IT Flashcards
Elements of Accounting Systems
- People
- Procedures
- Hardware
- Software
- Data
Risks in Computer-Based Systems
Systems, programs and people (FUNI) •Reliance on FAULTY systems or programs •UNAUTHORIZED changes in master files, systems, or programs •Failure to make NEEDED changes •Inappropriate INTERVENTION (by people)
COBIT purpose
Align IT and business goals/strategies
Link business risks, control needs and IT
Common language for users, auditors, management, and business process owners in identifying risks and structuring controls.
Determine how much to invest in IT control
COBIT Framework Defined
To provide the information that the organization needs to achieve its objectives, IT resources needed to be managed by a set of naturally grouped processes.
Process orientation to exercise responsibilities, achieve goals and manage risks.
CIRCLE (a) IT processes (b) Business requirements (c) IT resources
COBIT Information Attributes
- Effective
- Efficient
- Confidential
- Integrity
- Available
- Compliant
- Reliable
COBIT and COSO
Both concerned with monitoring of organizational processes
FOCUS:
•COSO: organizational control and processes
•COBIT: IT controls and processes
According to the COBIT model, identify 5 physical resources that, together, comprise an IT system
- People
- Applications
- Technology
- Facilities
- Data
According to the COBIT model, what are the four IT domains?
- Planning and organization
- Acquisition and implementation
•the process of identifying automated solutions. - Delivery and support
•the process of ensuring security and continuous service. - Monitoring
What are the three major components of the COBIT model?
- Domains and processes
- Information criteria
- IT resources
ERP Goals
- Integration (goal visibility): Integrate all data into 1 data base with user-Defined views
- Cost Savings: decrease system maintenance costs (only one system to maintain)
- Employee Empowerment: Improves Communication and decision making by increasing information availability
- “Best Practices”: include most successful business processes of an industry.
Enterprise Architecture Defined
An organizations enterprise architecture is its efforts to understand, manage, and plan for IT assets. An organizations IT security governance plan must articulate with, and be informed by, the organizations enterprise architecture plan.
Enterprise-Wide or Enterprise Resource Planning (ERP) Systems Defined
ERPS provide transaction processing, management support, and decision-making support in a single, integrated, organization-wide package. By integrating all data and processes of an organization into a unified system, ERPs attempt to manage and eliminate the organizational problem of consolidating information across departments, regions, or divisions.
Online Transaction Processing (OLTP) System
The modules comprising the core business functions: sales, production, purchasing, payroll, financial reporting, etc. These functions collect the operational day for the organization and provide the fundamental motivation for the purchase of an ERP.
Online analytical Processing (OLAP) System
Incorporates data warehouse and data mining capabilities within the ERP.
*provides an integrated view of transactions in all parts of the system.
•primarily concerned with collecting data (not analyzing it) across the organization.
PaaS Defined
The use of the cloud to CREATE (not access) software.
SaaS Defined
The use of the cloud to ACCESS software.
Three important functions (segregate) of IT department rolls
- Application Development: SAFEGUARD ASSETS (applications in development)
- Systems Administration and Programming: Grant AUTHORIZATION (access)
- Computer Operations: EXECUTE events, safeguard archived IP
Segregation of Duties: Data Control (Clerk)
Control document flows, schedule batches for data entry and editing, reconcile control totals (reconciling + authorizing function)
Segregation of Duties: Computer Operators
Operate the (mainframe) computer, load program and data files, run programs (execute transactions)
Segregation of Duties: File Librarian
Maintain files and data that are not online in file library, check files in and out to support scheduled jobs. Should not have access to operating equipment or data outside of library.
Inadequate Scope and Agility
IT investments in business units, inadequately scaled to meet changing business needs
Digitization Defined
Moving data to electronic form.
Governance Defined
The processes and structures, to oversee the activities of the organization in pursuit of organizational objectives.
Oversight Defined
Process of managing and monitoring an organizations operations to achieve internal control and effectively manage risk.
Product Differentiation Defined
Setting your product apart from your competitors’
Common Problems with IT Investments
- Lack of IT strategic focus - many IT investments are “bottom up”.
- Lack of strategic investment - over-investment in existing businesses and inadequate investment in “transformative” technologies.
- Inadequate scope and agility - IT investments in business units, inadequately scaled to meet changing business needs.
Governance is primarily the responsibility of
THE BOARD
Operational, Transaction Processing, Systems (TPS)
Support large volume, day-to-day activities of business.
•purchasing of goods/svcs, mfg activities, sales to customers, cash collections, payroll.
Transaction types
•Non-financial (placing orders for goods, accepting orders from customers)
•Financial (billing a customer, receiving pmt, paying employees)
GENERATE DEBIT AND CREDIT ENTRIES INTO ACCOUNTS.
Knowledge Management Systems (KM)
Components:
Knowledge base, knowledge database, provides means to collect, organize, and develop relations among information.
Management Information System (MIS)
Support routine, lower to mid level management.
- Primarily synthesize (analyze) data from TPSs (internal data)
- Tasks: structured problems
Ex: compare planning info (budgets, forecasts) data with outcomes. , AR Aging
Accounting Information System (AIS) is a subset of:
Management Information Systems (MIS)
•AIS generated debits and credits (ex: A/R transactions – aging)
Decision Support Systems (DSS)
Support mid and upper level management.
Tasks: manage non-routine problems and long-range planning.
Often integrate external (market-level) with TPS data.
Include significant analytical and statistical capabilities.
Two types of DSS (decision support systems)
DATA DRIVEN: process large amounts of data to find relations and patterns. Ex: data warehousing and data mining.
MODEL DRIVEN: use models to forecast outcomes, model-driven analytics.
DSS Examples Used by Audit Firms
Client risk Assessment
Client acceptance and retention
Internal control documentation and testing
Compute audit sample sizes
Group Support Systems (GSS)
Facilitate group collaboration
May include functions such as calendars, meeting scheduling, and document sharing.
Executive Support Systems (ESS) or Strategic Support Systems (SSS)
Similar to DSS •Support forecasting and long-range, strategic decisions •Greater use of external data •primarily to support top management. •DSS for dummies
•can be for a specific purpose (monitoring competitive price)
Flat File Systems
Early IT Systems
Separate programs and data sheets
Each application has separate data and programs (think going into multiple places to change the same thing)
•Data sharing across applications through separate programs
•Select data records from one application and reformat for other application.
•data redundancies.
Database Systems
Pool data into logically related files (the database).
MIS always implemented into a database environment.
Data Warehouses and Mining
System to collect, organize, integrate, and store entity-wide data.
Easy access to large quantities of varied data from across the organization.
Data Mining
Exploration, aggregation, and analysis of data in the data warehouse using analytical tools and exploratory techniques.
Data Warehousing
Relational data of archived operational transactions and other data.
Often incorporated in a data-driven DSS
May include external data.
Drill Down
Move from summary to detailed information.
Associated with data warehouses
Ability to move from summary to granular information.
Slicing and Dicing
View data in multiple ways.
A specialized version of a data warehouse
A data mart
Bit
Binary digit
Zero or one
Byte
Logical grouping of bits
Must be to the power of 2 (2^n)
Field (attribute)
- logical group of bytes
- identify a characteristic or attribute of an entity (invoice, customer, product, etc)
- in databases, fields are also known as “attributes”
Record
- a group of related fields (attributes)
* describe an example of an entirety (a specific invoice, a particular customer)
File (Table)
•collection of related records for one specific entity ( an invoice file, a customer file, a product file)
Database
A set of logically related files.
Systems Software
Programs that run computer and support system management (operating system is more important)
Programming Languages
- Used to create applications.
- Now, most are “third” or “fourth generation” languages, many are object-oriented programming languages (OOPL) (Ex: Java)
- All must be converted to “first generation” language (Ex: 0s and 1s) (from source to object code)
Application Software
End-user programs that you know and love.
Categories:
General (word processors, spreadsheets, databases)
Specific (a marketing IS for a clothing designer)
Runs on a specific operating system and hardware environment.
Operating System
- Interface between user and hardware.
- Defined what commands can be issued and how (typing in a command, pointing and clicking) Ex: Microsoft, Mac.
- Controls all input and output in computer systems.
Database Management System (DBMS)
“Middleware” program (between the Software and hardware, or application software and operating system)
Manages the database.
Data Definition Language (DDL)
- User can define tables and fields and relations among the tables
- Uses meta-data (data about data) to define the database elements
- Example commands: create, drop, alter (of fields and tables)
Data Manipulation Language (DML)
- User can add, delete or update records
* Example commands: update, insert, delete (of records)
Data Query Language (DQL)
- User can extract information.
- Most relational databases use structured query language (SQL) to extract fat (text approach)
- Query-By-Example (QBE): graphic interface with “drag and drop” fields to create query (graphic approach)
Database Controls - DBMS includes:
- No collisions - concurrent access management (only one person in at a time)
- No hackers or creepers - Access controls
- Data definition standards, data element standards
- Backup and recovery procedures
- Update privileges
- Data elements and relationship controls
Inputs and Output terminology
Peripherals = input and output devices = I/O devices
Input devices
Input devices instruct the CPU and supply data to be processes.
Ex: keyboard, mouse, trackball, touch-screen technology, microphones and voice recognition technology, point of sale (POS) scanners.
Output devices
Transfer data from the processing unit to other formats.
- printers,plotters–paper output
- monitors, flat panel displays, CRT (cathode ray tube) displays–visual output
- speakers, voice output communication aids (VOCAs)–auditory output
Central Processing Unit (CPU)
CONTROL UNIT: interprets program instructions
ARITHMETIC LOGIC UNIT (ALU): performs arithmetic calculations
Primary storage (main memory)
Stores programs and data when in use.
- Random Access Memory (RAM)– stores data temporarily (information in process in computer system)
- Read-Only Memory (ROM)– permanently stores data needed by computer
Solid State Drivers (SSDs)
Form of secondary storage.
Flash drives, USB, jump, thumb drives
No moving parts. Similar to the RAM.
Server
A computer that provides resource on a computer network.
Computer hardware
Physical equipment of the computer system.
How does system capture data and update master file? Two primary methods.
- Batch: group transactions for processing (then are sorted into item number sequence)
- On-line, real-time (OLRT): Continuous, immediate Processing.
Batch Processing
Transaction and mater files must be sorted on a common key
•Low volume, periodic transactions. Transactions are independent or unimportant.
•Called “sequential-access files” because the records are in sequence.
•Alternative is “random-access files” (ex: hardware storage devices)
On-Line, Real-Time (OLRT) Processing
Continuous, immediate transaction processing.
Near simultaneous transaction entry and master files updating.
Requirements: random access storage devices, networked computer system or internet.
•single transaction, random processing technology, immediate update.
Point-of-Sale (POS) System Technology
Scanners capture data from product bar codes (fast, accurate, cheap)
Computer system connected to, or integrated with, electronic cash register.
POS Systems or terminals networked to central computer.
Big Data
Creation, analysis, storage and dissemination of extremely large data sets.
•Feasible due to advances in computer storage technologies (ex: the cloud), advanced data analytics, and massive computing power.
Gartner definition: “high volume, velocity, and/or variety Information assets that demand new, innovative forms of processing for enhanced decision making, business insights or process optimization.”
Dark Data
Data from business activities that may be reused in analytics, business relationships, or directly monetized (sold).
Activity, operational or social media data that is unused or underused.
Sometimes a synonym for “meta-data” (data about data)
IaaS
Use of the cloud to access HARDWARE
Role of the systems analyst in an IT environment
Designing systems, prepares specifications for programmers, and serves as intermediary between users and programmers.
•should not have access to an entity’s data in a large firm. (Violation of segregation of duties)
Database administrator
Responsible for establishing user names and authorizing access to specific data files and fields
IT security principles: 5 trust services principles
- Security
- Availability (is the system operational and useable as specified in commitments and agreements? Do I/Cs support system availability?)
- Processing integrity (concerns the completeness, validity, accuracy timeliness and authorization of system processing)
- Confidentiality (is the information protected consistent with the orgs commitment in agreements?)
- Privacy (does the Systems collection, use, retention, disclosure, etc followed)
10 GAPP (Generally Accepted Privacy Principles)
- Management (accountability)
- Notice (tell others of policies and procedures)
- Choice and consent (US= users can opt out of collection of personal info)
- Collection (only for identified purposes)
- Use and retention (consistent with statements about use - retain only as long as needed or by law)
- Access (people can access, review and update their info)
- Disclosure to third parties (according to policy)
- Security for privacy (protect against unauthorized access)
- Quality (personal info is accurate, complete and relevant)
- Monitoring and enforcement (monitors the entities compliance)
IT security is not just The responsibility of the IT department but also
A top management issue.
Categories of Criteria for assessing achievement of IT security principles
- Organization and management
- Communications
- Risk management and design implementation of controls
- Monitoring of controls
- Logical and physical access controls
- System operations
- Change management
Time-Based Model of Controls
Given enough time and resources, preventive control can be circumvented.
Accordingly, detection and correction must be timely.
P=time it takes an intruder to break through the organizations preventive controls
D=time it takes to detect that Ana track is in progress
C=time to respond to the attack
If P > (D+C), then security procedures are effective
Defense-in-depth Strategy
The strategy of implementing multiple layers of controls to avoid having System break down
Cyber-Risk Assessment: COSO Principle 6
Organization specifies objectives with sufficient clarity to enable identification and assessment of risks relating to objectives.
Assessing cyber risks begins with understanding the value of information systems to an organization.
Risk identification and Fraud: COSO Principles 7 & 8
Principle 7: Organization identifies, analyzes and manages risks.
Principle 8: Organization considers fraud risks.
Assess likelihood and severity of cyber risk impact.
Consider industry-specific attack.
*initiative should be lead by senior management.
COSO principle 9
Organization identifies and assesses changes that could impact internal control.
Risks; Rapidly changing technologies and amber criminals’ quick adaption to changes yield new methods of exploiting vulnerabilities.
Control Activities to address cyber risks: COSO principles 10, 11, 12
10: Organization selects and develops control activities that contribute to mitigate risks.
11: Organization selects and develops general control activities over technology to support the achievement of objectives.
12: Organization deploys control activities through policies that establish expectations and procedures that implement policies.
* control activities related to cyber risks should relate to the organizations’ objectives and cyber risk profile. (Ex: defense-in-depth Approach. Manage cyber risks through careful design and implementation of controls)
Communicating about cyber risks and controls: principle 13
Organization obtains, generated and uses relevant, quality information to support internal control.
•Information needs follow from cyber risk Assessment and control design processes.
•Formally document information requirements to support processes and controls.
•Availability of “big data” can create information overload problems.
•Transform control system data into actionable, high-quality information to support cyber-related controls.
Communicating about cyber risks and controls: principle 14
Organization internally communicates information, including objectives and responsibilities for internal control, necessary to support internal control functioning.
•Communication about cyber risks should include all personnel, personnel responsible for managing and monitoring cyber risks and controls, and the Board of Directors.
Communicating about cyber risks and controls: principle 15
Organization communicates with external parties regarding internal control.
Define Cybercrime
Illegal activity that used a computer as its means of communication, or in which a computer is the target of the crime.
Define cyber risk
The likelihood of a financial loss, a disruption or damage to an organization form failure of, or an attack on, it’s IT Systems.
All policies, including IT policies, should….
Link to entity’s strategy and objectives.
Need a process for evolving with change.
IT Policies: according to COSO
- Policies central to internal control
- Reflect managements intentions regarding actions
- Procedures are actions to implement policies
Important IT Policies
- Values and Service Culture: what is expected of IT function personnel in interactions with clients and others?
- Contractors, Employees and Sourcing: why, when and how entity selects IT Human Resources from employees vs. outside contractors.
- Electronic Communications Use: policy related to employee use of the internal, intranet, email, blogs, chat rooms and telephones.
- Use and Connection Policy: Entity’s position on the use of personal devices and applications in workplace and connection to the entity’s systems.
- Procurement: policy on procurement processes for obtaining IT services.
- Quality: statement of IT performance standards
- Regulatory Compliance: statement of regulatory requirements for IT systems.
- Security: policy related to guarding against physical or electronic threats to IT. May include disaster recovery preparation policies.
- Service management and operational service problem solving: policies for ensuring quality of live IT services.
E-Commerce
Marketing, buying, and selling of products and services via the internet
- Narrower -> Transactions between organization and trading partners.
- Business-to-business (B2B) ecommerce: the electronic processing of transactions between businesses. (ex: Processing of business transactions, electronic data interchange (EDI), supply chain management (SCM) and EFT
•Business-to-consumer (B2C) ecommerce: selling goods and services to consumers, usually on Internet and web-based technology.
•Relies on intermediaries or brothers to
facilitate the sales transaction (eBay)
E-Business
Used internet to improve business performance through connectivity.
- Business process that relies on electronic dissemination of information or automated transaction processing.
- can be within or between organizations.
- Most via the Internet using web-based technology’s
E-commerce example (B2E)
Business-to-employee e-commerce: sharing information and interacting with employees.
E-commerce example: B2G
Business-to-government e-commerce: contract bidding, property disposal, audit procurement.
E-Commerce Risks
- availability/downtime
- privacy, security and confidentiality
- authentication and nonrepudiation (after the fact, can’t claim that transaction never occurred)
- integrity
Risks of Failing to Implement EC
- Customers go elsewhere
- Limited growth
- Limited markets
E-Commerce Business Models
- E-marketplaces and exchanges
- Viral marketing
- Online direct marketing
- E-rendering Systems (putting out bids for products we need?)
- Social networking
E-Commerce depends on trust in two parties.
- Trading partner
2. The trading site or service provider
Identify five risks of e-commerce
- Risk of System unavailability
•availability/downtime - Privacy, security and confidentiality risks
- Authentication risks
- Nonrepudiation risks
- System integrity risks
E-Procurement
Where a company seeks bids to provide a product or service.
Customer Relationship Management (CRM)
Technologies for managing client e-relationships.
Ex: customer data, profitability, personalized marketing
Database of customer data
•sales force automation: tracking contacts and follow-ups
Marketing automation: “triggered” marketing (ex: Kroger promoting grocery products only to interested customers)
Customer service automation
•customer service automation: automating common customer interactions
Analytics
•sales history and projections, marketing campaign success, trends, and performance indicators
Electronic Data interchange (EDI)
- computer-to-computer exchange of business data.
- structured data and processing protocols to reduce costs and speed processing (purchase orders, confirmations, invoices, etc.)
- facilitates JIT (just-in-time) inventory
- ex: Walmart and suppliers (direct EDI connections)
- often, direct links between trading partners through intermediaries (called “service bureaus” or VANs)
- Most EDI transactions on Value Added Networks (VANs)
Value Added Networks (VANs) provide…
Audit trails, controls, and security
Often used in conjunction with EDIs
EDI alternatives
Translation software converts between standardized EDI format and internal company format.
EDI Benefits
- paperless (saves storage, filing, process costs
- zero data entry
- reduce errors in information exchange
- required by customers (ex: Walmart can force supplies to adopt a system comparable to theirs)
- real time data, no delays (faster invoicing and payments)
E-Banking
•demanded by customers
•management of e-banking requires:
Senior management of BoD oversight
Technology under Senior IT leadership
Operational management
monitoring and measuring risk
Electronic Funds Transfer (EFT)
Technology for electronically transferring money.
Increase speed and reduce cost
Electronic Wallets
Not payment systems
Programs for managing credit cards, user names, passwords and address information in easy-to-use, centralized location.
Supply Chain Management (SCM)
Process of transforming raw materials into finished product and delivering goods.
Process of planning, implementing, and controlling supply chain operations
SCM OFTEN INCLUDES EDI (ex: Walmart)
Risk: Unauthorized Cloud Activity
Response = ?
Preventive and detective controls to prevent unauthorized procurement of cloud services.
•a cloud use policy that articulates how, when, and for what uses, cloud computing is allowed.
•a list of approved cloud vendors
Policy: who can contract for cloud services and under what conditions.
