Chapter 3 Flashcards
stewardship
the careful and responsible oversite and use of the assets entrusted to management
code of ethics
following ethical business practices
internal controls
a process affected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
effectiveness and efficiency of operations
reliability of financial reporting
compliance with applicable laws and regulations
fraud
the theft, concealment, and conversion to personal gain of another’s money, physical assets, or information
misappropriation of assets
theft of any item of value, also referred to as defalcation, or internal theft, most common are cash or inventory
misstatement of financial records
the falsification of accounting reports, referred to as earnings management, fraudulent financial reporting
fraud triangle
Incentive Opportunity Rationalization(attitude)
incentive
things that motivate people to commit fraud
opportunity
if there is a lack of internal controls it is possible to commit fraud
rationalization
justifying fraud
management fraud
conducted by one or more top level managers within the company, usually in reporting
management override
where the management tells a lower level employee to do it despite the controls
employee fraud
conducted by employees examples:
inventory theft, cash receipts theft, A?P theft, payroll fraud, expense account fraud
skimming
taking money before it is entered into the system
larceny
where money is taken after it is entered into the system
collusion
when two or more people work together to commit a fraud
customer fraud
when a customer improperly obtains cash or property from a company, or avoids a liability through deception
credit card fraud or check fraud
customer use of stolen cc or checks
refund fraud
when a customer tries to return stolen goods to collect a cash refund
vendor fraud
when vendors obtain payments to which they are not entitled
vendor audits
the examination of vendor records in support of amounts charged to the company
industrial espeonage
the theft of proprietary company info by digging through the trash of the intended target company
software piracy
the unlawful copying of software programs
internal computer fraud
input manipulation, program manipulation, output manipulation
salami technique
altering a program to slice a small amount from several accounts and then credit those small amounts to the perpetrator’s benefit
trojan horse program
a small unauthorized program within a larger legitimate program, used to manipulate the computer system to conduct a fraud
trap door alteration
a valid programming tool that is misused to commit fraud
hacking
term commonly used for computer network break ins
denial of service attack
intended to overwhelm an intended target computer system with so much bogus network traffic that the system is unable to respond to valid network traffic.
spoofing
when a person, through a computer system, pretend to be someone else
prevent fraud
1 maintain code of ethics
- maintain a system of accounting internal controls
- maintaining a system of information technology controls
Sarbanes Oxley Act (SOX)
passed to reform accounting, financial reporting, and auditing functions of public companies.
SOX requirement code of ethics
SOX requires that public companies adopt and disclose a code of ethics
preventive controls
designed to avoid errors, fraud, or events not authorized by management
detective controls
help employees to uncover or discover errors, fraud, or unauthorized events
corrective controls
steps to correct an error or problem uncovered via detective controls
committee of sponsoring organization (COSO)
made the COSO report
COSO report
five components of internal control:
control environment, risk assessment, control activities, information and communication, and monitoring
control environment
the tone of the organization, a tone of ethics and integrity will make fraud less likely, as well as the assignment of authority, and responsibility
risk assessment
considering existing threats and the potential for additional risks and stands ready to respond should these events occur, steps,
1 identify the sources of risk, both internal and external
2. determine the impact of such risks in terms of finances and reputation
3. estimate the chances of such risks occurring
4. develop an action plan to reduce the impact and probability of these risks
5. execute the action plan and continue the cycle, beginning again with the first step
control activities
the policies and procedures that help ensure that management directives are carried out and that management objectives are achieved, examples:
- authorization of transactions
- segregation of duties
- adequate records and documents
- security of assets and documents
- independent checks and reconciliation
authorization
an approval or endorsement, from a responsible person in the department or organization that has been sanctioned by management
general authorization
set of guidelines that allows transactions to be completed as long as they fall within established parameters
specific authorization
that explicit authorization is needed for that single transaction to be completed
segregation of duties
three parts should be separate, authorization, recording, and custody
compensating control
lessens the risk of negative effects when other controls are lacking
audit
presents verifiable information about the accuracy of accounting records
independent checks
method to confirm the accuracy and completeness of data in the accounting system, examples,
reconciliation
comparison of physical assets with records
recalculation of amounts
analysis of reports
review of batch totals
reconciliation
procedure that compares records from different sources
batch total
summation of key items in the batch
monitoring
ongoing review and evaluation of a system
reasonable assurance
controls achieve a sensible balance of reducing risk when compared with the cost of the control
Control objectives for IT(COBIT)
framework developed by the ISACA(information systems audit and control association)
trust services principles
designed to be the written guidance for CPA’s who provide assurance services for organizations
risk and controls in IT 5 categories
Security Availability Processing Integrity Online Privacy Confidentiallity
