Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Auditing > Auditing In Advanced Information Technology System > Flashcards

Auditing In Advanced Information Technology System Flashcards

1
Q

List the effect of electronic data interchange (EDI)

A
  1. Quick reaction time
  2. Continuous processing
  3. Strict application of condition of payments
  4. Impact on unauthorized access more significant
  5. Increase importance of security control
  6. Computer application must meet interface standard
  7. Certain user controls become obsolete
  8. Lack of paper trails
  9. Human judgement and intervention falls away
  10. Contractual liabilities addressed thru agreements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

List the advantages of EDI

A
  1. Cost saving
  2. Speed increased
  3. Reduced risk of errors
  4. Improved inventory and cash management
  5. Improved trade relation with suppliers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

List the general risks relating to EDI

A
  1. Increased reliance on trading partners
  2. Increased reliance on technology
  3. Less human involvements less chance of detecting errors
  4. Dependency on service provider
  5. Legal risks
  6. Business risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

List the internal risks in EDI

A
  1. Security risks
  2. Implementation risks
  3. Processing risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

List the external risks with EDI

A
  1. Controls at trading partners and VANS
  2. Loss of sensitive data due to unauthorized access
  3. Legislation regarding business transactions
  4. Loss of EDI facility
  5. Error during transmission of data
  6. Manipulation of transaction during transmission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

List the controls for increased reliance on trading partners

A
  1. Development and acceptance of proper contractual data interchange agreement
  2. Good relations between trading partners
  3. Third party review of trading partners on regular basis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

List the controls for increased reliance on technology

A
  1. Hardware and software continuously tested
  2. Strict development standards
  3. Control over physical access to critical hardware
  4. Error correction procedures
  5. Backup
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

List the controls for less human involvement

A
  1. Automated controls
  2. Training on management to understand information and to react timeously
  3. Limits and exception built into trading agreement
  4. Authorization of transaction by users during initial development of the system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

List the controls for dependency on VANS

A
  1. Assess reliability of service provider

2. Contractual agreement with service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

List controls for legal risks

A
  1. Adherence to legal requirement
  2. Contractual rights and obligations must be clearly defined in agreement
  3. Employee bound by code of conduct
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name the control for business risk

A

Information risk management policies and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

List the security risks involved in internal risks

A
  1. General lack of security policy for the organization as a whole
  2. Absence of executive sponsorship for security issues
  3. Security breach due unauthorized access
  4. Manipulation of software applications
  5. Blackmail
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

List the controls for security risk

A
  1. Security policy and procedures implemented and regularly reviewed
  2. Programmed access controls
  3. Audit trails of access to EDI and follow up unauthorized access
  4. Backup, recovery and restoration facilities
  5. Error correction procedures
  6. Physical security
  7. Personnel security
  8. Administrative security
  9. Communication security
  10. Risk management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List the controls for implementation risks

A
  1. Data retention requirements determined in respect of period, medium, legal requirements
  2. Perform risk analysis
  3. Obtaining technical advice
  4. Auditor must be involved
  5. Normal system development procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

List the controls for processing risks in EDI

A
  1. Edit tests by system
  2. Exception reports printed and followed up by management
  3. Sequential numbering and follow up missing items
  4. Reconciliation of control accounts and transactions
  5. Validation tests by system
  6. Transaction logs and audit trails
  7. Division of duties
  8. Protection of data transmitted through encryption
  9. High risk transactions are encrypted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

List the controls for trading partner and VANS

A
  1. Contractual agreement
  2. Good relationship
  3. Third party review
  4. Verify the identity of trading partners
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

List the controls for loss of sensitive data due to unauthorized access

A
  1. Business agreement between partners
  2. Good business relationship
  3. Encryption of transaction and data
  4. Third party review
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

List the controls for EDI facility

A
  1. Regular testing of system
  2. Choice of network supplier
  3. Failover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

List the controls to prevent error during transmission of data

A
  1. Edit tests

2. Parity test by system

20
Q

List the controls to prevent manipulation of transactions during transmission

A
  1. Access controls

2. Encryption

21
Q

List the general controls in an electronic business transaction system

A
  1. System development and implementation controls
  2. System maintenance controls
  3. Organizational and management controls
  4. Access controls
  5. Computer operating controls
  6. System software controls
  7. Business continuity controls
22
Q

List the additional considerations in system development and implementation controls in an electronic business transaction system.

A
  1. Strategic planning to allow for EDI transactions and risks
  2. Risk analysis performed before implementation
  3. Use recognized standards and methodology in development
  4. Planning of a business strategy to accommodate EDI transactions
  5. Contractual agreement covering rights and obligations with trading partners and service providers
  6. Necessity to update accounting processing procedures and controls
23
Q

List the aspects to be included in agreement with trading partners

A
  1. Responsibilities and duties
  2. Security audit
  3. Adequacy of controls
  4. Accountability for the creation, transmission and receipt of messages
  5. The format and frequency of acknowledgement
  6. Backups
  7. Contractual aspects
24
Q

List the additional controls to be considered in the organizational and management control in an electronic business transaction environment

A
  1. Involvement and support by senior management
  2. EDI coordinator/supervisor
  3. Division of duties between authorization and transmission of data
  4. Risk management
  5. All responsibilities and duties regarding the management and protection of data addressed in policy
  6. Regular independent certification of security
  7. Personnel policies
  8. Administrative policies
25
Q

List the additional controls for computer operating controls for electronic business transaction system.

A
  1. Hardware devices validate the source of all incoming messages using recognition codes
  2. Hardware devices confirm the identity of recipient of all outgoing messages
  3. Central computer should pool all remote devices on regular basis
  4. Communication links and network maintenance
  5. Recognition of receipt of data
  6. Correction of error
  7. Backup and recovery procedures
  8. System logs record all incoming and outgoing messages
  9. Line interference protection ensure messages not distorted
26
Q

List the system recovery procedures from operational failure

A
  1. System provide a record of accepted data transfer
  2. Written procedures for the re-transmission of non-accepted data transfer
  3. Controls to prevent duplication following syste recovery
  4. An incident log should be kept of all interruption
  5. Hardware failure, processing switch to alternative terminal or server
  6. Line failure, processing switch to other communication media
  7. Contingency plan tested periodically
27
Q

List the additional controls for system software controls

A
  1. Encryption of sensitive data before transmission
  2. Use of secure server software programs to encrypt all information before transmission
  3. Control in place to protect data against unauthorized manipulation and deletion during transmission and storage
  4. Secure electronic transmission (SET) set up by organization in respect of credit card transactions
  5. Protection of transaction data transmitted by use of digital signature
28
Q

List the additional controls for business continuity controls

A
  1. Contract with service provider/trading partners
  2. Power backup
  3. Communication lines
  4. Hardware
  5. Logging and storage copies of incoming and outgoing messages
  6. Numbering or other forms of systematic storage of incoming and outgoing messages
29
Q

List the programmed application controls for electronic business transaction system

A
  1. Echo checking
  2. Verification of headers, trailers and record counts to ensure completeness of message
  3. Hash values and hash value comparisons
  4. Check digits on control fields
  5. Verification of controls and/or hash totals
  6. Message automatically re-transmitted if any error detected
  7. Verification of proper message structure
30
Q

List the user application controls for electronic business transaction system

A
  1. Authorization of transaction by users
  2. Regular audit trails printout of incoming messages with exception reports
  3. Regular review of audit trails and exception reports by management
  4. Correction of error as soon as possible
  5. Reconciliation of control account
31
Q

List the controls in EFT transactions

A
  1. Master file changes
  2. Execution of payments
    - validity
    - completeness
    - accuracy
32
Q

List the accuracy control in EFT

A
  1. Training
  2. Edit tests
    • format test
    • screen test
    • dependency test
    • limit/reasonability test
    • check digits
    • control totals
    • validity/existence test
    • field size
33
Q

Problem areas in auditing in an EDI environment

A
  1. Transaction are performed and accounted for electronically without paper/documentation
  2. Transaction often take place automatically
  3. Authorized by computer
  4. Large Number of transactions
  5. High risk of unauthorized access
  6. Transaction stored in electronic format
34
Q

List the benefits of trading via Internet

A
  1. Ability to exchange information
  2. Ability to share information
  3. Cost-effective
  4. Marketing, advertising
35
Q

Risks on trading via Internet

A
  1. Security risks
  2. Privacy risks
  3. Hackers, hactivist, phishing, spoofing and spyware
  4. Wireless application
  5. Business continuity risks
  6. Payment via credit card
  7. Accounting risks
  8. Tax and regulation
  9. Outsourcing
36
Q

What are some of security risks of trading via internet

A
  1. Internet protocol carrying no identity enabling Intruders to pose as someone else
  2. Internet not defined with security in mind
  3. No central management of the Internet
  4. Dependence on on appropriate and adequate system design to prevent and detect abnormalities
  5. Dependence on programmed controls to cope with large volume of transactions
  6. Remote transactions initiated by users
  7. Risks relating to managing security ranging from choice of business model at the strategic level to the interface between processes
  8. Failure of encryption based security
37
Q

Name the privacy risks relating to trading via Internet

A
  1. Invasion of privacy may increase

2. Issues concerning payment with credit card

38
Q

List the risks relating to wireless applications

A
  1. Interception of confidential information by unauthorized data
  2. Risk of unauthorized access to computers and servers through wireless connection
39
Q

List the risks with payment via credit card

A
  1. Unauthorized acquisition of credit card information
  2. Claims against the organization where client information is accessed unauthorized users
  3. Risk of bad debts resulting for stolen card
40
Q

List the controls in Internet based system

A
  1. Certification
  2. Authentication
  3. Confidentiality
  4. Credit card
  5. Non-repudiation
  6. Identification and authentication
  7. Privacy policy
  8. Assurance logo
  9. Firewalls
  10. Controls relating to transaction integrity
  11. Controls over master file information
41
Q

List the controls against viruses

A
  1. Software protection
  2. Data file protection
  3. Staff
42
Q

Steps taken to implement software protection controls against virus

A
  1. Purchase from reputable suppliers, program tested before implementation
  2. Care taken when using free or public domain software
  3. Do not lend out removable media devices
  4. Never boot up a hard drive from removable devices
  5. Set anti-virus software to scan before mount
  6. Never use illegal copies of software
43
Q

List the controls for data file protection

A
  1. Sound access controls including firewall
  2. Install virus detection software
  3. Test data for virus before use
  4. Regular backups
  5. Keep removable device set on”write protect”
44
Q

Advantages of outsourcing and using a service provider

A
  1. Division of duties effected through processing being done by third party
  2. Cost consideration
  3. Hardware, resources and expertise are provided by service provider
  4. Reliability of processing
  5. Service provider is likely to have secure control environment
45
Q

Disadvantages of using service providers

A
  1. Dependence on service provider for processing
  2. Loss of control over information processing
  3. Reliability of service provider in respect of processing and safeguarding of integrity of data
  4. Risk of being locked into obsolete technology
46
Q

Factors to be consider when using a service provider

A
  1. Fee structure
  2. Speed of information turnaround
  3. Whether or not the service provider is financially sound
  4. Quality of backups and support available
  5. The service provider’s contingency plan
  6. Service provider’s ability to keep pace with technology
  7. Quality of information available
  8. Implication of management control
  9. Implication of accounting controls
  10. Effect of company’s image

Auditing (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions