Ch. 7 Control & Ais

Front 1

Threat

Back 1

Any potential adverse occurance

Front 2

Exposure or Impact

Back 2

The potential dollar loss from a threat

Front 3

Likelihood

Back 3

Probability that a threat will happen.

Front 4

Internal Control

Back 4

Process implemented to provide reasonable assurance that the following control objects are achieved:
-Safeguard assets
-Maintain accurate records
-Provide reliable information
-Improve operational efficiency
-Encourage adherence to policies

Front 5

Preventive Controls

Back 5

Deter problems before they arise
Ex: Segregation of duties, controlling physical access to assets

Front 6

Detective Controls

Back 6

Discover problems that are not prevented.
Ex: Duplicate checking and preparing bank reconciliations.

Front 7

Corrective Controls

Back 7

Identify and correct problems as well as correct and recover from the resulting errors.
Ex: maintaining backup copies of files, correcting data entry errors.

Front 8

Categories of Internal Controls

Back 8

General Controls (organization's control environment) & Application Controls (Correct processing of transactions)

Front 9

Foreign Corrupt Practices Act (FCPA)

Back 9

Prevent companies from bribing foreign officials to obtain business.

Front 10

Sarbanes-Oxley Act (SOX) of 2002

Back 10

Designed to prevent financial statement fraud, make financial reports more transparent, protect investors, strengthen internal controls and punish executives who perpetrate fraud.

Front 11

Control Objectives for Information and Related Technology (COBIT) framework

Back 11

Consolidates control standards into a single framework by:
1. Management to benchmark security & control practices
2. Users to be assured that adequate IT security and controls exit
3. Auditors to substantiate their internal control opinions

Front 12

COBIT Vantage Points

Back 12

1. Business Objectives (Seven categories of criteria that map objectives)
2. IT Resources (People, application systems, technology, etc.)
3. IT processes (planning & organization, acquisition & implementation, delivery & support, monitor & evaluate)

Front 13

Committee of Sponsoring Organizations (COSO)

Back 13

Internal control—integrated framework
• Control environment
• Control activities
• Risk assessment
• Information and communication
• Monitoring

Front 14

Enterprise Risk Management--Integrated Framework (ERM)

Back 14

Used to set strategy, identify events that may affect the entity, assess and manage risk, and provide reasonable assurance that the company achieves its objectives & goals.

Front 15

Internal Environment

Back 15

Company culture, influences how organizations establish strategies,objectives and structure business activities.

Front 16

Inherent Risk

Back 16

Exists before management takes any steps to control the likelihood or impact of an event.

Front 17

Residual Risk

Back 17

The remaining risk after management implements internal controls or some other response to risk.

Front 18

Reduce

Back 18

Reduce the likelihood and impact of risk by implementing an effective system of internal control

Front 19

Accept

Back 19

Accept the likelihood and impact of risk

Front 20

Share

Back 20

Share risk or transfer it to someone else by buying insurance, outsourcing an activity or enter into a hedging transaction.

Front 21

Avoid

Back 21

Avoid risk by not engaging in the activity that produces the risk.

Front 22

Expected Loss

Back 22

=impact x likelihood

Front 23

Control Activities

Back 23

policies and procedures that provide reasonable assurance that control objectives are met and risk responses are carried out.

Front 24

Segregation of duties

Back 24

-Authorization (approving decisions)
-Recording (preparing source documents; maintaining ledgers, files or databases)
-Custody (handling cash, tools, inventory, etc.)

Front 25

Collusion

Back 25

Detecting fraud where two or more people try to commit and conceal the fraud.

Front 26

Computer security officer (CSO)

Back 26

In charge of system security, independent of the information system function and reports to the COO or CEO

Front 27

Chief Compliance Officer (CCO)

Back 27

In charge of compliance issues within the company.

Front 28

Neural Networks

Back 28

Programs with learning capabilities that can be used to accurately identify fraud.