Mid-Term Test Flashcards
1
Q
System
A
A set of two or more interrelated components interacting to achieve a goal.
2
Q
Goal Conflict
A
When components acting in their own interest contribute do not toward the overall goal.
3
Q
Goal Congruence
A
When components acting in their own interest contribute toward the overall goal.
4
Q
Business transactions
A
An agreement between two entities to exchange goods/services or other event, that can be measured in economic terms by an organisation.
5
Q
Accounting Information System (AIS)
A
A system that collects, records, stores and processes data to produce information for decision-making.
6
Q
Components of an Accounting Information System (6)
A
- Users
- Procedures and instructions used
- Data about organisation and its activities
- Software used to process data
- Information technology infrastructure
- Internal controls and security measures
7
Q
The six components of an Accounting Information System enable three business functions to be fulfilled…(3)
A
1) Collect and store data about organisational activities, resources and personnel.
2) Transform data into information, for management to plan, execute, control and evaluate activities, resources and personnel.
3) Provide controls to safeguard assets and data.
8
Q
How can an AIS add value to an organisation? (6)
A
1) Improving the quality and reducing the costs of products or services
2) Improve efficiency
3) Sharing knowledge
4) Improve efficiency and effectiveness of supply chain
5) Improve internal control structure
6) Improve decision making
9
Q
Value chain
A
The set of primary and secondary activities a product/service moves along before output.
10
Q
Value chain: primary activities
A
Value chain activities that produce, market and deliver products/services to customers and provide post-delivery support.
11
Q
Supply chain
A
An extended system that includes an organisation’s value chain, as well as its suppliers, distributors and customers.
12
Q
Support activities
A
Value chain activities such as infrastructure, technology, purchasing and human resources.
13
Q
Data processing cycle
A
The four operations (data input, data storage, data processing, and information output) performed on data to generate meaningful and relevant information.
14
Q
Data input: Capture
Data must be collected about 3 facets of each business activity as it occurs.
A
1) Each activity of interest
2) Resource(s) affected by each activity
3) People who participate in each activity
15
Q
Source documents
A
Documents used to capture transaction data as its source - when the transaction occurs.
16
Q
Turnaround documents
A
Records of company data sent to an external party and then returned to the system as input.
17
Q
Coding
A
The systematic assignment of numbers/letters to items to classify and organise them.
18
Q
Coding types (4)
A
- sequence codes: items are numbered consecutively
- group codes: two/more subgroups of digits used to code items
- mnemonic codes: letters & numbers (description) used to identify an item
- chart of accounts: listing of numbers assigned to balance sheet and income statement accounts
19
Q
Data processing activities (4)
A
1) Create new data records
2) Read, retrieve or view existing data records
3) Update existing stored data records
4) Delete data or records
20
Q
Enterprise resource planning (ERP)
A
A system that integrates all aspects of an organisations activities (Financial, Human resources, Marketing, ect.)
21
Q
ERP Advantages (7)
A
- integration of organisation data and financial information
- data is captured once
- greater management visibility, increased monitoring
- better access control
- standardises business operating procedures
- improved customer service
- more efficient manufacturing
22
Q
ERP Disadvantages (5)
A
- cost
- time consuming to implement
- complex
- resistance to change
- changes to an organisations existing business processes can be disruptive
23
Q
Data flow diagram (DFD)
- data sources
- data flows
- data destination
- transformation processes
- data store
A
A graphical description of the flow of data within an organisation. This includes:
- data sources/destinations: square
- data flows: curved/straight arrow
- internal control: red square
- transformation processes: circle
- data store: two horizontal lines
24
Q
Data flow diagram levels (3)
A
1) Context
2) Level-0
3) Level-1
25
DFD: Context diagram
Highest level DFD, which show inputs and outputs into a system and their destinations and sources.
26
DFD:
Level-0
Level-1
Level-0: Show all major activity steps of a system. (labeled 1.0, 2.0)
Level-1: Show one major activity, divided into sub activities. (labeled 1.1, 2.1)
27
Flow charts
Use symbols to logically depict transaction processing and the flow of data through a system.
28
Types of flow charts (3)
- Document
- System
- Program
Document: illustrates flow of document through an organisation, useful to analyse internal controls.
System: representation of system inputs, procedures and outputs, useful to analyse systems and design.
Program: represent logical sequence or program logic.
29
Common threats to AIS (3)
- natural disasters
- software errors and/or equipment malfunction
- unintentional and intentional (sabotage) acts
30
Fraud
Any and all means a person uses to gain an unfair advantage over another person.
31
Legally for an act to be fraudulent there must be: (5)
- a false statement/representation/disclosure
- a material fact that induces a person to act
- an intent to deceive
- justifiable reliance
- an injury/loss suffered by the victim
32
Forms of fraud
- misappropriation of assets
- fraudulent financial reporting
Misappropriation of assets - theft of company assets by employees.
Fraudulent financial reporting - intentional/reckless conduct resulting in materially misleading financial statements.
33
Tread-way commission actions to reduce fraud (4)
1) establish environment which supports integrity of financial reporting
2) identification of factors that lead to fraud
3) asses risk of fraud within company
4) design and implement internal controls
34
Pressure
Motivation or incentive to commit fraud.
| Either by employee or financial reporting
35
Opportunity
Condition/situation that allows a person or organisation:
- commit fraud
- conceal fraud: lapping
- convert theft to personal gain
36
Rationalisation
Justification of illegal behaviour
- justification
- attitude
- lack of personal integrity
37
Computer fraud
Any illegal act in which computer technology knowledge is necessary to perpetrate.
38
Why computer fraud is on the rise? (7)
1) definition is not agreed on
2) often undetected
3) high percentage not reported
4) lack of network security
5) step by step guides are easily available
6) law enforcement is overburdened
7) difficulty calculating loss
39
Hacking
Unauthorised access, modification or use of a computer system/electronic device.
40
Social Engineering
Techniques, usually psychological tricks to gain access to sensitive data/information.
41
Malware
Any software used to cause harm.
42
Types of computer attacks (4)
- Botnet - Robot Network
- Denial-of-service (DOS) attack
- Spamming
- Spoofing
43
Hacking embezzlement schemes
- salami technique
- economic espionage
- cyberbullying
- internet terrorism
- salami technique: small amounts from many different accounts
- economic espionage: theft of information, trade secrets and intellectual property
- cyberbullying: harassment online
- internet terrorism: disrupting electronic commerce and harming computer communication
44
Virus
A segment of self-replicating, executable code that attaches itself to a file/program.
45
Worm
A standalone malware computer program that replicates itself in order to spread to other computers.
46
Internal controls
The processes and procedures implemented to provide reasonable assurance that control objectives are met.
47
Internal controls perform 3 important functions:
- Preventive controls
- Detective controls
- Corrective controls
48
COBIT - Control objectives for information and related technology
Allows management to benchmark security and control practices, users to be assured adequate information system security and control exist, and auditors to substantiate their internal controls.
49
The COBIT 5 framework
1) Meeting stakeholder needs
2) Covering enterprise end-to-end
3) Applying a single, integrated framework
4) Enabling a holistic approach
5) Separating governance from management
50
Enterprise risk management model (ERM)
A COSO framework that improves the risk management process by expanding COSO's internal control.
51
ERM - Internal Environment
The company culture that is the foundation for all other ERM components, as it influences how organisations establish strategies and objectives.
52
ERM - Objective Setting
Management sets objectives at the corporate level then subdivides them into more specific objectives;
- strategic
- operational
- reporting
- compliance
53
ERM - Event Identification
A positive or negative, incident from internal or external sources, that affects the implementation of strategy or achievement of objectives.
54
ERM - Risk Assessment
- Identify risk: likelihood and whether impact positive or negative
- Type of risk:
inherent: exists before plans to control it
residual: remaining risk after controls in place to reduce
55
ERM - Risk Response (4)
- reduce
- accept
- share
- avoid
56
Why is it important to seperate accounting duties?
To ensure no employee has too much responsibility, and therefore minimise risk of fraud.
need to separate: authorisation, recording & custody
57
Trust services framework (TSF)
TSF provides the means to consolidate COBIT
- Security
- Confidentiality
- Privacy
- Processing integrity
- Availability
58
Time-based model
Combination of detective/corrective controls.
P = time takes for attacker to break through
D = time takes to detect attack in process
C = time takes to respond to attack
P must be greater than D + C
59
Authentification
Verifies who a person is: passwords, ID cards, biometric characteristics.
60
Authorisation
Determines what a person can access: files and applications.
61
Intellectual property (IP)
What to protect?
- strategic plans
- trade secrets
- cost information
- legal documents
- process improvements
62
Steps to secure intellectual property (4)
1) Identification and classification - data inventory
2) Encryption - making info unreadable without special knowledge
3) Controlling access
4) Training employees
63
Privacy concerns (2)
- spam
| - identity theft
64
Encryption strength
- key length
- algorithm
- policies concerning keys
- key length: number of bits used to convert text into blocks
- algorithm: manner in which key and text is combined
- policies concerning keys: stored securely with strong codes
65
Symmetric encryption
one key used to both encrypt and decrypt
- pro: fast
- con: vulnerable
66
Asymmetric encryption
different key used to encrypt than decrypt
- pro: very secure
- con: very slow
67
Hybrid solution encryption
use symmetric for encrypting information and use asymmetric for encrypting symmetric key for decryption.
68
Hashing
Transforming plaintext of any length into a short code called hash.
69
Creating a digital signature - 2 steps
1) document creator uses a hashing algorithm to generate hash of the original document
2) document creator uses his/her private key to encrypt the hash created in step 1
RESULT - encrypted hash is legally binding signature
70
Input controls: Form design (3)
- all forms should be sequentially numbered
- use of turnaround documents and eliminates input error
- cancellation and storage of source documents
71
Batch processing
input multiple source documents at once in a group
72
How to promote a fast recovery?
- Back-up
- Business continuity plan
Back-up:
incremental - copy only data that changed from last period back-up
differential - copy only data that changed from last full back-up
Business continuity plan - How to resume all operations including IT.
73
Disaster Recovery Plan (DRP)
Procedures to restore an organisation's IT function in the event that it's data centre is destroyed.
74
DRP Types of sites
- Cold site
- Hot site
- Site data centre
Cold site - an empty building that is prewired for necessary telephone and internet access.
Hot site - a facility prewired for necessary telephone and internet access, along with all the computing and office equipment organisation needs to perform its essential business activities.
Site data centre: used for back-up and site monitoring.
75
Auditing
Systematic process of obtaining and evaluating evidence regarding assertions about economic actions/events to determine how well they correspond with established criteria.
76
Internal auditing
An independent, objective consulting activity designed to add value and prove organisational effectiveness and efficiency. (including assisting in design of AIS)
77
Types of internal audits (5)
- financial (integrity of accounting records)
- information system (assess AIS controls with internal policies)
- operational (efficient use of resources for goals)
- compliance (entities comply with laws)
- investigative (incidents of possible fraud)
78
External auditing
| + 4 elements
Responsible to corporate shareholders.
- gathers evidence to share opinion on financial statements
- indirectly concerned with AIS effectiveness
- assess how auditing strategy affected by AIS
- evaluate IT controls through tests
79
Audit process steps (4)
- planning
- collecting evidence
- evaluating evidence
- communicating audit results
80
1) planning the audit
Audit scope and objectives: why, when, how, whom?
- inherent risk ( error or omission as a result of factors)
- control risk (absence or failure in the operation of relevant controls)
- detection risk (fail to detect a material misstatement in the financial statements)
81
2) collecting evidence (5)
Samples collected and observes activities to be audited.
- review documentation
- test balances 3rd parties
- recalculate test values
- examine supporting materials
- examine relationships & trends
82
3) evaluating evidence
Does the evidence support favourable/unfavourable conclusion? How significant is evidence (errors)?
83
4) communication of audit
A written report summarising audit findings and recommendations to management, the audit committee, the board of directors and other appropriate parties.
84
Information systems audit purpose
To review and evaluate internal controls that protect a system.
85
Information systems audit objectives (6)
1) overall information security (threats)
2) program development and acquisition
3) program modification (source code comparison)
4) computer processing (concurrent audits)
5) source data (input control and data control)
6) data files (accuracy, integrity, security of data, and auditing by objectives)
86
Sales order processing
Take customer order, approve customer credit, check stock availability and respond to customer.
87
Shipping process
Pick and pack order, then ship order.
88
Cash collection process
Process customer payment and update their account balance, then deposit payments to bank.
89
Order goods/services processing
Identify what, when and how much to purchase, then choose a supplier.
90
Receiving process
Goods arrive
91
Approve supplier invoice and cash disbursements
Match supplier invoice to purchase order and receiving order, approve supplier for payment and then pay vendor.
92
Planning SDLC (2)
- project development plan
| - master plan
93
Project development plan (SDLC)
- cost/benefit analysis
- developmental and operational requirements
- schedule of activities required to develop and operate a new application
94
Master plan (SDLC)
What will system consist of? How will it be developed? Who will develop it? How will needed resources be acquired? Where the AIS is headed?
95
Planning technique
- PERT chart
| - GANTT chart
96
Program evaluation and review technique (PERT)
Network of arrows and nodes representing project activities that require an expenditure of time and resources and completion and initiation of activities.
97
GANNT chart
A bar chart with project activities on the left-hand side and units of time across the top. it graphically shows entire schedule for a large, complex project.
98
Feasibility analysis
Does it make sense to proceed with new system? Consider economic, technical, legal, scheduling and operational factors.
99
Economic feasibility: Cost-benefit analysis
Benefits and costs estimated and compared to determine whether system is cost beneficial.
100
Why do people resist change to computer systems? (4)
- lack of management support
- lack of communication
- disruptive change
- biasness and emotions
101
How can management prevent resistance? (4)
- offer support and communication lines
- meet user needs and involve users
- provide user training
- stress new opportunities are created
102
System survey (Extensive study of AIS)
System study provides understanding of company objectives, data and information flow, AIS strengths and weaknesses and available hardware, software and personnel.
103
System documentation
Once data gathered, document findings and model exisiting system.
104
Systems analysis report
Report outlines and documents analysis activities and provides recommendations that result from the system analysis.
105
System analysis process steps (5)
1) initial investigation (go-no occurs)
2) system survey - determine needs
3) feasibility analysis (go-no at end)
4) identify needs and capture requirements
5) system documentation: systems analysis report
(go no occurs at end)
106
Conceptual design
Developer creates general framework for user requirements and solving problems identified in analysis phase. Evaluate design alternatives, prepare design specifications and prepare conceptual design report.
107
Physical design
Conceptual designs are translated into detailed specifications that are used to code and test computer programs.
108
Output design
Determine nature, format, content and timing of reports, documents and screen displays.
109
Program design process steps (8)
1) determine user needs
2) create and document development plan
3) write program instructions
4) test program
5) document program
6) train users
7) intall system
8) use and modify system
110
Implementation and conversion of system
Process of installing hardware and software and getting AIS up and running.
111
Implementation and conversion of system steps (7)
1) planning
2) prepare site
3) test hardware
4) train personnel
5) complete
6) test system
7) conversion
112
Types of documentation (3)
- development documentation
- operations documentation
- user documentation
113
Development documentation
A system description of copies of output, input and file, and database layouts, program flowcharts, test results and acceptance forms.
114
Operations documentation
Documentation includes operating schedules, files and databases accessed, and equipment, security and file-retention requirements.
115
User documentation
Teaches users how to operate AIS, and includes procedures manual and training materials.
116
Types of conversions (4)
Direct - terminates old AIS and introduces new one
Parallel - operates old and new system simultaneously
Phase-in - replaces elements with new one
Pilot - implements system in one part of organisation
117
Post-implementation review
Determines whether system meets its planned objectives.
118
How can you develop an AIS? (3)
- purchase software
- develop software in-house
- hire and extend company to develop and maintain new software
119
Purchasing software - Off the shelf canned
- System capabilities for user with similar requirements
- Hardware and software sold as a package
- Driven by 'pay-per-use' model
- Software is provided to user via the internet
120
In-house system development
System developed in-house provides a significant competitive advantage.
121
Risks of in-house development (6)
- time consuming
- complex system
- poor requirements
- insufficient planning
- inadequate communication
- lack of qualified staff
122
End-user computing (EUC)
Hands-on development, control, use of CBIS by users.
123
End-user computing advantages (5)
- user creation, control and implementation
- system meets user needs
- timeliness
- free up system resources
- versatility and ease of use
124
End-user computing disadvantages (5)
- logic and development errors
- poorly controlled and documented
- incompatible systems
- redundant data
- increased costs
125
Outsourcing advantages (5)
- business solution: concentrates on core competencies
- access to greater expertise and technology
- facilitates downsizing
- less development time
- asset utilisation
126
Outsourcing disadvantages (5)
- inflexibility
- loss of control
- reduced competitive advantage
- locked-in system by contract
- unfulfilled goals
127
Methods to develop AIS (3)
- business process management (bpm)
- prototyping
- computer-aided software engineering (CASE) tools
128
Business process management
Systematic approach to continually improve and optimise an organisations business process.
129
Business process management systems (BPMS)
| + 4 components
Automate and facilitate business process improvements.
1) process engine
2) business analytics
3) collaboration tools
4) content manager
130
Internal control in BPMS
BPMS uses business process rules to determine correct person to perform task and authorise them.
- improved segregation
- strengthened application controls
- built-in audit trial
131
Prototyping advantages (6)
- better definition of user needs
- higher user involvement
- faster development time
- few errors
- more opportunity for changes
- less costly
132
Prototyping disadvantages (5)
- significant user time
- less efficient use of system
- inadequate testing
- negative behavioural reactions
- never-ending development
133
Computer-aided software engineering (CASE)
Software to help plan, analyse, design, program and maintain an information system.
134
Computer-aided software engineering advantages (5)
- improved productivity
- -improved program quality
- cost savings
- improved control procedures
- simplified documentation
135
Computer-aided software engineering disadvantages (3)
- incompatibility
- cost
- unmet expectations
136
Computer-based storage concepts
- attributes
- fields
- records
- files
Attributes - facts about the entity
Fields - where attributes are stored
Records - group of related attributes about an entity
File - group of related records
137
Difference between ERP and BPMS
ERP systems are data-centred and BPMS are process-centred. Manufacturers of ERP systems are integrating BPM into their systems.
138
Database systems advantages (5)
- data integration
- data sharing
- minimising data redundancy
- data independence
- cross-functional analysis
139
Relational database
Relational data model represents the conceptual and external level schemas as if data are stored in tables.
Each row = record and Each column = field
140
Attributes
- primary key
- foreign key
Primary key - attributes to uniquely identify a specific record
Foreign key - attribute in one table that is a primary key in another table
141
Database design errors
- update anomaly (data changes not recorded correctly)
- insert anomaly (unable to add record)
- delete anomaly (removing record removes unintended data)
142
Design requirements for relational database (4)
1) every column must be single value
2) entity integrity rule: primary keys must contain data
3) referential integrity rule: foreign keys must contain same data as primary key in another table
4) non-key attributes must identify characteristics of table identified by primary key
143
Database design process (5)
1) system analysis
2) conceptual design
3) physical design
4) implementation and conversion
5) operation and maintenance
144
Data modelling
Process of defining an information system so it represents an organisations requirements, and it occurs at the systems analysis stage and conceptual design stage.
145
Data models include (3)
- flowcharts
- data flow diagrams
- entity relationship diagrams
146
Entity-relationship diagrams
Used to graphically represent a database schema. It depicts entities and the relationships between entities.
147
Resource-Events-Agents Diagram rules
1) each event linked to at least one resource
2) each event linked to at least one other event (get, give and participation events)
3) each event is linked to at least two other agents
148
Cardinalities
Describes the nature of relationship between entities.
149
Relationship types in REA diagram
- one to one
- one to many
- many to many
150
Rules for creating integrated REA diagram
1) event linked to at least one resource
2) event linked to two agents
3) disposition event must be linked to acquisition event
4) increment event must be linked to decrement event
5) if event linked to more than one event, but cannot be linked to all other events, then REA must show event is linked to a minimum of 0 of each of those other events
151
REA to database steps (3)
1) create table for entity and many-to-many relationship
2) assign attributes to appropriate tables
3) use foreign keys to implement one-to-one and one-to-many relationships
152
XBRL
Extensible business reporting language is a standard for the electronic communication of business and financial data.
153
XBRL uses tags to data to:
- specify what piece of data is
- specify how it is used
- make data searchable
- represent a standard for the business environment
154
XBRL taxonomies
Taxonomies are the dictionaries that define each accounting item that can be tagged in XBRL.
155
Instance document
XBRL tagging is applied to a file containing data.
156
Users of XBRL
```
External Users
- lenders
- regulators
- government departments
- investors
Internal users
- quick and efficient production of reports, and consolidation of acquisitions
```
157
Ways to code financial accounts: apply tags
1) attach XBRL to accounting system
| 2) attach XBRL tags after financial accounts have been prepared
158
Sales order processing controls
1a) data entry edit controls
b) restrict access to mater data
2) signature to authorise sales
3) credit limits checked and if sale exceeds limit, special authorisation needed
4a) perpetual inventory system
b) RFID or bar code technology
c) physical inventory counts
159
Shipping process controls
1a) reconcile invoices with sales orders and shipping documents
b) seperate shipping and billing functions
2a) data entry edit controls
b) configure system for automatically enter price data
3) reconcile subsidiary accounts receivable balance to the amount for accounts
4) segregate authorisation and recording function for credit memos
160
Cash collection controls
1a) segregation of cash handling and posting to customer accounts, authorise credit memos or reconcile bank account.
b) use lockbox
c) deposit all cash receipts daily
2a) lockbox
b) discounts for early payment
c) cash flow budgeting
161
Ordering goods/services controls
1a) perpetual inventory system
b) bar-coding, RFID
2) review and approval of purchase requisitions
3a) price lists
b) competitive bids
4) use approved suppliers
5a) monitor supplier performance
b) require quality certification
6) purchase from approved supplier
7a) supplier audits
b) prohibit gifts
162
Receiving goods controls
1) authorised purchase orders needed before receiving goods
2) bar codes or RFID
3) budget controls and audits
4a) restrict physical access to inventory
b) document all inventory transfers
c) segregate receiving inventory
163
Approve supplier controls
1) verify invoice accuracy
2a) data entry audit controls
b) reconcile detailed accounts payable records to the general ledger accounts payable accounts
164
Cash disbursement controls
1) file invoices by due date to get discount
2) match supplier invoice to documents
3a) pay original invoices
b) cancel supporting document when payment made
4a) physical security of checks
b) separation of duties
c) reconcile bank accounts
5) check protection machines
6) cash flow budgets
