Acct 321 (C.7) Control And Aiss

Front 1

Threat / Event

Back 1

Any potential adverse occurrence or unwanted event that could inujure the AIS or the organization.

Front 2

Exposure / Impact

Back 2

The potential dollar loss should a particular threat become a reality.

Front 3

Likelihood

Back 3

The probability that a threat will come to pass.

Front 4

Internal Controls

Back 4

The processess and procedures implemented to provide reasonable assurance that control objectives are met.

Front 5

Preventive Controls

Back 5

Controls that deter problems before they arise.

Front 6

Detective Controls

Back 6

Controls designed to discover control problems that were not prevented.

Front 7

Corrective Controls

Back 7

Controls that identify and correct problems as well as correct and recover from the resulting errors.

Front 8

General Controls

Back 8

Controls designed to make sure an organization's information system and control environment are stable and well managed.

Front 9

Application Controls

Back 9

Controls that prevent, detect, and correct transaction errors and fraud in application programs.

Front 10

Belief System

Back 10

System that describes how a company creates value, helps employees understand management's vision, communicates company core values, and inspires employees to live by those values.

Front 11

Boundary System

Back 11

System that helps employees act ethically by setting boundaries on employee behavior.

Front 12

Diagnostic Control System

Back 12

System that measures, monitors, and compares actual company progress to budgets and performance goals.

Front 13

Interactive Control System

Back 13

System that helps managers to focus subordinates' attention on key strategic issues and to be more involved in their decisions.

Front 14

Foreign Corrupt Practices Act (FCPA)

Back 14

Legislation passed to prevent companies from bribing foreign officials to obtain business; also requires all publicly owned corporations maintain a system of internal accounting controls.

Front 15

Sarbanes-Oxley Act (SOX)

Back 15

Legislation intended to prevent financial statement fraud, make financial reports more transparent, provide protection to investors, strengthen internal controls at public companies, and punish executives who perpetrate fraud.

Front 16

Public Company Accounting Oversight Board (PCAOB)

Back 16

A board created by SOX that regulates the auditing profession; created as part of SOX.

Front 17

Control Objectives for Information and Related Technology (COBIT)

Back 17

A security and control framework that allows 1) management to benchmark the security and control practices of IT environments, 2) users of IT services to be assured that adequate security and control exist, and 3) auditors to substantiate their internal control opinions and advise on IT security and control matters.

Front 18

Committee of Sponsoring Organizations (COSO)

Back 18

A private sector group consisting of the American Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the Financial Executives Institute.

Front 19

Internal Control - Integrated Framework (IC)

Back 19

A COSO framework that defines internal controls and provides guidance for evaluating and enhancing internal control systems.

Front 20

Enterprise Risk Management Integrated Framework (ERM)

Back 20

A COSO framework that improves the risk management process by expanding (adds three additional elements) COSO's Internal Control - Integrated.

Front 21

Internal Environment

Back 21

The company culture that is the foundation for all other ERM components as it influences how organizations establish strategies and objectives; structure business activities; and identify, assess, and respond to risk.

Front 22

Risk Appetite

Back 22

The amount of risk a company is willing to accept to achieve its goals and objectives. To avoid undue risk, risk appetite must be in alignment with company strategy.

Front 23

Audit Committee

Back 23

The outside, independent board of director members responsible for financial reporting, regulatory compliance, internal control, and hiring and overseeing internal and external auditors.

Front 24

Policy and Procedures Manual

Back 24

A document that explains proper business practices, describes needed knowledge and experience, explains document procedures, explains how to handle transactions, and lists the resources provided to carry out specific duties.

Front 25

Background Check

Back 25

An investigation of a prospective or current employee that involves verifying their educational and work experience, talking to references, checking for a criminal record or credit problems, and examining other publicly available information.

Front 26

Strategic Objectives

Back 26

High-level goals that are aligned with and support the company's mission and create shareholder value.

Front 27

Operations Objectives

Back 27

Objectives that deal with the effectiveness and efficiency of company operations and determine how to allocate resources.

Front 28

Reporting Objectives

Back 28

Objectives that help ensure the accuracy, completeness, and reliability of company reports; improve decision-making; and monitor company activities and performance.

Front 29

Compliance objectives

Back 29

Objectives to help the company comply with all applicable laws and regulations.

Front 30

Event

Back 30

A positive or negative incident or occurrence from internal or external sources that affects the implementation of strategy with the achievement of objectives.

Front 31

Inherent risk

Back 31

The susceptibility of a set of accounts or transactions to significant control problems in the absence of internal control.

Front 32

Residual risk

Back 32

The risk that remains after management implements internal controls or some other response to risk.

Front 33

Expected Loss

Back 33

The mathematical product of the potential dollar loss that would occur should a threat become a reality (called impact or exposure) and the risk or probability that the threat will occur (called likelihood).

Hint 33

Expected loss = impact X likelihood

Front 34

Control activities

Back 34

Policies, procedures, and rules that provide reasonable assurance that control objectives are met and risk responses are carried out.

Front 35

Authorization

Back 35

Establishing policies for employees to follow and then empowering them to perform certain organizational functions. Authorizations are often documented by signing, initializing, or entering an authorization code on a document or record.

Front 36

Digital signature

Back 36

A means of electronically signing a document with data that cannot be forged.

Front 37

Specific authorization

Back 37

Special approval an employee needs in order to be allowed to handle a transaction.

Front 38

General authorization

Back 38

The authorization given employees to handle routine transactions without special approval.

Front 39

Segregation of accounting duties

Back 39

Separating the accounting functions of authorization, custody, and recording to minimize an employee's ability to commit fraud.

Front 40

Collusion

Back 40

Cooperation between two or more people in an effort to thwart internal controls.

Front 41

Segregation of systems duties

Back 41

Implementing control procedures to clearly divide authority and responsibility within the information system function.

Front 42

Systems administrator

Back 42

Person responsible for making sure the system operates smoothly and efficiently.

Front 43

Network manager

Back 43

Person responsible for ensuring that applicable devices are linked to the organization's networks and that the networks operate properly.

Front 44

Security Management

Back 44

People that make sure systems are secure and protected from internal and external threats.

Front 45

Change management

Back 45

Process of making sure changes are made smoothly and efficiently and do not negatively affect systems reliability, security, confidentiality, integrity, and availability.

Front 46

Users

Back 46

People who record transactions, authorize data processing, and use system output.

Front 47

Systems analyst

Back 47

People who help users determine their information needs and design systems to meet those needs.

Front 48

Programmers

Back 48

People who take the analysts' designs and develop, code, and test computer programs.

Front 49

Computer operators

Back 49

People who operate the company's computers.

Front 50

Information system Library

Back 50

A collection of corporate data bases, files, and programs stored in a separate storage area and managed by the system librarian.

Front 51

Data control group

Back 51

People who ensure that source data is properly approved, monitor the flow of work, reconcile systems input and output, handle input errors to ensure their correction and resubmission, and distribute systems output.

Front 52

Steering committee

Back 52

An executive level committee to plan and oversee the information systems function.

Front 53

Strategic Master Plan

Back 53

A multiple year plan that lays out the projects the company must complete to achieve its long-range goals and the resources needed to achieve the plan.

Front 54

Project Development Plan

Back 54

A document that shows how a project will be completed.

Front 55

Data Processing Schedule

Back 55

A schedule that shows when each data processing task should be performed.

Front 56

System Performance Measurements

Back 56

Ways to evaluate and assess a system.

Front 57

Throughput

Back 57

The amount of work performed by a system during a given period of time.

Front 58

Utilization

Back 58

The percentage of time a system is used.

Front 59

Response Time

Back 59

How long it takes for a system to respond.

Front 60

Postimplementation Review

Back 60

Review, performed after a new system has been operating for a brief period, to ensure that it meets its planned objectives.

Front 61

Systems Integrator

Back 61

An outside party hired to manage a company's systems development efforts.

Front 62

Analytical Review

Back 62

Examination of the relationships between different sets of data.

Front 63

Audit Trail

Back 63

A path that allows a transaction to be traced through a data processing system from point of origin to output or backward from output to point of origin.

Front 64

Computer Security Officer (CSO)

Back 64

An employee independent of the information system function and monitors the system, disseminates information about improper system uses and the consequences, and reports to top management.

Front 65

Chief Compliance Officer (CCO)

Back 65

Employee responsible for all the compliance tasks associated with SOX and other laws and regulatory rulings.

Front 66

Forensic Investigators

Back 66

Individuals who specialize in fraud, most of whom have specialized training with law enforcement agencies such as the FBI or IRS or have professional certifications such as certified fraud examiner CFE.

Front 67

Computer Forensics Specialists

Back 67

Computer experts who discover, extract, safeguard, and document computer evidence such that its authenticity, accuracy, and integrity will not succumb to legal challenges.

Front 68

Neural Networks

Back 68

Computing systems that imitate the brain's learning process by using a network of interconnected processors that perform multiple operations simultaneously and interact dynamically.

Front 69

Fraud Hotline

Back 69

A phone number employees can call to anonymously report fraud and abuse.