Exam 5 Flashcards
Identification of Control Activities: Principle 10
recognizes that a major task for an organization is to identify what control activities are desirable for that particular organization .
Identification of Control Activities: Principle 12
discusses the importance of developing policies and procedures to ensure control activities are in place and working .
Isolation
Data, programs, documentation, and information processing facilities should be isolated to protect them from potential hazards (e.g., unauthorized access), and access privileges should be restricted and monitored.
Redundancy
Backup copies of programs and data should be made for security reasons. Critical computations should be repeated as a check on accuracy.
Comparison
Comparisons between data provide a check on accuracy and may signal problems to be investigated.
Assistance
Control problems often result from the inability to handle a job, inadequate training, and lack of ongoing guidance.
Oversight
Supervision of employees, internal audits, and external audits encourage careful work and reduce the likelihood that inappropriate activity will occur. Independent reconciliation and verification activities support this concept.
Accountability
Holding employees accountable for their actions promotes compliance with established control activities (e.g., performance/operating reviews). This also encourages careful work.
Automated Controls
Controls programmed into computer software.
Manual Control Procedures
are weaker in that even in the best control environment, human behavior lacks consistency.
Control Activities
Cannot provide absolute assurance that all risks will be eliminated.
Preventive Controls
A control that deals with or stops potential problems through the controls in place.
Detective Control
A control that provides feedback regarding violations of controls in place.
Corrective Control
A control that remedies a control violation after it has been detected.
AU 314 Appendix Classification scheme
Performance reviews
Physical controls
Segregation of duties
Information processing
Performance reviews
Timely performance reviews act as detective control and corrective control.
Used to mitigate risks, reduce costs, reduce customer complaints by responding via social media.
Physical Controls
Devices and measures that protect computer hardware and other assets, such as cash, inventories, securities, fixed assets, mechanical check signers, and signature plates.
Segregation of Duties
A control activity in which authorization of transactions, custody of related assets, and modification or creation of related data and program files (or paper-based records) are segregated so that a single individual cannot both perpetrate and conceal an error or inappropriate activity.
Enforcing vacation
Employees are forced to take vacation days so that one person does not always work on the same task. It is to avoid errors and inappropriate actions.
Cryptography
The process of transforming, or encrypting, data (usually by scrambling) into a “secret code.”
Encryption
A process, typically involving a mathematical encryption algorithm and an encryption key that scrambles data to prevent unauthorized persons from accessing the data.
Digital Signature
Extra data appended to an electronic message which identifies and authenticates the sender.
Repuidation
A customer’s denial that an order was placed for goods or services from a vendor.
Digital Certificate
A form of electronic identification that is issued by a certification authority (CA) after the CA verifies the company participating in e-commerce activities is legitimate.
The secure Sockets Layer (The SSL)
protocol, represented by a small lock in the lower right hand corner of a webpage is currently the most commonly accepted protocol used by web browsers to protect sensitive data in transit.
Transmission medium for mobile devices and networks
Because fiber-optic cable carries signals as light waves rather than as electrical impulses, it provides better access security than other types of cable.
Automatic Log off
The disconnection of a workstation from a file server or host computer if there has been no activity for a given period of time.
Fire Suppression systems
Computer equipment is subject to damage should there be a fire in the data center. Fire is a major threat to the electrical equipment, so it is essential to protect the data center from this hazard. Fire extinguishers should be available (water-based and gas-based), and easily accessible. There should be equipment to provide early warning of a fire that is heard in an area that has continuous occupation by employees. These systems should be inspected and tested on a regular basis.
Environmental Control
Computer equipment is also sensitive to temperature and humidity. There should be environmental systems in place to control the temperature and humidity within a certain range. Typically, the range for temperature is between 18 and 21° C (65–70° F) and preferred humidity ranges between 45 and 55%.
Backup Controls
All files should be backed up routinely, and the backup copies should be stored in a secure, off-site location and tested regularly for readability. The backup medium should also minimize cost.
Downtime Controls
The repair of computer hardware may take several days and, occasionally, several weeks. Therefore, to reduce the amount of downtime, maintenance schedules should be established for all computer hardware. Conformity with these schedules should be checked routinely. Provision also must be made for emergency repairs to minimize nonproductive downtime.
Recovery Controls
Recovery controls deal with prompt recovery from equipment failure (such as controller failure, electrical failure, or media/head crashes) and natural disasters (such as flood, lightning, fire, earthquake, or hurricane) that could put the information processing facilities out of operation for an extended period.
Automatic Roll back
When a running program prematurely terminates, it cannot be restarted until associated records and files are returned to their original condition. A database management system has a feature called automatic rollback in which incomplete transactions are backed out so the database is returned to the state it was in before the transaction began.
Disaster Recovery Plan
A plan that documents detailed recovery procedures in the event of equipment failure or disasters to quickly and smoothly restore an organization’s processing capabilities.
Steering Committee
A steering committee establishes or approves information processing policies and operating standards, approves system projects, sets priorities for implementing systems, evaluates the effectiveness of processing operations, and generally monitors and evaluates information processing activities.
Input Controls
Control activities that deal with the authorization, entry, and verification of data entering the system.
Verification Controls
Programmed edit and validation routines that verify the correctness of entered data. They test for valid codes, reasonableness of amounts, valid data type (numeric, alphanumeric), valid field length, logical relationships, anticipated contents, and valid date.
Check Digit
A single digit appended to a number to validate the number. The digit is computed from the other digits in the number itself.
