Chapter 7 Flashcards
why are threats to accounting information systems increasing
Many companies do not realize that data security is crucial to their survival
a control procedure designed so that the employee that records cash received from customers does not also have access to the cash itself is an example of a
preventative control
Identify the preventative control
a) reconciling the bank statement to the cash control account
b) approving customer credit prior to approving a sales order
c) maintaining frequent backup records to prevent loss of data
d) counting inventory on hand and comparing counts to the perpetual inventory records
B
according to Sarbanes-Oxley Act of 2002, the audit committee of the board of directors is directly responsible for
hiring and firing external auditors
what measures can be taken to protect a company from AIS threats
- take a proactive approach to eliminate threats
- detect threats that do occur
- correct and recover from threats that do occur
Internal control is often referred as what, because it permeates an organization’s operating activities and is an integral part of management activities
process
duplicate checking of calculations is an example of what kind of control
detective
procedures to resubmit rejected transactions are an example of what kind of control
corrective
which type of control is associated with making sure an organization’s control environment is stable
general
which type of control prevents, detects, and corrects transaction errors and fraud
application
the primary purpose of the Foreign Corrupt Practices Act of 1977 was
to prevent the bribery of foreign officials by American companies
What was not an important change introduced by the Sarbanes-Oxley Act of 2002
new rules for information systems development
measures company progress by comparing actual performance to planned performance
diagnostic control system
helps top level managers with high level activities that demand frequent and regular attention
interactive control system
Sarbanes-Oxley Act applies to whom
all publicly traded companies
measures, monitors, and compares actual company progress to budgets and performance goals
diagnostic control system
describes how a company creates value, helps employees understand management’s vision, communicates company core values, and inspires employees to live by those rules
belief system
helps employees act ethically by setting boundaries on employee behavior
boundary system
helps managers to focus subordinates’ attention on key strategic issues and to be more involved in their decisions
interactive control system
COSO framework that improves the risk management process by expanding COSO’s Internal Control–Integrated
Enterprise Risk Management (ERM)
which of the following is not a component of COSO ERM
a) monitoring
b) control environment
c) risk assessment
d) compliance with federal, state, or local laws
D
The COSO Enterprise Risk Management Integrated Framework stresses that
risk management activities are an inherent part of all business operations and should be considering during strategy setting
T or F: the COSO ERM contains all five of the same COSO Integrated Framework components
TRUE
how many principles are in the updated COSO integrated framework
17
how many principles are in the updated COSO integrated framework
17
Why was COSO integrated control framework updating in 2013 from 1992
to more effectively address technological advancements
COBIT 5 key principles
- Meeting Stakeholder needs
- Covering the enterprise end-to-end
- Applying a single, integrated framework
- Enabling a holistic approach
- Separating governance from management
COBIT 5 framework primarily relates to
best practices and effective governance and management of organizational assets
Applying COBIT 5 framework governance is the responsibility of
the board of directors
applying the COBIT 5 framework monitoring is the responsibility of
CEO, CFO, and board of directors
what is not a factor of internal environment according to the COSO ERM framework
analyzing past financial performance and reporting
the audit committee of the board of directors
provides checks and balances on management
reducing management layers, creating self directed work teams, and emphasizing continuous improvement are all related to which aspect of internal enviornment
organizational structure
the SEC and FASB are best described as external influences that directly affect an organization’s
internal environment
an attribute that is not apart of the COSO ERM framework internal environment is
restricting access to assets
according to ERM, these help the company address all applicable laws and regulations
compliance objectives
using the COSO definition of an event, and event repressents
uncertainty
using the COSO definition of an event, and event repressents
uncertainty
is not a risk response identified in the COSO ERM framework
Monitoring
a publicly traded company were three best friends serve as its key officers
increases the risk associated with an audit
how is expected loss calculated
Impact X likelihood
According to COSO ERM framework he risk assessment process does not include
reporting potential risks to auditors
independent checks on performance do not include
data input validation checks
one of the key objectives of segregating duties is to
make sure that different people handle different parts of the same transaction
approving accounting software change requests and testing production scheduling software changes
is an example of coupling duties that do not violate the segregation of duties
a document that shows all projects that must be completed and the related IT needs in order to achieve long range company goals is known as a
strategic master plan
this is created to guide and oversee systems development and acquisition
steering committee
shows how a project will be completed, including tasks and who will perform them as well as a timeline and cost estimates
project development plan
which component of the COSO ERM integrated framework is concerned with understanding how transactions are initiated, data are captured and processed, and information reported
information and communication
COSO requires that any internal deficiencies identified through monitoring be reported to whom
the board of directors
to ensure compliance with copyrights and to protect itself from software piracy lawsuits, companies should
periodically conduct software audits
something not monitored by a responsibility accounting system
vendor analysis
budgets quotas and quality standards
are monitored by a responsibility accounting system
