B4-2 Flashcards
Which of the following statements best describes the importance of segregation of duties?
a.
Good internal control requires that no single employee be given too much responsibility over business transactions or processes. An employee should not be in a position to commit and conceal fraud.
b.
The objective is to encourage any one person from having total control over all aspects of the transaction.
c.
Within the IT department, the duties of system analysts, computer programmers, computer operators, and security administrators should all be the responsibility of one individual.
d.
Segregation of duties is defined as dividing responsibilities for different portions of a transaction (authorization, recording, and custody) for those employees who are on probation.
Choice “a” is correct. Segregation of incompatible duties serves to prevent and detect errors or irregularities.
Choice “c” is incorrect. Within the IT department, the duties of system analysts, computer programmers, computer operators, and security administrators should be kept separate to the most practical degree.
Choice “d” is incorrect. Segregation of duties is defined as dividing responsibilities for different portions of a transaction (authorization, recording, and custody) among several different people or departments.
Choice “b” is incorrect. The objective of segregation of duties is to prevent any one person from having total control over all aspects of the transaction.
All of the following are examples of a decision support system (DSS) except for a:
a.
Sensitivity analysis application.
b.
Financial modeling application.
c.
Database query application.
d.
Transaction processing system.
Choice “d” is correct. Decision support systems (DSS) are computer-based information systems that provide interactive support to managers or others during the decision-making process. Transaction processing systems process data resulting from business transactions (monthly, historical in nature; not predictive).
Choice “b” is incorrect. A financial modeling application is a DSS to assist management in evaluating financing alternatives.
Choice “c” is incorrect. Database query applications are a DSS that read and reorganize data to management’s specifications but do not allow alterations of the data.
Choice “a” is incorrect. Sensitivity analysis is a DSS that uses a “what if” technique that asks how a given outcome will change if the original estimates of the model are changed.
Which of the following information technology (IT) departmental responsibilities should be delegated to separate individuals?
a.
Data entry and quality assurance.
b.
Data entry and antivirus management.
c.
Network maintenance and wireless access.
d.
Data entry and application programming.
Choice “d” is correct. Application programmers should not be allowed to enter data in production systems nor should they have unrestricted and uncontrolled access to application program change management systems. An application programmer is the person responsible for writing and/or maintaining application programs and should not be responsible for also controlling or handling data.
Choice “c” is incorrect. Network maintenance and wireless access are both responsibilities of the Network Administrator.
Choice “b” is incorrect. Data entry and antivirus management can safely be assigned to the same person, as they are not incompatible functions.
Choice “a” is incorrect. Data entry and quality assurance can safely be assigned to the same person, as they are not incompatible functions.
An organization relied heavily on e-commerce for its transactions. Evidence of the organization’s security awareness manual would be an example of which of the following types of controls?
a.
Corrective.
b.
Detective.
c.
Preventive.
d.
Compliance
Choice “c” is correct. Preventive controls are controls that are designed to prevent potential problems from occurring. An organization that relied heavily on e-commerce would probably want as many preventive controls as possible because it might be difficult or impossible to correct errors after the fact.
Choice “b” is incorrect. An organization that relied heavily on e-commerce would probably want as many preventive controls as possible because it might be difficult or impossible to correct errors after the fact. Of course, detective controls should not be ignored because it is difficult to prevent all errors.
Choice “a” is incorrect. An organization that relied heavily on e-commerce would probably want as many preventive controls as possible because it might be difficult or impossible to correct errors after the fact. Of course, corrective controls should not be ignored, because, if errors are detected, they must be corrected properly.
Choice “d” is incorrect. Compliance controls appears to be a made-up term.
Which of the seven distinct information criteria included within the Control Objectives for Information and Related Technology (COBIT) framework includes the idea that information must be accurate and complete?
a.
Integrity.
b.
Reliability.
c.
Efficiency.
d.
Effectiveness.
Choice “a” is correct. The integrity business requirement for information includes the criteria that information be accurate, complete and valid.
Choice “d” is incorrect. The effectiveness business requirement for information includes the criteria that information be relevant to a business process and delivered timely in correct, consistent and usable manner.
Choice “c” is incorrect. Efficiency within the context of business requirements for information concerns delivery of information through the optimal use of resources (e.g., low cost without compromising effectiveness).
Choice “b” is incorrect. The reliability business requirement for information includes the criteria that information be appropriate to operate the entity.
What is the role of the systems analyst in an IT environment?
a.
Designing systems, preparing specifications for programmers, and serving as intermediary between users and programmers.
b.
Developing long-range plans and directing application development and computer operations.
c.
Selecting, implementing, and maintaining system software, including operating systems, network software, and the data base management system.
d.
Maintaining control over the completeness, accuracy, and distribution of input and output.
Choice “a” is correct. In an IT environment, a systems analyst is generally responsible for designing systems, preparing specifications for programmers, and serving as an intermediary between users and programmers. For internally developed systems, the analyst designs the overall application system but when the system is purchased, the analyst becomes a system integrator that adapts system design to processes.
Choice “b” is incorrect. Development of long-range plans and direction of application development and computer operations is undertaken by the Information Systems Steering Committee, not the systems analyst.
Choice “d” is incorrect. End users are typically responsible for maintaining control over the completeness, accuracy, and distribution of input and output, not the systems analyst.
Choice “c” is incorrect. System programmers would be involved in the selection of system software and would be responsible for maintaining system software, including operating systems, network software, and the data management system, not the systems analyst.
Review of the audit log is an example of which of the following types of security control?
a.
Corrective.
b.
Preventive.
c.
Detective.
d.
Governance.
Choice “c” is correct. Audit logs are detective security controls. They are generally chronological records that provide documentary evidence of the sequence of activities that can be used to detect errors or irregularities.
Choice “d” is incorrect. Audit logs do not represent governance security controls. Governance controls typically involve strategic and organizational controls to enhance security.
Choice “b” is incorrect. Audit logs do not represent preventive security controls. The existence of a log does not prevent errors or irregularities, it provides the record necessary to detect errors or irregularities.
Choice “a” is incorrect. Audit logs do not represent corrective security controls. Corrective security controls represent procedures put in place to correct security weaknesses.
What is the primary objective of data security controls?
a.
To formalize standards, rules, and procedures to ensure the organization’s controls are properly executed.
b.
To monitor the use of system software to prevent unauthorized access to system software and computer programs.
c.
To ensure that storage media are subject to authorization prior to access, change, or destruction.
d.
To establish a framework for controlling the design, security, and use of computer programs throughout an organization.
Choice “c” is correct. The objective of data security controls is to ensure that storage media are only accessed, changed, or deleted after appropriate authorization. The objective is to protect information.
Choice “d” is incorrect. Polices establish an overall approach to computer security and are sometimes referred to as the IT security strategy. Data security controls are designed to protect information, not to establish strategy or policy.
Choice “a” is incorrect. Policy support documents, such as procedures, formalize standards, rules, and procedures to ensure the organization’s controls are properly executed. Data security controls may be included in procedures, but development of procedures is not their objective.
Choice “b” is incorrect. Change management and related control activities anticipate monitoring the use of system software to prevent unauthorized access to system software and computer programs.
Which one of the following terms best describes a Decision Support System (DSS)?
a.
Structured system.
b.
Management reporting system.
c.
Interactive system.
d.
Formalized system.
Choice “c” is correct. Decision support systems are computer-based information systems that provide interactive support to managers or others during the decision-making process.
Choice “b” is incorrect. Management reporting systems provide managers with the information needed for day-to-day decision making.
Choice “d” is incorrect. A formalized system is a generic term used to describe any system operating in proper or regular form.
Choice “a” is incorrect. A structured system is a system in which each program within a system is independent of other programs within the system. This enables programming teams to work independently on different programs within the same system.
Which of the following control activities should be taken to reduce the risk of incorrect processing in a newly installed computerized accounting system?
a.
Segregation of duties.
b.
Ensure proper authorization of transactions.
c.
System testing through independent verification of the transaction processing results.
d.
Adequately safeguard assets
Choice “c” is correct. System testing through independent verification of transaction processing results represents one of the most effective methods to reduce the risk of incorrect processing of transactions in a newly installed accounting system.
Choice “a” is incorrect. Although segregation of duties is a foundational control that helps ensure that transactions are not controlled by one individual from beginning to end, the separation of transaction authorization, recordkeeping and asset custodial duties does not reduce the risk of incorrect processing of transactions.
Choice “b” is incorrect. Authorization of transactions is a strong control over the validity or legitimacy of transactions, but does not necessarily reduce the risk of incorrect processing.
Choice “d” is incorrect. Asset safeguarding is an important security measure but does not provide effective reduction of the risk for incorrect processing.
Which of the following statements is correct for application programs and application programmers?
a.
None of the listed statements are correct.
b.
Application programmers should be the only ones allowed to test programs before they are released to production.
c.
Application programmers should be given full write/update access to data in production systems so that data fixes (corrections to production data outside of the normal application programs) can be made quickly with the least amount of paperwork.
d.
If programs are developed internally, a small portion of the overall programming budget will normally be devoted to program maintenance. Program maintenance is quite simple if the programs are written using modern programming techniques.
Choice “a” is correct. None of the statements are correct, making this the only correct choice.
Choice “d” is incorrect. If programs are developed internally, a large portion of the overall programming budget will normally be devoted to program maintenance. Program maintenance is never simple, regardless of how the programs were written. Modern programming techniques may make program maintenance “simpler,” but they will not make it “simple.”
Choice “c” is incorrect. Application programmers should not be given full write/update access to data in production systems. Generally, programmers should only use test data and should not be allowed to modify programs in a production environment. The programmers deal with the programs, not the data.
Choice “b” is incorrect. Application programmers should be allowed to test the programs that they have written because testing is an integral part of program development. However, before a program is released to production, it should be tested by someone other than the programmer who developed it.
Which of the following items would be most critical to include in a systems specification document for a financial report?
a.
Communication change management considerations.
b.
Data elements needed.
c.
Training requirements.
d.
Cost-benefit analysis.
Choice “b” is correct. Data elements should always be included in the system specification document for a financial report. Data elements define the building blocks of the information provided in a financial report.
Choice “d” is incorrect. Cost-benefit analysis would not be included in the system specification document. The determination that the benefits outweigh the costs of a particular system is determined before the development of specifications.
Choice “c” is incorrect. Training requirements would not be included in the systems specification document for a financial report. Training requirements associated with generating the report would be found in an implementation plan, but not in a systems specifications document.
Choice “a” is incorrect. Communication change management considerations would not be included in the specification document for a financial report. Change management contemplates the control monitoring procedures of the system, not the specifications of a financial report.
Stratford Corporation uses a general ledger system that was developed internally in the mid-1970s. It is having more and more problems finding people who can support this system because the system was written in PL/1, a general-purpose language developed by IBM in the 1960s that was a mix of COBOL and FORTRAN and that was not widely used in commercial systems. In addition, the person who designed and wrote the system died of a heart attack in December of 1988. Which of the following statements is correct for Stratford to consider in determining whether/how to replace this system?
a.
If Stratford designs and writes a new general ledger system instead of purchasing a new system from an outside vendor, Stratford will be able to design the system to meet its own specific general ledger requirements.
b.
If Stratford designs and writes a new general ledger system instead of purchasing a new system from an outside vendor, it should purchase life insurance for the major system developers so that it will be protected from future heart attacks.
c.
If Stratford purchases a new general ledger system from an outside vendor, Stratford must rely on the vendor to maintain and support that system.
d.
If Stratford purchases a new general ledger system from an outside vendor, Stratford must customize that system to meet its own specific general ledger requirements.
Choice “a” is correct. If Stratford designs and writes a new general ledger system instead of purchasing a new system from an outside vendor, Stratford will be able to design the system to meet its own specific general ledger requirements, whatever those requirements might be. However, whether Stratford should design the system to meet those requirements is an entirely different question.
Choice “c” is incorrect. If Stratford purchases a new general ledger system from an outside vendor, Stratford may rely on the vendor to maintain and support that system. Note that maintenance and support are two different things. Maintenance is keeping the system “up to date” with new releases from time to time. Assuming that maintenance has been purchased from the vendor, the vendor normally maintains the system. Stratford may or may not even have access to the source code for the programs and thus may or may not be able to maintain it. Support is keeping the system up and running; support includes monitoring the system, determining that a problem has occurred, and fixing or getting around the problem. Support may be provided by the vendor or may be provided by the customer, especially when the system is running in the customer’s environment.
Choice “d” is incorrect. If Stratford purchases a new general ledger system from an outside vendor, Stratford may customize that system to meet its own specific general ledger requirements. However, there is a definite cost associated with such customization. Every time a new version of the purchased system is released, the customization will have to be done all over again. Such repeated work will become expensive over time and will almost certainly delay the installation of new versions. Stratford should really examine its “requirements” for a general ledger system and determine how many of those so-called requirements are actually required.
If there are some “real” specific requirements, these requirements should be considered when the various candidate systems are being investigated in the selection process. The intent, obviously, would be to select the system that comes closest to meeting those requirements. If there are some specific reporting requirements, for example, a reporting mechanism might be able to be added to the system without customizing the core system. So if everything else was equal, the system that should be selected is the system that best accommodates the addition of the reporting mechanism with the least change, and possibly no change, to the core system.
Choice “b” is incorrect. Even if Stratford purchased life insurance for the major system developers, it might be somewhat financially protected from future heart attacks of those developers, but it will not be protected from anything else. The people who design and write systems are often lost, but the cause is more often resigning or being transferred to other projects.
COBIT defines the enterprise architecture for IT as a:
a.
Combination of hardware, networking and system software.
b.
Networking and hardware configuration unique to each installation.
c.
Programming structure that integrates applications.
d.
Combination of IT resources and defined processes.
Choice “d” is correct. IT resources (applications, information, infrastructure and people) along with will defined processes are referred to as the enterprise architecture for IT.
Choice “c” is incorrect. A programming structure that integrates applications is not defined within COBIT.
Choice “b” is incorrect. Networking and hardware configurations are a part of IT infrastructure.
Choice “a” is incorrect. Hardware, networking and system software are part of IT infrastructure.
A fast-growing service company is developing its information technology internally. What is the first step in the company’s systems development life cycle?
a.
Testing.
b.
Analysis.
c.
Implementation.
d.
Design.
Choice “b” is correct. Systems analysis is the first step in the systems development life cycle.
Choice “c” is incorrect. Implementation is the actual installation and use of the system. It occurs near the end of the systems development life cycle.
Choice “a” is incorrect. Testing should occur after programming or purchase of a new system. It would not be the first step in the process.
Choice “d” is incorrect. Design should come after analysis.
