Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ACW482 AIS > Romney C10: Controls & AIS > Flashcards

Romney C10: Controls & AIS Flashcards

1
Q

Internal controls

A

The processes & procedures implemented to provide reasonable assurance that control objectives are met

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Objectives of Internal Controls

A
  1. Safeguard assets - prevent/detect unauthorized access
  2. Maintain records is sufficient detail to report company assets accurately
  3. Provide accurate & reliable information
  4. Prepare financial reports with established criteria
  5. Promote & improve operational efficiency
  6. Comply with applicable laws & regulations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Threat

A

Any potential adverse occurrence or unwanted event that could injure the AIS or the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Exposure/Impact

A

The potential dollar loss if a particular threat becomes a reality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Likelihood/risk

A

The probability that a threat will come to pass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Functions of Internal Controls

A
  1. Preventive Controls
  2. Detective Controls
  3. Corrective Controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Preventive controls:

A

Controls that deter problems before they arise

Ex: hiring qualified employee, segregating employee duties, and controlling physical assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Detective Controls

A

Controls designed to discover control problems that were not prevented

Ex: Duplicate checking of calculations, bank reconciliations & monthly trial balances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Corrective controls

A

Controls that identify and correct problems as well as correct and recover from the resulting errors

Ex: maintaining back up copies of files, correcting data entry errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

2 Categories of Internal Controls:

A
  1. General controls

2. Application controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

General Controls:

A

Make sure an organization’s control environment is stable and well manage.

Ex: security, IT infrastructure, software acquisition, maintenance controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Application Controls:

A

Prevent, detect and correct transactions errors and fraud in application programed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What Application Controls are concerned with?

A

Accuracy, completeness, validity, and authorization of data captured, entered, processed stored etc
.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Who espoused 4 Levers of Control?

A

Robert Simons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4 Levers of Control (BBDI)

A
  1. A belief system
  2. A boundary system
  3. A diagnostic control system
  4. An interactive control system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Belief system:

A

Describes how a company creates value, help employees understand management’s vision, communicates company core values, and inspires employees to live by those values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Boundary System:

A

Helps employee act ethically by setting boundaries on employees behaviour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Diagnostic Control System

A

Measures, monitors and compares actual company progress to budgets and performance goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Interactive Control System:

A

Helps managers to focus subordinates’ attention on key strategic issues and to be more involved in their decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Foreign Corrupt Practices Act

A

Was passed in 1977 to prevent companies from bribing foreign officials to obtain business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Sarbanes-Oxley Act (SOX)

A

Applies to publicly held companies and their auditors and was designed to prevent financial statement fraud, make financial reports more transparent, protect investors, strengthen IC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Important aspects of SOX:

A
  • Public Company Accounting Oversight Board (PCAOB) was created
  • New rules for auditors - report specific info to company’s audit committee.
  • New roles for audit committee - audit committees must be on the co’s BOD and be independent.
  • New rules for management - CEO & CFO to certify that financial statements are fairly stated and the auditors were told about all material internal control weaknesses & fraud.
  • New internal control requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Control Frameworks:

A
  1. COBIT - Control & Objectives for Information and Related Technology
  2. COSO - Committee of Sponsoring Organization
  3. Control Environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

COBIT - Controls Objectives for Information and Related Technology (COBIT)

A

Control framework that allows:

  1. Management to to benchmark the security and control practices of IT environments
  2. Users of IT services to be assured that adequate security & Control exist
    3: Auditors to substantiate their internal control opinions and advise on IT security & control matters.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

COBIT is

A

describe as best practices for the effective governance and management of IT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

5 Keys of COBIT IT Governance and Management

A
  1. Meeting stakeholder needs
  2. Covering the enterprise end-to-end
  3. Applying a single, integrated framework
  4. Enabling a holistic approach
  5. Separating governance from management.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Objective of Governance

A

To create value by optimizing the use of organizational resources to produce desired benefits in a manner that effectively address risk & reward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q
  1. Meeting stakeholder needs:
A

Helps users customize business processes & procedures to create an information system that adds value to its stakeholders

  • allow company to create proper balance between risk & rewards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Covering the enterprise end-to-end:

A

Integrates all IT functions and processes into companywide functions and processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Applying a single, integrated framework

A

Can be aligned at a high level with another standards & frameworks so that an overarching framework for IT governance & management is created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Enabling a holistic approach

A

Results in effective governance and management of all IT functions in the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Separating governance from management

A

Distinguishes between governance and management

33
Q

Governance & Management Objectives:

A

G:
1. EDM (evaluate, direct & monitor)

M:

  1. APO (align, plan, organize)
  2. BAI (build acquire, implement)
  3. DSS (deliver, service, support)
  4. MEA (monitor, evaluate, assess)
34
Q

Governance Obj: EDM

A

Evaluate strategic options, direct the chosen options, and monitor strategy achievement

35
Q

Management Obj: APO

A

Organization, strategy & supporting activities for I&T

36
Q

BAI

A

Definition, acquisition, and implementation of I&T solutions

37
Q

DSS

A

Operational delivery & support of I&T services

38
Q

MEA - Monitor, evaluate, assess

A

Performance & conformance monitoring I&T

39
Q

Committee of Sponsoring Organizations

A

A private sector group consisting of the American Accounting Association, AICPA, Institute of Internal Auditors, the Institute of Management Accountants & the Financial Executives Institute

40
Q

Internal Control - Integrated Framework (IC)

A

A COSO frameworks that defines internal controls and provides guidance for evaluating and enhancing ICS

41
Q

5 Components & 17 Principles of IC Framework

A

Components:

  1. Control environment
  2. Risk assessment
  3. Control activities
  4. Information & Communication
  5. Monitoring
42
Q

Control Environment:

A

Company’s culture that is the foundation for all other internal control components, as it influences how organizations establish strategies & objective, structure business activities, and identify, assess and respond to risk

43
Q

Control environment consists of:

A
  1. management’s philosophy, operating style & risk appetite
  2. Commitment to intergrity, ethical values & competence
  3. Internal control oversight by the BOD
  4. Organizational structure
  5. Methods of assigning authority & responsibility
  6. HR that attract, develop and retain competent individual
  7. External influences
44
Q

Management’s philosophy, operating style & risk appetite

A

philosophy, or shared beliefs and attitudes, about risk that

affects policies, procedures, oral and written communications, and decisions

45
Q

Risk appetite

A

The amount of risk a company is willing to accept
to achieve its goals and objectives. To avoid undue risk
risk appetite must be in alignment with company strategy.

46
Q

COMMITMENT TO INTEGRITY, ETHICAL VALUES, AND COMPETENCE

A

Companies endorse integrity by:

  • Developing a written code of conduct that explicitly describes honest and dishonest behaviors.
  • Put processes in place to use the company’s code of conduct to evaluate individual and team performance
  • Actively teaching and requiring the code of conduct
  • Avoiding unrealistic expectations that motivate dishonest/illegal acts
47
Q

IC oversight by BOD

A

An involved board of directors represents shareholders and provides an independent review of management that acts as a check and balance on its actions

48
Q

Audit Committee

A

The outside, independent board of director members responsible for financial reporting, regulatory compliance, internal control, and hiring and overseeing internal and external auditors

49
Q

Organizational Structure

A

Company’s organizational structure provides a framework for planning, executing, controlling & monitoring operations

50
Q

important aspects of organizational structure

A
  • de/centralization of authority
  • a direct or matrix reporting relationship
  • organization by industry, product line, location
  • how allocation of responsibility affects information requirements
  • size and nature of company activities
51
Q

Methods of assigning authority and responsibility

A

Authority and responsibility are assigned and communicated using formal job descriptions, employee training, operating schedules, budgets, a code of conduct, and written policies
and procedures.

52
Q

policy and procedures manual

A

a document that explains proper business practices, describes needed knowledge and experience, explains document procedure, explains how to handle transactions and lists the resources provided to carry our specific duties

53
Q

HR standards that attract, develop & retain competent individuals

A

HR policies should convey the required level of expertise, competence, ethical behavior, and integrity required

ex: plan & prepare for succession, hiring, compensating, training, discharging, vacations & job rotations

54
Q

COSO IC Framework: Risk Assessment & Response

A

Management is responsible for identifying & assessing the threats the company faces.

Inherent risk: susceptibility of a set of accounts or transactions to significant control in the absence of internal control

Residual risk: risk that remains after management implements IC/response to risk.

55
Q

4 ways to respond to risk

A
  1. reduce
  2. Accept
  3. Share
  4. Avoid
56
Q

Reduce:

A

reduce the likelihood & impact of risk by implementing an effective system of IC

57
Q

Accept:

A

accept the likelihood and impact of risk

58
Q

Share

A

Share risk/transfer to someone else by buying insurance, outsourcing, entering into hedging transaction

59
Q

Avoid:

A

Avoid risk by not engaging in the activity that produces the risk

60
Q

Expected loss:

A

The mathematical product of the potential dollar loss that would occur should a threat become a reality (called impact or exposure) and the risk or probability that the threat will occur (called likelihood ).

expected loss = impact x likelihood

61
Q

Control Activities

A

policies, procedures, and rules that provide reasonable assurance that control objectives are met and risk responses are carried out

62
Q

Categories of control procedures:

A
  1. Proper authorization of transactions and activities.
  2. Segregation of duties.
  3. Project development and acquisition controls.
  4. Change management controls.
  5. Design and use of documents and records.
  6. Safeguarding assets, records, and data.
  7. Independent checks on performance.
63
Q

Authorization

A

Establishing policies for employees to follow and then empowering them to perform certain organizational functions.

Authorization are often documented by signing, initializing, or entering an authorization code on a document or record

64
Q

digital signature

A

A means of electronically signing a document with data that cannot be forged

65
Q

Specific authorization

A

special approval an employee needs in order to be allowed to handle a transaction

66
Q

General authorization

A

the authorization given employees to handle routing transactions without special approval

67
Q

Segregation of duties:

A

separating the accounting functions of authorization, custody and recording to minimize an employee’s ability to commit fraud.

68
Q

Separation of duties functions

A
  1. authorization: approving transactions and decisions
  2. Recording: preparing source documents, entering data into computer, maintaining journals, ledgers, files or database
  3. custody: handling cash, tools, inventory, FA writing checks etc
69
Q

segregation of system duties:

A

implementing control procedures to clearly divide authority and responsibility within the information system function

70
Q

data entry

A

responsible for entering or capturing the data for all business transactions

71
Q

users

A

people who record transactions, authorize data processing, use system output

72
Q

Personnel Management

A
  1. Systems admin: ensure all info system components operate smoothly
  2. Network managers: ensure that devices are linked to the org’s internal external networks works properly
  3. Security mgmt: ensure systems are secure & protected from internal & external threats
  4. Change mgmt: ensure changes are made smoothly and does not negatively impact system
  5. data control: ensure data sources have been properly control, monitors the flow
    Database admin - responsible for coordinating controlling & managing the database
73
Q

Information & Communication

A

systems should capture and exchange the information needed

to conduct, manage, and control the organization’s operations

74
Q

Primary purpose of AIS

A

to gather, record, process, store, summarize and communicate information about an organization

75
Q

Audit trail

A

Allows transactions to be tracked back and forth between their origination and the FS

76
Q

3 principles Information & communication

A

Obtain/generate relevant, high-quality information to support internal control

Internally communicate the information, necessary to support other components

communicate relevant internal control matters to external parties

77
Q

Monitoring

A

The internal control system that is selected or developed must be continuously monitored, evaluated, and modified as needed

78
Q

Monitoring

A
  • perform internal control evaluations
  • Implement effective supervision
  • use responsibility accounting systems
  • monitor system activities
  • conduct periodic audits
  • employ computer security officer
  • install fraud detection software

ACW482 AIS (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions