CH 9+10 Flashcards
Why is an understanding of internal control important?
Understanding internal control is critical because it helps ensure quality of information, efficient operations, security over assets, and compliance with regulations.
What are internal controls? How does the Sarbanes-Oxley 404 view of internal control over financial reporting differ?
Internal controls are processes designed to provide reasonable assurance regarding financial reporting, operational efficiency, and regulatory compliance. Sarbanes-Oxley 404 requires management and auditors to assess and report on the effectiveness of internal controls over financial reporting.
How does an error compare and contrast to an irregularity in financial reporting?
An error is an unintentional mistake in financial reporting, while an irregularity is a deliberate act of fraud or misrepresentation.
What is the COSO (2013) framework? What is it used for?
The COSO (2013) framework is a model for designing and evaluating internal controls. It is used to ensure the effectiveness of internal controls in achieving financial reporting accuracy, operational efficiency, and regulatory compliance.
What are the components of the COSO framework?
The five components are:
- Control Environment – Ethical culture, governance, and accountability.
- Risk Assessment – Identifying and evaluating risks.
- Control Activities – Policies and procedures to mitigate risk.
- Information & Communication – Effective data flow and reporting.
- Monitoring – Continuous assessment of controls.
Provide three examples of control activities. What activities should be segregated?
Examples:
- Authorization procedures.
- Reconciliation of accounts.
- Physical asset security.
Segregation of duties should be applied to authorization, recordkeeping, and custody of assets.
How does the control environment affect the effectiveness of control activities?
A strong control environment enhances effectiveness by promoting ethical behavior and accountability, while a weak environment can undermine controls.
How do ethical values affect internal control over financial reporting?
Ethical values ensure integrity in financial reporting. The SEC emphasizes corporate ethics, and organizations can measure them through audits, surveys, and monitoring of compliance programs.
What is risk assessment, and how does it relate to the COSO (2013) framework?
Risk assessment is the identification and evaluation of risks that may impact an organization. It is a key component of COSO and helps determine necessary internal controls.
What is monitoring, and how does it relate to the COSO (2013) framework?
Monitoring is the continuous assessment of internal controls to ensure they function properly. It differs from control activities as it focuses on oversight rather than execution.
What are management’s responsibilities under Section 404 of the Sarbanes-Oxley Act?
Management must assess and report on the effectiveness of internal controls over financial reporting.
What are the inherent limitations of a “perfectly” designed internal control system?
No system is perfect due to human error, collusion, management override, and evolving risks.
What is the main difference between application and general IT security controls?
Application controls focus on transaction-level security, while general controls apply to the overall IT environment, such as network security and access management.
What are the three types of application controls? Provide an example.
- Input controls – Validity checks on entered data.
- Processing controls – Ensuring calculations are performed correctly.
- Output controls – Restricting access to reports.
What is phishing, and why is it a threat?
Phishing is a cyberattack where attackers trick users into providing sensitive information. It threatens data security and financial integrity.
What is ransomware, and why is it harmful to businesses?
Ransomware is malicious software that encrypts data and demands payment for decryption. It disrupts operations and leads to financial losses.
Why is encryption used in accounting?
Encryption protects sensitive financial data from unauthorized access and ensures data integrity.
What is patch management?
Patch management is the process of updating software to fix security vulnerabilities and improve system performance.
What is a disaster recovery plan? Are they necessary? What should be included?
A disaster recovery plan outlines procedures for restoring IT operations after an incident. It is necessary for business continuity and should include data backup strategies, alternate processing sites, and emergency response protocols.
What are the three types of disaster recovery options?
- Hot site – Fully operational backup facility.
- Cold site – Infrastructure without pre-installed systems.
- Warm site – A balance between hot and cold, with some pre-configured resources.
Which control would reduce the likelihood of someone receiving an expense check for $65,000 more than they were entitled to?
Limit check.
What best describes a computer virus?
A list of instructions to a computer that can replicate itself and attach to another program.
Which approach to alternate processing facilities presents the least risk to a company?
Recovery operations center.
Physical access and protection falls under which category of control?
General control.
