Audit Part I, Section II Flashcards
Absolute Risk
The risk derived from the environment without the mitigating effects of internal controls.
Acceptable Risk
A type of risk that revolves around the business impact that would be experienced if certain risks were realized.
Acceptable risk level
A risk level derived from an organization’s legal and regulatory compliance responsibilities, its threat profile, and its business drivers and impacts.
Active control
A type of control that prevents or detects a deviation from the approved procedure.
Adequate control
A level of control that is present if management has planned and organized in a manner that provides reasonable assurance that the organization’s risks shave been managed effectively and that the organization’s goals and objectives will be achieved efficiently and economically.
Application control
An IT control related to the specific functioning of an application system that supports a specific business process.
Benchmarking
The comparison of an organization or project to similar internal or external organizations or projects, for the purpose of determining areas for potential improvement and to identify best practices. May also be used to assess likelihood and impact of potential events across an industry.
Brainstorming
An activity in which a group generates new ideas; ideas are accepted without criticism and are then evaluated together.
Pervasive Risk
The type of risk found throughout the environment.
Positive conflict
A type of conflict that leads to beneficial results; can transform the way sin which individuals interact and improve the quality of conflict outcomes.
Process-flow analysis
A two-dimensional graphic representation of an operation in terms of the flow of activity through the process. Examines the combination of inputs, tasks, and responsibilities that comprise a process.
Processing controls
Automated error checks built into computer processing as well as segregation of duties such as controlling programmers’ access to files and records. They check that data processing tasks are accurate, complete, and valid.
Residual risk
The risk remaining after management takes action to reduce the impact and likelihood of an adverse event, including control activities in responding to a risk.
Risk
The possibility of an event occurring that will have an impact on the achievement of objectives; measured in terms of impact and likelihood.
Risk analysis
The identification of risk, the measurement of risk, and the process of prioritizing risk or selecting alternatives based on risk.
