Accounting Software Development

Another thing you should be aware of in accounting systems is that no one should have direct access to the tables. This means all access to the accounting system must be through stored procs. This is prevent fraud not just SQL  injection attacks. An intenal user who wants to commit fraud should not have the ability to directly change data in the database tables, ever. This is a critcal internal control on your system. Do you really want some disgruntled employee to go to the backend of your database and have it start wrting them checks? Or hide that they approved an expense to an unauthorized vendor when they don’t have approval authority? Only two people in your whole organization should be able to directly access data in your financial database, your dba and his backup. If you have many dbas, only two of them should have this access.