Unit 6 - Module 12

Question 1

Under Section 404 of Sarbanes Oxley, management is required to provide an annual report addressing the following points:

Answer 1

Describe the flow of transactions, including IT aspects, in sufficient detail to identify points at which a misstatement could arise.

Using a risk-based approach, assess both the design and operating effectiveness of selected internal controls related to material accounts.Footnote

Assess the potential for fraud in the system and evaluate the controls designed to prevent or detect fraud.

Evaluate and conclude on the adequacy of controls over the financial statement reporting process.

Evaluate entity-wide (general) controls that correspond to COSO internal control framework.

Question 2

general computer controls

Answer 2

Specific activities performed by persons or systems designed to ensure that business objectives are met.

Question 3

information technology controls

Answer 3

Include controls over IT governance, IT infrastructure, security, and access to operating systems and databases, application acquisition and development, and program changes.

Question 4

Information Technology Control Relationship

Answer 4

Question 5

The General Model for Accounting Information Systems

Answer 5

Question 6

Program fraud

Answer 6

Techniques such as creating illegal programs that can access data files to alter, delete, or insert values into accounting records; destroying or corrupting a program’s logic using a computer virus; or altering program logic to cause the application to process data incorrectly.

Question 7

Operations fraud

Answer 7

Misuse or theft of the firm’s computer resources.

Question 8

Database management fraud

Answer 8

Altering, deleting, corrupting, destroying, or stealing an organization’s data.

Question 9

scavenging

Answer 9

Searching through the trash of the computer center for discarded output.

Question 10

eavesdropping

Answer 10

Listening to output transmissions over telecommunications lines.

Question 11

Organizational Chart of a Centralized Information Technology Function

Answer 11

Question 12

Tests of controls include

counting cash.
completing questionnaires.
counting inventory.
confirming accounts receivable.

Answer 12

completing questionnaires.

The correct answer is “completing questionnaires.” Tests of controls include completing questionnaires. The Sarbanes-Oxley Act requires that management certify that the financial statements are correct. In order to ensure that the financial statements are, in fact correct, accounting processes and information systems will be built with checks, balances and controls. Auditors will use questionnaires to guide their approach to testing the controls in the system. Questions include topics such as “Is fraud awareness training carried out?” and “Do particularly critical or sensitive activities require two levels of authority?”

Question 13

Control risk is

• the likelihood that the control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accounts.
• associated with the unique characteristics of the business or industry of the client.
• the probability that the auditor will render an unqualified opinion on financial statements that are materially misstated.
• the risk that errors not detected or prevented by the control structure will also not be detected by the auditor.

Answer 13

the likelihood that the control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accounts.

The correct answer is “the likelihood that the control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accounts.” Control risk is the likelihood that the control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accounts. Auditors assess the level of control risk by performing tests of internal controls. An auditor could create test transactions, including some with incorrect total values, which are processed by the application in a test run. The results of the test will indicate that price extension errors are not detected and are being incorrectly posted to the AR file.

Question 14

Which is the most critical segregation of duties in the centralized IT function?

data preparation from data control
data control from data librarian
data operations from data librarian
systems development from computer operations

Answer 14

systems development from computer operations

The correct answer is “systems development from computer operations.” The most critical segregation of duties in the centralized IT function is systems development and computer operations. Access to the data center must be very carefully controlled to comply with SOX. This includes both physical and electronic access. Once the system is turned over to operations, developers lose their access to the live system. Should an error occur, the developers will diagnose the error in their development copy or in a test system. When the error is corrected, the update will be turned over to operations for installation.

Question 15

Segregation of duties in the computer-based information system includes

performing independent verifications by the computer operator.
separating the programmer from the computer operator.
preventing management override.
separating the inventory process from the billing process.

Answer 15

separating the programmer from the computer operator.

Question 16

Systems development is separated from data processing activities because failure to do so

-results in master files being inadvertently erased.
-weakens database access security.
-allows programmers access to make unauthorized changes to applications during execution.
-results in inadequate documentation.

Answer 16

allows programmers access to make unauthorized changes to applications during execution.

The correct answer is “allows programmers access to make unauthorized changes to applications during execution.” Systems development is separated from data processing activities because failure to do so allows programmers access to make unauthorized changes to applications during execution. Consolidating these functions invites fraud. With detailed knowledge of an application’s logic and control parameters along with access to the computer operations, an individual could make unauthorized changes to application logic during program execution. Such changes may be temporary (in real-time) and will disappear with little or no trace when the application terminates.