If you have multiple users in your QuickBooks file, pay
close attention to the following information. This
security issue may have significant implications for
your business and/or your clients (for those CPAs out
there!)
When you are setting up users in QuickBooks, one of
the choices you have to make is whether to allow that
user to delete transactions in areas for which they
have access (found on page 9 of 10 of the user set
up screens). If you choose NO, meaning you do
not want that user to be able to delete any
transactions in those areas they can access, they can
still delete them in some cases anyway!
To be specific, any transaction that this user creates
can be deleted WITHIN THE SAME LOGIN SESSION.
Once they have logged off and logged back on, any
transactions that were previously created cannot be
deleted.
The implications of this are chilling! For
example, if you have employees at a "front desk" type
of area that are accepting payments from customers,
they can enter a transaction, post the payment, and
then immediately delete the payment. If they are really
devious, they can pocket the payment and then wait for
your system of internal controls and auditing to catch
them.
According to QuickBooks support, deleted
transactions, whether in the current login session or
from prior sessions are to be reviewed using the audit
trail report, and appropriate actions taken.
HOWEVER -
if you have specifically said NO to allowing someone
to delete transactions, why is there ANY differentiation
between deleting while currently logged on versus
logging off? NO means NO.
According to the QuickBooks product development
department, this is a "known issue" with the software.
However, as of this writing, there are no imminent
plans to fix it. I simply cannot understand why
they don't see this as an extremely large internal
control issue that needs immediate attention. The only
thing that will sway them to expedite a fix on this issue
is input directly from YOU, the QuickBooks users.
If you also feel that this is a significant problem for
your business, submit your feeback
directly to QuickBooks. The more they hear about
this problem, the better the chances of getting a fix put
in place for it. I'll certainly be monitoring it and report
on any changes in future issues.
Site Map
