Our team -
I work in financial and operational reporting as one of a team of 3 -- I'm not an accountant or in the finance function as such, it's more like Management Information (or Business Intelligence). We pull out numbers for senior managers and do daily reporting and stuff.
To do the reporting we have "view" access to operational systems (ie. the actual customer relationship information, accounting ledgers, etc) and our role is just to pull information from these systems and collate 'Management Information' reporting through the systems we maintain.
For example if we were Amazon (we're not) we would have access to the "customer orders" database etc. We'd update a daily report including something like "Total dollar amount of orders, number of orders, number of unique customers, number of repeat customers, number of returned items... etc etc"
There's an automated process that pulls the information daily, and through which we write "one off" queries as well.
I found potential security problems...
About a year ago I discovered that due to the way the system is set up with usernames etc, an automated account (used for reporting) inadvertently has access to update those operational systems (where it has no business doing that) and someone on the reporting side, if they knew that that was the case and were so inclined, could log in and write a query to "delete all of John Smith's orders" (or something more destructive, they could even delete all the Orders if they wanted!)
I have raised this and so have my co-workers many times to our managers (who have come and gone), senior managers, legal/compliance people who didn't seem to understand the risk or didn't have enough knowledge to see that it was relevant, etc. Every time we have received responses like "don't bother your pretty little head with that!" -- but I know it is a huge hole in the system.
We've got auditors in
Now we have an imminent audit (not related to this issue, it's just a part of the business cycle) in which the auditors will be talking to people around the business including me or someone else in my team (among many others) about things like "ensuring integrity of financial information".
I know the usual rule when dealing with auditors is to answer honestly, but don't volunteer information outside of what they ask (and I understand the reasons for that).
In this situation could/should I "let slip" to the auditor that we follow xyz process to ensure the daily figures match up to the operational system etc etc.. but there's this account that actually has "UPDATE" access to the operational system which is used to do that and I see that as a vulnerability?