1E. Internal Controls

Front 1

Articles of Incorporation

Back 1

Filled in the state in which the corporation is incorporated; provides a basic structure for the company

Front 2

By-laws

Back 2

Contains more detailed information than the articles of incorporation

Front 3

Policies and Procedures

Back 3

Provide structure for the day to day operations of a corporation

Front 4

Audit Committee Members

Back 4

3 to 5 independent directors

Front 5

Sarbanes-Oxley Act of 2002 (SOX)

Back 5

Enacted as a result of massive fraud committed by Enron and WorldCom

Front 6

Public Company Accounting Oversight Board (PCAOB) Member Composition

Back 6

2 CPAs

3 Non-CPAs

Front 7

PCAOB duties (3)

Back 7

The board is subject to oversight by SEC and has the duty to:

1. Register public acctg firms that prepare audit reports

2. Establish rules regarding preparation of audit reports

3. Conduct inspections/investigations

Front 8

Rotation

Back 8

Lead Audit or coordinating partner and the reviewing partner must rotate off the audit engagement every 5 years

Front 9

Foreign Corrupt Practices Act (FCPA)

Back 9

Enacted to prohibit US individuals and entities from paying bribes to advance their business interests

Front 10

Penalties for violation of FCPA

Back 10

1. 5 yrs prison

2. $100k fine

3. Both

Front 11

Inherent Risk

Back 11

The susceptibility of an assertion to a material misstatement

Front 12

Control Risk

Back 12

The likelihood that a misstatement that could occur in an assertion will not be prevented, detected or corrected on a timely basis by the entity's internal control

Front 13

Detection Risk

Back 13

The likelihood that the auditor will not detect a misstatement that exists in the assertion that could be material

Front 14

Emphasis-of-matter paragraph

Back 14

Used when referring to a matter that is appropriately presented or disclosed in the financial statements fundamental to the user's understanding of the FS

Front 15

Other-matter paragraph

Back 15

Matters other than those presented/ disclosed in FS that are relevant to user's understanding of the audit

Front 16

Paragraphs used for nonissuers or privately held companies (2)

Back 16

1. Emphasis-of-matter paragraph

2. Other-matter paragraph

Front 17

Explanatory paragraph

Back 17

For issuers; included when required by PCAOB auditing standards or at auditor's discretion

Front 18

Internal control

Back 18

A process that is designed and implemented by an organization's management, BOD, to provide reasonable assurance that the organization will achieve its operating, reporting, and compliance objectives

Front 19

3 Objectives of Internal Control

Back 19

1. Operations

2. Reporting

3. Compliance

Front 20

5 Components of Internal Control

Back 20

1. Control Activities

2. Risk Assessment

3. Information and Communication

4. Monitoring Activities

5. Control Environment

Hint 20

CRIME

Front 21

Control Environment

Back 21

-Tone at the top

-commitment to ethics and integrity

-board independence and oversight

-organizational structure

-commitment to competence

-accountability

Front 22

Risk Assessment

Back 22

-identification and analysis of risks to achieve objectives

-consider potential for fraud

-identify and assess changes

Front 23

Information and Communication

Back 23

Identification, capture, and exchange of information in a timely and useful manner

Front 24

Monitoring activities

Back 24

Assessing the quality of internal control performance over time

Front 25

Control Activities

Back 25

Set forth by the entity's policies and procedures to ensure that the directives initiated by management to mitigate risks are performed

Front 26

System Flowcharts

Back 26

Shows document origin, subsequent processing, and final disposition

Front 27

Program Flowchart

Back 27

IT flowchart that documents the logic and flow of a computer program

Front 28

Narratives

Back 28

Written version of a flowchart that describes the internal control system

Front 29

Preventive Controls

Back 29

Proactive measures designed to prevent errors and fraud

Front 30

Detective Controls

Back 30

Designed to provide reasonable assurance that errors and irregularities will be detected and corrected on a timely basis

Front 31

Safeguarding Controls

Back 31

Limit access to authorized personnel

Front 32

Physical Controls

Back 32

Security devices and limited access to programs and restricted areas

Front 33

Segregation of Duties (4)

Back 33

Custody

Authorization

Recording

Execution

Front 34

Input Controls

Back 34

Designed to ensure the data being entered in the system is both factually accurate and properly authorized

Front 35

Processing Controls

Back 35

Designed to ensure that transformations to the input data are executed correctly

Front 36

Output Controls

Back 36

Ensure that processing results are presented in a useful state to authorized persons

Front 37

Storage Controls

Back 37

Ensure that appropriate records are retained, retrieved, and accessed by authorized people and processes

Front 38

Phishing

Back 38

E-mails are used to coax an employee to provide access credentials

Front 39

Trojan Horse

Back 39

Apparently benign program or application that contains malicious script or program designed to steal data, alter files, or destroy systems

Front 40

Ransomware

Back 40

Encryption of data by an attacker who demands payment to decrypt data

Front 41

Viruses

Back 41

Programs that invade host systems, replicate, and hide within the system while carrying out a mission

Front 42

Encryption

Back 42

Computer algorithm that encodes data from a readable to unreadable state

Front 43

Firewalls

Back 43

Network security system that monitor, control, and restrict incoming and outgoing traffic

Front 44

Business Continuity Planning

Back 44

Process of creating plans and pre-positioning assets to allow a business to function during and after a business disruption

Front 45

5 steps in Disaster Recovery

Back 45

1. Assess Risk

2. Identify mission-critical applications and data

3. Develop plans to handle mission-critical applications

4. Determine personnel responsibilities in disaster recovery

5. Test Disaster Recovery Plan

Front 46

Full backup

Back 46

Exact copy of the entire database

Front 47

Incremental Backup

Back 47

Restoration starts from last full backup with each incremental backup in sequence thereafter

Front 48

Differential backup

Back 48

Back up all items changed since prior full backup

Front 49

Cold Site

Back 49

Off-site; electrical connections and physical data processing requirements

Front 50

Hot-site

Back 50

Off-site; equipped to quickly take over data processing, personnel must relocate to off-site facility to restore function

Front 51

Warm-site

Back 51

Stocked with hardware needed to create a data center facsimile; represents a compromise between hot-site speed and cold-site cost