Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BEC IV > 1. Information Technology Governance > Flashcards

1. Information Technology Governance Flashcards

1
Q

What are 3 steps of manual AIS (accounting information system) and corresponding automated AIS term for each step?

A
  1. Journalize: record entries = input
  2. Post: to general ledger = process
  3. Summarize: prepare a trial balance = output
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are 3 steps of automated AIS?

A
  1. Input: record or capture event data in system, (input to storage)
  2. Process: update data storage
  3. Output: retrieve master data from storage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are 4 main categories of AIS accounting records?

A
  1. Source “documents”/data capture
  2. Data accumulation records/journals
  3. Subsidiary ledgers/registers
  4. General ledger, FS, reports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the least predictable element in most accounting systems?

A

People.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are 5 elements of accounting systems?

A

People, procedures, hardware, software, data (automated or programmed controls increasingly important)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are 2 elements of manual accounting systems?

A

People and procedures (manual controls still relevant).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is manual historically and now?

A

H: An AIS with no computers.
N: Instructions for users (user procedures manual, operations manual)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are 6 potential differences between manual and computer system controls?

A
  1. Segregation of duties
  2. Audit trail
  3. Transaction processing
  4. Computer initiated transactions
  5. Risk of errors and defalcations
  6. Management review
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe manual and computer system controls in each 6 elements.

A
  1. Segregation of duties
    M: Possible in medium to large organizations
    C: Combine previously segregated functions, include compensating (automated) controls
  2. Audit trail
    M: Physical (paper) trails
    C: Electronic audit trails
  3. Transaction processing
    M: More clerical errors
    C: Potential for systematic (logic) errors
  4. Computer initiated transactions
    M: None = less efficient
    C: Increase efficiency
  5. Risk of errors and defalcations
    M: no remote access, paper records, manual processes, separate functions
    C: Remote access risk, data concentration, less human observation, manipulation of errors in application programs
  6. Management review
    M: Isolated data = not useful for analytics
    C: Greater data accessibility, embedded controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are 4 risks in computer-based systems?

A

Systems, programs, and people (FUNI)

  • Reliance on Faulty systems or programs (F)
  • Unauthorized changes in master files, systems, or programs (U)
  • Failure to make Needed changes (N)
  • Inappropriate Intervention (by people) (I)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is IT security goals?

A

Security, availability, processing integrity, confidentiality, privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is COBIT?

A

The Control Objectives for Information and Related Technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of COBIT?

A
  • Align IT and business goals/strategies.
  • Link business risks, controls needs and IT.
  • Common language for users, auditors, management, and business process owners in identifying risks and structuring controls.
  • Provide framework: how much IT security must management invest in? - IT security and control. Auditing and oversight.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the framework flow of COBIT?

A

Business requirement - IT resources - IT processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is COBIT framework definition?

A

To provide the information that the organization needs to achieve its objectives, IT resources need to be managed by a set of naturally grouped processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why is COBIT framework needed?

A

Process orientation to exercise responsibilities, achieve goals and manage risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

COBIT framework: what are 7 criteria for business objectives?

A

Effectiveness, efficiency, confidentiality, integrity, availability, compliance, reliability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

COBIT framework: What are 5 IT resources?

A

Data, application systems, technology, facilities, people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

COBIT framework: what are 4 IT processes?

A

Plan and organize, acquire and implement, deliver and support, monitor and evaluate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the difference between COSO and COBIT and what are both focusing on?

A

COSO: Organizational control and processes
COBIT: IT controls and processes
Both: focus on monitoring of organizational processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

COBIT process: monitor and evaluate: What are 2 activities?

A
  • Regularly assess IT processes for quality and compliance

* Includes management oversight of control process and independent assurance

22
Q

COBIT process: monitor and evaluate: what are 4 processes?

A
  • Monitor the process
  • Assess internal control adequacy
  • Obtain independent assurance
  • Provide for independent audit
23
Q

What are 3 major components of the COBIT model?

A

Domains and processes, information criteria, IT resources.

24
Q

What is ERP?

A

Enterprise-wide or Enterprise Resource Planning.

25
Q

What are the goal of ERP?

A
  • Integration: management support, knowledge work support, and operational support into one system
  • Cost savings: reduce system maintenance costs
  • Employee empowerment: improves communication and decision making by increasing information availability
  • Best practices: Include most successful business processes of an industry
26
Q

ERP: what is a typical architecture? Current?

A

Typical: client/server network configuration
Current: Internet-and-intranet-based

27
Q

What is an example of ERP architecture?

A

2-or-3-tier architecture: 3-tier separates application and database functions (needed in large or complex systems).

28
Q

How is ERP systems typically purchased? What is this practice called? What is required when using this practice?

A 
in modules (e.g. sales, logistics, planning, financial reporting).
Called choosing "best of breed" components.
Requires building "bridges" between systems from different vendors.
29
Q

What is OLTP?

A

Online transaction processing system: one of ERP modules that include core business functions: sales, production, purchasing, payroll, financial reporting etc.

30
Q

What is OLAP?

A

Online analytical processing system: Data warehouse and data mining capabilities within ERP.

31
Q

What is cloud-based systems and storage?

A

A virtual data pool often managed by a third party vendor.

32
Q

What is IaaS?

A

Infrastructure as a Service: Access to virtual hardware (Amazon Web Services and Carbonite).

33
Q

What is Paas?

A

Platform as a Service: Access to operating system and related services including development (Salesforce.com’s Force.com).

34
Q

What is SaaS?

A

Software as a Service: Access to software (Office 465, Google docs).

35
Q

What are 4 clouds deployment models?

A
  • Public Clouds: available to public or large industry group, owned by an organization selling cloud services (Google, IBM, Microsoft etc).
  • Private Clouds: For one organization, maybe outsourced on or off site.
  • Community Clouds: shared by common users for one organization (e.g. municipal governments, an industry association, related to compliance requirements).
  • Hybrid Clouds: two or more of the above with partitions between types of services.
36
Q

Cloud-based systems and storage: what are 6 benefits?

A
  1. Universal access: system data is available at any site with Internet access
  2. Cost reduction: Eliminate multiple systems, pay-for-use “demand” pricing, no or low fixed costs
  3. Scalability: grow with organization
  4. Outsourcing and economies of scale: outsource to provider with lower costs
  5. Enterprise-wide integration: synergies with ERP
  6. Deployment speed: outsourcing often much faster than insourcing
37
Q

Cloud-based systems and storage: 5 risks?

A
  1. Data loss: Increase risk of data loss and outages.
  2. Increase system penetration risk.
  3. Vendor failure risk
  4. More vulnerable to actions by other tenants for data stored in community and public clouds
  5. Storing data with a high-profile cloud service provider can make one a high profile target for cyber attackers
38
Q

What are IT dept risks?

A
  1. Physical asset theft and destruction

2. Intellectual property (IP) (software) risks: theft, undetected alteration, destruction

39
Q

IT dept: What are common functions?

A
  • Built applications
  • Support the delivery of IT services in the organization
  • Manage database, data stores, and data archives
40
Q

IT dept: what is CIO? What does she do?

A

Chief Information Officer.

  • Oversees IT dept
  • In some organizations, vice president of information technology or chief technology officer (CTO)
  • Generally reports to the chief executive officer (CEO)
  • Responsible for existing and future systems
  • Accountable for organization’s hardware and software operations
41
Q

IT dept: what are 3 functions that must be segregated?

A
  1. Application development
  2. Systems administration and programming
  3. Computer operations
42
Q

IT dept: what are the roles for 3 main functions?

A
  • Application development: safeguards assets (applications in development: create/maintain = done in a test environment. Use non live copies of programs)
  • Systems administration and programming: grant authorization (access), maintain computer hardware and computing infrastructure.
  • Computer operations: execute events, safeguard archived IP, day-to-day operations of systems.
43
Q

IT dept: Application development: what are 2 key roles?

A
  • System analysts: analyze and design new systems, lead teams of programmers, partner with end users to define problems and solutions.
  • Application programmers: write application programs under the direction of system analyst, work in a test environment, must not have access to live copies of program or archived software.
44
Q

IT dept: Systems administration and programming: key roles?

A
  • System administrators (e.g. database administrator, network admin, web admin).
  • System programmers: maintain operating systems and related hardware (e.g. new software and hardware releases), must not have access to programs under development or archived software.
45
Q

IT dept: computer operations: what are examples?

A

Batch input, data conversion, scheduling computer activities, run programs, printing and/or distributing output, system backup

46
Q

IT dept: computer operations: roles?

A
  1. Data control (clerk): control document flows, schedule batches for data entry and editing, reconcile control totals (reconciling + authorizing function)
  2. Computer operators: operate the (main frame) computer, load program and data files, run programs (execute transactions)
  3. File librarian: maintain files and data that are not online in file library, check files in and out to support scheduled jobs.
47
Q

IT dept: how is segregation of duties selected?

A

Software identifies roles and creates matrix of needed segregations - semi automated process that is driven by a large complex spreadhseet.

48
Q

IT dept: who has access to live system?

A 
Computer operators (live programs + data).
Systems programmers (live systems).
49
Q

IT dept: who has access to application programming?

A

Application programmers, system analysts, data administrator.

50
Q

IT dept: who has access to systems programming?

A

Systems programmers (live systems).

51
Q

IT dept: what is the weakest security element? What can the dept do?

A

Users.

  • Must communicate evolving threats and risks.
  • Monitor user’s security compliance
  • Targeted security education
52
Q

IT dept: what are some procedures re: termination?

A

Clearly specified procedures especially for involuntary terminations.

  • Disable username and keycard before notification
  • Escort terminated employee from building

BEC IV (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions