ACC 7010 Module 4 Computer Crime and Security Example

Course	ACC-7010 Auditing and Accounting Information Systems
Module	Module 4
Paper type	Module 4 written assignment: pricing security threats and choosing controls
Length	About 719 words, 5 pages
Format	APA 7 student paper
School	Thomas Edison State University
Program	MBA in Accounting
Updated	October 2026

Free sample paper for ACC 7010 Module 4

Pricing the Threat: Computer Crime, Security Controls and a Decision Model for a Distributor's Security Budget

Student Name

MBA in Accounting, Thomas Edison State University

ACC-7010: Auditing and Accounting Information Systems

Mentor Name

Month Day, Year

What this page is doingThe title frames security as a decision with prices attached, which is how the assignment treats it, for the composite company used throughout the course.

Pricing the Threat: Computer Crime, Security Controls and a Decision Model for a Distributor's Security Budget

Introduction

Computer crime includes any illegal act in which knowledge of technology is used to commit, conceal or profit from it. Hurt (2016) frames the accountant's response in terms of controls: preventive controls stop attacks, detective controls find them and corrective controls limit damage and restore operations. Because security spending competes with other investments, management also needs a way to decide how much to spend and where, which is what decision-making models provide.

Part A: Threats Ranked by Expected Loss

Loss estimates include lost margin during outages, recovery costs, payments lost to fraud, notification and legal costs and penalties under hospital contracts. Likelihoods come from industry loss data and the company's incident history, and they are uncertain, so the ranking matters more than the exact totals. Ransomware dominates because a distributor that cannot take orders loses sales immediately and hospitals switch suppliers. The losses extend beyond direct costs: Kamiya et al. (2021) found that successful cyberattacks reduce shareholder wealth, with larger losses when financial information is taken.

Insurance can absorb part of the ransomware loss, though insurers now commonly make multifactor authentication and tested backups a condition of cover.

Threat	Annual likelihood	Loss if it occurs	Expected annual loss
Ransomware halting order processing	15%	$12,000,000	$1,800,000
Credential theft leading to payment fraud	20%	2,500,000	500,000
Insider misuse of customer data	5%	4,000,000	200,000
Compromise through a software vendor	8%	6,000,000	480,000
Total	\|	$2,980,000

Part B: Controls Matched to Threats

These controls also support the Sarbanes-Oxley assessment, because IT general controls over access and change management underpin the reliability of automated controls in revenue and purchasing.

Threat	Preventive	Detective	Corrective
Ransomware	Patching within 14 days for critical flaws; endpoint protection; restricted administrator rights	Endpoint detection and response with 24-hour monitoring	Immutable offline backups; tested recovery plan
Credential theft	Multifactor authentication for email, VPN and the ERP system	Alerts on impossible travel and new payment details	Payment recall procedures with the bank
Insider misuse	Role-based access; least privilege	Logging and review of bulk data exports	Incident response plan with legal counsel
Vendor compromise	Vendor security reviews; SOC 2 reports	Monitoring of vendor connections	Ability to disconnect vendors quickly

What this page is doingPlacing preventive, detective and corrective controls side by side for each threat shows that no single layer is expected to stop an attack.

Part C: Sizing the Security Investment

Gordon and Loeb (2002) modeled the optimal investment in protecting an information set and showed that, for broad classes of breach probability functions, a firm should spend no more than about 37 percent, one divided by e, of the expected loss it is protecting against. The model does not say how much to spend, but it sets an upper bound and makes clear that spending should rise with expected loss and with how much the investment reduces vulnerability.

For Atlantic Coast, 37 percent of the $2,980,000 expected loss is about $1,100,000. The proposed $900,000 budget falls within that bound. Allocating it by expected loss reduction, the first priorities are immutable backups and endpoint detection, which cut ransomware loss most per dollar, and multifactor authentication, which is inexpensive and blocks most credential theft. If these controls cut the ransomware likelihood to 5 percent and halve its impact through faster recovery, expected ransomware loss falls from $1,800,000 to $300,000, which alone justifies the budget.

Part D: A Decision Model for the Audit Committee

A decision table shows management how to respond to an incident consistently:

A quarterly dashboard for the audit committee should report the measures tied to expected loss: percentage of critical patches applied within 14 days, multifactor coverage, results of the last restore test and its recovery time, phishing simulation failure rate and open vendor security findings. Each measure has a target and an owner, so the committee can see whether the investment is lowering risk.

The decision model is reviewed after every significant incident and each tabletop exercise, so that the conditions and actions stay current with the company's systems and contracts.

Condition	Action
Ransomware on one device, contained	Isolate, restore, report to the CIO within a day
Ransomware on servers or several devices	Activate the incident response plan, notify insurer and counsel, brief the audit committee chair within 24 hours
Suspected payment fraud	Contact the bank to recall funds, freeze vendor changes, notify the controller
Customer data exposed	Legal review of notification duties, notify hospital customers per contract

References

Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438-457. https://doi.org/10.1145/581271.581274

Hurt, R. L. (2016). Accounting information systems: Basic concepts and current issues (4th ed.). McGraw-Hill.

Kamiya, S., Kang, J.-K., Kim, J., Milidonis, A., & Stulz, R. M. (2021). Risk management, firm reputation, and the impact of successful cyberattacks on target firms. Journal of Financial Economics, 139(3), 719-749. https://doi.org/10.1016/j.jfineco.2019.05.019

What the ACC 7010 Module 4 instructions ask for

The last assignment treats security as a decision with costs, probabilities and owners. Expect questions that classify computer crimes and attack methods, recommend preventive, detective and corrective controls, connect IT general controls to Sarbanes-Oxley compliance and use decision models, such as expected value, decision tables and dashboards, to support management decisions. Some prompts ask you to evaluate a real breach. Expect to quantify risk before recommending controls. Some versions present a real breach to analyze, asking what controls failed and what a decision model would have suggested, while others ask for a security budget or a decision table.

How the ACC 7010 Module 4 example is put together

The introduction defines computer crime and the three types of control and explains why decision models matter. Part A ranks four threats by expected annual loss in a table and explains where the estimates come from. Part B matches preventive, detective and corrective controls to each threat and ties them to Sarbanes-Oxley. Part C sizes the security budget with the Gordon-Loeb bound and estimates the loss reduction. Part D provides a decision table for incidents and a dashboard of measures for the audit committee. The estimates are stated as ranges of judgment, the Gordon-Loeb bound is used as a ceiling rather than a target and the dashboard measures map back to the threats in Part A.

ACC 7010 Module 4 rubric: what earns full marks

Security analysis is the final written task, also worth 7.5 points. In this assignment mentors check accurate identification of threats, controls that address each threat across prevention, detection and correction, sound use of decision models with clear assumptions and recommendations management could act on. Quantifying risk and linking security to financial reporting controls shows the accountant's perspective. Clear tables and cited research complete the grade. Expected loss estimates with stated assumptions, controls layered across prevention, detection and correction, and a decision model management could use are the elements mentors look for. Connecting IT general controls to financial reporting shows the accountant's view. Mentioning how insurance requirements interact with controls shows awareness of how risk is managed in practice. A budget compared against an economic bound shows judgment.

ACC 7010 Module 4 help: mistakes that cost marks

Security answers lose points by listing controls without tying them to threats, treating security spending as unlimited and offering models without assumptions. Rank threats by expected loss first. Match each with layered controls. State the assumptions behind any model and show how the decision would change if they were wrong. Show the expected loss computation in a table and state where each likelihood and impact estimate comes from. Rank controls by the loss they reduce per dollar spent, and keep the decision table short enough to use in an emergency. A free first sample of your own ACC-7010 Module 4 assignment is available on request.

Write yours, or have the desk draft it

This paper is an original model document written by our desk, not a submitted student paper and not an official Thomas Edison State University document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.

More ACC 7010 and MBA in Accounting sample papers

ACC 7010 Module 4 questions, answered

Where can I find a free ACC 7010 Module 4 sample paper?

The distributor's security assignment is printed above: threats ranked by expected loss, layered controls, the Gordon-Loeb bound on spending and a decision table and dashboard.

How is expected annual loss calculated?

The annual likelihood of an event multiplied by the loss if it occurs, summed across threats.

What does the Gordon-Loeb model suggest?

That optimal security investment generally should not exceed about 37 percent of the expected loss being protected.

What are preventive, detective and corrective controls?

Controls that stop problems, find them after they occur and limit their damage or restore operations.

Why do IT general controls matter for Sarbanes-Oxley?

Automated financial controls are reliable only if access, change management and operations controls over the systems are effective.

ACC 7010 Module 4 Written Assignment: Computer Crime, Security and Decision Models Example