Lesson 4

SECTION 4.1

IntroductionIn Section 4.1, you will learn about the accounting and finance functions, which are fundamental to every business. The financial health of an organization is important to investors, founders, leaders, employees, and consumers. Section 4.1 Features Discuss accounting principles and concepts Examine the accounting equation, accounting approaches, and accounting cycle Differentiate between the various financial statements Solve for the various financial ratios Differentiate between the various types of costs and apply them to breakeven analysis and budgets Discuss cash management, cash budget, and cash balances Examine the various types of assets and liabilities and apply them to working capital Examine the various types of debt and equity Differentiate between the various capital budgeting methods

Accounting Defined  Accounting is defined as a system of recording business transactions, preparing financial statements, and showing how an entity’s economic resources are utilized in accomplishing its objectives in a given time period. In doing so, accountants follow professional accounting standards.  The accounting function can be divided into two sub-functions: Financial accounting (FA) Management accounting (MA) Financial accounting provides information mainly to external parties such as investors, bankers, regulators, tax authorities, stock markets, and others for their decision-making purposes. Financial accounting is the language of business. All business transactions will eventually end up in financial statements. Accounting principles are used to classify, record, post, summarize, and report the business transactions between various parties involved. Accountants apply their professional standards to analyze business transactions, prepare estimations, and report business events. The output of financial accounting becomes an input to tax accounting. The reported revenues, expenses, and profits from the income statement are used to prepare the income tax returns.   Management accounting provides information to internal managers and executives for their decision-making purposes. One can think of MA and FA topics as the two sides of a coin because one side provides information to the other side, and each side shares some common information with each other.

Accounting Principles and Concepts Accounting principles and concepts emphasize the “why” and “how” of accounting performed within a company.  The following are some important accounting principles: Business Entity Concept   Accounting is performed for an individual business unit for which financial data are needed. The unit or entity must be identified so that the accountant can determine which financial data should be analyzed, recorded, and summarized in reports.   In other words, the business is viewed as an entity separate from its owners to record the activities of the business only, not the personal activities, property, or debts of the owner.   The business entity concept assumes (1) that the company will have a long life ahead (going concern concept) and (2) that all business transactions and events can be measured in terms of a common denominator, such as the dollar.     Example: A business entity could be an automobile dealer, a department store, or a grocery store

Cost Concept   The historical cost concept is the basis for entering the exchange price or cost of an asset into accounting records. Use of the cost concept involves two other important accounting concepts: objectivity and the unit of measure.   The objectivity concept requires that accounting records and reports be based upon objective evidence. In exchanges between a buyer and a seller, both try to get the best price. Only the final agreed-upon amount is objective enough for accounting purposes. If the amounts at which properties were recorded were constantly being revised upward and downward based on offers or appraisals, accounting reports would soon become unreliable.  The unit of measure concept requires that financial data be recorded in dollars.

Matching Concept   The matching concept, which is based on accrual accounting, refers to the matching of expenses and revenues (net income) for an accounting period. Under the accrual basis, revenues are reported in the income statement in which they are earned. Similarly, expenses are reported in the same period as the revenues to which they relate.  Under the cash basis of accounting, revenues and expenses are reported in the income statement for the period in which cash is received or paid.

Materiality Concept   The materiality concept implies that errors, which could occur during journalizing and posting transactions, should be significant enough to affect the decision-making process. All material errors should be discovered and corrected.  Example 1: A part that costs $1,255.55 was entered as $1,255.50 into the accounting system. The $0.05 difference is immaterial and may not need to be fixed.  

Accounting Period Concept   The accounting period concept breaks the economic life of a business into time periods and requires that accounting reports be prepared at periodic intervals.  Some accounting reports may be prepared weekly, some monthly, and some even yearly, depending on the needs of company management. Example 2: A part that costs $1,255.55 was entered as $12.55, which is a material error and needs to be immediately fixed.

Revenue Recognition Concept   The revenue recognition concept refers to calculating revenues in the period in which they are earned. This means it must be recorded when revenues are earned, when goods are sold and shipped, and when services are rendered and completed. Otherwise, it's unethical and unprofessional.   Example: Some business organizations misapply the revenue recognition concept on purpose to manipulate revenues so management looks good from a financial performance viewpoint. For example, fake shipping documents can be created showing the shipping dates of the few days close to the end of fiscal year so that revenues are recorded in the same fiscal year, although no goods were actually bought by and shipped to a customer in that fiscal year.

Accounting EquationThe fundamental equation used within accounting is

All transactions are analyzed and then recorded based upon their effect on assets, liabilities, and owners’ equity. The increases and decreases in these accounts are recorded as debits or credits. In recording these transactions, the total amount of debits must equal the total amount of credits.

Accounting ApproachesThe US tax code allows cash-basis accounting or accrual-basis accounting as long as either method is consistently used.  With cash-basis accounting, revenues are recognized when cash is received, and expenses are recognized when cash is paid out.  With accrual-basis accounting, revenues are recognized when sales are made or services are performed, and expenses are recognized as incurred. Revenues and expenses are recognized in the period in which they occur rather than when cash is received or paid out.   Accrual-basis accounting is in accordance with accounting standards and is used by many medium-size and large-size corporations. This is because accrual accounting requires expenses to be recorded in the period they're incurred, not when they're paid. Small businesses can use the cash-basis accounting because it's simple and requires less recordkeeping.  Cash-Basis Accounting Requires Less Recordkeeping  Accrual-Basis Accounting Requires More Recordkeeping

Accounting CycleThe accounting cycle records the effect of business transactions upon the assets, liabilities, and owners’ equity of an organization. Consequently, every transaction a business conducts will be entered into the accounting system. From these transactions, financial statements are prepared. Financial statements are reports that summarize the financial status of organizations. The four main financial statements include

Income Statement  After preparing the adjusting entries and posting them to the accountant’s working papers, an income statement is prepared.  The income statement is also known as the statement of income, the statement of earnings, or the statement of operations.  It summarizes the results of an entity’s economic activities or performance for a period of time (for example, an accounting period). It also measures a firm’s profitability over a specific period.  

Company management is concerned with the income statement because it needs to know how efficiently or effectively resources were used during that time period. Investors and creditors also use the balance sheet to evaluate their investments in the company.

Statement of Owner's Equity  Next, a statement of owner's equity is prepared.  The statement of owner's equity may be used in sole proprietorships and small partnerships. Once an entity becomes large and complex or has many shareholders, the statement of retained earnings is created. Both statements have the same purpose--the names reflect the number and kinds of shareholders of the company.  These statements show the difference in owners’ equity over the period of time. Owners want to know how their stake in the company performed based on the company’s net income. This statement tells the reader how much money management is “plowing back” into the business.

Balance Sheet  The balance sheet is prepared after the income statement. The balance sheet is divided into assets, liabilities, and owners’ equity and reflects the balances in these accounts at the end of the year.  The balance sheet reflects the financial health and flexibility of an enterprise.

Statement of Cash Flows  The statement of cash flows requires three classifications:   Operating activities reflects the cash paid and received in the day-to-day management of the business. Cash from customers and cash paid for supplies and salaries are reflected here.   Investing activities reflects how the company is investing in itself. Cash used to build new plants or open new stores is reflected here.   Financing activities reflects how the company is obtaining money from investors or creditors. Outside investments or loans received are reflected here.

Please click here to open a PDF document containing examples of the above financial statements. Use this PDF as a reference when reading the next four slides, which break down the above financial statements in detail.

Income StatementABC Products CompanyIncome Statement For the Year Ended December 31, 2017  Sales– Cost of Goods Sold = Gross Profit– Operating Expenses  = Operating Income – Interest Expenses

 = Net Income Before Taxes – Taxes  = Net Income after taxes – Cash Dividends = Net Income (Loss)

Key Information in the Income Statement   Sales or revenues are charges to customers for the goods and/or services provided during the period. Both gross sales or revenues and net sales or revenues should be presented by showing returns, allowances, and discounts.  Cost of goods sold is the cost of the inventory items sold during the period for a manufacturing or retail company. It includes wages, materials, rent, supplies, and utilities to manufacture goods.  Operating expenses are primary recurring costs associated with business operations to generate sales or revenues. They include selling expenses (such as salesperson salaries, commissions, and advertising) and general and administrative expenses (such as salaries, office supplies, and telephone bills).  Operating income is gross profit minus operating expenses.   Net income or loss is operating income minus interest, taxes, and dividends. Net income is earnings available to common stockholders.

Statement of Owner's EquityABC Products CompanyStatement of Owner's EquityFor the Year Ended December 31, 2017Beginning Owners’ Equity at January 1, 2017 + Additional Investment from Owner  + Net Income / – Net Loss  •         Owners’ Drawing  = Ending Owner’s Equity at December 31, 2017

Key Information on the Statement of Owner's Equity   Beginning Owner's Equity is taken from last period’s Statement of Owner's Equity as a starting point for this year.  

Additional Investment from Owner is the amount paid into the company from the owner for business needs during the year.  Net Income / Net Loss is taken from the current period’s income statement, which is why the income statement is prepared before the Statement of Owner's Equity. How the business performs affects the owner’s financial position.  Owner's Drawing is the amount taken or drawn out from the company by the owner.   Ending Owner's Equity is the addition of all previous items and reflects the owner’s financial position at the end of the period. This amount is then carried forward to next year’s Statement of Owner's Equity.

Balance SheetABC Products CompanyBalance Sheet At December 31, 2017   Assets         CashAccounts Receivable      Inventory      Property, Plant, and Equipment Total Assets (1)                Liabilities & Owners’ Equity  Current Liabilities + Noncurrent Liabilities  = Total Liabilities (2) + Owners’ Equity (3) = Total Liabilities and Owners’ Equity (2 + 3)    Note: Assets (1) must equal Total Liabilities (2) + Owners’ Equity (3).

Key Information on the Balance Sheet  Current Assets include cash balances in bank accounts and any stocks or money market funds held.  Accounts Receivable is the amount expected to be received from customer orders via invoices.  Inventory includes raw materials, work-in-process, and finished goods.    Property, Plant, and Equipment is the amount paid for land, buildings, and machinery.  Current Liabilities include any short-term debts payable by the company due within one year.   Noncurrent Liabilities include bonds or bank loans that are due over one year.  Owners’ Equity is taken from the previous page, The Statement of Owner's Equity, which would have already been prepared.

Statement of Cash FlowsABC Products CompanyStatement of Cash Flows For the Year Ended December 31, 2017Cash Flows from Operating Activities        Cash from Customers – Cash Paid as Salaries and Supplies = Cash Flow From Operations (1) Cash Flows from Investment Activities – Increase in Equipment Costs + Sold Assets and Equipment = Cash Flow from Investments (2) Cash Flows from Financing Activities + Additional Investment from Owner – Cash Dividends= Cash Flow from Financing (3) Net Increase or Decrease in Cash (1 + 2 + 3)     + Cash at the Beginning of the Year = Cash at the End of the Year (must equal the Cash account on the balance sheet)

Key Information on the Statement of Cash Flows  An increase in the asset account or a decrease in the liability or equity account is a use of cash. Similarly, a decrease in the asset account or an increase in the liability or equity account is a source of cash. This can be represented in a table as follows:

Financial Statement AnalysisFinancial statement analysis requires a comparison of the firm’s performance with that of other firms in the same industry, comparison with its own previous performance, or both. Three major parties analyze financial statements from their own perspectives: Managers of the firm assess whether the firm’s resources are utilized in the most effective, efficient, and economical manner. Potential investors who want to invest in the firm use data in financial statements to understand future earnings potential and associated risks. Creditors and lenders (such as bankers) analyze financial data to assess the financial strength of the firm and the ability to pay interest and principal for the money they lent the firm. The real value of financial statements is in their predictive power about the firm’s future earnings potential and dividends payment strength.  Financial ratio analysis shows relationships among accounts in financial statements. While there are numerous ratios, we focus on the following:

Current ratio Inventory turnover ratio Debt ratio Profit margin Price earnings ratio

Current RatioCurrent Ratio Purpose  The current ratio indicates an organization’s ability to pay its current debts with its current assets. Can the organization meet its current obligations?  A current ratio of 1 or greater than 1 indicates a strong liquidity. A current ratio of less than 1 indicates weak liquidity. While a high current ratio is good, it could also mean excessive cash, which may not always be productive.   Both short-term and long-term creditors are interested in the current ratio, because a firm unable to meet its short-term obligations may be forced into bankruptcy. Many bond indentures require the borrower to maintain at least a certain minimum current ratio. Current Ratio Equation

Inventory Turnover RatioInventory Turnover Ratio Purpose  The inventory turnover indicates how quickly inventory is sold. How fast is the organization converting its inventory into sales (and therefore cash)?  Typically, a high turnover indicates that an organization is performing well. This ratio can be used in determining whether there is obsolete inventory or if pricing problems exist. As obsolete inventory increases, inventory turnover decreases.  A high turnover rate is preferred over a low turnover rate because it signals a high movement in selling. Inventory Turnover Ratio Equation

Debt RatioDebt Ratio Purpose  The debt ratio indicates an organization’s ability to withstand losses without impairing the ability to repay its debt. What kind of cushion does the company have to meet its debts in case there's difficulty?  A creditor prefers a low debt ratio since it means there's more “cushion” available to creditors if the organization is unable to pay its debts. High debt ratio indicates the company has too much debt and may have difficulty in paying it off, given its other assets.  Here, total debt includes both current liabilities and long-term debt.

Debt Ratio Equation

Profit MarginProfit Margin Ratio Purpose  Profit margin on sales ratio indicates the proportion of the sales dollar that remains after deducting expenses.    Here, net income after taxes is divided by sales to give the profit per dollar of sales.  A high profit margin shows an organization’s ability to operate efficiently and productively by keeping expenses low in relation to its revenues. Profit Margin Ratio Equation

Price-Earnings (P/E) RatioPrice-Earnings Ratio Purpose  Price-earnings ratio shows how much investors are willing to pay per dollar of reported profits. Financial analysts, stock market analysts, and investors in general use this ratio quite often to determine whether a stock is overpriced or underpriced.  Different analysts have differing views as to the proper P/E ratio for a certain stock or the future earnings prospects of the firm. Several factors such as relative risk, trends in earnings, stability of earnings, and the market’s perception of the growth potential of the stock affect the P/E ratio. Price-Earnings Ratio Equation

Types of CostsCosts have many dimensions to meet specific needs of users and as such are classified into categories: actual costs, variable costs, fixed costs, and overhead costs.

Actual costs are the actual amounts incurred in making a product or delivering a service to customers.     Example: A fast food restaurant receives an invoice from a vendor for $100 for supplies purchased. The $100 is an actual cost, since that's what will be paid to the vendor.     Variable costs are costs that fluctuate and are generally reported as a cost per unit.  Example: Variable costs for a fast-food restaurant would be food costs, food container costs, and the cost of hourly labor preparing the food. The variable costs for large-sized French fries would be greater than the variable costs for small-sized French fries.

Fixed costs are costs that remain constant in total over a period of time.  Example: Fixed costs for a fast-food restaurant would be building rent, the cost of the machines used to cook the food, the cost of the cash registers, and the cost of salaried labor.     

 Overhead costs are considered indirect costs that go into the cost of producing goods and services.  Example: Overhead costs for a fast-food restaurant would be electricity, gas, and insurance.

Breakeven CalculationManagers need to understand the relationship between costs and revenues. A critical calculation is the breakeven point (BEP), which shows the relationship between costs and sales volume on profits.  BEP is the point of volume where total revenues and total costs are equal. No profit is gained or loss incurred at the BEP. An increase in the BEP is a “red flag” for management to analyze all of its cost, volume, and profit relationships more closely. The BEP can be calculated by using an equation method or an accounting-based contribution margin method, because they both yield the same results.

Equation Method  The equation method is more general, and thus it's easier to apply with multiple products, with multiple costs and revenue drivers, and with changes in the cost structure. At BEP, the operating income or loss is zero.              Formula: (Unit sales price × number of units) – (Unit variable cost × number of units) – Fixed costs = Operating income  Or  Sales – Variable costs – Fixed costs = Operating income              Example: Price per unit is $100, variable cost per unit is $60, and fixed costs are $2,000. What's the breakeven point in units?   100 N – 60 N – 2,000 = 0 40 N = 2,000 N = 2,000/40 = 50 units 

Contribution Margin Method   Contribution margin (CM) is the excess of sales over all variable costs, including variable manufacturing, marketing, and administrative categories. BEP is calculated as follows:   Formula:BEP = Fixed costs/Unit contribution margin   Example: Price per unit is $100, variable cost per unit is $60, and fixed costs are $2,000. What is the breakeven point in units?  

BEP = 2,000/(100 - 60) = 2,000/40 = 50 units where $40 is the contribution margin (that is, sales minus variable cost)  Gross margin (GM), also called gross profit, is the excess of sales over the cost of the goods sold. Both CM and GM would be different for a manufacturing company.

Operating BudgetsBudgets are a necessary component of financial decision making because they help provide an efficient allocation of resources. A budget is a profit planning and a resource-controlling tool. It's a quantitative expression of management’s intentions and plans for the coming year(s) to meet their goals and objectives within the resource constraints. Budgets are prepared at the beginning of each year. Departmental or functional budgets are summarized and compared with revenue forecasts and revised as necessary.  A budgeting system includes builds on historical, or actual, results and expands to include consideration of future, or expected, results. A budgeting system guides the manager into the future.

Master Budget

The master budget by definition summarizes the objectives of all subunits of an organization. As the only budget encompassing the entire company, the master budget helps in coordinating activities, implementing plans, authorizing actions, and evaluating performance.  The master budget captures the financial impact of all the firm’s other budgets and plans. Although the master budget itself is not a strategic plan, it helps managers to implement the strategic plans. The master budget focuses on both operating decisions and financing decisions. Operating decisions concentrate on the acquisition and use of scarce resources, while financing decisions center on how to get the funds to acquire resources.  The master budget consists of several individual budgets: Sales budget Production budget Labor budget Purchases (materials) budget Cash budget Budgeted income statement Budgeted balance sheet Note that the sales budget should be prepared first, since it drives all the other budge

Finance Defined

A major purpose of the finance function is to raise funds (sources of funds), spend those funds (uses of funds), and communicate the results of the company to outside parties, like investors and bankers.  The goal of the finance manager is then to manage the money inflows (cash inflows) and money outflows (cash outflows) in a professional manner. The table to the right shows a list of sources of funds and uses of funds.  The finance function deals with how new capital must be raised in the capital markets either through a new stock offer or a new debt undertaking; how that capital must be spent (for example, capital investment projects as listed in a capital budget); and how annual earnings must be distributed to owners and investors in the form of dividends.     It's important for all supervisors, managers, and executives to understand the basics of the finance function in order to perform their job duties better with a clear understanding of how their decisions affect the overall company’s financial position.

Cash ManagementOn one hand, adequate cash serves as protection against a weak economy and can be used to pay off debts and to acquire companies. On the other hand, too much cash makes a firm vulnerable to corporate raiding or takeovers.   Effective cash management is important to all organizations, whether profit- oriented or not. The scope of cash management encompasses cash gathering (collection) and disbursement techniques and investment of cash. Since cash is a “nonearning” asset until it's put to use,

the goal of cash management is to reduce cash holdings to the minimum necessary to conduct normal business.  The following list encompasses the scope of cash management: Developing a cash budget Implementing efficient cash management techniques Establishing controls over cash Developing a schedule showing sources and uses of cash

Cash BudgetPF Knowledge Corporation Cash Budget For The Year Ended December 31, 2017                          Cash receipts Less: Cash disbursements Net cash flow  Add: Beginning cash balance = Ending cash balance  Less: Minimum cash balance required = Cash shortage / Cash surplus  Cash shortage exists when the ending cash balance is less than the minimum cash balance. Cash surplus exists when the ending cash balance is greater than the minimum cash balance.

The cash budget describes cash inflows (cash receipts) and outflows (cash disbursements) in a specific time period, such as a one year, one quarter, or one month. Components of cash receipts include cash sales, collections of accounts receivable, and non-sale related cash (for example, interest and dividends received; cash from the sale of equipment, stocks, and bonds; and lease payments).  However, credit card sales and sales on account are not a part of cash receipts, because they have a time lag and become a part of accounts receivables. Debit card sales are part of cash receipts because cash is immediately deposited into the cash account. Components of cash disbursements include cash purchases; payments of accounts payable; rent, lease, interest, cash dividends, and loan principal; and wages and salaries.  Net Cash Flow = Cash Receipts – Cash Disbursements  Ending Cash Balance = Net Cash Flow + Beginning Cash Balance

Cash BalancesOrganizations have many reasons for holding cash. There are several types of cash balances that satisfy business needs:   Transaction balance. Payments and collections are handled through a cash account. These routine transactions are necessary for day-to-day business operations and to pay bills.       

Compensating balance. A bank requires the customer to leave a minimum balance on deposit to help offset the costs of providing banking services. Some loan agreements also require compensating balances. Compensating balances are reported on the balance sheet either as a current asset or noncurrent asset depending on whether the loan is short-term investment or long-term investment.              Precautionary balance. Firms hold some cash in reserve to accommodate for random, unforeseen fluctuations in cash inflows and outflows. These are similar to the “safety stocks” used in inventories.        Speculative balance. Cash may be held to enable the firm to take advantage of any bargain purchases that might arise. Similar to precautionary balances, firms could rely more on reserve borrowing capacity and on marketable securities than on cash for speculative purposes.   Caution: The total desired cash balance for a company isn't simply the addition of the above four cash balances, because the same money often serves more than one purpose. For example, precautionary and speculative balances can also be used to satisfy compensating balance requirements.

Cash Management TechniquesA cash budget, which shows cash inflows and outflows and cash status, is the starting point in the cash management system.  The techniques used to increase the efficiency of cash management include cash flow synchronization, use of float, speeding collections, slowing disbursements, and transfer mechanism

Cash Flow Synchronization  By coinciding cash inflows with cash outflows, the need for transaction balances will be low.  Example: When a company knows when it will receive payments from customers, it can plan for expenses to be paid accordingly. Synchronizing cash inflows with cash outflows is a good habit for managers and owners to develop.

Use of Float  Float is the difference between (1) cash according to the company’s checking account at the bank and (2) cash according to the company’s accounting system.  There are two types of float:   Disbursement float arises when one makes a payment by check. It's defined as the amount in checks that one has written and that's still being processed. The amount hasn't yet been deducted by the bank from one’s checking account balance.  

Collection float arises when one receives a check for payment. It's defined as the amount in checks that one has received but that's in the collection process. It takes time to deposit a check, for the bank to process it, and to credit one’s account for the amount collected. 

Speeding Collections  Funds are available to the receiving firm only after the check-clearing process has been completed satisfactorily. There's a time delay between a firm processing its incoming checks and in making use of them.     Lockboxes, located at post offices, are used to reduce mail delays and check-clearing delays. With a lockbox, most of the float is squeezed from the cash management systems of both vendor and customer. Elimination of float accelerates cash inflow.   Preauthorized debit (checkless transactions) allows funds to be automatically transferred from a customer’s account to the firm’s account on specified dates. Both mail and check-clearing times are eliminated. Examples include payroll checks, mortgage payments, tax bills, and utility bills.  Debit cards will also speed up the cash collection process, because a customer’s money is taken right away from his or her bank account. Using debit cards is similar to paying with cash.

Slowing Disbursements  Two techniques are available to slow down disbursements: delaying payments and writing checks on banks in different locations.  Delaying payments has negative consequences, such as a bad credit rating. A customer can sue a firm for writing checks on banks in distant locations—playing west coast banks against east coast banks in the United States. Speeding the collection process and slowing down disbursements have the same objectives—both keep cash on hand for longer periods. Slowing disbursements could be unethical, but it isn't illegal.

Transfer Mechanisms  A transfer mechanism is a system for moving funds among accounts at different banks. Two examples of electronic transfer mechanisms are depository transfer checks and wire transfers.   A depository transfer check (DTC) is restricted for deposit into a particular account at a particular bank. A DTC is payable only to the bank of deposit for credit to the firm’s specific account. DTCs provide a means of moving money from local depository banks to regional concentration banks, and to the firm’s primary bank.   A wire transfer is the electronic transfer of funds via a telecommunications network that makes funds collected at one bank immediately available from another bank. The wire transfer eliminates transit float and reduces the required level of transaction and precautionary cash balances.

Managing AssetsManagement of assets includes managing current assets (short-term) and non-current assets (long-term).

Short-term means it takes one year to convert the current assets into cash; conversely, long-term means it takes more than one year to convert the non-current assets into cash. Here, cash is used as the common denominator.  A company’s overall assets can be classified as three assets:

1. Earning assets 2. Nonearning assets 3. Troubled assets

Simply stated, earning assets generate revenues (cash) while nonearning assets don't generate revenues (cash), or generate insufficient cash.     Example 1: For manufacturers and retailers, inventory is an earning asset because it will be sold for cash.   Example 2: Surplus cash that is sitting in a bank account is a non-earning asset because it isn't being put to profitable use for the company.  Example 3: A house with an "underwater" mortgage (a mortgage in which the amount owed is more than the fair market value of the house) is a troubled asset. Due to the difference between the market value of the house and what's owed on the mortgage, it's very hard to sell the house for profit.

On the Job: Case Study: Cash at Apple ComputersRead the following articles about Apple Inc.’s cash account, which is the highest in the world. Then answer the Case Study questions. As you read the first article, notice the tone, and think about what point the author is trying to make with the title of her article. How does she seem to feel about Apple's large cash account? Article 1: http://www.cnbc.com/2015/01/28/apple-cash-enough-to-pay-556-to-every-american.html  Article 2: http://money.cnn.com/2015/07/22/investing/apple-stock-cash-earnings/  Case Study questions:

Why does Apple Inc. generate so much cash? What do you think it should do with its cash? Buy companies? Invest in new products? Create more innovative technology? What would help generate more revenue? What would create positive brand image? Do these articles change your opinion about Apple Inc.? If so, how?

Current AssetsGenerally speaking, current assets are financed with current liabilities, and fixed assets are financed with long-term debt or stock.  

Liquidity is the ability to turn an asset into cash. The components of current assets in the order of liquidity are shown below:    Cash (most liquid) Marketable securities Accounts receivable Prepaid expenses Inventory (least liquid)

Current LiabilitiesMost small firms rely on short-term bank loans to finance current assets, which increases current liabilities.  In part, current liabilities represent current maturities of long-term debt. Large firms usually rely on long-term capital markets, such as stocks. The components of current liabilities are shown below: Accounts payable Accrued wages Accrued taxes Notes payable Current maturities of long-term debt

Working CapitalEvery business organization, regardless of its size, needs a working capital. Working capital (WC) is a short-term cash borrowing to pay for employees' wages and salaries, to make inventory, to pay for operating expenses (buying supplies, maintaining equipment, and the like), and to fulfill other financial obligations (pay taxes, utility bills, dividends, and interest). The WC requirements fluctuate every day, week, month, or quarter.  

  WC is also needed because revenues may not come to the organization in a timely manner to take care of the day-to-day expenses. When a company sells its goods or services to customers on a credit, that sale becomes a receivable to the company. When the customer pays the bill, the company receives cash, and the accounts receivable amount is reduced by the amount of cash received. This creates a receivables time gap for cash. Organizations usually take short-term loans from banks to fill the receivables time gap.   Because current assets fluctuate with sales, managing working capital is important for both large and small firms alike. Working capital means current assets (also gross working capital). Net working capital is current assets minus current liabilities. Working capital management involves the administration of both current assets and current liabilities.

Noncurrent AssetsFor a manufacturing company, noncurrent assets represent a significant amount of money invested in the two major categories of tangible assets and intangible assets:   Tangible Assets From an accounting viewpoint, tangible assets (fixed assets) are a major group of assets called property, plant, and equipment (PPE). PPE includes land, buildings, factories, offices, warehouses, distribution centers, machinery and equipment, furniture and fixtures, and vehicles. These tangible assets are utilized to produce goods and services which, in turn, generate revenues.   Intangible Assets From an accounting viewpoint, intangible assets include patents, copyrights, trademarks, and trade secrets. As long as these intellectual property (IP) assets aren't expired, they continue to generate revenues through licenses and franchises.  

Managing DebtsCapital structure of a firm consists of debt and equity as part of total capital. Debt is the amount of money owed to others, and equity is the amount of money a firm owns, similar to an individual.    Debt is of two types:  Short-term debt  Long-term debt Note that there's a tradeoff between risk and profits in using debt.  Debt maturities affect both risk and expected returns. For example, Short-term debt is riskier than long-term debt because the borrower may not be able to pay the debt back due to cash flow problems. Short-term debt is less expensive than long-term debt because loan processing costs would be lower and because there is less risk involved. Short-term debt can be obtained faster than long-term debt because the eligibility requirements may be less stringent. Short-term debt is more flexible than long-term debt because short-term debt may be unsecured (no collateral required as in credit cards), whereas long-term debt may be secured (collateral required for a home equity line of credit).

Short-Term DebtBy definition, short-term debt (credit) is any liability originally scheduled for payment within one year. The four major sources of short-term credit are accruals, accounts payable (trade credit), bank loans, and commercial paper (promissory notes issued by companies). The order of short-term credit sources is shown below from both cost and importance viewpoints. In the order of importanceA. Trade credit (most important)B. Bank loansC. Commercial paperD. Accruals (least important)In the order of costA. Trade credit (free, no interest paid)B. AccrualsC. Commercial paperD. Bank loans (not free, interest paid)

Long-Term DebtLong-term debt is often called funded debt, a term used to define the replacement of short-term debt with securities of longer maturity. Many types of long-term debt instruments are available, including term loans, bonds, secured notes, unsecured notes, marketable debt, and nonmarketable debt. Here, we will focus on term loans and bonds.        Term Loans

A term loan is a contract under which a borrower agrees to make a series of payments (interest and principal) at specific times to the lender. Most term loans are paid off in equal installments over the life of the loan ranging from 3 to 15 years.   Bonds A bond is a long-term contract (seven to ten years or more) under which a borrower agrees to make payments (interest and principal) on specific dates to the holder of the bond. The interest rates paid on bonds can be fixed or variable (floating rate bonds), though they're generally fixed.

Types of Bonds  A treasury bond (T-bond) has the lowest risk and low opportunity for return.   Indexed bonds are based on an inflation index (such as consumer price index) so that the interest paid rises automatically when the inflation rate rises, protecting the bondholder against inflation.   Zero coupon bonds pay no interest and are offered at a discount below their maturity value.   Junk bonds are a high-risk, high-yield bond issued to finance a leveraged buyout, a merger, or a troubled company. In junk bond deals, the debt ratio is high, so the bondholders share as much risk as stockholders would. Since the interest expense on bonds is tax deductible, it increases after-tax cash flows of the bond issuer.

Managing EquityCommon equity in the balance sheet is the sum of a company’s common stock, additional paid-in capital, preferred stock, and retained earnings. The common equity is the common stockholders’ total investment in the firm. The sources of long-term capital include common stocks, preferred stocks, debt (such as loans, bonds, and notes), leases, and option securities. One use of long-term capital is treasury stock.   Common stock is the amount of stock that a company’s management has actually issued (sold) to public. Common stockholders are the real owners of a corporation.    Preferred stock is a hybrid stock containing both the elements of common stock and debt. Therefore, it can be classified either as a common stock or as a bond. It's issued to raise long-term capital when neither common stock nor long-term debt can be issued on reasonable terms. The dividends on preferred stock fluctuate with changes in interest rates.   Treasury stock is created when a company buys back shares of its own stock from the open stock market. The effects of treasury stock are to decrease the shares outstanding, to increase the earnings per share, and to increase the market price of the stock.

Capital Budgeting Defined

Capital budgeting decisions deal with the long-term future of a firm’s course of action. Capital budgeting is the process of analyzing investment projects and deciding whether they should be included in the capital budget which, in turn, outlines the planned expenditures on fixed assets (noncurrent assets) such as buildings, factories and plants, machinery, equipment, retail stores, warehouses, and offices.   Short-term working-capital decisions focus on increasing current assets, whereas long-term investment (capital budgeting) decisions focus on increasing noncurrent (fixed) assets.   Methods to Rank Capital Investment Projects   Five methods are used to rank capital investment projects and to decide whether or not such projects should be accepted for inclusion in the capital budget: Payback method Accounting rate of return method Net present value method Profitability index method Internal rate of return method.

Payback MethodThe payback period is the expected number of years required to recover the original investment in a capital budgeting project. It's calculated by dividing net investment by the average annual after-tax operating cash inflows.The procedure calls for accumulating the project’s net cash flows until the cumulative total becomes positive. The shorter the payback period is, the greater the acceptance of the project, and the greater the project’s liquidity. Initial investment money can be recouped quickly.

Accounting Rate of Return MethodThe accounting rate of return (ARR) method is based on accounting data and is computed as the average annual profits after taxes divided by the initial cash outlay in the project. This ARR is then compared to the required rate of return to determine if a particular project should be accepted or rejected. Strengths of the ARR method include that it is simple and that accounting data is readily available. Drawbacks of the ARR method include that it does not consider the project’s cash flows, it measures the average rate of return over the asset’s entire life, and that it ignores the time value of money. The formula for this method is:

For examples of the ARR method, please visithttp://www.accountingformanagement.org/accounting-rate-of-return-method/

Net Present Value Method

A simple method to accommodate the uncertainty inherent in estimating future cash flows is to adjust the minimum desired rate of return. Discounted cash flow (DCF) techniques, which consider the time value of money, were developed to compensate for the weakness of the payback method. Two examples of DCF techniques include the net present value (NPV) method and the internal rate of return (IRR) method.   NPV is equal to the present value of future net cash flows, discounted at the marginal cost of capital. The approach calls for finding the present value of cash inflows and cash outflows, discounted at the project’s cost of capital, and adding these discounted cash flows to give the project’s NPV. The rationale for the NPV method is that the value of a firm is the sum of the values of its parts.

For examples of the NPV method, please visit:http://www.accountingformanagement.org/net-present-value-method/

Profitability Index MethodProfitability Index Method   A variation of the net present value (NPV) method is the profitability index (PI) method, also called present value (PV) index. The PI is the present value (PV) of cash inflows divided by the present value (PV) of cash outflows.

As long as the PI is 1.00 or greater, the project is acceptable. For any given project, the NPV method and the PI method give the same accept-reject answer. When choosing between mutually exclusive projects, the NPV method is preferred, because the project’s benefits are expressed in absolute terms. In contrast, the PI method expresses in relative terms.  For an example of the PI method, please visit:http://www.accountingformanagement.org/exercise-5-cbt/

Internal Rate of Return MethodThe internal rate of return (IRR) method finds the discount rate that equates the present value of future cash inflows to the investment’s cost. In other words, the IRR method is defined as the discount rate at which a project’s NPV equals zero.

When a project’s IRR is greater than its marginal cost of capital, it increases the value of the firm’s stock, since a surplus remains after paying for the capital. Similarly, when a project’s IRR is less than its marginal cost of capital, it decreases the value of the firm’s stock, since the project reduces the profits of the existing stockholders.    

The payback method, NPV method, and IRR method all show an investment “breakeven” point for the project in an accounting sense, which would be useful in evaluating capital projects. The IRR method, NPV method, and profitability index consider risk only indirectly through the selection of a discount rate used in the present value computations. For examples of the IRR method, please visit:http://www.accountingformanagement.org/internal-rate-of-return-method/

SECTION 4.2

IntroductionIn Section 4.2, you will learn about human resources, the area of a company that focuses on the employee. Employee hiring and development affects the success of organizations and supports business strategy. Section 4.2 Features Describe the human resource planning process Distinguish between job design, job analysis, and job descriptions Discuss employee recruiting and selecting methods Discuss employee training and development methods Examine the employee performance appraisal process Learn about employee relations and apply them to labor unions

Human Resource Planning ProcessHuman resources (HR) planning is a part of an organization’s strategic planning. The HR planning process is a systematic approach of matching the internal and external supply of people with job openings anticipated over a specified period of time. Specifically, it includes three major elements: Forecasting HR requirements Forecasting HR availability Comparing HR requirements with the availability The outcome of the HR planning process can be either surplus of workers or shortage of workers. The HR management needs to address both of these outcomes.

In forecasting HR requirements, the demand for employees is matched against the supply of employees. If they are equal, no action is necessary.  In forecasting HR availability, the number of employees with the required skills and at the required locations is determined. Prospective employees may be found internally and/or externally. If a shortage is forecasted, the needed employee may come from developing creative recruiting methods, increasing compensation incentives to employees, or conducting special training programs.

 In comparing the HR requirements with HR availability, a situation of surplus or shortage of workers may exist.

Job DesignA job consists of a group of tasks that must be performed to achieve defined goals. A position is the collection of tasks performed and responsibilities assumed by one employee. There should be a definite position for every employee in an organization.    Job design is the assignment of tasks to employees for them to accomplish the stated goals of the job. Job design is the process of determining the specific tasks to be performed, the methods used in performing these tasks, and how the job relates to other jobs in an organization.  Job design should apply motivational theories for improving employee productivity and satisfaction, which are achieved through job simplification, job redesign, job enlargement, and job enrichment approaches. The output of job design work provides core information to conduct a job analysis.

Job Design ApproachesFour job design approaches include job simplification, job redesign, job enlargement, and job enrichment.   Job simplification focuses on task efficiency by reducing the number of tasks an employee must do. When job tasks are designed to be simple, repetitive, and standardized, they lead to job dissatisfaction which, in turn, results in employee boredom, sabotage, absenteeism, and unionization.   Job redesign tries to find a correct fit between an employee’s skills and work requirements to increase job satisfaction. A job is redesigned because the original job design isn't accomplishing its objectives.    Job enlargement increases the number of tasks a worker performs, with all of the tasks completed at the same level of responsibility. Job enlargement provides job variety and challenge and is a response to the dissatisfaction found in job simplification. Job enlargement adds width to a job.   Job enrichment changes the content and the level of responsibility of a job to provide greater control and challenge to the worker. Job enrichment leads to employee recognition, opportunities for learning and growth, decision making, motivation, and job satisfaction.

Job AnalysisA job analysis is the systematic process to determine the knowledge, skills, abilities (KSAs), and duties required to perform a specific job or a group of jobs. Timeliness of conducting the job analysis is critical as new jobs are created and old jobs are redesigned or eliminated.  Job analysis provides a summary of a job’s duties and responsibilities; its relationship to other jobs; the KSAs required; and working conditions under which a job is performed. Job facts are gathered, analyzed, and recorded as the job exists now, not as the job should exist. Industrial engineers and HR analysts often design jobs in terms of determining how a job should exist.  Job analysis is conducted after the job has been designed, after an employee has been trained to do the work, and when that employee is performing the job.  Typically, a job analysis is performed on four occasions: When a job analysis program is initiated for the first time in a company When new jobs are created When current jobs are changed due to new technologies, procedures, or systems When the nature of a job has changed

Several methods exist to perform the job analysis, including questionnaires, observations, interviews, and logs of employees' daily work activities.Different types and amounts of information are needed to conduct a thorough job analysis, including Work activities (procedures used on the job) Worker-oriented activities (actions and communications required for the job) Work facilitating tools (machines, equipment, and work aids) Job-related information (materials processed, products made, services rendered, and related knowledge required) Work performance levels (standards and measurements) Job context (work schedules and working conditions) Personal requirements (experience, education, and training needed)

Job Description and SpecificationsThe output of the job analysis is used as input to prepare job descriptions and job specifications, where job specifications can be a part of the job description document.  The job description document contains the essential functions performed and the tasks, duties, and responsibilities required of the job.  Job descriptions must be relevant and accurate in terms of what employees are expected to do on the job, how they do the job, and the conditions under which the job duties are performed. Both job analysis and job description documents must be shared with the employee and his supervisor to ensure that they are clear and understandable to both parties and to ensure employee empowerment. This sharing will make the employee more productive and cooperative with others.  

The job specification document contains the minimum acceptable qualifications (skills, education, and experience) an employee should possess in order to perform a specific job. Normally, both of these documents are combined into one document with effective date and expiration date listed to identify job changes.  

The following is a list of major reasons for conducting a job analysis and developing job descriptions and job specifications. These major reasons, in turn, become major benefits to all.   Providing input into the HR planning process Providing input into the employee recruitment and selection process Planning employee training and development programs Conducting employee performance appraisals Setting employee compensation systems Developing employee health and safety programs Handling employee and labor relations in terms of promotion, transfer, or demotion Supporting the legality of employment practices to defend decisions involving terminations, promotions, transfers, and demotions

Employee Recruiting and Selecting MethodsRecruitment is the process of attracting qualified individuals on a timely basis and in sufficient numbers to fill required jobs based on job descriptions and job specifications.  The following is a list of sources and methods of recruiting: External recruitment sources include high schools and vocational schools, community colleges, traditional colleges and universities, competitor companies, former employees, unemployed persons, and military personnel.   External recruitment methods include media advertising, employment agencies, company recruiters, job fairs, internships, executive search firms, professional associations, unsolicited applicants, open houses, and high-tech competitions using electronic games.     Internal recruitment sources and methods include job posting, job bidding, employee referrals, and employee enlistment.    Online recruitment sources and methods include virtual job fairs, corporate career websites, blogs, and general employment websites.   Alternatives to recruitment include outsourcing, use of temporary workers or contractors, and additional overtime for current workers to meet short-term workload fluctuations.

Factors Affecting Job Recruiting  External factors such as labor market considerations (demand and supply) and legal considerations such as non-discriminatory practices (giving equal opportunity to all genders, races, and ethnicities) affect an organization’s recruitment efforts.  

Similarly, internal factors such as promotion policies (promotion from within versus hiring externally) also affect recruitment efforts.

Normal Recruiting and Reverse RecruitingNormal recruiting occurs when employers plan to fill their specific job needs with prospective employees. Here, the employer decides which employee to hire.   Reverse recruiting occurs when employees plan to fill their specific job needs with prospective employers. Here, the employee decides what company to work for.  Normal recruiting is traditional, whereas reverse recruiting is modern. The rationale for reverse recruiting is that employees want to make sure that they will like the company before getting a job offer. This requires employees to be highly skilled and competent to create meaningful job options. Skilled and marketable employees will be able to reject companies' job offers that they don't like while pursuing the ones they value.

Recruitment for DiversityRecruitment for diversity focuses on equal employment legislation, which outlaws discrimination of protected-class members in employment based on race, religion, gender, color, national origin, age, disability, and other factors. This requires that recruiters must be trained in the use of objective, job-related standards, such as use of employee selection devices that predict job performance and success.   Normal discrimination occurs when a protected-class member (female, nonwhite, or minority) files a written complaint about a denied job opportunity due to preferences given to a non-protected-class member (male, white, and non-minority) who may be less qualified.   Reverse discrimination occurs when a non-protected-class member (male, white, or non-minority) files a written complaint about a denied job opportunity due to preferences given to a protected-class member (female and minority) who may be less qualified.   Managers are equally vulnerable to judgmental errors in hiring new job applicants. Two types of hiring errors exist:

Yes-hire-error occurs when the employer is hiring a wrong applicant. No-hire-error occurs when the employer is rejecting the right applicant.

Both errors are situations that managers should avoid.

Employee Training and Development MethodsThe goal of employee training and development (T&D) is to improve employee competencies and to increase organizational performance continuously. Competencies are a broad range of knowledge, skills, and abilities (KSAs), traits, and behaviors that could be labeled as hard skills and soft skills. Note that training is different from development: Training provides learners with the KSAs needed to perform their current jobs. Development involves learning and education that goes beyond the current job and prepares employees for future job(s). Employee training focuses on achieving short-term goals. Employee development focuses on achieving long-term goals.  

Both employees and employers benefit when an employee’s personal growth strategies are aligned with corporate strategies. These benefits include greater employee satisfaction (which, in turn, increases customer satisfaction), improved employee morale, higher employee retention, and lower employee turnover.  To achieve these benefits, many firms are becoming “learning organizations” by recognizing the importance of continuous improvement and continuous learning to deliver continuous performance. The learning organization should turn every learner into a teacher and every teacher into a learner to sustain the knowledge levels in the organization.

Several factors impact and are impacted by T&D: Top management support (budget and active role) Commitment from all levels of employees Technological advances (such as the Internet and computers) Organizational complexity (flat versus tall organization structure) Learning styles (such as just-in-time training versus delayed training)Example 1: A company that hires marginally qualified employees needs to plan for extensive T&D programs.  Example 2: A company with competitive pay systems or comprehensive healthcare benefit packages attracts competent employees requiring fewer T&D programs.   

Training and Development ProcessClick each button below to learn about the six steps of the T&D process. 

Determine the specific T&D needs. This focuses on organizational analysis using corporate mission, goals, and plans and HR plans; task analysis using job descriptions; and individual analysis to strengthen the employees' KSAs.

Establish specific T&D objectives. Start with defining the purpose and developing specific learning objectives to achieve organizational goals.

Select specific T&D learning methods including instructor-led courses, case studies, behavior modeling, role-playing, business games, in-basket training, on-the-job training (OJT), job rotation, internships, and apprenticeship training.

Target specific T&D delivery systems including corporate universities, colleges, universities, community colleges, distance learning, videoconferencing, video media, e-learning for online instruction, virtual reality, and simulators.

Implement T&D programs. This task is difficult, as it requires the cooperation of both managers and employees. Managers must try to implement T&D programs on an incremental basis, meaning showing success rates in one area and extending them into other areas of the company. Employees resist training because it implies a change. Employee feedback and record-keeping are vital to correct and improve any gaps in the program.Evaluate T&D programs. Evaluation methods include (1) soliciting the training participants' opinions and suggestions, (2) designing pre-test and post-test control group studies, (3) requesting a 360-degree feedback from managers, employees, trainers, and colleagues, (4) assessing whether stated training objectives have been achieved and job performance has been improved, and (5) benchmarking with other

companies regarding training costs and ratio of training staff to total employees in a department, division, or company. Evaluation must be done objectively.

On the Job:Special Training ProgramsVarious special training programs are identified for supervisors, managers, and employees to avoid potential risks and legal liabilities: Diversity training to handle the protected-class members such as women and minorities properly (This training could reduce glass-ceiling issues. The glass ceiling is an invisible societal barrier that prevents women and minorities from reaching their full potential at the workplace.)    Ethics training dealing with fair play, respecting laws and rules, rewarding ethical behavior, punishing those for unethical behavior, and ways to prevent and detect fraud Telecommuter training dealing with employees working from home where the supervisor’s focus is changed from task-based management to results-based management Customer service training requiring communication and listening skills to handle customers with care Conflict resolution training where conflicts may occur between employees and between customers and employees Teamwork training to teach employees how to work in groups for better performance Empowerment training dealing with problem-solving and decision-making skills, taking responsibility for results, and not abusing the empowerment privilege Anger management training to prevent workplace violence     

Training and Development Methods (1)Several low-cost T&D options are available for employees to learn and develop their job-related and interpersonal skills and to become positive contributors to their personal success (as well as to their employer’s success):

Cross-training covers several tasks within a department, office, or store. Employees can master their own tasks and the tasks of their coworkers in the event that extra help may be needed in the same department or other departments. Cross-training is internal, with the more senior employees being the trainers. This training is appropriate when employee turnover is high and when the vacant jobs can't be filled immediately due to budget cuts.   In-house training is an inexpensive method of training, because many employees can participate at one time. Facilitators for in-house training are internal experts of the training topic.     Outside training involves taking courses outside of the company, either in a local college or at a local training firm. This type of training can be expensive compared to other training methods and should be used only for specialized courses that can't be learned internally.   Brown-bag lunch meetings invite individuals to come voluntarily during lunch time and bring their lunches to eat while participating in the training.

Webinar training provides meetings and presentations conducted online where the trainer guides the course materials. During the webinar, employees are given the choice to ask the trainer questions. The

trainer takes mini-polls at various points during the training to give feedback to participants on issues that they raised. Often, the webinar is archived so that it's available on demand around the clock.     Podcast training uses a series of digital audio or video media files available for download through websites. This is a great tool for employees to attend at various times due to shift work, as they're available on demand for anytime and anywhere learning. It's a good alternative to reading a book or manual.   Videoconferencing allows multiple sites within an organization to connect together at the same time to participate in training events, meetings, or presentations. The training is conducted through video and audio transmissions simultaneously. This method is extremely helpful in organizations with global sites.

Training and Development Methods (2)Several low-cost T&D options are available for employees to learn and develop their job-related and interpersonal skills and to become positive contributors to their personal success (as well as to their employer's success):

Train-the-trainer program means companies send one or two employees to be trained outside on a particular topic. The employees will return back to the company and be expected to train other employees that need the same particular skill or knowledge. The outside-trained employee is labeled as the official trainer and will train other employees in the future.   Training by external experts is a great opportunity for employees working from their homes or onsite at their employers. Sending an expert to train an employee or training through the Internet eliminates the need for travel to training sites, saving time and expense. This training provides in-depth learning on a specific course due to the SME’s expertise.   E-learning occurs when an employee signs up for an electronic or virtual course approved by an employer. The e-learning system allows easy access and creates a record of all the courses taken. Both the employee and employer benefit from the e-learning courses due to savings of time and costs.

Role playing or role modeling is where an employee assumes or acts out a specific job role to understand the behaviors associated with that role. It improves an employee’s interpersonal skills.   In-basket training occurs to determine whether an employee can handle and process all the paper documents crossing an employee’s work desk within a reasonable time.   Email training occurs to determine whether an employee can read and answer all the in-box messages and can give a timely response to all the senders.   T-group training (sensitivity training) is designed to help individuals learn how others perceive their behavior. It's a diversity training course that increases the interpersonal skills of the participants and increases self-awareness and sensitivity to the behaviors and cultures of others. A drawback of sensitivity training programs is that they focus on changing individuals instead of changing the work environment.

Employee Performance Appraisal ProcessSimilar to corporations wanting to grow in sales and profits, employees need to grow personally and professionally to reach their career goals and make a positive contribution to the company they work for. The goal congruence concept is at play here.

  Although both employees and supervisors don't like to give and receive performance appraisal evaluations for delicate reasons, it's a very important part of employee career growth plans. Evaluations can be used in justifying employee termination and promotion decisions, and they help in identifying employee training and development needs.    Characteristics of an effective performance appraisal system include job-related criteria, performance expectations, standardization, trained appraisers, continuous open communications, periodic performance reviews, and due process to appeal appraisal results.   Results from the employee performance appraisal process can be put to several good uses, such as input into the human resource planning, recruitment and selection, training and development, career planning and development, compensation programs, employee relations, succession planning, promotion or demotion, and assessment of employee potential in the company.

Factors Affecting Employee Performance AppraisalsBoth external factors and internal factors can affect an employee’s performance appraisal process. Two external factors include: (1) government legislation requiring non- discriminatory practices to follow and (2) the labor unions preferring seniority as the basis for promotions instead of performance. One major internal factor is the organization’s culture: a non-trusting culture does not encourage high performance.     Employee Performance Appraisal Process   The employee performance appraisal process is divided into a series of steps: identifying specific performance appraisal goals, establishing performance criteria and communicating them to employees, examining employees’ work performed, appraising employees’ performance, and discussing appraisal results with employees.   At the end of a review process with a positive outcome, an employee might receive an increase in pay, a promotion, or both. Promotion costs are expensive, especially if there's a judgment error associated with it. (Supervisors, managers, and executives are equally vulnerable to these judgmental errors.)

Two types of promotion errors can exist: Yes-promote-errors exist if the employer decides to promote when the employee doesn't deserve promotion. No-promote-errors exist if the employer doesn't promote when the employee deserves promotion.    The goal for every company is to minimize both of these errors.

Employee Performance AppraisersTraditionally, only one supervisor or manager was involved in the performance review of his or her employee, conducting one employee at a time in a private setting to keep it confidential. This is called one-to-one review. Now, more and more HR managers require more than one person to review an

employee’s performance for an impartial and unbiased output. This is because the output of the performance review is used to decide salary increases and/or promotions.   Individuals responsible for conducting the employee performance appraisal include immediate supervisors, senior managers, subordinates, peers and team members, and internal and external customers. This is called a 360-degree feedback evaluation method. The biggest risk with 360-degree feedback is confidentiality, whether the evaluation is done internally or externally.       A 720-degree review focuses on the big picture at the company level for all of its employees, not at the individual employee level. The review is all about senior managers and their performance. The participants in the review include senior managers, subordinates, customers, and investors. This is done because senior managers deal more with the external parties than most other employees.

Problems with Employee Performance AppraisalsProblems associated with the performance appraisal process include appraiser discomfort, lack of objectivity, halo/horn error, leniency/strictness effect, central tendency error, recent behavior bias, personal bias (stereotyping), manipulating the evaluation, and employee anxiety.   Halo Error versus Horn Error  Halo error occurs when a manager projects one positive performance feature or incident onto the rest, resulting in a higher rating.  Example: John, an IT analyst, completed a project within the budgeted timeframe just two months before his annual performance appraisal although most of his previous projects were not completed on time. Based on the last project, John's manager gave John a higher rating for the whole year's performance.  Horn error occurs when a manager projects one negative performance feature or incident onto the rest, resulting in a lower rating.  Example: Joe, a finance analyst, completed a project late by one month just one month before his annual performance appraisal although his most previous projects were completed on time. Based on the last project, Joe's manager gave Joe a lower rating for the whole year's performance. Managers should be aware of both types of errors so that they can avoid them.

Employee RelationsEmployees constantly move in and out of an organization—some for good reasons and others for not so good reasons.  Example 1: Examples of employee movements internal to the organization include promotion (upward), transfer of equal level (lateral), transfer of higher level (diagonal), and demotion (downward).  Example 2: Examples of employee movements external to the organization include resignation, termination (discharge), layoff, and retirement. (Demotion can be an alternative to termination.)  

Unfortunately, some employees get into trouble at the workplace due to their unacceptable behaviors. Such employees may need disciplinary actions to bring their behavior to an acceptable condition.

Handling Employee Disciplinary ActionsTo handle disciplinary actions properly, organizations should follow a structured approach in terms of defining specific steps. These steps include setting organizational goals, establishing employment rules, communicating the rules to employees, observing employee actual performance, comparing actual performance with rules, and taking appropriate disciplinary actions. These steps are needed to avoid legal and financial risks.   There are three important approaches available to handle disciplinary actions: Hot stove rule (advance warning) Progressive disciplinary action (minimum penalty) Disciplinary action without punishment (time off with pay) The progressive disciplinary action approach is designed to impose a minimum penalty appropriate to the offenses and requires the employer to follow specific steps in the sequence as shown below:

Employers must be consistent in their disciplinary actions against employees from the beginning to the end. Actions can't be too lenient in the beginning and then suddenly become too strict. Inconsistent action means a long-term employee might receive only a suspension notice whereas a short-term employee might be terminated for the same serious violation.

Employee termination or firing costs are expensive, especially when there is a judgment error associated with it; supervisors, managers, and executives are equally vulnerable to these judgmental errors.  Two types of firing errors can exist:   Yes-fire-error exists when the employer decides to fire the employee who doesn't deserve to be fired. No-fire-error exists when the employer doesn't fire the employee who deserves to be fired.  Many organizations are rethinking their approach to disciplinary actions, deciding to abandon warnings (oral and written) and suspensions (unpaid time off) and going strictly with the disciplinary action without punishment (time off with pay). This rethinking is attributed to reducing legal and financial risks.  

Employee Grievance ProceduresA grievance is an employee's dissatisfaction or feeling injustice relating to his job (for instance, after getting fired). Grievance procedures under a collective bargaining agreement (union organization) are handled differently than in a non-union organization. Arbitrators, mediators, and union stewards are involved in the union organizations to solve the grievance problems.  Non-union organizations are encouraged to develop and implement formal grievance procedures so that an employee can make complaints without the fear of reprisal.

 A sample grievance form can be found at the link below: http://www.samplewords.com/employee-grievance-form/

Employee Dispute Resolution MethodsBoth employees and employers have several approaches to handle work-related disputes arising between them.  The US Office of Personnel Management in conjunction with the US Department of Labor developed alternative dispute resolution (ADR) guidelines to help employers and employees without going to courts, because the court system is costly, uncertain, and untimely.  The ADR is a procedure whereby the employee and the employer agree ahead of time that any problems will be addressed by an agreed-upon means, as follows:    An arbitrator is an impartial third-party person who enters into a dispute case between a labor union and company management for a binding arbitration. He acts as a judge and jury.  A mediator is a neutral third-party person who enters into a dispute case between a labor union and company management when a bargaining impasse has occurred. He acts like a facilitator and informal coach to ensure fair and effective bargaining discussions. Mediation is a voluntary process.  An ombudsperson is a complaint officer in a company who has access to top management and who hears employee complaints, investigates, and recommends appropriate action.

Employee Termination and Resignation ProceduresTermination is the most severe penalty, requiring careful consideration on the part of the employer. Termination of non-managerial and non-professional employees is handled differently from the termination of higher-level executives and middle-level/lower-level managers.  For example, termination procedures for non-managerial employees (such as truck drivers and waiters) are dictated by whether these employees belong to a union.  Usually, executive jobs are protected under a contract, if there is one. They have no formal appeal rights because the termination could be due to valid business reasons (such as economic downturn, reorganization and downsizing, and decline in performance and productivity). However, if an executive is involved in illegal activities such as management fraud or insider trading, he or she can be terminated.  Middle-level and lower-level managers and professionals may be the most vulnerable to termination, unless they belong to a union, because their employment depends on the wills and whims of management.  Resignations occur on a voluntary basis by the employee or as forced by the employer. When an employee resigns on a voluntary basis, the employer must determine the reasons for leaving through the use of an exit interview (before an employee departs) and post-exit questionnaire (after an employee departed).

Exit Interviews and Attitude SurveysExit interviews are face-to-face meetings at the office between HR staff and the departing employee. These interviews identify the reasons for leaving, which can be used to change the HR planning process, modify training and development programs, and improve other areas. A major problem with the face-to-face exit interview is that the departing employee may not tell the interviewer the real reasons for leaving due to their sensitivity.  Post-exit questionnaires are sent to former employees several weeks after they leave the company to determine the real reasons they left, which takes the sensitivity issue out of the equation.    The best way to manage employee relations is to conduct a periodic attitude survey of current employees to determine their feelings, issues, and concerns related to their jobs and to seek their ideas for improvement. The scope of the survey can include nature of the work, supervisor relations, work environment, flexibility in the work schedules, opportunities for job advancement, training and development opportunities, pay and benefits, and workplace safety and security concerns. The results from the survey can benefit the employer in correcting the identified gaps on a proactive basis before the problems get out of hand. If uncorrected, it can result in employees leaving the company.

Labor UnionsCollective Bargaining Due to lack of trust between company management and its labor unions, a bargaining unit is established for a specific group of employees empowered to bargain collectively with their employer. This is called a collective bargaining unit that helps determine wages and working conditions through direct negotiations with the employer. A contract is developed between the labor union and company management describing various provisions and clauses.  Employees who belong to collective bargaining units represented by labor unions can also file grievances over discrimination and reprisal allegations under the terms of collective bargaining agreements. In those situations, the employee must choose to seek relief either under the statutory procedure or under the negotiated grievance procedure, but not both.  Consultation is a clause in labor union contracts or in some state laws applicable to public employees stating that company management must consult the labor union before making any major personnel changes.

Handling Union Member Grievances  A grievance committee is established within the local union to process grievances arising from contract or legal violations.  

A conciliator is an impartial third party who attempts to reconcile differences between labor unions and company management.  Arbitrators and mediators can also be used to address union member grievances.

SECTION 4.3

IntroductionIn Section 4.3, you will learn about the information technology (IT) function. Technology was once applicable to technology professionals and now is relevant to every consumer and employee. Section 4.3 Features Distinguish between the various types of networks available to companies and consumers Differentiate between the various types of network connectivity mechanisms Discuss security threats and vulnerabilities Examine information security controls to deter threats and vulnerabilities Discuss physical security controls to deter threats and vulnerabilities Describe the components of business continuity management

Computer NetworksComputer networks connect different types of computers running on different computing platforms (hardware and software), different sizes of computers (notebooks, laptops, desktops, and mainframes), with diverse operating systems (Mac and PC), different locations (domestic or foreign), and with different configurations and protocols for transmitting data, voice, videos, images, messages, and programs between those computers. Several threats and risks exist for computer networks.  Although there are several types of computer networks available, here we focus only on seven types of networks: Mobile ad-hoc networks Content delivery networks Wireless sensor networks Body area networks Radio frequency identification (RFID) networks Digital cellular networks Cloud computing networks

Fact 1: In November 2014, the Hollywood film division of Sony Corporation was the target of hackers before the release of its film The Interview. It was believed that this hacking was done by North Korean government agents in opposition to the film’s release. Sony’s computer networks were down for more than six weeks after this massive cyber-attack.      Fact 2: In July 2015, computer stock trading at the New York Stock Exchange came to a halt due to failures in its computer networks.   Fact 3: The most common website error is the “404 Not Found Error." This occurs when a user is trying to access a particular webpage that cannot be found on a computer system.

Mobile Ad-Hoc NetworksCustomers now use their wireless devices everywhere they go and expect to have Internet access (in the form of Wi-Fi) wherever they are.  Mobile ad-hoc networks are used on an as-needed or on an on-demand basis and enable customers to use the Internet where they are. Some ad-hoc networks require the customer to login, and some are available without a username and password.  Example 1: Bluetooth has emerged as a very popular mobile ad-hoc network standard.  Example 2: If you go to a café and work on your laptop computer, you're using the Wi-Fi mobile ad-hoc network. The same thing applies when you use your computer at airports.  Example 3: Hotel lobbies and more and more stores let customers use their Wi-Fi networks for free for the time they are in the area.

Content Delivery NetworksContent delivery networks (CDNs) are used to quickly deliver the contents of music, movie, sports, or news from content owners' websites. Consumers now expect to watch or listen to what they want, when they want it, and how they want it. Content delivery networks satisfy this consumer need.  Example 1: Each time you watch an online movie from Netflix or Amazon, you're using a content delivery network.  Example 2: Music streaming services such as Spotify and Pandora enable consumers to listen to music on multiple devices and create customized playlists.

Wireless Sensor NetworksWireless sensor networks (WSNs) are networks of interconnected wireless devices that are in the physical environment, such as buildings and facilities. They monitor physical movement of activity or the physical environment itself.  Example 1: Typical applications of WSNs include monitoring traffic or military activity, protecting physical property, monitoring environmental changes in a building (such as humidity, voltage, and temperature), managing the movement of machinery in a factory, monitoring of vehicle operations (delivery trucks), establishing physical security perimeters for building and facilities, monitoring supply chain management activities, and detecting the presence of chemical, biological, or radiological substances.  Example 2: When wireless sensors are put in commercial delivery trucks, transportation companies have found that their truck drivers are delivering the goods to customers on time. This is because trucking company management is observing the activities and performance of the truck driver via the sensors.

Body Area Networks

A body area network (BAN) is a technology that allows communication between ultra-small and ultra-low-power intelligent sensors/devices that are located on or inside the body. BANs are used primarily in medical devices and sports activity monitoring.  These radio-enabled sensors can be used to continuously gather a variety of important health and/or physiological data (information critical to providing health care) wirelessly.  According to The Massachusetts Institute of Technology (MIT), approximately 300,000 implantable medical devices are implanted into patients each year.   Example 1: Radio-enabled implantable medical devices offer a revolutionary set of possible applications, including smart pills for precision drug delivery and glucose monitors for diabetic patients.  Example 2: Fitness trackers like Fitbit and Jawbone sense a person’s movement, monitor it, and wirelessly transmit it to their computer systems.  

Radio Frequency Identification NetworksRadio frequency identification (RFID) network systems share information across organizational boundaries, such as supply chain applications. RFID systems provide a method for tracking the movement of goods throughout the supply chain. These systems use small tags with embedded microchips containing data about an item and its location to transmit radio signals over a short distance to special RFID readers. These readers then pass the data over a network to a computer for processing the tag’s data.  Example 1: When an RFID tag is attached to a new automobile production in a factory, one can track its progress as it moves from the assembly line to completion stage.  Example 2: When a person enters a hospital, an RFID tag is put on the patient, and the movements of this person are tracked from entry to exit of the hospital.  

Digital Cellular NetworksToday’s digital cellular network systems are used to transmit both voice and data (such as a short message service [SMS] to send and receive text messages). Current digital cellular networks use fourth-generation (4G) networks to send and receive voice, data, video, and images. Voice traffic deals with the telephone traffic, data networks deal with the Internet, and video and images deal with cable television broadcasts or satellite networks.   Example: When you send and receive text messages between you and your friends, you are using the digital cellular networks of two wireless telephone carriers.

Cloud Computing NetworksCloud computing enables consumers to store large amounts of data at a location other than their computer. Previously, consumers stored their files on their computer’s hard drive. Now, consumers use "the cloud” as an extension of their hard drive.   

Example 1: If you're using any of Apple’s products, your emails, phone calls, contacts, text messages, and photos are automatically backed up on its iCloud storage, which helps you access data when your phone is not working.  Example 2: Flickr is an online photo storage site. Instead of storing photos on your computer, you can store thousands of photos on Flickr for free. Other websites like Google and Photobucket also allow for this type of storage. Example 3: Many small businesses use Dropbox to store their computer files. Employees have access to files and can share them easily with co-workers, wherever they are working.

Wired vs. Wireless NetworksAnother way of classifying computer networks is whether they're wired or wireless. Wired networks use cables, routers, adapters, switches, and other hardware devices to connect to the Internet. Wireless networks, on the other hand, connect to the Internet via wireless signals and transmissions. There are five major types of networks, as shown in the following table.

Network Connectivity MechanismsComputers are connected through hardware and software, thereby forming a network. Data then moves from one network to another and within networks.  Business organizations have their own specific networks, where all of the computers are interconnected. Outsiders will not have access to a company’s network unless they are authorized.   Even though there are several types of network connectivity mechanisms available, here we focus only on six mechanisms:

Firewalls monitor incoming and outgoing connections and file transfers. Think of firewalls as the "security guards" of the computer network. A company’s IT staff set up firewall rules to ensure proper connections and access. Hackers often break into companies that have weak firewall rules.  Here are a few examples of firewall rules: Which employees are authorized to access certain company files? Which web pages can consumers access from their computers? Which employees have the authorization to change company files?

Sensors detect intrusions into a company’s computer system from unauthorized users or other threats.  If firewalls are the “security guards” of a computer system, think of sensors as the “security alarm”. They inform IT staff or a user that something is not right.  Examples of sensors include antivirus and anti- spyware software, which are available to companies and individuals.

Switches are used to forward data within a computer system to their destinations. Think of them as the internal “traffic cops” for computer data.  Employees and consumers see the effects when switches don't work as access to critical information or services is severely limited.  Example 1: Computers used by air traffic controllers at major airports occasionally experience computer glitches due to failures in switches, thus preventing flight landings and takeoffs.   Example 2: If switches at a central switching office of a local telephone company have failed, then your landline phones may not work.

Routers are used to forward data across different computer networks. Think of routers as “messengers” who deliver data from one computer network to a different computer network

Routers are located at gateways, which translate data from the sending network to the receiving network. Think of gateways as the “intersection” of two different computer networks, where the “messengers” (routers) pick up the message that needs to be transmitted.  Example 1: When you send and receive emails, email gateways do the work for you to transmit the message from one email system to another.    Example 2: A wireless body-area network can use a wireless network technology as a gateway to transmit information. Through these devices, it's possible to connect the wearable devices on a patient’s body to the Internet. This way, medical professionals (doctors and technicians) in a remote location can access the patient’s data online using the Internet.

A server is the most powerful computer in a particular network. The server stores critical files for the network. Generally, there's a server for each critical business function: an email server, a webserver, and file server.  Small businesses may need 1–2 servers, while large corporations have thousands or servers.

Network Connectivity Diagram Now that you’ve learned the terminology of how computers are connected, take a visual look at network connectivity.  URL: http://diagramo.com/firewall-network-diagram_OLnvgh.html

Security Threats and VulnerabilitiesThere are two important, complicated, and related terms involved with computer security: threats and vulnerabilities.  A threat is any circumstance or event with a potential to adversely impact an organization’s operations (mission, functions, image or reputation), assets, information, or individuals through an information system. Generally, a threat is created because of authorized access to a computer system. Threats result because there is a vulnerability, or weakness, in a computer system.  A vulnerability is a weakness or a security hole in a system’s functions and operations, security procedures, and design and implementation of internal controls that could be exploited or triggered by a threat source.       Threats take advantage of computer vulnerabilities, which create risk for a company.  Risks include Leaked customer and employee information and data (social security numbers, customer credit cards, and employee salaries) Hacking from unwanted sources that leads to work stoppages in manufacturing or communications  

Threat Events and Threat SourcesMany threat events or threat targets are looming around in all organizations, including business corporations; governmental agencies, including defense; industrial control systems; and electric power grid systems.  Many threat sources exist, including malicious software and malicious code (viruses, worms, logic bombs, time bombs, and Trojan horses), mobile code on mobile devices (mobile botnets, mobile applications, exploitation of mobile commerce, exploitation of social media networks, and social engineering), Web browser-based attacks, eavesdropping, and masquerading (impersonating, spoofing, and mimicking) attacks.   Many types of threat agents exist who can initiate threats, including hackers, hobbyists, intruders, criminals, insiders (employees and guests), outsiders (consultants, contractors, visitors, and suppliers), data terrorists, data hijackers, foreign intelligence-gathering agents, and agents of foreign governments.

Malware ThreatsMalware means malicious software. There are two types of threats: Malware threats Non-malware threats Malware threats are more dangerous and serious than non-malware threats.   Malware threats include malicious code, spyware, freeware, shareware, and adware programs. Freeware and shareware by themselves are not threats; they are the means by which malware can be transmitted.  Malicious code refers to computer viruses, worms, Trojan horses, logic bombs, active content, mobile code, and other uninvited software. This malicious code can attack personal computers and other platforms. These malware threats can use an information system’s entry and exit points (such as firewalls, email servers, web servers, proxy servers, and remote-access servers). These malware threats can cause system outages and can bring down the computers. The goal of malware threats is denial-of-service to computer users.   Non-malware threats include virus hoaxes and phishing and pharming. Virus hoaxes come with urgent warning messages about a non-existent virus. In other words, virus hoaxes are false virus warnings. Non-malware threats are not as serious as malware threats.

VirusesA virus is designed to self-replicate—make copies of itself—and distribute the copies to other files, programs, or computers. Viruses come in various sizes and strengths.  Virus writers (hobbyists) create new virus strains frequently, thus nullifying the effectiveness of older versions of antivirus software tools.   There are four main controls that companies use to protect themselves from malware and viruses:  Control 1: Install antivirus software to control viruses and other forms of malware. Antivirus software monitors a computer or network to identify all major types of malware.  Control 2: Update the antivirus software with newer versions. Some virus- specific software may fail to detect recently released viruses.    Control 3: Install antispyware software. Many antivirus software programs also include antispyware.   Control 4: Have strong company policies and procedures in place. These are the first lines of defense against the threat of virus attack.

Worms

A worm is a self-replicating and self-contained program that doesn't require a host program. Worms commonly use network services to propagate other host systems. They search a network for idle computing resources and execute the program in small segments. Worms are more damaging than viruses.   A worm is a program that copies itself from system to system via the network. It exploits weaknesses in the operating system or inadequate system management. Releasing a worm usually results in brief but spectacular outbreaks, shutting down the entire network. The majority of worms infect computers as a result of a user directly executing the worm (that is, by clicking on it).    The following are simple controls against worms:  Don’t click on any attachments or links in email messages or social media sites that don't look familiar. Hackers install worms in places where users wouldn’t necessarily suspect them. Install a firewall on your personal computer as another layer of protection. This is especially helpful if you're accessing your computer at public places like cafés. Have the most up-to-date antivirus software, many of which also detect worms.

Spoofing AttacksSpoofing uses various techniques to subvert the Internet Protocol-based (IP- based) access controls by masquerading as another system by using its IP address. It's an unauthorized use of legitimate identification and authentication data (such as user IDs and passwords) by an intruder to impersonate an authorized user or process to gain access to a computer system or data on it.  Several types of spoofing attacks exist, including IP address spoofing, website spoofing, caller ID spoofing, and email address spoofing. Spoofing is also called phishing and spamming.        Example 1: Using a voice over IP (VOIP), an intruder can launch a caller ID spoofing by forging a caller ID with false names and numbers, which will be difficult to trace.   Example 2:  In email address spoofing, an intruder can fake the “From” field in the email header, which will be difficult to trace.        Control 1:  Implement anti-spoofing methods to prevent the unauthorized use of legitimate identification and authentication data to mimic a subject different from the attacker.   Control 2: Install firewalls and strong identification and authentication mechanisms (that is, the use of strong passwords with frequent changes) to fight against spoofing attacks.

Spamming AttacksA spamming attack is an unwanted, unrequested email. Distributing such email angers most Internet users and has been known to invite retaliation, often in the form of return spamming that can flood and possibly disable the email box of the original spammer.  Spamming is often called electronic garbage and harassment. It also includes mailing of electronic chain letters, sending junk email, and inviting fraudulent money schemes on the Internet.  

A spammer can spoof or falsify some portion of or the entire email header, making it difficult for ISPs and law enforcement authorities to identify the true source of an illegal email message. Hackers use crimeware programming code to launch spamming attacks.  Control 1: Install spam-filtering software by the Internet Service Provider (ISP). All the spam messages sitting in your email inbox somehow escaped your ISP’s spam-filtering software test. Don't open them, even if they sound interesting.  Control 2: Install web-content filtering software to control spamming attacks.  Control 3: Install and manage the spam and spyware protection mechanisms centrally.  

Spyware Attacks

Spyware refers to software and software components that collect information and use connectivity without the users' knowledge, typically to track users’ behavior (such as websites visited) and report it to a central location. Some hackers use spyware kits that even include technical support to launch spyware attacks.  Examples of spyware attacks include a standalone program installed on a user’s system and a tracking cookie placed in a Web browser. Spyware not only violates users’ privacy, but also causes functional problems on systems, such as slowing performance or causing application instabilities. Antispyware software has been created to identify many types of spyware on systems and to quarantine or remove spyware files.  Control 1: Install anti-spyware software to detect both malware and non- malware forms of spyware.   Control 2: Install and manage the spam and spyware protection mechanisms centrally.

Phishing AttacksA phishing attack occurs when a subscriber is lured (usually through an email) to interact with a counterfeit verifier and tricked into revealing information that can be used to masquerade as that subscriber to the real verifier.  It is a form of online identity theft that uses deceptive spam to trick consumers into divulging sensitive or personal information, including credit card numbers and other financial data. It is a digital form of social engineering technique that uses authentic-looking but phony (bogus) emails to request personal information from users or direct them to fake websites that request such information.  Hackers are using phishing toolkits, which are computer scripts that enable a hacker to automatically set up phishing websites that spoof legitimate sites, to launch these campaigns. They also use crimeware programming code to launch phishing attacks.  Controls against phishing attacks include implementation of strong password controls and being vigilant about unauthorized requests for information.

Other AttacksPharming Attacks Pharming uses crimeware software that misdirects users to fraudulent websites or proxy servers, typically through domain name system hijacking or poisoning.  Social Engineering Attacks Social engineering is a general term for attackers trying to trick or coerce people into revealing sensitive information or performing certain bad actions, such as downloading and executing files that appear to be harmless but are actually malicious. It's the act of deceiving an individual into revealing sensitive information by associating with the individual to gain confidence and trust.    There are two types of social engineering attacks: manual and digital. Manual social engineering involves getting system users or administrators to divulge information about computer systems they work on or use, such as passwords and system weaknesses. Personal gains involve stealing and selling data and subverting computer systems. Phishing attacks are an example of using digital social engineering skills.   Controls against social engineering attacks include providing security training to system users and being vigilant about who is requesting information and releasing such information only after thoroughly validating the requested person.

Information Security PoliciesSecurity policies control user behavior when users access and work on computers so that they do not damage computer data files or perform illegal or unauthorized activities.

Access rules describe clear action statements dealing with expected user behavior in a computer system. Access rules reflect security policies and practices, business rules, information ethics, system functions and features, and individual roles and responsibilities, which collectively form access restrictions.   Acceptable use policies require that a system user, an end-user, or an administrator (system, security, and network administrator) agrees to comply with such policies prior to accessing computer systems, internal networks, and external networks (the Internet). Acceptable use is based on authorized access.  Controlling system users means classifying system users into different groups such as super-users, special privileged users, privileged programs, guest accounts, and temporary accounts. A super-user is a user who's authorized to modify and control IT processes, devices, networks, and files. Special privileged users are given permissions to access files, programs, and data beyond normal users, thus creating a security risk. Privileged programs are those programs that, if unchecked, could cause damage to computer files (and some utility programs). Guest accounts and temporary accounts are risky because they aren't deleted even after the work is completed, which is good news for hackers.

Rules of behavior describe the rules established and implemented concerning use of, security in, and acceptable level of risk of the system. Rules will clearly describe responsibilities and expected behavior of all individuals with access to the system. The organization establishes and makes readily available to all information system users a set of rules that describes their responsibilities and expected behavior with

regard to information system usage. The rules of behavior apply to insiders (employees and guests) and outsiders (consultants, contractors, visitors, and suppliers).  Rules of engagement provide IT management with guidelines for consultants and contractors, who provide services to assist in system development, network management, security testing, and other types of work. Rules of engagement (ROE) apply to these outsiders, not to insiders such as employees, in order to establish boundaries (dos and don’ts) for their work. The ROE provides detailed guidelines prior to start of a contractor’s work and gives them a blanket approval of things that they can do and cannot do on the engagement without requiring frequent permissions from IT management.

Password ControlsPassword controls in most public and private organizations are weak or nonexistent because it's a people issue. Strong password methods (such as passphrases, encrypted passwords, and dynamic passwords with challenge-response protocols) are needed to protect against attacks.  Password management may seem simple, but it's not, especially when doing business on the Internet. One should not think that some passwords are less important than others, because all passwords are important to hackers. Some hackers can piece together password-related information stored online and shared on social media networks. Another risk is that some commercial websites give customers the ability to store billing and shipping addresses along with their credit/debit card information. This could lead to identity theft.

Identity Theft ControlsIdentity theft is defined as an illegal act wherein someone steals valuable information from an innocent person. The type of stolen information includes personal information (social security numbers and addresses) bank account information, credit/debit card information, and tax return information (to file for phony refunds). Usually, computers are involved in identity theft.  Because identity theft is a top consumer complaint, the US Federal Trade Commission (FTC) established a website to guide consumers in the event they face identity theft: https://www.identitytheft.gov/. 

Physical Security Threats and RisksA physical security system in a computer center or data center integrates people, policies, procedures, standards, hardware, software, equipment, facilities, and controls to protect an organization’s assets against potential threats and vulnerabilities. The following are some examples of potential threats and risks that can exist if physical security controls over a computer center are lax: Interruptions in providing computer services (for instance, computer processing jobs could be delayed)   Physical damage to computer hardware due to sabotage (hardware needs to be repaired or replaced) Unauthorized disclosure of information due to stealing of data storage media (intruders taking data storage media such as disks) Loss of control over system integrity (an intruder can reboot computer systems, bypass logical access controls, and introduce malicious software such as viruses into a company’s computer systems without anybody knowing it) Physical theft (computer hardware, either in full or in part, can be stolen, resulting in interruption of computer services)

Physical Security ControlsPhysical security controls are as important as information security controls because intruders can walk into a data center, cut cables and wires, damage servers, and destroy computer hardware, thus loosing connections to computers and becoming a major disaster by itself.   It is preferred to deter attacks against property, whether criminal or not. If not deterred, access to selected areas or properties should be denied. If not denied, attacks that occur should be detected. If not detected in time, attacks should be delayed to allow time for response by authorities.   Physical security controls (like basic locks and keys) are the first line of defense against potential risks and exposures, and they're mostly hardware-related. People (employees) are the last line of defense or the best line of defense by questioning strangers and others unfamiliar to them.  This sequence of actions is shown below.

Physical Protection MeasuresThe physical protection measures can be divided into three types: preventive measures, corrective measures, and detective measures.

 Click or tap each of the orange buttons below to learn more about various types of physical protection measures.

Preventive measures reduce the likelihood of a deliberate attack, reduce impact, introduce delays, reduce vulnerabilities, or cause an attack to be unsuccessful.  Example: Examples of preventive measures include (1) physical deterrents such as fences, lighting, physical barriers, access controls, locks, visitor controls, and window grills, and (2) psychological deterrents such as closed-circuit television (CCTV) cameras, employee screening, employee supervision, and visible security officers.

Corrective measures reduce the effect of an attack and restore the facility to normal operation. The corrective action should be in line with the identified threats.  Example: Examples of corrective measures include procedures for monitoring the protection system, assessing the information produced by alarms, and dispatching an appropriate response either through protective force or law enforcement authorities, or a combination.

Detective measures help discover attacks and activate appropriate preventive or corrective measures.  Example: Examples of detective measures include intrusion detection systems, identification badges, access controls, searching equipment by metal detectors, and investigation by protective force. Note that access controls such as doors, keys, and locks are both preventive and detective measures.

Memory Cards and Smart CardsMemory Cards Memory cards are data storage devices that allow storage of information used for personal authentication, access authorization, card integrity, and use of application systems. The card does not process data but serves as a repository of information.   A user presents the memory card to a reader and enters a valid PIN using a keypad or keyboard, which has two levels of security built into it. If the access control application determines that the PIN is valid and corresponds to the memory card presented, then the user is allowed access privileges based on something that the user has and something that the user knows. This is a smart and strong way to prevent unauthorized use.    Smart Cards A smart card is similar to a memory card but better and stronger. The difference between the two cards is that a smart card processes data like a simple computer, with an embedded chip.

Business Continuity Management DefinedOrganizations of all sizes heavily depend on information technology (IT) to run their business functions such as manufacturing, service, marketing, sales, accounting, human resources, finance, and others. These organizations couldn't survive if their computer systems and business systems failed or shutd own for more than a few hours, if at all. The boards of directors and officers of the United States' publicly held corporations are legally liable for gross negligence in not designing, developing, testing, and maintaining disaster recovery plans to provide continuity of business operations. Therefore, in this section, we will focus on how to keep a company’s computer systems running despite major disasters and disruptions.   To ensure the continuity of business operations, all computer-based application systems and business-related information systems must be available at all times to continue normal business operations and to handle and recover from major disasters.   A contingency plan or disaster recovery plan is needed to address an emergency or undesirable event, a security incident (data breach), or a disaster with the potential to disrupt computer operations, thereby disrupting critical business functions. Disruptive events are of three types: man-made, nature- made, or technology-induced.

Example 1: Examples of man-made disruptions include vandalism, terrorism, economic espionage, sabotage, malicious mischief, arson, strikes, riots, and collisions from vehicles, trains, boats, and aircraft.   Example 2: Examples of nature-made disruptions include wind, rain, snow, sleet, lightning, flooding, tidal waves, fire, and earthquakes.   Example 3: Technology-induced disruptions include cyber-attacks by hackers and hobbyists, attacks with the use of malicious software, and power outages at electric utility companies.

Alternate Recovery Site StrategiesBecause the primary computers at data centers of a company are shut down during a major disaster or disruption, organizations need to find out alternate recovery sites (backup computer sites) ahead of time to continue their business operations. These backup sites charge fees for using their data centers. After all the major disruptions are fixed, the backup computer system’s processing is brought back to the primary data centers. Business functional users may not even notice this kind of switching back and forth between the primary computers and backup computers. This is because the switching task is relatively easy and invisible if the backup computers were properly tested before.       The link and the switch between the primary computers and backup computers are shown below.

Alternate Sites

The backup site must be able to support system operations as defined in the contingency plan. The three alternate sites commonly categorized in terms of their operational readiness are cold sites, warm sites, or hot sites, progressing from basic to advanced, as follows:

The hot site is fully ready, the cold site is not ready at all, and the warm site is partially ready. Other variations of the three common sites include mobile sites and mirrored sites with similar core features.   Decision Criteria for Alternate or Backup Sites High-impact systems require mirrored systems with disk replication, high availability systems, and a hot site, a mobile site, a mirrored site, or a combination of these sites. Medium-impact systems require a warm site. Low-impact systems require a cold site or a reciprocal agreement between two similar companies.

Cold SitesCold sites are locations that have the basic infrastructure and environmental controls available (such as electrical, heating, and air conditioning), but no equipment or telecommunications established or in place. There's sufficient room to house needed equipment to sustain a system’s critical functions.   Cold sites are normally the least expensive alternate processing site solution, as the primary costs are only the lease or maintenance of the required square footage for recovery purposes. However, the recovery time is the longest, as all system equipment (including telecommunications) will need to be acquired or purchased, installed, tested, and have backup software and data loaded and tested before the system can be operational. Depending on the size and complexity of a system, recovery could take several days to weeks to complete. The cold site method is most difficult and expensive to test compared to hot or warm site methods.  Examples of cold sites include unused areas of a data center and unused office space (if specialized data center environments aren't required).

Warm SitesWarm sites are locations that have the basic infrastructure of cold sites, but also have sufficient computer and telecommunications equipment installed and available to operate the system at the site. However, the equipment isn't loaded with the software or data required to operate the system. Warm sites may not have equipment to run all systems or all components of a system, but rather only enough to operate critical mission/business functions.  A warm site is more expensive than a cold site, as equipment is purchased and maintained at the warm site, with telecommunications in place. Some costs may be offset by using equipment for noncritical functions or for testing. Recovery to a warm site can take several

hours to several days, depending on system complexity and the amount of data to be restored.  Example:  An example of a warm site is a test or development site that's geographically separate from the production system. Equipment may be in place to operate the system, but would require reverting to the current production level of the software, loading the data from backup media, and establishing communications to users. Another example is available equipment at an alternate facility that's running noncritical systems and that could be transitioned to run a critical system during a contingency event.

Hot SitesHot sites are locations with fully operational equipment and capacity to quickly take over system operations after loss of the primary system facility. A hot site has sufficient equipment, the most current version of production software installed, and adequate storage for the production system data. Hot sites should have the most recent version of backed-up data loaded, requiring only updating with data since the last backup. In many cases, hot site data and databases are updated concurrently with or soon after the primary data and databases are updated. Hot sites also need a way to quickly move system users’ connectivity from the primary site.  This is the most expensive option, requiring full operation of a system at an alternate location and all telecommunications capacity, with the ability to maintain or quickly update the operational data and databases. Hot sites also require having operational support nearly equal to the production location. Recovery to a hot site can take minutes to hours, depending on the time needed to move user connectivity to the new location and make data current at the hot-site location. A hot site is used for short-term needs while a cold site is used for long-term needs.

Mirrored and Mobile SitesMirrored Sites   Mirrored sites are fully redundant facilities with automated real-time information mirroring. A mirrored site (redundant site) is equipped and configured exactly like the primary site in all technical respects. Some organizations plan on having partial redundancy for a disaster recovery purpose and partial processing for normal operations. The stocking of spare personal computers and their parts or LAN servers also provides some redundancy. The following table summarizes the five alternate sites.

Mobile Sites   Mobile sites are self-contained, transportable shells custom-fitted with specific telecommunications and system equipment necessary to meet system requirements. They're alternate recovery sites on wheels.