Acc 324 Test 2

Front 1

Organizational Governance

Back 1

a process of which organizations select objectives, establish processes to achieve objectives, and monitor performance.
*Determine Objectives: Mission, Vision, Purpose, Strategy

Front 2

Enterprise Risk Management (ERM):

Back 2

a process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may effect the entity, and manage risk to be within appetite, to provide reasonable assurance regarding the achievement of entity objectives.

Front 3

*You can’t mitigate a plan if you don’t know the risk.
**Underlying Principles: Every entry exists to create value & Value is directly correlated with management decision
***Enables MGT to: Deal effectively with uncertainty (risk) & Reduce risk while increasing opportunity.

Back 3

*You can’t mitigate a plan if you don’t know the risk.
**Underlying Principles: Every entry exists to create value & Value is directly correlated with management decision
***Enables MGT to: Deal effectively with uncertainty (risk) & Reduce risk while increasing opportunity.

Front 4

Internal Environment

Back 4

tone at the to, philosophy of risk management, the entity is risk culture, considers how decisions affect risk

Front 5

Objective Setting:

Back 5

form management’s risk appetite for the entity, also helps us weigh risk TOLERANCE and align us with risk appetite

Front 6

Event Identification

Back 6

: differentiates risk from opportunities, the idea to determine where significant risk and opportunity are present in the org.

Front 7

Risk Assessment

Back 7

appetite for risk, capacity of risk, how to identify risk

Front 8

-Risk Response

Back 8

avoiding, accepting, reducing, or sharing risk

Front 9

Control Activities

Back 9

procedures to control above actions

Front 10

Monitoring

Back 10

: ensuring process is being implemented correctly

Front 11

Components of Enterprise Management

Back 11

Internal Environment
Objective Setting
Event Identification
-Risk Assessment
Risk Response
Control Activities
Monitoring:

Front 12

risk

Back 12

the possibility that an event or action will cause an organization to fail to meet its objectives.

Front 13

process

Back 13

: a series of actions or operations leading to a particular and usually desirable result

Front 14

Internal Control

Back 14

: a process-effected by an entity’s board of directors, management, and other personnel-designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of reporting, and compliance with applicable laws and regulations.

Front 15

fraud

Back 15

a deliberate act or untruth intended to obtain unfair or unlawful gain.

Front 16

Under law 4 things must be present to classify as fraud

Back 16

(1) Material false statement
(2) Knowledge that statement was false
(3) Reliance on the statement by the victim
(4) Damages (loss) resulting from (3)
**Civil: preponderance of evidence
**Criminal: 100% conviction

Front 17

Abuse: a deceitful act / a corrupt practice or custom

Types of abuse?

Back 17

-“Taking sick days when not sick”
-Surfing the web at work
-Borrowing company equipment

Front 18

Classic “Red Flags”…

Back 18

(1) Unduly aggressive earnings targets
(2) Mgt compensation based on (1)
(3) Financial Statements require significant estimates
(4) Related party transactions

Front 19

The Fraud Process

Back 19

(1)Theft-->(2)Conversion to Cash-->(3)Concealment

Front 20

The Fraud Triangle

Back 20

Opportunity
Pressure
Rationalization

Front 21

Computer Crime

Back 21

crime in which the computer is the target of the crime or the means used to commit the crime

Front 22

Computer Fraud Classifications

Back 22

Data, Input, Process, Output, Computer Instruction (Fraud)

Front 23

*Computer Fraud and Abuse Techniques

Back 23

Social Engineering, Fishing, Dumpster Diving

Front 24

Computer Virus

Back 24

program code that can attach itself to other programs (including macros within word processing documents), thereby “infecting” those programs and macros.

Front 25

Control Matrix

Back 25

a tool designed to assist in evaluating the potential effectiveness of controls in a business process by matching control goals with relevant control plans.

Front 26

Control Environment:

Back 26

a state of control consciousness that reflects the organization’s (primarily the board of director’s and management’s) general awareness of and communication to the importance of control throughout the organization. (Overall policies and procedures that demonstrate an organization’s commitment to the importance of control).

Front 27

-Ethics & Control

Back 27

-COSO Report stresses ethics as a part of control environment (tone at top)
-AICPA has built ethics issues into CPA exam
-The institute of MGT. accountants has a code of ethics which also is tested on the CMA and CFM exams.
-Internal auditing has ethics

Front 28

Framework for Ethical Decision Making

Back 28

Ethics is NOT…
•Feelings, religion, following law, culturally accepted norms, science

Front 29

-Ethical Steps (approaches)

Back 29

Recognize ethical issue
-Get facts
-Evaluate alternative actions from various perspectives
-Which option will produce the most good & least harm

Front 30

Ethical Approaches

Back 30

Utilitarian: produces most good & does least amount of harm
-Rights: humans have rights & choice to do so as they please. Impair rights or choices of ppl.
-Fairness or Justice approach: treat equally or proportionally if that’s better.
-Common God approach: best for most (welfare for everyone)
-Virtue approach: action consistent with being best
**Make a decision and test it  Ace, the reflect on the decision later

Front 31

Education Employees
Texas Instruments established a Quick Test for educating employees about what is right or wrong:

Back 31

Is this action legal?
Does it comply with our values?
If you do it, will you feel bad?
How’s it look in the newspaper

Front 32

Control Goals

Back 32

business process objectives that an internal control system is designed to achieve

Front 33

Effectiveness

Back 33

a measure of success in meeting one of more goals for the operations process.

Front 34

Efficiency

Back 34

a measure of the productivity of the resources applied to achieve a set of goals.

Front 35

Security of Resources

Back 35

protecting an organization’s resources from loss, destruction, copying, sale, or other misuse.

Front 36

Input Validity

Back 36

input data are appropriately approved and represent actual economic events

Front 37

-Input Completeness

Back 37

all valid events or objects are captured and entered into a system

Front 38

-Input Accuracy

Back 38

all valid events must be correctly captured and entered into a system.

Front 39

Update Completeness

Back 39

: all events must be entered into a system must be reflected in the respective master data

Front 40

Update Accuracy

Back 40

data entered into a system must be reflected correctly in the respective master data.

Front 41

Control Plans

Back 41

information-processing policies and procedures that assist in accomplishing goals

Front 42

Pervasive Control Plans

Back 42

control plans that relate to a multitude of goals and processes. Like the control environment, they provide a climate or set of surrounding conditions in which the various business processes operate. They are broad in scope and apply equally to all business processes; hence, they pervade all systems. (Address multiple goals and apple to many processes)

Front 43

General Controls or IT General Controls

Back 43

are applied to all IT activities. For example, preventing unauthorized access to a computer system would protect all the specific business processes that run on the computer (such as order entry/sales, billing/accounts receivable/cash receipts, inventory, payroll, and so on.

Front 44

Business Process Control Plans

Back 44

plans that relate those particular controls specific to a business process, such as billing or cash receipts. (Relate to specific AIS process or to the technology used to implement the process).

Front 45

Application Controls

Back 45

automated business process controls contained within IT application systems (i.e., computer programs).

Front 46

Preventive Control Plans

Back 46

a control plan that is designed to stop problems from occurring.

Front 47

Detective Control Plans

Back 47

discover that problems have occurred

Front 48

Corrective Control Plans

Back 48

rectify problems that have occurred

Front 49

Which control plan is best?

Back 49

preventative, but unrealistic so we would want a combination of the preventive, detective, and corrective

Front 50

IT Governance

Back 50

the responsibility of executives and board of directors, and consists of the leadership, and organizational structures, and processes that ensure the enterprise’s IT sustains and extends the organization’s strategies and objectives.
*Businesses with superior IT governance practices generated 20% greater profits on average

Front 51

IT Resources

Back 51

Applications, Information, Infrastructure, Ppl. (Ppl are weakest link)

Front 52

CIS-“Thin”

Back 52

*1960-1980: No data; No processing on the client

Front 53

-PC-“Thick

Back 53

1981-1995: Data & Processing take place on client
-“Distributed Processing” a lot more control
*1996-Present: Thin Why & How?
Control & Broadband Internet

Front 54

IT Control Domains and Processes

Back 54

*Planning and Operatioms
*Acquisition and Implementation
*Delivery and Support
*Monitoring

Front 55

Segregation of Duties

Back 55

separating the four basic functions of event processing

Front 56

4 functions of SOD

Back 56

Function 1: Authorizing Events(Segregation)-approve phases of event processing
Function 2: Executing Events- physically move resources, complete source documents
*Function 3: Recording Events- record entries in books of original entry, post event summaries to general ledger
*Function 4: Safeguarding resources resulting from consummating events(custody)- physically protect resources, maintain accountability of physical evidence.
**Through the design of an appropriate organizational structure, no single employee should be in a position both to perpetrate and conceal frauds, errors, or other kinds of system failures

Front 57

Security Officer

Back 57

performs a multitude of control-related activities such as monitoring employees’ network access, granting security clearance for sensitive projects, and working with human resources to ensure that interview practices, such a background checks, are conducted during the hiring process.

Front 58

IT Steering Committee

Back 58

coordinates the organizational and IT strategic planning processes and reviews and approves strategic IT plan. Provides significant help to the org. in establishing and meeting user information requirements and in ensuring the effective and efficient use of the org.’s IT resources. Consists of 7 execs from major functional areas of the org

Front 59

PERSONNEL CONTROL PLANS

Back 59

Selection and Hiring: candidates should be carefully screened, selected and hired. Qualified, technically competent, HONEST & TRUSTWORTHY
-Retention Control Plans: provide opportunity for advancement and challenges & offer open channels to mngmt.
-Personnel Development: training must be permanent, regular, & not haphazard.
-Personnel Management Control Plans: project future managerial and technical skills of the staff, anticipate turnover and develop a strategy for filling necessary positions.

Front 60

Rotation of Duties

Back 60

: a policy that requires an employee to alternate jobs periodically

Front 61

Forced Vacations

Back 61

policy that requires an employee to take leave from the job and substitutes another employee.
*So that is an employee is doing something irregular, the irregularity will be detected

Front 62

Fidelity Bonds

Back 62

indenifies a company in case it suffers a losses from defalcations committed by its employees. Employees who have access to cash and other negotiable assets are usually bonded. (Banking)

Front 63

Termination Control Plans

Back 63

define a set of procedures a company follows when an employee voluntarily or involuntarily leaves an organization.

Front 64

Systems Development Life Cycle (SDLC):

Back 64

the progression of information systems through the systems development process, from birth, through implementation, to ongoing use.

Front 65

Program Change Controls

Back 65

provide assurance that all modifications to programs are authorized and that the changes are completed, tested, and properly implemented.
*DevelopmentTesting (Quality Assurance)StagingProduction

Front 66

Business Continuity Planning-(aka: Disaster Recovery Planning, Contingency Planning, Business Interruption Planning)

Back 66

Process that identifies events that may threaten and organization and provides a framework to ensure that the org. will continue to operate when the threatened event occurs, or will resume operations with a minimum operation

Front 67

Backup

Back 67

we periodically make a copy of information stored data and documentation. They are typically stored in a secure location not located near the primary facility

Front 68

Recovery

Back 68

process whereby we restore the lost data and resume operations. Need not to be at an alternative site

Front 69

Continuous Data Protection (CDP

Back 69

data must be replicated in real-time on primary and secondary systems. This strategy is whereby all data changers are data stamped and saved to secondary as the changes are happening on the primary.
*Is a process for continuous and immediate replication of any data changes

Front 70

Mirror Site

Back 70

site that maintains copies of the primary site’s programs and data

Front 71

Electronic Valuting

Back 71

a service whereby data changes are automatically transmitted over the Internet on a continuous basis to an off-site server maintained by the third party.

Front 72

-Hot Site

Back 72

: fully equipped data center, often housed in bunker-like facilities, that can accommodate many businesses and that is made available to client companies for monthly subscriber fees.

Front 73

Cold Site

Back 73

less costly, less responsive site. A facility usually comprised of air-conditioned space with a raised floor, telephone connections, and computer ports into which a subscriber can move equipment.

Front 74

Denial-of-Service Attack

Back 74

a web site is overwhelmed by an intentional onslaught of thousands of simultaneous messages, making it impossible for the attacked site to engage in its normal activities.

Front 75

Distributed Denial-of-Service Attack

Back 75

: uses many computers that unwillingly cooperate in a denial-of-service-attack by sending messages to the target web sites.

Front 76

Biometric Identification Systems

Back 76

identify authorized personnel through some unique physical trait such as fingers, hands, voice, eyes, face, writing dynamics, and the like. Most common read fingerprints

Front 77

Security Module

Back 77

access control software that (1) ensure that only authorized users gain access to a system through a process of identification (e.g., a unique number given to each user) and authentication (e.g., a password to verify that the user is who they say they are), (2) associate with authorized users the computing resources they are permitted to access the privileges (e.g., read, copy, write data) they have with respect to those resources (access rights), and (3) report violations attempts.

Front 78

Firewall

Back 78

technique to protect one network from another “untrusted” network, may be used to protect the system from the Internet by blocking certain kinds of traffic from flowing into or out of the organization.

Front 79

-Intrusion Detection Systems (IDS):

Back 79

used to monitor a system and network resources and activities and “learn” how users typically behave on the system. The typical behavior is accumulated in user profiles.

Front 80

*IDS’s can be used to detect attacks from outside the org. such as denial-of-service attacks, or from inside the org., when authorized users attempt to undertake unauthorized actions

Back 80

*Organizations not wanting to wait until an unauthorized activity has occurred might emply an Intrusion-Prevention System (IPS) to actively block unauthorized traffic using rules specified by the organization.

Front 81

Library Controls:

Back 81

-Library Controls: restrict access to data, programs, and documentation. They are provided by a librarian function, a combination of people procedures, and computer software that serves two major purposes
*First, library controls limit the use of stored data, programs, and documentation to authenticated users with authorized requests
*Second, they maintain storage media

Front 82

Computer Hacking and Cracking

Back 82

: reflects the intentional, unauthorized access to an org’s computer system, accomplished by bypassing the system’s access security controls.

Front 83

Preventive Maintenance

Back 83

periodic cleaning, testing, and adjusting of computer equipment to ensure its continued efficient and correct operation.

Front 84

Document Design

Back 84

a control plan in which a source document is designed to make it easier to prepare the document initially and later input data from the document.
*We tend to fill in a well-designed document completely and legibly. If a document is legible, data entry errors will occur less frequently.

Front 85

Written Approvals

Back 85

a signature or initials on a document to indicate that an event has been authorized. Ensures that the data input arises from a valid business event and that appropriate authorizations have been obtained

Front 86

Electronic Approvals

Back 86

using a computer system’s workflow facility to route business events to persons authorized to approve the event online.

Front 87

Preformatted Screens

Back 87

: a computer screen designed to control the entry of data by defining the acceptable format of each data field, automatically moving to the next field, requiring that certain fields are completed, and/or automatically by populating fields.
Simplifying data input

Front 88

Online Prompting

Back 88

: a control plan that requests user input or asks questions that the user must answer.

Front 89

Populate Input Screens with Master Data

Back 89

: a control plan that operates when a clerk enters the identification code for an entity, such as a customer, and the system retrieves data about that entity from the master data, to eliminate the need for re-entry of those data.

Front 90

Compare Input Data with Master Data

Back 90

a process to determine the accuracy and validity of the input data. Such comparisons may be done manually or by the computer.

Front 91

Procedures for Rejected Inputs

Back 91

a control plan designed to ensure that erroneous data (i.e, not accepted for processing) are corrected and resubmitted for processing

Front 92

Programmed Edit Checks

Back 92

an edit that is automatically performed by data entry programs upon entry of the input data
*The edits identify erroneous or suspect data and reduce input errors.

Front 93

Document/Record Hash Totals

Back 93

reflect a summarization of any numeric data field within the input document or record, such as item numbers or quantities on a customer order. The totaling of these numbers typically serves no purpose other than as a control. Calculated before an then again after entry of the document or record, this total can be used to determine that the applicable fields were entered accurately and completely.

Front 94

Mathematical Accuracy Checks

Back 94

compare calculations performed manually to those performed by the computer to determine whether a document has been entered correctly. For this check, the user might enter the individual item (e.g., quantity purchased, unit cost, tax, shipping cost) on a document, such as an invoice, and the total for that document. Then the computer adds the individual items and compares that the total to the one input by the user

Front 95

Check Digit Verification

Back 95

: involves the inclusion of an extra digit—a check digit—in the identification number of entities such as customers and vendors. More than likely, you have a check digit as part of the ID on your ATM card.
*The digit 6 might be appended to the customer code123 so the entire ID becomes 1236

Front 96

Confirm Input Acceptance

Back 96

this control causes the data entry program to inform the user that the input has been accepted for processing. The program may flash a message on the screen telling a user that the input has been accepted, or it might display a number assigned to the event.

*After input of a customer number, the computer might display the internal sales order number that will be used to track the sale.

Front 97

Automated Data Entry

Back 97

a strategy for the capture and entry of event-related data using technology such as OCR, bar codes, RFID, and EDI. These methods use fewer human resources and capture more data in a period of time than is possible with manual entry. Improves accuracy of entered data & can validate authenticity of the entered data.
*By eliminating manual keying and using scanning and other technology, the input accuracy is improved

Front 98

Enter Data Close to the Originated Sourced

Back 98

: a strategy for the capture and entry of event-related data close to the place that an event occurs. Online transaction entry (OLTE) and online real-time processing (OLRT) are examples of this strategy. Databases are more current and subsequent events can occur in a timelier manner.
*B/C operations personnel or business partners are familiar with the event being entered, they are less likely to make input errors and can more readily correct these errors if they occur.

Front 99

Digital Signature

Back 99

: this technology validates the identity of the sender of an electronic message to reduce the risk that a communication was sent by an unauthorized system or user or was intercepted/modified in transit.
*Detects messages that have been altered in transit, thus preventing input of inaccurate data.