Chapter 3 Flashcards
What are internal control
is a process that specifically mitigates risk to the company financial information
What can internal control do
Create quality info
Identify financial issue
Prevent fraud
Increase operating efficiency
Ensure compliance with laws and regulation
Lessen the risk of financial misstatement
What are the function of Internal control
Prevent
Detect
Correct
What are preventive Control
Precent problem from happening ex: Segregation of duties
What are Detective control
alert the management to an issue once it has occurred. They identify problems like fraud, legal compliance and quality control
What are corrective controls
these are the changes you makes after an undesirable outcome occur after the risk has occurred
Explain management override
this is when the internal control dont work due to management not following the policy or procedure
Explain the time based model of control
This measure the residual risk for technology attacks by comparing the relationship of the three control functions
Whats the time base model of control formula
P>(D+C)
What are three locations for controls
Physical control ( human actives )
IT General Control (
IT Application Control
It general controls
Apply to the entire operation of the full systems and it environment ( emails, web browsers, time keeping software)
What are the two methods of implementing control
Manual
automated
Whats does implementing manual control requires
it requires human judgement or physical interaction .
Risk and error and manipulation
What are automated control implementation
use technology to implement control activities. This increased reliability and consistency
Continuous Monitoring technology are use for
create detective controls that use rules based programming to monitor the business data for red flags risk
Whats are the three lines of defense
first = Business operation ( management)
second: Risk management and Compliance ( management)
Third : Internal audit)
First line of defense role
Provision of products or services to client to managing risk
Second line of defense role
Support monitor and challenge on risk related matter
Third line of defense role
Independent and objectives assurance and advice on all matters related to achieve the objectives
What is the maturity Model
This show how far the company is to achieving its ideal state by comparing the current one to a predetermine set of practices
What are the four phase of Maturity model
Limited
Informal
Defined
Optimized
Limited on the maturity Model means
the company is poorly defined and the employees have multiple ways to achieve the same outcomes.
Informal process
reliance on key individual
Ad hoc controls
What maturity model phased these are
Phase 1 Limited
Informal on the maturity model means
Some processes and controls are defined but the documentation , inconsistencies and reliance on key individual still exist
Defined on the maturity model means
Policies,procedures and controls are formally document which creates a consistent environment where key employees are no longer relied on
Optimized on the maturity model means
the gold standard in the process of maturity model
Clearly defined controls
Formal documentation
Clearly defined process
No reliance on key individual
Whats phase on the maturity model is it
Phase 3 : Defined
Top down approach, proactive approach
Internal audit provide strategic values
Clear communication
Whats phase on the maturity model is it
Phase 4 : Optimized
Some defined processes
Lack of documentation
Primarily manual control
reliance on key individual
Whats phase on the maturity model is it
Phase 2 : Informal
When doing an internal audit we must have
Assurance
Insight
Objectivity
What is a framworks
publish a set of specification and criteria that defines a strategies to achieve a certain objectives. Like a set of instructions for business to follow . ex: road maps
What is Sarbanes- Oxley Act ( SOX)
Is to protect investors from fraud and other risk by improving the reliability of financial statement
What are the key part of COSO Frameworks
Control Objectives
Component and related principles
COSO Cube
What are the control objectives
Operations
Reporting
Compliance
what are the fives steps of Component
Control environment
risk assessment
Control activities
Information and communication
Monitoring
