Ais Ch 6

Front 1

any potential adverse occurrence or unwanted event that could be injurious to either the AIS or the organization is referred to as a

Back 1

threat or event

Front 2

the potential dollar loss of a threat is referred to as

Back 2

exposure or impact

Front 3

the process implemented by the board of directors management and those under their direction to provide reasonable assurance that the following control objectives are achieved

Back 3

safeguarding assets, maintaining records, providing accurate and reliable information, providing reasonable assurance that financial reporting is prepared in accordance with GAAP, promoting and improving operational efficiency, encouraging adherence to managerial policies, and complying with laws and regulations

Front 4

preventative controls would include

Back 4

hiring qualified accounting personnel, appropriately segregating employee duties, effectively controlling physical access to assets, facilities and information

Front 5

examples of detective controls

Back 5

duplicate checking of calculations, bank reconciliations and trial balances

Front 6

corrective controls include

Back 6

maintaining backup of transaction and master files and adhering to procedures for correcting data entry errors

Front 7

internal controls are often segregated into two categories

Back 7

general controls and application controls

Front 8

some of the more important general controls are

Back 8

information systems management controls, security management controls, and IT infrastructure controls

Front 9

application controls perform what function

Back 9

prevent detect and correct transaction errors and fraud, they concern themselves with accuracy completeness, validity and authorization of data captured

Front 10

new rules under SOX are

Back 10

auditors must report specific information to the audit committee; audit partners must be rotated periodically; auditors must not perform certain nonaudit services such as bookkeeping, information systems design and implementation, internal audit outsourcing services, management functions, and human resource services CEO and CFO must certify that financial statements are fairly presented and not misleading

Front 11

the four levels of control are

Back 11

belief system, boundary system, diagnostic control system, interactive control system

Front 12

this communicates company core values to employees and inspires the employees to live this way

Back 12

belief system

Front 13

this helps employees act ethically by setting limits beyond which an employee must not pass

Back 13

boundary system

Front 14

this measures company progress by comparing actual performance to planned performance

Back 14

diagnostic control system

Front 15

this helps top-level managers with high-level activities that demand frequent and regular attention, such as developing strategy, etc

Back 15

interactive control system

Front 16

COBIT

Back 16

Control Objectives for Information and Related Technology

Front 17

COBIT is a framework of generally applicable information systems security and control practices that allows

Back 17

management to benchmark the security and control practices of the IT environments, users of the IT services to be assured that adequate security and control exist, and auditors to substantiate their opinions on internal control and to advise on IT security and control matters

Front 18

COBIT framework addresses the issue of control from three dimensions

Back 18

Business objectives, IT resources and IT processes

Front 19

What are the seven categories that map into the COSO objectives

Back 19

effectiveness, efficiency, confidentiality, integrity, availability, and compliance with legal requirements, and reliability

Front 20

the five interrelated components of COSO's internal control model

Back 20

control environment, control activities, risk assessment, information and communication, monitoring

Front 21

The intent of ERM is to achieve all the goals of the control framework and help the organization to

Back 21

provide reasonable assurance that company objectives and goals are achieved, achieve its financial and performance targets, assess risks continuously and identify steps to take, and avoid adverse publicity and damage

Front 22

the four types of objectives that management must meet to achieve company goals

Back 22

strategic objectives, operations objectives, reporting objectives, compliance objectives

Front 23

high level goals that are aligned with and support the company's mission,

Back 23

strategic objectives

Front 24

goals that deal with the effectiveness and efficiency of company operations, such as performance and profitability goals and safeguarding assets

Back 24

operations objectives

Front 25

help insure the accuracy, completeness, and reliability of internal and external company reports

Back 25

reporting objectives

Front 26

help the company comply with all applicable laws and regulations

Back 26

compliance objectives

Front 27

the tone or culture of a company that helps determine how risk conscious employees are is called the

Back 27

internal environment

Front 28

ERM ensures that company management puts into place a process to formulate ____,____, ___, and ____

Back 28

strategic, operations, reporting and compliance objectives that support the company's mission and that are consistent with the company's tolerance for risk

Front 29

Eight interrelated risks and control components of COSO

Back 29

Internal environment, objective setting, event identification, risk assessment, risk response, control activities, information & communication, and monitoring

Front 30

the problem with focusing on controls first is that

Back 30

it has an inherent bias toward past problems and concerns

Front 31

COSO is ____ based

Back 31

risk, not control

Front 32

the amount of risk a company is willing to accept in order to achieve its goals and objectives.

Back 32

risk appetite

Front 33

section 301 of SOX requires that

Back 33

all public companies to have an audit committee composed entirely of outside independent directors

Front 34

an independent director is

Back 34

one who Dow not receive any fees other than board of director fees from the company and is not affiliated with eh company or any subsidiary thereof

Front 35

important aspects of organizational structure include

Back 35

centralization of decentralization of authority; assignment of responsibility for specific tasks; whether three is a direct reporting relationship or more of a matrix structure; organization by industry product line, geographical location, or by a particular distribution or marketing network; the way responsibility allocation affects managements information requirements; the organization of the accounting and information system functions; the size and the nature of company activities

Front 36

some threats that would challenge EDI implementation would be

Back 36

choosing inappropriate technology; unauthorized system access, tapping into data transmissions, loss of data integrity, incomplete transactions, system failures incompatible systems

Front 37

External Event Categories

Back 37

economic, natural environment, political, social, technological

Front 38

internal event categories

Back 38

infrastructure, personnel, process, technology

Front 39

common techniques companies use to identify events

Back 39

comprehensive lists of potential events, perform an internal analysis, monitor leading events and trigger points, conduct workshops and interviews, perform data mining and analysis, analyze business processes

Front 40

the risk that exists before management takes any steps to control the likelihood or impact of a risk is a

Back 40

inherent risk

Front 41

\

Back 41

residual risk

Front 42

four ways to respond to risk

Back 42

reduce, accept, share and avoid

Front 43

control procedures fall into one of these categories

Back 43

proper authorization of transactions, segregation of duties, project development and acquisition controls, change management controls, design and use of documents and records, safeguarding assets, records and data, independent checks on performance

Front 44

an effective segregation of accounting duties is achieved when the following functions are separated

Back 44

authorization, recording, and custody

Front 45

authorization is

Back 45

approving transactions and decisions

Front 46

recording is

Back 46

preparing source documents, entering data into online systems, maintaining journals, ledgers, files or databases, preparing reconciliations, and preparing performance reports

Front 47

custody is

Back 47

handling cash, tools, inventory, fixed assets, receiving incoming checks, and writing checks

Front 48

authority and responsibility is divided within the information system into

Back 48

systems administration; network management; security management, change management, users, systems analysis, programming, computer operations, information system library, and data control

Front 49

AIS has five primary objectives

Back 49

identify valid transactions, properly classify transactions, record transactions, record transactions in proper accounting period, present transactions and related disclosures in the financial statements