7. Control and Accounting Information Systems Flashcards
Explain the goal of internal control concepts
Internal controls are the processes implemented to provide reasonable assurance that the control objectives are met.
What are the three internal control objectives/functions?
Internal controls perform three important functions:
Preventive control
Detective controls
Corrective controls
Explain preventive control
Forebygge
Preventive controls that deter problems before they arise
Explain detective controls
Opdage
Detective control: discover problems that were not prevented
Explain corrective controls
Løse
Corrective control: identify and correct problems and recover
Explain Control Objective for Information and Related Technology Standards (COBIT), is a collection of generally accepted and applicable standards in information technology, prepared by the International Information Systems Audit and Control Association
Tip: security and control framework allows
1. management, 2. user, 3. auditors
COBIT (focus IT): control objectives for information and related technology, a security and control framework allows:
The benefit of a standard framework for IT controls:
- It allows management to benchmark their environments and compare with other organizations.
- Because the framework is comprehensive, it provides assurances that IT security and controls exist.
- Allows auditors to substantiate their internal control opinions.
Explain COSO internal control framework
(A counterpart from COBIT is COSO for financial control).
Tip: guidance and enchancing
Internal Control – Integrated Framework, a framework that defines internal controls and provides guidance for evaluating and enhancing internal control systems
Explain Enterprise Risk Management (ERP)
Used by who and what is it used for?
Enterprise Risk Management adds three layer to the risk management process from the COSO. Used by board of directors and management to set strategy.
How can the organization minimizing uncertainty
Tip: strategic, operations, reporting, compliance
The organizational can minimize uncertainty with
- strategic (goals)
- operations (effectiveness & efficiency)
- reporting (accuracy + completenes + reliability)
- compliance (laws) objectives
Before the risk assessment, managers identify what could go wrong, internal and external, after that:
The factors in risk assessment: likelihood, positive or negativ impacts, effect on other organizational units.
And types of risk, inherent and residual risk.
Explain inherent(before) and residual risk (after).
Remember risk is a difficult job to asses!!
Inherent = susceptibility of risk or significant control problems in the absence of internal control
Residual = risk that remains after implementation of internal control
Remember risk is a difficult job to asses!!!!
How can the management respons to risk?
Four ways management can respons to risk are reduce, accept, share or avoid the risk.
Segregation of duties is spilt into two categories
- Segregation of accounting duties
- Segregation of system duties
Explain the first one about authorization, recording and custodial
Segregation of accounting duties is achieved authorization, recording and custody are separated
Authorization: approving transactions and decisions
Recording: preparing source documents: entering data into the computer and maintaining journals, ledgers, files or databases
Custody: handling cash, tools, inventory, or fixed assets, receiving incoming customer checks, writing checks
Explain segregation of system duties
Tip: authority and responsibility
Segregation of system duties are when implementing control procedures to clearly divide authority and responsibility within the information system.
The text book listed many examples including; system administrator, network management, security management etc. on page 241.
What is a primary objective of an AIS
Tip: proactive means creating or controlling a situation rather than just responding to it after it has happened.
To enable control of the organization so the organization can achieve its objectives.
Management expects accountants to:
Take a proactive approach to eliminating system threats.
Detect, correct, and recover from threats when they occur.
Tell about SOX
Tip: publicly held companies and their auditors
prevent, transparency, protect, strengthen and punish.
SOX is legislation passed (2002) applies to all publicly held companies and their auditors to:
Prevent financial statement fraud Financial report transparency Protect investors Strengthen internal controls punish executives who perpetrate fraud
