Chapter 1 (Domain 1) Flashcards
Executive Misconduct
Misconduct in the executive suite usually reflects a fundamental compliance gap in corporate management. The gap commonly manifests itself as a group of executives in power.
FCPA
Foreign Corrupt Practices Act (FCPA)
COSO
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
SOX
US Sarbanes-Oxley Act (SOX)
For NYSE publicly traded corporations, similar to the US government’s own internal controls in the Office of Management and Budget Circular A-123
PCI
Payment Card Industry (PCI)
What are the two basic components of Regulatory Objective?
- Evidence of operational integrity
- Evidence of internal controls to protect valuable assets.
What is an asset?
defined as anything of value, including trademarks, patents, secret recipes, durable goods, data files, competent personnel, and clients. Although people are not listed as corporate assets, the loss of key individuals is a genuine business threat.
What is a threat?
a negative actor that creates an event that would cause a loss if it occurred.
What is a vulnerability?
The access path used by a threat
What is your job as an IS auditor?
To verify that assets, threats, and vulnerabilities are properly identified and managed to reduce risk.
What are the three data types?
- Data, 2. Metadate, 3. Authentication Data
RMS
Records Management System (RMS)
What are the four (4) documents organizations typically have in place?
- Policy
- Standard
- Guidelines
- Procedures
What is a Policy?
(Goals)
A policy is a chief executive mandate to identify a topic of concern containing particular risks to avoid or prevent.
What is a Standard?
(Definition of Requirement)
These are mid-level documents containing measurement control points to ensure uniform implementation in support of a policy.
What are Guidelines?
(General Instructions)
Provides vague direction of “do this, not that” to provide very limited advice pertaining to how organizational objectives might be obtained. The purpose is to provide information that would aid in making decisions about intended goals (should do), beneficial alternatives (could do), and actions that would not create problems (won’t hurt).
What are Procedures?
(How-to Instructions for Success)
These are “cookbook” recipes providing a workflow of specific tasks necessary to achieve minimum compliance to a standard. Details are written in step-by-step format from the very beginning to the end.
What is a Fiduciary Relationship?
Is simply one in which you are acting for the benefit of another person and placing the responsibilities to be fair and honest ahead of your own interests.
Who is the Auditor?
The auditor is the competent person performing the audit.
Who is the Auditee?
The organization and people being audited are collectively called the auditee.
Who is the Client?
The client is the person or organization with the authority to request the audit. A client may be the audit committee, external customer, internal audit department, or regulatory group. If the client is internal to the auditee, that client assumes the auditee role.
COBIT
Control Objectives for Information and Related Technology (COBIT)
What are the two classes of standards?
- Parent Class with Broad Application across a Variety of Industries - Examples include the ISO 27001 information security management standard, NIST 800-53 controls, and NIST 800-26 (Security Self-Assessment Guide for Information Technology Systems). Older versions of ISO standards frequently bear lower ID numbers.
- Industry Specific with a Limited Scope - Examples include FFIEC regulations and portions of the HIPAA security rules, which may incorporate only select portions of the parent class standards. More and more industries worldwide are adopting ISO standards as the preferred baseline with specific designated tailoring of attributes to fit the industry.
What are the two basic categories of audit testing?
- Compliance test - Initially audits will verify that items necessary for compliance exist
- Substantive test - Then items are selected to undergo additional testing to check inside for the substance and integrity of a claim
Least Privilege
Refers to providing only the minimum information necessary to complete a required task.
What is a risk based approach?
Refers to focusing upon the most important highest risk areas first.
What to external auditors do?
Are paid to be independent reviewers for an organization.
What do internal auditors do?
Can add enormous value to an organization by providing ongoing efforts that help prepare the organization for an external audit.
Auditor’s opinion
A good auditor will use sufficient evidence to formulate their auditor’s opinion, which is really a numeric scoring based on evidence test results. No opinion can be formed when you lack evidence of acceptable quantity, relevance, and reliability.
