55E - RESO - AGMT - DEPOSITORY SRVS

Home Browse Search

J.P. Morgan's Response to Clarification Questions for the City of Santa An RFP No. 16 -111 Banking Services 1. In terms of Internal Audit Controls, do you have Audit and Event Log reports available on your system? If, so please provide a copy of a report sample and include in demonstration. J.P. Morgan ACCESS does provide an Audit and Event Log under the Tools menu available from any screen within the system. Our Audit and Control Logs allow you to perform searches based on individual or a group of users by a specific date range with a variety of filters including product type (Checks, Reports, Payments, etc.), detail type (Imported File, Report Type, etc.), and event /activity type (File Format, Report Name, etc.). Results can be viewed online or downloaded PDF, Excel and CSV format This process will be reviewed during the demonstration; we have also attached a screenshot in the appendix of this document for your reference. 2. Describe how your system safeguards against an individual user, including an administrator, from J.P. Morgan ACCESS automatically prevents a single user from performing all actions (create, approve and release) on a single payment, even if the user is entitled to create, approve and release. For those functions that demand an extra level of security, ACCESS provides two - factor authentication via RSA SecurID® token technology. The City can setup ACCESS with strict controls over user access to functions and accounts. This also helps to enforce compliance with internal audit requirements while enhancing security. Some of the available fraud prevention options include: • Enabling IP filtering to restrict access by limiting authorized users' ability to log on from only IP addresses you designate. • Customizing the payment approval process by creating rules that determine the number and identity of approvers for different types of transactions, including separate approval rules for repetitive templates and free form wires, as well as the order in which that review must occur. • Separating duties, accounts and approval workflows, the City can help reduce the risk of fraud or compromised data. The City's security administrators are the only individuals able to assign users with transaction initiation privileges. • Limiting each ACCESS user to a single, designated computer. • Establishing transaction and daily aggregate limits at the account and user level. • Creating templates with payment details to prevent wires from being initiated and executed without prior approval of the recipient bank account numbers and template details. We will address the process of entitling users for electronic payments during the demonstration. 55E -296