, computer programs, data and application features.
• Card Skimming: This is the theft of credit and debit card data and PIN numbers when the user is at an automated teller machine (ATM) or point of sale (POS).
• Financial Institution: This is a company that focuses on dealing with financial transactions, such as investments, loans, and deposits.
• Financial Sector: This is a section of the economy made up of firms and institutions that provide financial services to commercial and retail customers.
• Financial Technology: This is used to describe technologies that seeks to improve and automate the delivery and use of financial services.
• Fraud: A wrongful or criminal deception intended to result in financial or personal gain.
• Internal Controls: These are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud.
• Observation Attack: This is an act whereby the authentication information of an ATM user is obtained by a person who is directly monitoring the authentication sequence.
• OTP: A one-time password (OTP), also known as one-time PIN or dynamic password, is a password that is valid for only one login session or transaction, on a computer system or other digital device.
• Recording Attack: This is an act whereby the authentication information of an ATM user is obtained by recording the authentication sequence for later analysis.

Shoulder Surfing: The practice of spying on the user of a cash-dispensing machine or other electronic device in order to obtain their personal identification number, password, etc.