Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPA 2021 > CPA - IT > Flashcards

CPA - IT Flashcards

1
Q

COBIT focuses on IT controls and is intended for use by IT managers, IT professionals, and internal and external auditors

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Enterprise architecture

A

An organization’s enterprise architecture is its efforts to understand, manage, and plan for IT assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Enterprise-wide or Enterprise Resource Planning (ERP) systems

A

ERPs provide transaction processing, mgmt support, and decision-making support in a single, integrated, organization-wide package

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Goals of ERP systems

A
  1. Global visibility
  2. cost reductions
  3. Employee empowerment (improved communcation and decison making)
  4. “Best practices”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An enterprise resource planning (ERP) system has which of the following advantages over multiple independent functional systems?

A

Modificaitons can be made to each module w/out affecting other modules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Online transaction processing (OLTP) system

A

The modules comprising of core business functions: sales, production, purchasing, payroll, financial reporting etc -> think operational data for the eorganization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Online analytical processing (OLAP) system

A

Incorporates data warehouse and data mining capabilities w/in the ERP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cloud Delivery Service Models

A
  • Infrastructure as service (IaaS) - Use of the cloud to access a virtual data center of resrouces (e.g. AWS)
  • Platform as service (PaaS) - A development environment for creating cloud-based software and program using cloud-based services (Salesforce.com)
  • Software as service (SaaS) - Remote access to software (Office 365 etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Good internal control in a computer system requires that operators, programmers, and the library function be segregated.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

systems analyst is responsible for designing the computer system, including the goals of the system and means of achieving those goals, based upon the nature of the business and its information needs. The systems analyst also must outline the data processing system for the computer programmer with system flowcharts.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

systems programmers are given responsibility for maintaining system software, including operating systems and compilers.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In relation to data management activities, the data owner’s primary role is __________, the data steward’s primary role is _____________, and the data custodian’s primary role is ____________________.

A

Answer: Accontability, responsible, responsible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The Systems Development Life Cycle (SDLC) is the traditional methodology for developing information systems. In which phase of the SDLC would the activity of identifying the problem(s) that need to be solved most likely occur?

A

Answer: Planning

Planning is the first phase of the SDLC and this information is needed before most of the analysis phase activities can be initiated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The steps in the systems development life cycle are analysis, design, build, test, and implement.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A direct changeover involves implementation of a new system without the possibility of reverting to the old system. It is often a risky strategy.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Operational systems

A

support day-to-day activities of the business (i.e. purchasing of goods and services, manufacturing activities, sales t ocustomer, payroll etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Management Information Systems (MISs)

A

Systems designed to support routine management problems based primarily on data form transaction processing systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Order data elements by size

A

Files: are composed of

Records: are composed of

Fields: are composed of

Data values: are composed of

Bytes (characters): are composed of

Bits: the smallest storage element in a computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A data mart is a type of data warehouse that is customized for an organization.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An overall description of a database, including the names of data elements, their characteristics, and their relationship to one another, would be defined by using a

A

data definition language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

During the annual audit, it was learned from an interview with the controller that the accounting system was programmed to use a batch processing method and a detailed posting type. This would mean that individual transactions were

A

Assigned to groups before posting, and each transaction had its own line entry in the appropriate ledger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A company has a significant e-commerce presence and self-hosts its website. To assure continuity in the event of a natural disaster, the firm should adopt which of the following strategies?

A

Establish a off-site mirrored website

Establishing an off-site mirrored Web server would provide for continuous duplication of data in geographically separated locations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Compared to online real-time processing, batch processing has which of the following disadvantages?

A

Stored data are current only after the update processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Business analytics

A

“the science and art of discovering and analyzing patterns, IDing anomalies, and extracting other useful info in data for application to a business issue or problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

data lake

A

an unfiltered pool of big data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

data warehouse

A

structured, filtered data repository for solving business problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Common challenges in data governance

A
  • It’s hard to quantify the benefits of data governance and management -> thus, underinvestment in these activities is common
  • Unclear as to who is responsible for data ownership
  • Complying w/increasing regulation of data ownership
  • Too much data (data deluge)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Data classification defines the privacy and security properties of data

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

data taxanomy categorizes the data within the organization’s structure and hierarchy

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The data life cycle overviews the steps in managing and preserving data for use and reuse

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

RACI acronym -> illustrates the data stewardship roles of the data owner, steward, and custodian across the data life cycle

A

Responsible - Does the work to complete the task

Accountable - Delegates the work and is the lats one to review the task or deliverable before completion

Consulted - Deliverables are strengthened by review and consultation from multiple team members

Informed - Informed of project progress

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

data architecture

A

the structure and interaction of the major types and sources of data, logical data assets, physical data assets and data management resources of the enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Metadata

A

a set of data that describes and gives further detail about a dataset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Criteria for describing data

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

3 criteria for describing data

A
  1. The description includes the dataset’s purpose
  2. The desciption of the set of data is complete and accurate; it includes the 10 elements:

P(opulation)

U(nits)

R(ecords)

P(recision)

S(ample)

S(ources)

T(ime)

U(ncertainty)

F(ields)

F(ilters)

3. The data description identifies information that hasn’t been included within the set of data or description but is necessary to understand each data element and the population

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

5 IT security principles specified by the AICPA Assurance Services Executive Committee (ASEC)

A
  1. Security - A top mgmt issue. Security is the foundations of systems reliability
  2. Availability - whether the system is operational and usable as specified in committments and agreements
  3. Processing integrity - does the system of internal control help ensure taht the system processes info as intended w/out errors or manipulations?
  4. Confidentiality - whether confidential info is proectected consistent w/organization’s commitments and agreements
  5. Privacy - addresses whether the system’s collection, use, retention, disclosure, and disposal of personal info conforms to its own commitments and w/the criteria set forth in GAAP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

7 categories of assessing IT security principles

A
  1. Organization and management
  2. Communications
  3. Risk management, and design and implementation of controsl
  4. Control monitoring
  5. Logical and physical access controls
  6. System operations
  7. Change Management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Time based model of controls

A

The time-based model evaluates the effectiveness of an organization’s security by measuring and comparing the relationships among the 3 categories of controls:

  1. time it takes an intruderto break through preventive controls
  2. time it takes to detect that an attack is in progress
  3. time to respond to the attack

Accordingly, if #1 is > #2 + #3, then security procedures are effective. Else, they are ineffective.

39
Q

One disadvantage of value-added network (VAN) is that they are expensive

A
40
Q

The primary advantage of using value-added network (VAN) is that it provides increased security for data transmissions

A
41
Q

Electronic data interchange involves

A

the electronic exchange of business transaction data in standard format from 1 entity’s computer to another entity’s computer

42
Q

Communication about cyber incidents to external parties should be selective and appropriate to their roles. For example, few banks publicly announce when they have lost money in a theft or cyber-hack.

A
43
Q

Distributed data processing system is useful when processing is done in multiple locations.

It enables processing of a large volume of transactions and fast access to data.

A
44
Q

IT policies are particularly valuable in _______ and _________ organizations.

A

Answer: Decentralized; geographically disbursed

These attributes make IT policies particularly valuable, since personnel are disbursed across multiple locations. IT policies are particularly valuable with disbursed units.

45
Q

A decentralized system is characterized by distributed processing and a lessened need for network resources.

A
46
Q

According to the framework for cybersecurity, protecting and securing the U.S. critical infrastructure requires a partnership between ___________ and __________.

A

public entities ; private entities

47
Q

XBRL

A

eXtensive Business Reporting Language

XBRL, or eXtensible Business Reporting Language, is an XML standard for tagging business and financial reports to increase the transparency and accessibility of business information by using a uniform format.

48
Q

A computer emergency response team (CERT) is a ______ control.

A

Corrective

A CERT is a corrective control since it is intended primarily to clean up the mess of a violation of the system’s integrity.

49
Q

a value-added network (VAN) is a system that routes data transactions between trading partners.

A
50
Q

Encryption

A

The process of converting a plaintext message into a secure-coded form (ciphertext)

51
Q

digital signature assures the recipient that the message came from a certain individual and it was not modified.

A
52
Q

Brownout is reduced voltage in the electrical system of an organization.

A
53
Q

Encryption protection is least likely to be used in which of the following situations?

A

When transactions are transmitted over local area networks (LAN)

This answer is correct. Various factors need to be considered. Encoding is important when confidential data are transmitted between geographically separated locations that can be electronically monitored. Although LANs may need encryption protection, the type of data and the described communication media make the other options appear more vulnerable.

54
Q

Organizational (Business) Continuity Planning

A
  1. Create a BCM Policy and progrma
  2. Understand and evaluate organizational risks
  3. Determine Business Continuity Strategies
  4. Develop and implement a BCM Response
  5. Exercise, Maintain, and Review the Plan
  6. Embed the BCM in the Organization’s culture

*BCM = Business Continuity Management

55
Q

Recovery point objective (RPO)

A

RPO = acceptable amount of data lost in an incident (usually stated in hours and defines the regularity of backups)

56
Q

Recovery Time Objective (RTO)

A

RTO => specifies the longest acceptable time for a system to be inoperable

57
Q

Cold site (empty shell)

A

An off-site location that has all the electrical connections and other physical requirements for data processing, but doesn’t have the actual equipment or files

58
Q

Warm site

A

A location where the business can relocate to after the disaster, that isalready stocked w/computer hardware similar to that of the original site, but doesn’t contain backed up copies of data and info

59
Q

Hot site

A

An off-site location completely equipped to quickly resume data processing

60
Q

System backup = good;

data redundancy = bad

A
61
Q

Checkpoint and restart

A

Common in batch processing systems - a checkpoint is a point in data processing where processing accuracy is verified

If there’s a problem, one returns to the previous checkpoint instead of the beginning of the transaction processing

Saves time and money

62
Q

DoS attacks

A

denial of service attacks -> criminal may use a computer to deny others the use or services of a computer system or network

Legitimate users are prevented from accessing the system

63
Q

In end-user computing, the user is responsible for the development and execution of the computer application that generates the information used by that same user.

A
64
Q

A zombie computer is used most frequently to perpetrate a _________ attack:

A

DoS

65
Q

Backup and recovery systems should be both _________ and ____________.

A

Off-site; redundant

Backup systems should include an off-site company and should include redundancy.

66
Q

Disaster recovery plan should provide for an alternative processing site, backup and off-site storage procedures, identification of critical applications, and test of the plan.

A
67
Q

Source program library management system (SPLMS)

A

The SPLMS manages the migration from the application development test environment to the active production library

The SPLMS ensures that only valid changes are made to the system by checking for all necessary authorizations and for program modifications by comparing the new source code to the old one

Only after verification does the program migrate to the SPL

68
Q

Application controls concern the accuracy, validity, and completeness of data processing in specific application programs

A
69
Q

3 categories of application controls

A
  1. Input and origination controls - control over data entry and data origination process
  2. Processing and file controls - controls over processing and files, including the master file update process
  3. Output controls - control over the production of reports
70
Q

Procesing Controls

A

Controls designed to ensure that master file updates are completed accurately and completely

Processing controls also serve to detect unauthorized transactions entered into the system and maintain processing integrity

71
Q

a validity check is a check of an entered number to see if it is in valid form or a valid account number.

A
72
Q

The practice of authorizing changes, approving tests results, and copying developmental programs to a production library is program change control.

A
73
Q

In updating a computerized accounts receivable file, which one of the following would be used as a batch control to verify the accuracy of the total credit posting?

A

The sum of cash deposits + discounts taken by customers

74
Q

a validity check involves comparison of input to a list of valid items.

A
75
Q

a field check is a control that limits the types of characters accepted.

A
76
Q

a check digit is an extra reference number that follows an identification number and bears a mathematical relationship to the other digits.

The identification number can be subjected to an algorithm and compared to the check digit.

A
77
Q

An edit check is a check on the accuracy of data as it is inputted.

A
78
Q

In a daily computer run to update checking account balances and print out basic details on any customer’s account that was overdrawn, the overdrawn account of the computer programmer was never printed. Which of the following control procedures would have been most effective in detecting this fraud?

A

Answer: periodic recompling of programs from documented source files, and comparisons w/programs currently in use

This answer is correct because a periodic recompiling of the program from the original source files and comparison with the program currently in use would allow the auditor to detect the modification in the program that has permitted the fraud to occur.

79
Q

Smigly Construction builds large warehouses for many clients. Smigly is more likely than most other businesses to use _____________ in its revenue cycle billing processes.

A

remittance advice

Remittance advices help customers match payments with invoices. They are more likely to be used in complex businesses, such as construction and medical billing.

80
Q

Which of the following steps in the accounting cycle comes before posting entries to accounts?

A

Analyze transactions

81
Q

A purchase requisition is a formal document that orders goods. It is the best offered control related to the risk of ordering unneeded goods.

A
82
Q

Form 941 shows aggregate payroll tax withholdings and payments.

A
83
Q

Winifred, an internal auditor, wants to determine if employee pay rates are accurate. Her best strategy for accomplishing this goal is to

A

Review the cumulative earnings register

This review will enable Winifred to determine if employee pay rates are accurate. She can evaluate these over time, and across job descriptions and ranks.

84
Q

Adjusting journal entries are often the responsibility of

A

The controller

Adjusting entries are usually posted by the controller in the general ledger cycle.

85
Q

Quality (in th econtext of total quality management)

A

The concept of quality is how well the item meets its design specifications. Does it perform as it’s expected to perform?

86
Q

Quality of conformance

A

The degree to which a product meets its design specifications and/or customer expectations

87
Q

Quality addresses 2 perspectives in total quality management (TQM)

A
  1. Failure to execute the product design as specified
  2. Failure to design the product appropriately; quality of design is defined as meeting or exceeding the needs and wants of customer
88
Q

Cost of quality

A

The costs incurred by an organization to ensure that its products and/or services have a high quality of conformance

89
Q

4 components of cost of quality

A
  1. Prevention cost - cost of any quality activity designed to help do the job right the 1st time
  2. Appraisal cost - the cost of quality control including testing and inspection
  3. Internal failure cost - the costs incurred when substandard products are produced but discovered before shipment to the customer
  4. External failure cost - the cost incurred for products that don’t meet requirements of the customer and have reached the customer
90
Q

Backflush costing

A

The act of delaying journal entries until after the physical sequences have occurred

Often used in high-speed automated environments

91
Q

Six-sigma is a statistical measure expressing how close a product comes to its quality goal.

Six-sigma is 99.999997% perfect with a 3.4 defects per million parts.

A
92
Q

A Pareto chart ranks the causes of process variations by the degree of impact on quality.

A
93
Q
A

CPA 2021 (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions