Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ais test 2 > Chapter 7 > Flashcards

Chapter 7 Flashcards

1
Q

More than 60% of businesses each year experience a failure in controlling security and integrity of their computer systems. What are some reasons why organizations have not adequately protected data?

A
  • Some companies mistakenly view loss of crucial information as a DISTANT, UNLIKELY THREAT
  • Not all of the control implications of moving from centralized computer systems to internet-based systems are fully understood
  • Many companies do not realize information is a strategic resource, it must be a strategic REQUIREMENT
  • Productivity and cost pressures - these may be both timely and costly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Any potential adverse occurence (to the AIS) is considered a

A

threat, or event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Likelihood of a threat is the:

A

probability that it will happen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Potential dollar loss from a threat is called

A

impact, or exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What control objectives are achieved (with reasonable assurance) when Internal controls are put in place?

A
  • SAFEGUARDING OF ASSETS, including preventing or detecting unauthorized acquisition, use, or disposition
  • MAINTAIN RECORDS, which provides sufficient detail for accuracy and fairness
  • Provides ACCURATE AND RELIABLE information
  • Encourages preparation of financial statements with ACCORDANCE to ESTABLISHED CRITERIA
  • Promotes and improves OPERATIONAL EFFICIENCY
  • Encourages ADHERENCE to policies of management
  • encourages COMPLIANCE with applicable laws and regulations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Internal Control permeates an organization’s operating activities and is an integral part of management activities. Does it provide complete assurance?

A

No. It provides REASONABLE assurance. Complete assurance is difficult, expensive, and there are inherent limitations such as:

  • simple errors and mistakes
  • faulty judgement and decision-making
  • collusion
  • management overrides
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are detective controls?

A

Deisnged to DISCOVER control problems that were NOT PREVENTED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The processes
and procedures implemented to
provide reasonable assurance
that control objectives are known as ____ ____

A

Internal Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When do preventive controls deter problems?

A

Preventive controls deters problems BEFORE THEY ARISE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Controls that identify and correct problems as well as correct and recover from the resulting errors are known as

A

Corrective Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Internal controls are usually segregated into which two broad categories?

A
  1. General Controls

2. Application Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Harvard Business Professor Robert Simons has espoused four levels of control that helps management reconcile conflict between creativity and controls. What are they?

A
  1. Belief system
  2. Boundary system
  3. Diagnostic control system
  4. Interactive control system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Internal controls are performing three important functions. What are they?

A
  • Preventive Controls
  • Detective Controls
  • Corrective Controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security, IT infrastructure, maintenance controls, and software acquisition are an example of which type of broad category of Internal Controls?

A

General Controls - Make sure the organization’s information system and control environment is stable and well-managed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define the Boundary system

A

This helps employees act ethically by setting BOUNDARIES ON EMPLOYEE BEHAVIOR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

One wants to implement control but not tell employees exactly what they have to do. What should they do?

A

Create a Boundary System that implements a minimum performance standard. This encourages creativity to solve problems while meeting customer needs. It could also shun off-limit activities, a preventive control avoiding actions that may damage company reputation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define the belief system component of control

A

A Belief System is how a company:

  • Creates Value
  • Helps employees understand management’s vision
  • Communicates company core values
  • Inspires employees to live by expressed values
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Controls that prevent, detect, and correct transactional errors and fraud in application programs are which type of category of internal control?

A

Application control. These are concerned with:

  • Validity
  • Accuracy
  • Completeness
  • Authorization of all data entered/processed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which system (from Robert Simon) measures, monitors, and compares actual company progress to budgets and performance goals?

A

Diagnostic control system. an example is feedback, which may help management adjust and fine-tune inputs and processes so future outputs more closely match goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which act requires all publicly owned corporations to maintain a system of internal accounting controls?

A

FCPA - Foreign Corrupt Practices Act. The main purpose of the FCPA was to prevent companies from bribing foreign officials to obtain business. Unfortunately, this wasnt sufficient enough to cover all the problems related to internal control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data of which system (from Robert Simon) is often interpreted and discussed in face-to-face meetings of superiors, subordinates, and peers?

A

Interactive Control System. These help managers to focus employee attention on key strategic issues and to be more involved in decision-making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Describe Sarbanes Oxley

A

An act passed in 2002 in response to large accounting frauds. Its intended to make financial reports more transparent, provide investor protection, strengthen internal controls at public companies, and punish executives who carry out fraud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the purpose of the PCAOB?

A

5 people appointed by the SEC. Controls the auditing profession

Sets and Enforces:

  • Auditing and other auditing standards
  • Quality Control
  • Indepencence
  • Ethics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

According to SOX,where must auditors report specific information, such as critical accounting policies and practices?

A

Audit commitee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does SOX do?

A
  • Created PCAOB
  • New rules for Auditors
  • New roles for audit committees
  • New rules for management
  • New internal control requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What must management do according to mandates by the SEC?

A
  • Base its evaluation on a RECOGNIZED CONTROL FRAMEWORK
  • DISCLOSE all MATERIAL Internal Control WEAKNESSES
  • Conclude that a company does NOT have effective financial reporting internal control if there are MATERIAL WEAKNESSES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Provide an example of top management conflict with regards to performing audit services according to SOX

A

Acc to p 191 of text, “Audit firms cannot provide services to companies if top management
was employed by the auditing firm and worked on the company’s audit in the preceding
12 months”

28
Q

According to SOX, would a firm that performs information systems design and implementation for a company be able to also perform an audit of the same company?

A

No. Sox prohibits auditors from doing certain nonaudit services.

29
Q

A weak or deficient internal environment could result in

A

breakdonws in risk management and control. The Internal Environemnt is essentially the same thing as the “control environment” in the IC framework.

30
Q

An internal environment consists of what?

A
  1. Management’s philosophy
  2. Commitment to integrity, ethical values, and competence
  3. Internal control oversight by BOD
  4. Organizational structure
  5. Methods of assigning authority and responsibility
  6. Human resource standards that attract, develop, and retain competent individuals
  7. external influences
31
Q

One seeking guidance for Internal Control can refer to the ?

A

“Internal Control - Integrated Framework” of COSO. Widely accepted as the authority on internal controls. The framework is usually incorporated into policies, rules, and regulations used to control business activities

32
Q

The more responsible the philosophy and strategy of management, along with the operating style and risk appetite, the more likely employees will behave responsibly. What questions may be asked to assess this?

A

●Does management take undue business risks to achieve its objectives, or does it assess
potential risks and rewards prior to acting?

●Does management manipulate performance measures, such as net income, so they are
seen in a more favorable light?

●Does management pressure employees to achieve results regardless of the methods, or
does it demand ethical behavior? In other words, do the ends justify the means?

33
Q

The second framework made by COSO to improve risk management is called

A

Enterrise Risk Management (ERM). Process the BOD and management would use to set strategy, identify events that affect the entity, assess risk, and provide reasonable assurance that company is achieving goals.

34
Q

Amount of risk willing to be accepted by a company to achieve their goals is the

A

risk appetite

35
Q

Five basic principles of ERM

A
  1. Companies are formed to create value for their owners
  2. Management must decide how much uncertainty would be accepted as it creates value
  3. Uncertainty results in risk, possibility something negatively affects ability to create or preserve revenue
  4. Uncertainty also results in opportunity, possibility something positively affects ability to create or preserve value
  5. Thus, ERM framework can manage uncertainty as well as create and preserve value.
36
Q

What is the internal environment?

A

Company culture. influences how strategies and objectives are established, structures business activities, and identifes/responds to risk.

37
Q

SEE p. 196 for ERM figure

A

p. 196

38
Q

According to SOX, public companies must have an audit committee of outside, independent directors. These are responsible for what?

A
  • Financial reporting
  • Regulatory compliance
  • internal control
  • and hiring and overseeing internal and external auditors.
39
Q

Commitment to integrity, ethical values, and competence begins at the top. Companies can endorse integirty by (2 of 2)

A
  • Developing a written code of conduct. Companies should document that employees ahve rad and understand the code of conduct so employees know right-from-wrong, rather than relying on expediency which may lead them to dishonesty
  • Requiring employees to report dishonest or nillegal acts. Employees should be dismissed and prosecuted to show that such behavior is not allowed
40
Q

the organizational structure provides a framework for planning, executing, controlling, and monitoring operations. Important aspects of the organizational structure are:

A
  • Centralization or decentralization of authority
  • Direct or matrix reporting relationship
  • Organization by industry, product line, location, or marketing networjk
  • Allocation of responsibility affects information requirements
  • Organization and lines of authoirty for accounting, auditing,and IS functions
  • sizen and nature of company activities.
41
Q

Commitment to integrity, ethical values, and competence begins at the top. Companies can also endorse integirty by (1 of 2)

A
  • Actively teaching and requiring it (making clear honest reports are more important than favorable ones, for example)
  • Avoiding unrealistic expectations or incentives that motivate dishonest or illegal acts (overly aggressive sales practices, unfair or unethica negotitaton tactics, or bonuses excessively based on reported financial results)
  • Consistently rewarding honesty and giving verbal labels to certain types of behaviors
42
Q

Give an example of how a complex, unclear oeganizationa structure can indicate serious problems

A

it can hide fraud. For example, ESM used a multi-layered organizational structure to hide b300 million in fraud.

43
Q

What could be used as a guide for authority and responsibility for employees?

A

Job descriptions, employee training, operating schedules, budgets, code of conduct, but especially the written policies and procedures

44
Q

Who should be responsible for assignting authority and responsibily, as well as holding those individuals accountable for achieving or not achieving goals?

A

Management. It is especially omportant to identify who is responsible for company’s information security policy.

45
Q

Policy and Procedures manual is what?

A

Explains proper business activities, descirbes needed knwoelege and experience, explaines document procuderes, how to handle transactions, and lists out resources prvided to carry out specific duties. Helpful on-the-job reference

46
Q

One of the greatest control strengths is employee ____. Reciprocally, one of the greatest control weaknesses is ___ of employees.

Hint: think HR

A

Honesty / Dishonesty

47
Q

What must HR think about when hiring employees?

A

Hiring employees based on factors like educational background, experience, achievements, honesty, integrity, and whether job requirements are met. This also goes for people like cleaning crews and temps (fraudsters can pose of these to gain physical access to things like computers)

48
Q

Applicant qualifications can be evaluated using resumes, reference letters, interviews, and background checks. What are background checks?

A

Talking to references, checking criminal records, and verifying work or education experience. People who fail to do this could employ someone who actually may be a criminal and embezzle funds. Background check specialists can be use to validate bogus education sites or to detect applicants who used hackers to enter fake data into university databases

49
Q

What should HR consider when thinking about compensating, evaluating, and promoting employees?

A

Poorly compensated employees are more likely to feel resentment. Financial pressures from things like this can motivate fraud. Fair pay and appropriate bonuses can hep motivate performance, and promotions should be based on performance and qualifitication. Periodic performance appraisals should be given so employees know weaknesses and strengths

50
Q

HR considerations in regards to training employees?

A

programs shpuld be taught to teach responsibilites, expected levels of performance, as well as culture and norms.

51
Q

examples of hr training programs

A

Informal or formal discussions and meeting, issuing periodic memos, distributing written guidelines and codes of conduct/ethics, circulations reports of unethical behavior and its consequences, and promoting security and fraud trainign programs

52
Q

What can HR do to make fraud less likely to occur?

A

Fraud is less liekly to occur when employees recognize the need to report it. Such a culture of employees believing security is everyone’s business must be taught and practiced. In addition, the conseuquences of unwanted behavior should be taught and reinforced.

53
Q

Who are disgruntled employees and how may they be managed?

A

Some disgruntled employees that may be seeking reeinge for a perceived wrong. Thus, they perpetrate fraud or sabotage systems. HR needs procedures to identify these employees, help them resolve their feelings, or remove them from sensitive jobs. Not easy as employees may fear that admitting these feelings may have bad consequences

54
Q

Why is most fraud not reported or prosecuted?

A
  1. PR disaster (could also attract more hackers)
  2. Law Enforcement (LE)/ courts are busy with violent crimes
  3. difficult, costly, and time-consuming
  4. Many LE/Judges do not ahve computer skills needed to instigate and prosecute cybercrimes
  5. Fraud sentences light.
55
Q

Why is it important to especially have increased control activities around holiday time the end of the year?

A

(1) extended employee
vacations mean that there are fewer people to “mind the store”; (2) students are out of school and
have more time on their hands; and (3) lonely counterculture hackers increase their attacks.

56
Q

What is fidelity bond insurance?

A

protects companies from acts of deliberate frauds

57
Q

Differences between Risk Assessment and Risk Response?

A

basis. Inherent risk is the susceptibility of a set of accounts
or transactions to significant control problems in the absence of internal control. Residual
risk is the risk that remains after management implements internal controls or some other
response to risk. Companies should assess inherent risk, develop a response, and then assess
residual risk.

58
Q

What are the one of four ways management can respond to risk?

A

●Reduce. Reduce the likelihood and impact of risk by implementing an effective system
of internal controls.
●Accept. Accept the likelihood and impact of the risk.
●Share. Share risk or transfer it to someone else by buying insurance, outsourcing an activity, or entering into hedging transactions.
●Avoid. Avoid risk by not engaging in the activity that produces the risk. This may require
the company to sell a division, exit a product line, or not expand as anticipated.

59
Q

Differences between preventive, detective, and corrective controls?

A

Preventive
controls are usually superior to detective controls. When preventive controls fail, detective
controls are essential for discovering the problem. Corrective controls help recover from any
problems. A good internal control system should employ all three.

60
Q

Difference between specific and general authorization.

A 
Specific "- Special 
approval an employee needs in order to be allowed to handle a transaction. eg - anything +500k must be approved. The 
authorization given employees 
to handle routine transactions 
without special approval.
61
Q

Segregation of accounting duties is achiev when which of the following functions are seperated?

A

Authorization/recording/and custdy (handiling of cash and assets/writing checks)

62
Q

See figure 7-5 p 206

A

p 206

63
Q

Three types of accounts that are most manipulative

A
  1. Revenue
  2. Inventory
  3. A/R
64
Q

Substantive testing is used to

A

test internal controls

65
Q

inherent risk is

A

risk in place before any internal controls are implemented

66
Q

5000 is transaction amount where things tend to get valuable (in this example). Anything under 5000 has ___ authorization. Anything over 5000 has ____ authorization

A

general / specific

ais test 2 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions