Accounting Information Systems

Front 1

AIS Threats

Back 1

-Natural and political disasters
-Software errors and equipment malfunctions
-Unintentional Acts
-Intentional acts

Front 2

Cookie

Back 2

data that Web sites store on your computer to identify their Web sites to your computer and to identify you to the Web site so you don't have to log on every time you visit

Front 3

Fraud Requirements

Back 3

-False statement or respresentation
-A material fact
-Intent to deceive
-A justifiable reliance
-an injury or loss

Front 4

Fraud Triangle

Back 4

-Opportunity
-Rationalization
-Pressure

Front 5

Opportunity

Back 5

Perpetrator must be able to
-Commit
-Conceal
-Convert to cash

Front 6

Lapping Scheme

Back 6

perpetrator steals the csah or check that Customer A mails in and then pays back with a check from Customer B which is in turn paid back by a check from customer C

Front 7

Kiting scheme

Back 7

perpetrator creates cash by taking advantage of the timing lag between depositing a check and the check clearing the bank

Front 8

Computer fraud

Back 8

Any illegal act for which knowledge of computer technology is essential for its perpetration, investigation, or prosecution

Front 9

Processor Fraud

Back 9

fraud committed through an unauthorized system use, including the theft of computer time and services

Front 10

Computer Instructions Fraud

Back 10

Tampering with the software that processes company data

Front 11

Data Fraud

Back 11

Illegal use of company data, typically to copying it, using it, or searching it without permission

Front 12

Torpedo Software

Back 12

Destroys competing malware, resulting in "malware warfare" between competing developers

Front 13

Exposure

Back 13

The potential dollar loss should a particular threat become a reality, also called impact

Front 14

Internal Control

Back 14

process implemented by the board of directors, management and those under their direction to provide reasonable assurance

Front 15

Foreign Corrupt Practices Act

Back 15

Prevent bribery of foreign officials in order to obtain business

Front 16

PCAOB (Public Company Accounting Oversight Board)

Back 16

A five-member team to control the auditing profession

Front 17

Boundary System

Back 17

helps employees act thically by setting limits beyond which an employee must not pass

Front 18

diagnostic control system

Back 18

measures company progress by comparing actual performance to planned performance

Front 19

Interactive Control system

Back 19

helps top-level managers with high-level activities that demand frequent and regular attention, such as developing company strategy, setting company objectives, understanding threats and risks, monitoring changes, and developing responses and action plans to proactively deal with high-level issues

Front 20

COBIT (Control objectives for Information and Related Technology)

Back 20

a framework of generally applicable information systems security and control practices for IT control

Front 21

COSO (Committee of Sponsoring Organizations)

Back 21

a private-sector group consisting of the American Accounting Association, the AICPA, the institute of Intern Auditors, the Institute of Management Accountants, and the Financial Executives Institute

Front 22

Strategic Objectives

Back 22

high-level goals that are aligned with and support the company's mission

Front 23

Operations objectives

Back 23

deal with the effectiveness and efficiency of company operations, such as performance and profitability goals and safeguarding assets

Front 24

Reporting objectives

Back 24

help ensure the accuracy, completeness, and reliability of internal and external company reports, of both a financial and nonfinancial nature

Front 25

Compliance objectives

Back 25

help the company comply with all applicable laws and regulations

Front 26

risk appetite

Back 26

the amount of risk a company is willing to accept in order to achieve its goals and objectives

Front 27

audit committee

Back 27

composed entirely of outside(nonemployee), independent directors

Front 28

policy and procedures manual

Back 28

explains proper business practices, describes the knowledge and experience needed by key personnel, spells out management policy for handling specific transactions, and documents the systems and procedures employed to process those transactions

Front 29

event

Back 29

an incident or occurence emanating from internal or external sources that affects implementation of strategy or achievement of objectives

Front 30

inherent risk

Back 30

the risk that exists before management takes any steps to control the likelihood or impact of a risk

Front 31

residual risk

Back 31

the risk that remains after management implements internal controls, or some other response to risk

Front 32

four ways to reduce risk

Back 32

reduce, accept, share, avoid

Front 33

control activities

Back 33

policies, procedures, and rules that provide reasonable assurance that management's control objectives are met and the risk responses are carried out

Front 34

authorization

Back 34

policies for employees to follow which empower them to perform certain tasks and make decisions

Front 35

digital signature

Back 35

signing a document with a piece of data that cannot be forged

Front 36

segregation of duties

Back 36

achieved when the following functions are separated: authorization, recording, and custody

Front 37

systems administrators

Back 37

responsible for ensuring that the different parts of an information system operate smoothly and efficiently

Front 38

systems administrators

Back 38

responsible for ensuring that the different parts of an information system operate smoothly and efficiently

Front 39

network managers

Back 39

ensure that all applicable devices are linked to the organization's internal and external networks and that the networks operate continuously and properly

Front 40

network managers

Back 40

ensure that all applicable devices are linked to the organization's internal and external networks and that the networks operate continuously and properly

Front 41

analytical review

Back 41

an examination of the relationships between different sets of data

Front 42

time-based model of security

Back 42

focuses on the relationship between preventive, detective, and corrective controls

Front 43

defense-in-depth

Back 43

to employ multiple layers of controls in order to avoid having a single point of failure

Front 44

authentication

Back 44

focuses on verifying the identity of the person or device attempting to access the system

Front 45

multifactor authentication

Back 45

using two or all three methods of authentication (something they know, something they have, some physical characteristic) in conjunction

Front 46

access control matrix

Back 46

a table specifying which portions of the sytem users are permitted to access and what actions they can perform

Front 47

social engineering

Back 47

a person uses deception to obtain unauthorized access to information resources

Front 48

border router

Back 48

connects an organization's information system to the internet

Front 49

demilitarized zone (DMZ)

Back 49

a separate network that permits controlled access from the internet to selected resources, such a the organization's e-commerce Web server

Front 50

Transmission Control Protocol (TCP)

Back 50

specifies the procedures for dividing files and documents into packets to be sent over the internet and the methods for reassembly of the original document or file at the destination

Front 51

Internet Protocol (IP)

Back 51

specifies the structure of packets and how to route them to the proper destination

Front 52

routers

Back 52

read the destination address fields in IP packet headers to decide where to send the packet next

Front 53

access control list (ACL)

Back 53

determines which packets are allowed entry and which are dropped

Front 54

static packet filtering

Back 54

screens individual IP packets based solely on the contents of the source and/destination fields in the IP packet header

Front 55

stateful packet filtering

Back 55

maintains a table that lists all established conections between the organization's computers and the Internet

Front 56

deep packet inspection

Back 56

examine the data in the body of an IP packet to provide more effective access control than those that look only at information in the IP header

Front 57

intrusion prevention systems (IPS)

Back 57

identify and drop packets that are part of an attack

Front 58

hardening

Back 58

process of turning off unecessary features

Front 59

encryption

Back 59

process of transforming normal text, call plaintext, into unreadable gibberish, called ciphertext

Front 60

decryption

Back 60

reverses the process of encryption

Front 61

Symmetric encryption systems

Back 61

use the same key both to encrypt and to decrypt

Front 62

Assymmetric encryption systems

Back 62

uses two keys, one to encrypt and one to decrypt

Front 63

hashing

Back 63

an irreversible process that takes plaintext of any length and transforms it into short code

Front 64

digital certificate

Back 64

an electronic document, created and digitally signed by a trusted third party, that certifies the identity of the owner of a particular public key

Front 65

public key infrastructure (PKI)

Back 65

refers to the system and processes used to issue and manage asymmetric keys and digital certificates

Front 66

certificate authority

Back 66

organization that issues public and private keys and records the public key in a digital certificate

Front 67

e-signature

Back 67

a cursive-style imprint of a person's name that is applied to an electronic document

Front 68

Log analysis

Back 68

the process of examining logs to monitor security

Front 69

Intrusion Detection systems (IDS)

Back 69

create logs of network traffic that was permitted to pass the firewall and then analyze those logs for signs of attempted or successful intrusions

Front 70

patch

Back 70

code released by software developers that fixes a particular vulnerability

Front 71

Virtual Private Network (VPN)

Back 71

encrypting information before sending it over the Internet to provide the functionality of a privately owned network, while using the internet

Front 72

sequence check

Back 72

tests if a batch of input data is in the proper numerical or alphabetical sequence

Front 73

financial total

Back 73

sums a field that contains dollar values, such as the total dollar amount of all sales for a batch of sales transactions

Front 74

hash total

Back 74

sums a nonfinancial numeric field, such as the total of the quantity ordered field in a batch of sales transactions

Front 75

record count

Back 75

sums the number of records in a batch

Front 76

prompting

Back 76

system requests each input data item and waits for an acceptable response

Front 77

closed-loop verification

Back 77

checks the accuracy of input data by using it to retrieve and display other related information

Front 78

Concurrent update controls

Back 78

protect records from errors that occur when two or more users attempt to update the same record simultaneously

Front 79

parity bit

Back 79

an extra digit used to detect errors due to some bits that are lost or received incorrectly due to media disruptions or failures

Front 80

echo check

Back 80

calculates a summary statistic such as the number of bits in the message and sends the result back to the sending unit

Front 81

fault tolerance

Back 81

enabling a system to continue functioning in the even that a particular component fails

Front 82

uninterruptible power supply (UPS)

Back 82

provides protection in the event of a prolonged power outage

Front 83

incremental backup

Back 83

copying only the data items that have changed since the last backup

Front 84

differential backup

Back 84

coppies all changes made since the last full backup

Front 85

recovery point objective

Back 85

represents the maximum length of time for which it is willing to risk the possible loss of transaction

Front 86

archive

Back 86

a copy of a database, mater file, or software that will be retained indefinitely as an historical record

Front 87

recovery time objective (RTO)

Back 87

represents the time following a disaster by which the organization's information system must be available again

Front 88

financial audit

Back 88

examines reliability and integrity of accounting records

Front 89

information systems audit

Back 89

reviews the controls of an AIS to assess its compliance with internal control policies and procedures an dits effectiveness in safeguarding assets

Front 90

operational (management) audit

Back 90

concerned with the economical and efficient use of resources and the accomplishment of established goals and objectives

Front 91

auditing

Back 91

a systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users

Front 92

compensating controls

Back 92

procedures that compensate for deficiency of a control

Front 93

test data generator program

Back 93

automatically prepares test data based on program specifications

Front 94

integrated test facility (ITF)

Back 94

technique that places a small set of fictitious records in the master files

Front 95

audit hooks

Back 95

audit routines that flag suspicious transactions