Regarding Benihana's information systems, what specific deficiency in user access controls was identified?
Benihana Franchise · 2024 FDDAnswer from 2024 FDD Document
| ● The Company did not design and maintain formal and effective controls over user access to |
|---|
| certain information systems to ensure adequate restriction of users and privileged access to |
| venue level transaction processing applications and IT systems maintained by third parties. |
| As a result, it is possible that the Company’s business process controls that depend on the |
| accuracy and completeness of data or financial reports generated by these information |
| technology systems could be adversely affected due to the lack of operating effectiveness of |
| information technology controls |
Source: Item 23 — Receipts (FDD pages 74–576)
What This Means (2024 FDD)
According to Benihana's 2024 Franchise Disclosure Document, a material weakness was identified regarding user access controls to certain information systems. Specifically, Benihana did not design and maintain formal and effective controls over user access. This deficiency relates to ensuring adequate restriction of users and privileged access to venue-level transaction processing applications and IT systems maintained by third parties.
This lack of control over user access could potentially affect the accuracy and completeness of data or financial reports generated by these information technology systems. The FDD indicates that business process controls that depend on the accuracy of data from these systems could be adversely affected due to the ineffectiveness of information technology controls.
In response to these issues, Benihana states that they have improved control activities related to information technology user access security. These improvements include reviewing and restricting both user and privileged access, enhancing the user provisioning and termination processes, and instituting detailed quarterly security reviews for both in-house applications and IT systems maintained by third parties. Benihana believes these steps have improved the effectiveness of their internal control over financial reporting.