acc systems exam 2

अब Quizwiz के साथ अपने होमवर्क और परीक्षाओं को एस करें!

estimate account balance

(audited value of sample/recorded balance of sample) x recorded balance of pop

Basic Steps in Sampling

-planning -performing -evaluating

Steps in Sampling: Performing

4. Determine sample size 5. select sample items 6. measure sample items

cobit 5 2 main components

5 geit principles and 7 enablers both of these are fundamentally different than the approach used in 4.1 for ex, 4.1 did not have enablers

• Subschema

A description of a portion of a schema

erm

A process, effected by an entity's board of directors, management, and other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

Database Management Systems (DBMS)

A set of integrated programs designed to simplify the tasks of creating, accessing, and managing a centralized database • Integrates a collection of files that are independent of application programs and are available to satisfy a number of different processing needs • Contains data related to: - All the organizations applications, - Supports normal data processing needs, and - Enhances management activities by providing data useful to managers • Enterprise databases are a subset of DBMS

intelligent agent

A software program that may be integrated into a DSS or other software tool (such as word processing, spreadsheet, or database packages) that provides automated assistance, advice, and/or information for decision making.

Third Normal Form (3NF)

A table is in third normal form (3NF) if it is in 2NF and has no transitive dependencies • Transitive dependency - Exists when a non-key attribute is functionally dependent on another non-key attribute - Cust_Name is functionally dependent on Cust_Code, which is a non-key attribute

control matrix

A tool designed to assist in evaluating the potential effectiveness of controls in a business process by matching control goals with relevant control plans.

control redundancy

Are too many goals directed at the same goal?

steps to precision and reliability

Based on sampling procedure, form sample estimate Based on precision and reliability, form precision interval

Monetary Unit Sampling (MUS)

Basics of MUS Determining Sample Size Selecting and Measuring Sample Items Evaluating Sample Results

Two primary functions of a DBMS

Creation and maintenance of master data 2. Recording of business event data

• Entity-relationship modeling

Designer identifies the important things (entities) about which information will be stored and how the things are related to each other (relationships)

• Data mining

Exploration, aggregation, and analysis of data in data warehouses using analytical tools and exploratory techniques

• 3 steps in analysis of E-R diagram

Identify entities 2. Identify relationships and learn about the characteristics of the relationships 3. Uses info to create database tables and connections among tables

key verification

Input documents are keyed by one individual and then rekeyed by a second individual to detect keying errors. occasionally applied to input of low volume, high value batches of events

3. Define the population

Item(s) about which question is asked (e.g., health club members?) Need to ensure population is carefully and completely define pop= all sales invoices sample unit= 1 sales invoice

Selection and Hiring Control Plans

Job candidates should be carefully screened, selected and hired. companies choose which plans to employ based on the salary level and job duties for the position for which the candidate is applying

reliability (confidence)

Likelihood of achieving a given level of precision

nonsampling risk

Likelihood that an incorrect conclusion is drawn for reasons unrelated to the sample Most common cause is mistakes in evaluating sample items usually errors in judgment or execution of the test (test performed incorrectly or test not created correctly, not bc ur using sampling).

risk response

Management selects risk responses - avoiding, accepting, reducing, or sharing risk - developing a set of actions to align risks with the entity's risk tolerances and risk appetite.

review tickler file

Manual file of documents, or a computer file, that contains business event data that is pending further action. should be reviewed on a regular basis

DSS (decision support system)

Models information to support managers and business professionals during the decision-making process

Population size

Not applicable unless relatively small once pop reaches 500 it has a much reduced effect on sample size so we dont typically consider it too important

Normalization in Relational Databases Bottom-Up Approach

One of two approaches - Other is top-down, which will be covered later • Designer identifies the attributes of interest and organizes those attributes into tables • Common practice to gather all paper documents currently used and design the computer system so that they can be completed electronically • Limitation is that one tends to automate current practices without leveraging computer technology capabilities • The need for computer-oriented controls may be ignored even though prior manual controls may not be effective

forms

Onscreen presentations that allow users to view data in tables or collected by queries from one or more tables and input new data

Nonstatistical Sampling

Permissible under GAAS Does not allow auditors to control exposure to sampling risk Major differences in: Determining sample size (may judgmentally determine sample size and do not need to quantify expected deviation rate or CI in that case) Selecting sample items (may use nonrandom methods like block or haphazard selection) Evaluating sample results (may judgmentally evaluate sample results based on a sample rate of dev compared to a tol rate and basically ask urself is there enough cushion to allow for sampling risk. based on auditor judgment which is not as precise so be careful with it)

Anomalies or errors

Results when you fail to follow the rules of normal forms - That might occur when adding, changing, or deleting data stored in the database

sample size examples: parameters

Risk of overreliance = 5% Tolerable rate of deviation = 6% Expected population deviation rate = 2%

Risk of Incorrect Rejection occurs when

Sample indicates account is misstated Account is not misstated

Risk of Incorrect Acceptance occurs when

Sample indicates account is not misstated Account is misstated

risk of overreliance occurs when

Sample indicates controls are functioning effectively Controls are not functioning effectively

• Normal forms

Structure of tables must comply with several rules - Include specifications that must be met by relational database tables

hash totals

Sum of any numeric data existing for all batch documents, such as a total of customer numbers or purchase order numbers. Can determine if inputs have been altered (accuracy) , added (validity), or deleted (completeness).

PCAOB Inspection Results

The Firm failed to sufficiently test an important control over the loan grading process that it selected, as the sample size the Firm used in its testing was too small to obtain the necessary level of assurance that the control was operating effectively to prevent or detect material misstatements. For these compensating controls [over revenue and accounts receivable transactions], the sample used by the Firm to test the compensating controls was inadequate because the Firm underestimated the number of times the control operated when computing the necessary sample size.

risk appetite

The amount and type of risk that an organization is willing to take in order to meet their strategic objectives (from Institute of Risk Management)

coding

The creation of substitute values, or codes, to represent classification categories long labels

Cannot afford to prevent all losses

Too expensive to eliminate all risk (if possible)

queries

Tools that allow users to access the data stored in various tables and to transform data into information

applications approach to business event processing

Under this approach, each application collects and manages its own data, generally in dedicated, separate, physically distinguishable files for each application. concentrates on process being performed eACH applicaiton collects and amnages its own data, gernerally in dedicated, separate, physically distinguishable files for each app.

Logical Versus Physical Database Models

Underlying concept of centralized database approach - Decouple data from applications • Data independence - Data is decoupled from the system applications to make it independent of the application or other users • Three-tier architecture - Systems that are decoupled are referred to as having 1. User or presentation tier 2. Application or business logic tier - Middleware 3. Database tier

Variables Sampling

Used to estimate the amount (or value) of some characteristic of a population Used in the auditor's substantive procedures

data redundancy

When the same data is stored in multiple locations and files • For example, customer information Can cause inconsistencies among the same data in different files. Increases storage and labor costs and data may not be shareable

automated data entry

a strategy for the capture and entry of event-related data using technology such as OCR, bar codes, RFID, and EDI. these methods use fewer human resources and capture more data in a period of time than is possible w manual entry. by eliminating the keying errors that can occur in manual data entry, these methods improve the accuracy of the entered data. finally, in some cases, the input method can validate the authenticity of the input. for ex, when the rfid chip on a box is read, we know that the box exists. completeness

continuous data protection (CDP)

all data changes are date stamped and saved to secondary systems as the changes are happening. u can have server here and one in another location and a keystroke is made here and almost simultaneously itll be on the server at another location. ex: invoice here, computer dies, go to starbs and invoice is there. ensures security of resources/ securing ur assets/computer files. this process is not the periodic backup of files mentioned previously but is a process for continuous and immediate replication of any data changes for many organizations, it is not cost-effective to maintain duplicate computer facilities, although they still need cdp. these orgs might contract w third parties for electronic vaulting

risks

are those events that would have a neg impact on an orgs objectives require assessment and response, whereas opportunities are channeled back to the strategy-setting process. ex: a new mkt op might have opened up that mgmt could decide to pursue.

Approving a customer credit purchase would be an example of which basic events processing function?

authorizing events

the best way to mitigate password risk is to put in additional authentications, such as a

biometric identification (i.e., something they are) or a smartcard (i.e., something they have) that users must use along w their passwords

As described in COSO, elements of a control environment might include the following:

commitment to the importance of control reward systems tone at the top of the org

incorrect acceptance is the same as

confidence level

COSO's 5 Elements of Internal Control

control environment, risk assessment, control activities, information and communication, monitoring

to overcome the roadblocks to quality decision making, managers use

decision support systems (DSSs), exec info sys (EISs), group support sys (GSSs), expert sys (ESs), neural networks (NNs), and intelligent agents

One-for-one checking

detailed comparison of the individual elements of two or more data sources to determine that they agree differences indicate errors in input or update expensive, reserved for low volume high value events

control efficiency

do individual control plans address multiple goals?

tolerable misstatements vs tolerable rate of deviation

dollar values that we are willing to tolerate as misstatements vs how many times can this control not function b4 we can consider it to be broken

impact

effect of an event's occurrence

timeliness

effectiveness

a mechanism by which a company is reimbursed for any loss that occurs when an employee commits fraud is called a

fidelity bond

GSSs facilitate

group interaciton and group consensus building

as summation of customer account numbers taken from a batch of sales invoices would be classified as

hash total

coso places integrity and ethical values at the

heart of what is called the control environment (captured in erm as internal environment)

personnel security control plans

help prevent the organization's own personnel from committing acts of fraud or theft of assets

object-relational databases

incldues a relational dbms framework w the capability to store complex data types. companies like either rn.

fidelity bond

indemnifies a company in case it suffers losses from defalcations committed by its employees employees who have access to cash and other negotiable assets are usually bonded

DSSs structure the available data to provide

info ab alternative courses of action w/o offering a solution. DSSs work well w unstructured or semistructured problems that have a quantifiable dimension.

knowledge

information that has been formatted and distributed in accordance w an orgs standards

supervision control plans

involve the processes of approving, monitoring, and observing the work of others

forced vacations

is a policy that requires an employee to take leave from the job and substitutes another employee in his or her place irregularity of skipping vacays will be detected by this (detective control) if these are in place, they should act as a deterrent to the irregularity ever occuring in the first place (preventive)

sampling

is the process of making a statement about a population of interest by examining only a subset (or sample) of that population

• Chief advantage of a DBMS is

it contains a query language

cobit 4.1 supports it governance by providing a framework to ensure that

it is aligned w the bus it enables the bus and maximizes benefits it resources are used responsibly it risks are managed appropriately

matrix

key tool in the assessment of a sys of ic that is used to determine whether a sys of ic is designed well and can help an org achieve objectives and respond to risks

use control matrix to

match bus process controls to the goals will allow us to access the effectiveness of design of the system of ic by examining, easily, which goals are being addressed and which goals are not. use it only to assess bus process controls

Classical Variables Sampling Approaches

mean per unit difference estimation ratio estimation

EISs use

menus, graphics, and color to provide a friendly interface to DSSs for execs who want to minimize their interaction w the sys

controls that ensure input accuracy and completeness do not

necessarily ensure update accuracy and completeness if the events ir trans are processed using an online real time (olrt) processing system, the input and update will occur nearly simultaneously. this will minimize the possibility that the update will occur nearly simultaneously.

DSS and EIS similarities

neither tells the decision maker what to do. both primarily provide views for interpreting the info. users generally use a dss to arrive at estimated or "recommended" solutions to problems being considered. statistical methods rarely used for eis. eis mainly ab collecting and presenting info desired by an exec and less ab doing additional processing calculations. eis's are more liekly to have the ability to drill down (from summarized into to the primary docs) than DSSs. no matter the type of decision aid being used, the knowledge and experience required to analyze the info, to make the judgements, and to take the actions required reside w the decision maker.

ensure input validity

no false transactions are put into the system ex: order entry clerk requested processing of 50 customer orders. 2 of the 50 orders are ficticious.

another useful and common way to classify controls is in relation to the timing of their

occurrence

Before a completed input screen is recorded the data entry clerk is asked if the data should be accepted. This is which control plan?

online prompting

erm is a process for

org governance. orgs create value for their stakeholders by establishing objectives and identifying and managing risks that might result in failure to achieve objectives.

MUS: Measuring Sample Items

perform appropriate substantive testing procedure for each misstatement, calculate tainting percentage as: (recorded bal - audited val)/recorded balance gives u the % it is tainted/misstated

personnel management control plans

personnel planning control plans job description control plans supervision control plans personnel security control plans

second level of protection

pervasive control plans

Control Activities

policies and procedures are established and implemented to help ensure the risk responses are effectively carried out includes approvals, authorizations, verifications, reconciliations, reviews of operating performance, security procedures, supervision, audit trails, and segregation of duties

likelihood

possibility that an event will occur

In a control matrix the coding P-1 means:

present control plan

best control

preventive controls bc in the lr they're less expensive and less disruptive to ops to prevent, rather than to detect or correct, problems. however, bc no control can be made to be 100% effective, we need to implement a combination of preventive, detective, and corrective controls. detective can help prevent or deter fraudulent or careless acts. if someone knows that plans exist to detect or uncover fraud and carelessness, such knowledge can serve as one additional preventive measure

The goal of normalization is to

produce a database model that contains relations that are in third normal form (3NF)

personnel planning control plans

project future managerial and technical skills of the staff, anticipate turnover, and develop a strategy for filling necessary positions

ESs apply expertise extracted froma human expert to

provide specific recs on problems or decisions

systems documentation

provides an overall description of the application, including the systems purpose; an overview of sys procedures; and sample source docs, outputs, and reports

Agree run-to-run totals

reconcile totals prepared before a computer process has begun to totals prepared at the completion of the computer process reconciled manually or by the computer

specific attention must be paid to

recruitment promotion personnel qualifications training backup performance evaluation job change termination honesty is key to implement other control plans

which of the following database types has dominance in orgs

relational

a policy that requires employees to alternate jobs periodically is called

rotation of duties

sequential sampling process

select initial sample options -conclude control is operating effectively -conclude control is not operating effectively -sample is inconclusive; examine additional items

process

series of actions or operations leading to a particular and usually desirable result. results could be risk mgmt as described by erm, effective ic as proposed by coso, or a specified output of an ops process for a particular mkt or customer

process

set of procedures and practices also thought of as controls

domain

set of processes

Principle 1: Meeting Stakeholder Needs.

since enterprises exist to create value for their stakeholders, it makes sense that the key objective of governance and mgmt should be value creation. in turn, value creation has 3 objectives or components: benefits realization, risk optimization, and resource optimization

intelligent agents can be embedded in

software to perform tasks for u or help u more effectively complete certain tasks

Approaches to sampling

statistical sampling nonstatistical sampling Both statistical sampling and nonstatistical sampling are appropriate under GAAS

preventive control plans

stop problems from occurring ex: programmed edits, such as validation of the customer name and address

relational database model

stores information in the form of logically related two-dimensional tables more flexible model each individual fact or type of into (i.e. entity) is stored in its own table allows users to query the tables to obtain info from 1 or more tables in a very flexible way

Elements of Relational Databases

tables queries forms reports

monitoring

the entirety of erm is monitored, and modifications are made as necessary. monitoring is accomplished through ongoing mgmt activities, separate evaluations, or both. should not be considered a final activity

variables sampling decisions

ul on misstatements <= tolerable misstatements = acct bal is not misstated ul on misstatements > tolerable misstatement = acct bal is misstated

turnaround documents

used to capture and input a subsequent event picking ticket, inventory count sheets, remittance advice stubs, etc

A data model depicts the requirements for data as specified by the:

user

applying the framework

• Let's walk through the controls on matrix and flowchart • P-1: Document design - Source document designed to make it easier to prepare the document and to input data from the document into a computer or other input device. • P-2 Written approvals - Signature or initials to indicate someone authorized the event. Ensures data input arises from a valid business event and appropriate authorizations have been obtained. - Electronic approvals • Route events using a computer system's workflow facility to persons authorized to approve. • P-3: Preformatted screens - Defines acceptable format of each data field. Includes drop-down data lists, automatic cursor move to the next field, mandatory inputs and auto population of certain fields. - System may automatically populate fields with data (current date, sales tax, etc.) • P-4: Online prompting - Requests user input or asks questions user must answer. Includes context-sensitive help. - In a sense, advising you to check your work. • P-5: Populate input screens with master data - Clerk enters identification code for an entity and system retrieves data about that entity from the master data. - Reduces number of key strokes. • P-6: Compare input data with master data - Performed manually or by the computer to determine the accuracy and validity of input data. - Three comparisons made: • Input/master data match. - Test that correct ID code has been manually entered. • Input/master data dependency check. - Test logical relationship. • Input/master data validity and accuracy check. - Test whether master data supports the validity and accuracy of the input. • P-7: Procedures for rejected inputs - Ensures that erroneous data are corrected and resubmitted for processing. - Suspense file of rejected inputs. • P-8: Programmed edit checks: - Automatically performed by data entry programs upon entry of data to highlight actual or potential input errors and allow them to be corrected quickly and efficiently. - Erroneous data highlighted for corrective action - Most common are: • Limit checks - Test whether the contents of the data entered fall within predetermined limits. • Reasonableness checks - Compares entered data with a calculated amount to discover inputs that may be incorrect. - Does the customer really want to order this amount. • P-8: Programmed edit checks: - Most common are (continued): • Document/record hash totals: - Summarization of any numeric data field within the input document or record. Calculated before and then again after entry of the document or record, total is used to determine that the applicable fields were entered accurately. - Total usually serves no function than control. • Mathematical accuracy checks: - Compare calculations performed manually to those performed by the computer to determine whether a document has been entered correctly. - If they don't agree, something was likely entered erroneously • P-10: Automated data entry: - Capture and entry of event-related data using items like OCR, bar codes, RFID, and EDI. - May also confirm validity of input (i.e., RFID) • P-11: Enter data close to the originating source: - Strategy for the capture and entry of event-related data close to the place and time that an event occurs. - Databases more current, no lag. - Lowers the risk of error in data entry. • P-12: Digital signatures: - Validates sender identity and electronic message integrity. - Uses data encryption and public key cryptography. • PCAOB AU 5 asserts that auditors must consider the impact of entity-level controls (i.e., control environment, pervasive, general, and IT controls) have on business process controls and application controls

Implications of Computer Fraud and Abuse

• Computer crime - Includes crime in which the computer is the target of the crime or the means used to commit the crime. • Two basic categories of computer crime - Tool - Target • Malware - Short for malicious software - Software designed specifically to damage or disrupt a computer system • Computer virus - A program code that can attach itself to other programs thereby "infecting" those programs and macros. • Real issue with computer fraud and abuse - It characterizes a s poorly controlled process

The COBIT 4.1 Framework

• Control Objectives for Information and Related Technology (COBIT) • Widely adopted framework for IT governance and control • Provides guidance on the best practices for the management of information technology • Supports IT governance by providing a framework that ensures: - IT is aligned with the business - IT enables the business and maximize benefits - IT resources are used responsibly - IT risk are managed appropriately

Steps in Sampling: Evaluating

7. Evaluate sample results • In statistical sampling, evaluating sample results controls exposure to sampling risk • Parameters -Sample estimate -Precision -Reliability

Programming Errors

-Softwares error resulting from bad code in some program involved in producing the erroneous result -There are two types: logic and syntax errors (-Logic errors-where conditions or variables are not correctly described -Syntax errors-where a variable is misspelled or a function is used incorrectly) for instnace, instead of reducing inventory for each order, the inventory balances were increased

doc design

-effectiveness goal a, efficient employment of resources: a well designed doc can be completed more quickly (effectiveness goal A) and can be prepared and entered into the computer w less effort (efficiency) -input accuracy: we tend to fill in a well designed doc completely and legibly. if a doc is legible, data entry errors will occur less frequently

Compare input data with master data

-effectiveness goal a, efficient employment of resources: events can be processed on a timelier basis and at a lower cost if errors are detected and prevented from entering the sys in the 1st place. making sure 2 match -input validity: the edits identify erroneous or suspect data and reduce the possibility of the input of invalid events -input accuracy: the edits identify erroneous or suspect data and reduce input errors. completeness by control matrix.

risk of underreliance

(Risk of Assessing Control Risk too High) Also referred to as Type I error, false rejection

ERM Framework

1. Internal Environment 2. Objective Setting 3. Event Identification 4. Risk Assessment 5. Risk Response 6. Control Activities 7. Information and Communication 8. Monitoring

cobit groups it control processes into 4 broad domains

1. plan and organize 2. acquire and implement 3. deliver and support 4. monitor and evaluate (provides feedback to other 3 domains)

Schema

A complete description of the configuration of a record types, data items, and the relationship between them

• Sequential (serial) coding

Assigns numbers to objects in chronological sequence - Provides limited flexibility and tells nothing about the object's attributes - Limitations with adding and deleting exist

suprina control matrix

Note: Four elements of the control matrix (a) control goals (b) recommend control plans (c) cell entries (d) explanation of cell entries

residual risk

The risk that remains after a risk response is chosen - Avoid, reduce, share, accept

sample control plan for data input

This discussion describes generic controls • Knowing these controls will help you identify present and missing controls • Data entry step - Usually inefficient and susceptible to errors • As we discuss these controls, keep in mind that the following improvements can help address inefficiencies and errors - Data entry automated - Purchasing initiated by the buying organization and transmitted to the selling organization via the Internet or electronic data interchange (EDI) - In an ERP system, multiple steps may be integrated

organizational governance

a process by which organizations select objectives, establish processes to achieve objectives, and monitor performance

cobit 5's domains and governance process

cobit 5 is diff from 4.1 in how they specify their domains and processes cobit 4.1 has 4 sets of domains and 34 high level processes. 5 has 5 domains and 37 high level processes. 4.1's domains are plan and organize, acquire and implement, deliver and support, and monitor and evaluate. 5's domains are evaluate, deliver, and monitor, align, plan, and organize, build, acquire, and implement, deliver, service, and support, and monitor, evaluate, and assess

isaca is in the process of releasing a new cobit framework

cobit 5, at the publication time of this edition. not merely an update of cobit 4.1 but instead takes us in a radicallly new direction, according to isaca. siwtch to cobit 5 or merge 4.1 and 5

it steering committee

coordinates the organizational and IT strategic planning processes and reviews and approves the strategic IT plan guides the it org in establishing and meeting user info requirements and in ensuring the effective and efficient use of its resources. this and the cio are the main authorizing bodies within the it dept. come up with plan for it sys. tell ppl in comp what task they need done. rank as most important. look at budget. choose projects to do. important bc its putting a priority intact

alternative names for contingency planning include

disaster recovery planning business interruption planning business continuity planning

ESs can automate portions of the decision making act

hey can func independently and actually make the decision, or they can assist the decision maker and recommend a course of action. the goal of Ess is not to replace ppl. these sys make it possible for valuable expertise to be avail in multiple locations

Acquire and Implement Domain

• Processes designed to identify, develop or acquire, and implement IT solutions • Failure to successfully implement these processes can lead to significant risks throughout the organization • Systems development life cycle (SDLC) - Covers the progression of information systems through the systems development process, from birth, through implementation, to ongoing use and modification

If attribute A determines a single value for attribute B at any time, we say that attribute B is ____.

functionally dependent on attribute A

monitoring

in an internal control system means assessment by management to determine whether the control plans in place are continuing to function appropriately over time further involves making sure that any control weaknesses are communicated to responsible parties on a timely basis and that responsible parties take appropriate action typicallly underused by orgs. ineffective monitoring can result in a failure of the control sys itself or, less severely, in a failure to implement control plans to correct identified problems

updating master data

info processing activity whose function is to incorporate new data into existing master data 2 types of updates that can be made to master data: info processing (analogous to the posting step in a manual bookeeeping cycle) and data maintenancce our analysis of the ics related to data updates is restricted to data updates from info processing

organizational design

involves the creation of roles, processes, and formal reporting relationships in an org. one aspect of org design includes establishing departmental relationships, including the degree of centralization in the org. another aspect involves personnel reporting structures such as chain of command and approval levels. ex: upper mgmt of a comp reporting to the bod. ex: separation of op units (sales and production) from accting units. org design is a key component of a companys ic structure

cobit 5

is a new departure in the corporate governance of info tech. the most sig change is restructuring and reorganizing the framework from being an it process model into an it governance model w a set of governance practices for it, a mgmt sys for the continuous improvement of it acts, and a process model w baseline practices. thus, cobit 5 is, for one thing, more inclusive than 4.1 cobit 5 moved from it governannce as its overall objective to governance of enterprise it (geit) shifting the center of attention from it to governance. more strategic or big pic oriented than 4.1 holistic approach. this is a complete, comprehensive approach that an enterprise tailors to its own specific needs, putting ic control w the larger context of tnerprise wide governance and mmgmt. more flexible and adaptable more principles based and less procedures based

internal control

is a process -- effected by an entity's board of directors, mgmt, and other personnel -- designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness (degree to which and objective is accomplished) and efficiency (the ability to accomplish an objective w minimal waste of resources) of ops reliability of fin reporting compliance w applicable laws and regulations

Business Continuity Planning

is a process by which a business identifies its critical processes, or those areas of its business that must occur without failure lest the business will also fail. Such planning defines specific lengths of time for acceptable outages, responsible parties, contact information, and partners that have assumed the risk of supporting emergency continuity services. also called disaster recovery planning, contingency planning, and business interruption planning

Variables sampling

is used to estimate the amount (or value) of a population find diff between true value and recorded value and determine if its material or not substantive procedures (used for substantive test of details): Estimate account balance or misstatement Compare estimated account balance or misstatement to recorded balance or tolerable misstatement approaches (use 1 of 2): Monetary unit sampling (MUS) (use a variation of attribute sample principles applied to a monetary pop. using a theoretical statistical framework very similar to our previous module but applying it to a monetary pop) Classical variables sampling (use more traditional types of statistical techniques to calculate an estimate of the pop)

orgs that must ensure continuous ops may

maintain and operate two or more sites that separately contain identical equipment and identical copies of all programs, data, and documentation. should the primary facility become unavail, one of the secondary sites takes over, sometimes automatically and without noticeable delay. in these situations, data must be replicated in real time on both systems. this data replication strategy is called continuous data protection (cdp)

Establishing a viable internal control system is primarily the responsibility of:

management

control plans

reflect information-processing policies and procedures that assist in accomplishing control goals • Starts with the control environment • Pervasive control plans - They relate to a multitude of goals and processes, They are broad in scope and apply equally to all business processes. • General controls (also known as IT general controls) - Are applied to all IT service activities. doc control plans: 2 flavors. doc code and new code. reading proc book

pervasive control plans

relate to a multitude of goals and processes. Like the control environment, they provide a climate or set of surrounding conditions in which the various business processes operate. they are broad in scope and apply equally to all business processes; hence, they pervade all systems

completeness

reliability of reporting

controls implemented to respond to risks must be

reviewed to determine that the activities have been performed and to determine whether additional actions must be taken to respond to the risk

residual risk

risk that remains after one of these responses is chosen.

Events that could have a negative impact on organizational objectives:

risks

seg of duties

separating: authorizing events executing events recording events safeguarding resources resulting from consummating events no employee in a position both to perpetrate and to conceal frauds, errors, or other kinds of system failures. applies not only to classic accting trans, such as a cash disbursement or credit sale, but also to other events and activities, such as planning a company dinner or implementing a new general ledger system.

four categories of management objectives

strategic: high level goals aligned with and supporting its mission operations: effective and efficient use of its resources reporting: reliability of reporting compliance: compliance w applicable laws and regs

program change controls take on an even higher level of significance w enterprise systems

the challenges are the result of the interdependence of the bus processes and the complexity of these processes and their connections. should unauthorized or untested changes be made to such systems, the results could be disastrous. ex: assume that a change is made to the inventory module of an erp sys w/o testing to see the impact that change will have on the sales module used to enter customer orders. bc these 2 modules work together, and orders from customers for inventory cannot be processed w/o the inventory module, changes to either module must be carefully planned and executed

Populate input screens with master data

the clerk enters the identification code for an entity, such as a customer, and the system retrieves data about that entity from the master data ex: entering a customer order. user might be prompted to enter customer id code. then, by accessing the customer master data, the sys automatically provides data such as cust name and address, salespersons name, and the sales terms. this reduces the number of key strokes required, making data entry quicker and more efficient. fewer keystrokes=fewer mistakes. to enable this control, numeric, alphabetic, and other designators are usually assigned to entities such as customers, vendors, and employees

data mining

the exploration, aggregation, and analysis of large quantities of varied data from across the org used to bettter understnd an orgs bus processes, trends within these processes, and potential opps to imprve effectiveness and efficiencyof org. requires training and expertise large amts of this so u could identifty relationships between factors that appear relevent but in fact are not (spurious correlations)

COBIT 4.1 (Control Objectives for Information and Related Technology)

the framework that has been widely adopted for it governance and it controls developed by the it governance institute to provide guidance to managers, suers, and auditors on the best practices for the mgmt of info tech it resources must be managed by it control processes to ensure that an organization has the information it needs to achieve its objectives organizes control processes

some auditors differentiate between

the point in a system where a control is "established" and the later point where it is "exercised"

data warehousing

the use of information systems facilities to focus on the collection, organization, integration, and long-term storage of entity wide data purp is to provide users w easy access to large quantities of varied data from across the org for the sole purp of improving dec making capabilities copying data periodically from 1 db to another analyze to gain insight

Principle 3: Applying a Single, Integrated Framework

there are numerous it standards, best practices, and guidance procedures available to enterprises. sobit 5 can align with any of these at a high level and thereby provide an enterprise w a single, integrated, overarching framework for it governance and mgmt. this overall framework is context and principles based, allowing for flexibility and dealing w open ended situations

bc control is an ongoing process,

there are periodic iterations of the steps. could be fraud! so periodic reviews are conducted to determine the effectiveness of fraud prevention programs.

of the following options, a database that is in _____ form has the best design

third normal (3NF)

purp of ic

to provide reasonable assurance that objectives are achieved and that risk responses are carried out

dss and eis managers

typiccally work alone and make decisisns

attributes sampling decision

ulrd <= trd = rely on controls as planned ulrd > trd = reduce planned reliance on controls

attributes sampling decisions

ulrd<=trd = rely on controls as planned ulrd>trd = reduce planned reliance on controls

what goals are aimed at minimizing processing errors

update completeness and accuracy

no sepate goal for

update validity. there would be invalid updates only if the inut completeness or update completeness control goals are not met (i.e. inputs or updates are to be processed once and only once)

in a manual based system, the goals of ensure update completeness and ensure update accuracy relate to

updating varius ledgers (ex: accts receivable subsidiary ledger) for data items entered into the books of original entry ( sales and cash receipts journals)

if u want to assess the design of a sys of ic

use the matrix to ask the Q " can these processes/controls provide reasonable assurance that the objectives are achieved?" an org should have at lease 1 process for each objective. otherwise, the org may achieve its objectives, but the odds are not v good. assessment concludes w recommendations for changes to the processes and controls that might be necessary. make changes carefully and take into acct cost benefits.

important data elements

usually all fin data elements, such as numbers that enter into a calculation. ex: amt ordered, selling price, discount, and net sales amt are crucial reference numbers, such as those for inventory items, customer numbers, and general ledger cording. accurate reference numbers are crucial to the proper classification of items in the fin stmts dates so we can determine that events are recorded in the proper time period

monitoring control plans differ from normal control plans in that they

verify the operation of the normal control plans. a normal control plan only serves to deetect and correct errors. monitoring control plans lead to the identification of the root cause of the error and ideally the implementation of normal control plans to prevent future errors. ex of monitoring: creating a periodic exception report listing all employees who have not taken vacations within a specified time frame and ensuring that report was reviewed and acted upon by mgmt. ex: writing and distributing the code of conduct outlining appropriate employee behavior is a normal control plan; a monitoring control plan would involve periodically collecting and reviewing letters signed by the employees that they have read, understand, and will follow the code of conduct

computer agreement of batch totals

works in the following manner: 1. First, one or more of the batch totals are established manually. 2. The manually prepared total is entered into the computer and written to the computer batch control totals data. 3. As individual source documents are entered, computer program accumulates independent batch totals and compares totals to the ones prepared manually and entered at start of the processing. 4. Computer prepares report, which usually contains details of each batch, together with an indication of whether totals agreed or disagreed. - Batched that do not balance are rejected, and discrepancies are manually investigated.

Fraud and Its Relationship to Control

• Accounting Profession Proactive in Dealing with Fraud • SAS No. 99 (Consideration of Fraud in a Financial Statement Audit) - Emphasizes brainstorming fraud risks, increasing professional skepticism, using unpredictable audit test patterns and detecting management override of internal controls. • SEC - "Management's evaluation of risk of misstatement should include consideration of the vulnerability of the entity to fraudulent activity..." • PCAOB AS5 (An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements) - An auditor's assessment of internal control should take into account the fraud risk assessment

University Housing Controls

• App State Safety & Security Policies: - Residents are issued an Appalachian State University ID card used to gain access to their residence hall. - Residents should not allow non-residents to follow them through the open door when entering/leaving the building. - This practice of "tailgating" compromises the safety of all residents. - Non-residents should contact a resident of the building to escort them while in the residence hall. - Residence hall staff are on duty from 8:00pm - 3:30am to monitor activity in each building. • Break Into Groups and Discuss the Following: - How well do these policies work? - In the context of this chapter, what improvements could be made?

Applying the Control Framework for Data Entry with Batches

• Batch control plans: - Regulate processing by calculating control totals at various points in a processing run and subsequently comparing these totals. - To be effective, batch control plans must ensure that: • All documents are included in the batch. • All batches are submitted for processing. • All differences are investigated and corrected on a timely basis. • All batches are accepted by the computer.

Caveat about the COBIT 4.1 Framework

• COBIT 5 framework has been adopted by ISACA • There are firms that are, and will continue, to utilize the COBIT 4.1 framework • PCAOB suggest finding a suitable framework to comply with SOX Section 404 - No specific framework is required • You may see this or another suitable framework in practice - Unlike accounting standards that do require adherence to changes in standards • I.e., PCAOB AU's and FASB's GAAP

Ethical Considerations and the Control Environment

• Control environment - Reflects the organization's general awareness of and commitment to the importance of control throughout the organization - Primarily the board of directors' and management's awareness • COSO places integrity and ethical values at the heart of the of control environment and states that ethical behavior and management integrity are products of the "corporate culture." - Corporate culture determines what actually happens and which rules are obeyed, bent, or ignored • Rewards system can pressure employees to bend the rules to attain unrealistic performance targets • Code of conduct

the control framework

• Control matrix - A tool designed to assist in analyzing the effectiveness of controls in a particular business process by matching control goals with their associated control plan • PCAOB Auditing Standard Number 5 calls this "Effectiveness of Control Design" - Compliance with SOX Section 404 • Provides a means to explain and analyze the controls that have been annotated on a systems flowchart • Caveat for this chapter: - Not learning a specific control plan - Overview of control matrix elements and how they relate to each other • Let's get real why we're learning about evaluating controls

A framework for Assessing the Design of an Internal Control System

• Control matrix - A tool designed to assist in evaluating the potential effectiveness of controls in a business process by matching control goals with relevant control plans - Analyze objectives and related risk - Establish processes and controls to provide reasonable assurance that objectives will be met • Control goals - Business process objectives that an internal control system is designed to achieve • Control plans - Reflect information-processing policies and procedures that assist in accomplishing control goals

Pervasive Control Plans

• Control plans that relate to a multitude of goals and processes • Provide a climate or set of surrounding conditions in which the various business processes operate - Similar to the control environment • Influence the effectiveness of control plans at lower levels in the control hierarchy • PCAOB AS5 includes them under "entity-level" controls • 4 pervasive controls we'll disuses - Organizational design (focus on segregation of duties) - Corporate policies (focus on personnel policies) - Monitoring controls - IT general controls

PWC 2011 Global Economic Crime Survey

• Cybercrimes - Crimes involving computers and the Internet - Now rank as one of the top four economic crimes worldwide. • Frauds reported within the previous 12 months occurred in 34% of companies in 2011, up from 30% in 2009. • For the first time in 12 years, computerized internal controls was the most effective method for detecting fraud. • Internal audit was the second most effective fraud detection method at 14%, down from 17% in 2009. • Suspicious transactions monitoring led to 18% of fraud detections in 2011, up from 5% in 2009. • Cybercrime represented 23% of all economic crime. • Strong correlation exists between fraud risk management activities and higher chances of fraud detection. • Accounting fraud decreased 37% from 2009 to 2011 but was still the second most reported fraudulent activity at 24%. • Most reported fraud was asset misappropriation at 72%

Control and Audit Implications of Data Warehouses

• DBs are normalized and emphasize data integrity • Data warehouses are primarily meant for decision support, which requires speed to perform data analysis - Data integrity relaxed as a tradeoff for speed • Relevance vs. Reliability • DB approached differently than a data warehouse • Auditor must be attentive to the possibility that bad data is present as a result of weak data integrity • GIGO

control plans for manual and automated entry

• Data entry program presents the clerk with a preformatted screen that prompts entry of certain data • In the following slide, the left-hand side presents manual entry and the right-hand is automated entry • The flowchart stops without depicting the update of master data - In this example we're focusing on input controls

Acquire and Implement Domain: IT Process 4 Develop and Acquire IT Solutions

• Develop and acquire or develop application software and technology infrastructure • Application software: - General term used for the software that is used to facilitate the execution of a given business process • Service level requirements: - Include such items as availability, reliability, performance, capacity for growth, disaster recovery, security, minimal system functionality, and service charges • Develop service level requirements and application documentation which typically includes the following: - Systems and program documentation - Operations run manual and user manual - Training materials

The Segregation of Duties Control Plan A Couple of Questions

• Do you agree with the following comment? - No matter how sophisticated the internal controls, success ultimately requires that a company place trust in a small number of trusted employees • Do you think it is possible for a small company to adequately implement segregation of duties? • Compensatory controls - Alternative controls - Placing greater reliance on management supervision, ownership involvement in the day-to-day operations of the business, and personnel control plans that focus on hiring honest employees

COBIT 5's Seven Enablers

• Enablers - Means to achieve governance objectives • Seven categories of enablers 1. Processes 2. Principles, policies and frameworks 3. Organizational structures 4. People, skills, and competencies 5. Culture, ethics, and behavior 6. Services, infrastructure, and applications 7. Information

Acquire and Implement Domain: IT Process 6 Manage Changes to Existing IT Systems

• Ensures integrity between versions of the systems • Ensures consistency of results • Changes to IT infrastructure must be managed via change request, impact assessment, documentation, authorization, release and distribution policies, and procedures • Improper changes can allow a programmer to make changes that are improper - Create opportunity for fraud • Program change controls - Provide assurance that all modifications to programs are authorized, and that changes are completed, tested, and properly implemented • These controls take a higher level of importance with an enterprise system

Monitor and Evaluate Domain: IT Process 10 Monitor and Evaluate the Processes

• Establish a system for defining performance indicators (service levels). • Gather data about processes and generate performance reports. • Measure progress toward identified goals. • Obtain outside confirmation based on independent review. • AICPA and Canadian Institute of Chartered Accountants have developed professional assurance and advisory services based on a common set of Trust Principles

Acquire and Implement Domain: IT Process 9 Provide Support Services

• Identify training needs of all personnel - internal and external - who use the organization's IT services. • Conduct timely training sessions. • Help desks - Provide advice and assistance to users with problems encountered in using IT resources so that they can effectively use those resources.

Organizational Governance Objective Setting

• Includes defining mission, vision, purpose and strategies to establish relationships

Plan and Organize Domain: IT Process 1 Establish Strategic Vision for Information Technology

• Information service (IS) management should establish a process for developing a strategic plan and converting it into short-term goals • IS strategic planning effort must ensure the strategic plan is supported and that IT is optimally deployed • Plan must ensure the organization is prepared to anticipate competitors' actions and take advantage of emerging technology

Common Ground on Working Definition of Internal Control

• Internal control is a process - Process is a series of actions or operations leading to a particular and usually desirable result • It is management's responsibility to establish and maintain internal control system • Strength of internal control system largely dependent on people who operate it • Internal control cannot provide absolute assurance - But can provide reasonable assurance

Organizational Design Control Plans

• Involves the creation of roles, processes, and formal reporting relationships in an organization • Is a key component of a firm's internal control • Without proper structure, greater likelihood of fraud

Using a Matrix to Evaluate Internal Controls

• Key tool for evaluating internal controls • Check marks show which process address which objective • At least one process for each objective • Concludes with recommendations for changes to processes and controls - Shown as "-n " process

Acquire and Implement Domain: IT Process 8 Ensure Security and Continuous Service

• Mirror site - Site that maintains copies of the primary site's programs and data. • Electronic vaulting - Service whereby data changes are automatically transmitted over the Internet on a continuous basis to an off-site server maintained by a third party. • Hot site - Fully equipped data center that can accommodate many businesses and made available to subscriber companies for a monthly fee. • Cold site - Facility usually with air-conditioned space, a raised floor, telephone connections, and computer ports into which a subscriber can move equipment. • Denial-of-service attack - A Web site is overwhelmed by an intentional onslaught of thousands of simultaneous messages, making it impossible for the attacked site to engage in its normal activities. • Distributed denial-of-service attack - Uses many computers (called zombies) that unwittingly cooperate in a denial-of-service attack by sending messages to the target Web sites.

Monitoring Control Plans

• Monitoring - An internal control system - Means management assessment to determine whether control plans are functioning appropriately • Consist of two parts 1. Putting controls in place and periodically following up on the operations of the controls • Set a baseline to compare or test the control 2. Ensuring that proper communications take place • Verifies operation of control plan • Identifies root causes of errors and implementation of control plans that mitigate future errors

IT General Controls and the COBIT 4.1 Framework

• Organizational governance - The processes employed by organizations to select objectives, establish processes to achieve objectives, and monitor performance • IT governance - A process that ensures the enterprise's IT sustains and extends the organization's strategies and objectives

2012 ACFE RttN's - Employees

• Over 75% of the frauds were committed by employees. • Most fraudsters were first-time offenders whose record was previously clean • Top 6 behavioral red flags same since the RttN's tracked (2008) - Living Beyond Means (45.80%) - Financial Difficulties (30.00%) - Unusually Close Association with Vendor/Customer (20.10%) - Wheeler-Dealer Attitude (15.30%) - Control Issues, Unwillingness to Share Duties (15.30%) - Instability in Life Circumstances (13.40%) • Small businesses disproportionally victimized by fraud

pcaob stuff

• PCAOB Inspection Reports critical of performance of audit firms • PCAOB wants to ensure compliance with auditing standards • Critical nature indicates how serious PCAOB is • The statistics bear this out - In 15% of 2009 engagements inspected, firms failed to gather sufficient audit evidence to support their internal control audit opinions due to one or more deficiencies. - Of those engagements, 10% had two or more deficiencies. - In 13% of the engagements, there was not sufficient evidence to support the financial statement audit opinion. - In 2011, the percent of engagements in which firms failed to gather sufficient evidence to support their internal control audit opinion climbed to 22%.

COBIT 4.1's Four Broad IT Control Process Domains

• Plan and organize • Acquire and implement • Deliver and support • Monitor and evaluate

Personnel Policy Control Plan

• Policy - A plan or process put in place to guide actions and achieve goals • Selection and hiring control plans - Job candidates should be carefully screened, selected and hired • Retention control plans - Companies should provide create and challenging work opportunities as well as channels for advancement whenever possible • Personnel development control plans - Training must occur regularly and be a top priority - Performance reviews should assess strengths and weaknesses and identify opportunities for promotion, training and personal growth • Personnel management control plans - Personal planning control plans • Project future staff skills, anticipate turnover and develop strategies for filling positions. - Job description control plans • Lay out position responsibilities and identify necessary resources for performing such responsibilities. - Personnel security control plans • Help prevents employee acts of fraud and theft of assets. • Rotation of duties • Forced vacations • Fidelity bond • Personnel termination control plans - Procedures when an employee leaves an organization - Voluntary and involuntary fidelity bond (insurance ur buying). used on any1 that handles cash. required to prosecute employee.

Acquire and Implement Domain: IT Process 8 Restricting Logical Access to Stored Programs, Data, and Documentation

• Preventing unauthorized disclosure and loss of data has become almost impossible. Employees and others can use iPods, flash drives, cameras, and PDAs, such as iPhones and iPads, to download data and remove it from a company's premises. • Access control software ensures; 1. Only authorized users gain access to a system through identification and authentication, 2. Restricts authorized users to specific data they require and sets action privileges for data, and 3. Monitors access attempts and violations. • The best way to mitigate password risk is additional authentications such as a biometric identification system (something they are) or a smartcard that must be used along with passwords and user ID's. • Intrusion-detection systems (IDS) - Log and monitor who is on or trying to access a network. • Intrusion-prevention systems (IPS) - Actively block unauthorized traffic using rules specified by an organization. • Library controls - Restrict access to data, programs, and documentation through a combination of people, procedures and computer software • Data encryption - Is a process that employs mathematical algorithms and encryption keys to encode data so that it is unintelligible in its encrypted form. • Public-key cryptography - Employs a pair of matched keys for each system user, one private (i.e., known only to the party who possesses it) and one public. The public key corresponds to but is not the same as the user's private key • Computer hacking and cracking - Is the intentional, unauthorized access to an organization's computer system, accomplished by bypassing the system's access security controls. • Hacker - Is someone who gets a kick out of breaking into a computer system but does not hold malicious intentions to destroy or steal. • Cracker - Is a term used when a hacker's motive is crime, theft, or destruction.

Acquire and Implement Domain: IT Process 3 Identify Automated Solutions

• SDLC must include procedures to: - define information requirements - formulate alternative courses of action - perform feasibility studies and assess risks • Solutions should be consistent with the strategic IT plan and may be developed in house or by third parties.

Types of Malware

• Salami slicing - Instructions inserted in programs to steal very small amounts of money. • Back door - Special code that allows a programmer to bypass its security features and can be used to attack the program. • Trojan horse - Module of unauthorized code that performs a damaging, unauthorized act. Often used in phishing emails. • Logic bomb - Code secretly inserted in a program that is designed to execute or explode at a specific date or event. ACC 3570 Chapter 7: Controlling Info Systems: Intro to ERM & IC Malware • Worm - Computer virus that replicates itself on disks, in memory and across networks • Zombie - Program that secretly takes over another Internet-attached computer and uses that computer to launch untraceable attacks

Highlights from Sarbanes-Oxley

• Section 101 - Created PCAOB • Section 201 - Prohibits audit firms from providing a wide array of nonaudit services to audit clients - Prohibits consulting engagements involving the design and implementation of financial information systems • Section 302 - CEO and CFO must certify quarterly and annual financial statements • Section 404 - Mandates the annual filing of an internal control report with the SEC - Section 404 and PCAOB AU 5 requires that management: • Evaluate company controls to determine if they adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner • Gather and evaluate evidence about the operation of its controls • Present a written assessment of internal control effectiveness • Company's independent auditor must test and report of the effectiveness of the system of internal controls (using narratives, DFD diagrams, and systems flowcharts) • Section 802 - Makes it a felony to knowingly destroy, alter, or create records or documents with the intent to impede, obstruct, or influence an ongoing or completed federal investigation • Section 906 - Up to 20 year sentence and up to $5 million penalty for CEO and/or CFO who knowingly and willingly falsely certifies annual or quarterly reports • Section 1102 - Provides for fines and imprisonment of up to 20 years for anyone who knowingly destroy, alter, or create records or documents with the intent impede, obstruct, or influence an ongoing or completed federal investigation • Pros and cons of SOX

The Segregation of Duties Control Plan

• Segregation of duties - Separates the four basic functions of event processing • Authorizing events • Executing events • Recording events, and • Safeguarding resources resulting from consummating events • Ideally, different departments carry out each of these • Collusion necessary between departments for fraud to occur • No single employee should be in a position to perpetrate and conceal fraud, errors or other system failures. • Not just for classic segregation of duties - For example, company event open house

batch control totals

• Several types of batch control totals can be calculated • Some are better than others at addressing the information control goals of input validity, input completeness, and input accuracy

Intelligent Agents

• Software program that may be integrated into DSS or other software tools (such as word processing, spreadsheet, or database packages) • Once set in motion, intelligent agents (sometimes called "bots," short for "robots") continue to perform their tasks without further direction from the user. • Used in EIS for collecting specific information from the Internet

Monitor and Evaluate Domain: IT Process 10 Main Concerns with Cloud Computing

• Support and control of the cloud computing services are largely in the hands of third-party cloud service providers. • There is typically no 24/7 support, one hour response time common. • Much cloud communication occurs over the Internet which has security risks unless a secure network connection or encrypted line is used. • Cloud users commonly use browsers with known security vulnerabilities. • Cloud service providers' employees might have loosely controlled access to sensitive data stored on their servers. • Cloud services have been known to go down for up to an hour and some start-up cloud vendors have failed

Control Plans for Data Entry with Batches

• System Description and Flowchart - In this example, the clerk assembles the picking tickets into groups of 25 and calculates batch totals - Periodically, the shipment data are sent to the computer for processing by the shipping program - Distinguishing control-related features are that it processes event data in batches, uses batch totals as a major control, and produces an exception and summary report. - Exception and summary report • A report that reflects the events - either in detail, summary, or both - that were accepted or rejected by the system - Some data could still be rejected at the update stage where the computer compares the input data with the master data.

Hypothetical Computer System

• The challenge is to protect the system from inside and the outside threats - Intentional or unintentional misuse • Supports organizational objectives • Provide environment where business processes control plans can be effective

Plan and Organize Domain: IT Process 2 Develop Tactics to Plan, Communicate, and Manage Realization of the Strategic Vision

• The entire IT organization acts as in a service capacity to the entire organization • Ensures adequate funding for IT • Project management framework - Undertaken in order of importance • Must not overlook IT hiring practices, even when labor is scarce - A disgruntled or incompetent employee can do a lot of damage in a short period of time - Midwest nonprofit IT manager • IT departments must employ organizational design principles including reporting and segregation of duties.

COSO Report on Fraudulent Financial Reporting from 1998 to 2007

• There were 347 cases of public company fraudulent financial reporting investigated by the SEC from 1998 to 2007 as compared to 294 cases from 1987 to 1997 • A total of $120 billion was misstated or misappropriated across 300 cases. - The mean was almost $400 million per case versus $25 million in COSO's earlier study • Median assets and revenues were almost $100 million compared to under $16 million in the 1999 report • Stock prices of an accused company declined an average of 16.7% within the first two days of the news release. • Subsequent news of an investigation resulted in an average 7.3% stock price decline. • Companies engaged in fraudulent activities frequently went bankrupt, were delisted from the stock exchange or required to sell their assets. • Of the fraud companies, 26% switched auditors between the last pre-fraudulent financial statements and the fraudulent financial statements. Only 12% of non-fraud companies changed auditors during that same time • Most common fraud schemes were improper revenue recognition, followed by overstatement of assets or capitalization of expenses. • CEO's and CFO's were involved in 89% of the cases, up from 83% in 1987 - 1997. Over 60% of those indicted were convicted.

Deliver and Support Domain: IT Process 7 Deliver Required IT Services

• This process includes activities related to the delivery of the IT services that were planned in the Plan and Organize domain and developed and implemented in the Acquire and Implement domain

ERM Framework

(4 Categories of Management Objectives) 1. Strategic • High-level goals aligned with and supporting its mission 2. Operations • Effective and efficient use of its resources 3. Reporting • Reliability of reporting 4. Compliance • Compliance with applicable laws and regulations

Nonstatistical Sampling: Determining Sample Size

(recorded bal of pop/tolerable misstatement) x confidence factor

Three Fraud Studies

- 2012 ACFE Report to the Nations - COSO Report on Fraudulent Financial Reporting from 1998 to 2007 - PwC 2011 Global Economic Crime Survey • All three studies indicate that fraud controls are necessary but must be backed by a strong ethical culture, a broad risk management program, the right "tone at the top" and zero tolerance for any fraud, regardless of the perpetrator

fraud

- A deliberate act or untruth intended to obtain unfair or unlawful gain - Always entails manipulating information for criminal purposes Laws imply that management has a legal responsibility to prevent fraud - Example: Foreign Corrupt Practices Act

• Entity-relationship model

- A diagram of the relational model

tables

- A place to store data - The most important step in creating a useful database is proper table design. - Each table stores data about one specific thing or entity. - Database table columns each store one specific attribute of the type of things stores in the table. - Primary key • Each row in a database must be unique and include a unique identifier that serves as an address for the row - Composite primary key • A primary key formed by combining two or more columns in a table

Control goals of information processes

- Ensure input validity, completeness, and accuracy - Ensure update completeness and accuracy

Users access data in tables by:

- Formulating a query, - Preparing a report or - Including a request for data within an application program

• Four types of DBMS we'll discuss

- Hierarchical - Network - Relational - Object-Oriented

Control plans for physical protection of IT assets

- Organization must install and regularly review suitable environmental and physical controls. - With newer hardware, malfunctions are rare - Regular preventative maintenance (periodic cleaning, testing and adjusting of computer equipment) should be done to ensure the equipment's continued efficient and correct operation.

• E-R diagram (entity-relationship diagram)

- Reflects the system's key entities and the relationships among those entities. - The E-R diagram represents the data model • Rectangles = entities • Connecting lines = relationships • Diamonds = characteristics of relationships

points of general agreement of internal control

- ic is a process for accomplishing objectives - establishing and maintaining a viable ic sys is mgmts responsibility - ultimate ownership of the sys should rest w the ceo. only if the primary responsibility for the sys resides at the top can control effectively permeate the entire org - the strength of any ic sys is largely a function of the ppl who operate it. no matter how sound the control processess may be, they will fail unless the personnel who apply them are competent and honest. bc ic is so people-dependent, we explore ethics. ethics must be a central concern when designing an effective ic sys. - partly bc it depends on ppl to op it and partly bc it comes only at some cost to the org, ic cannot be expected to provide absolute, 100% assurance that the org will reach its objectives. rather, the operative phrase is that it should provide reasonable assurance to that effect

populate input screens w master data

-effectiveness goal a, efficient employment fo resources: automatic population of inputs from the master data results in fewer keystrokes, which should improve the speed and productivity of the data entry personnel -input validity: the code entered by the user calls up data form existing records (a customer record, a sales order record), and those data establish authorization for the input event. for ex, w/o a customer record, a customer order cannot be entered. -input accuracy: fewer keystrokes and the use of data called up from existing records reduce the possibility of input errors efficiency and input completeness and accuracy. address syncing on QB for top customers

turnaround docs

-effectiveness goal a, efficient employment of resources: by scanning the picking ticket, we reduce the amt of data that must be input to record the shipment and improve the speed (effectiveness) and productivity of the data entry personnel (efficiency) -input validity: the turnaround docs were printed in a diff func area. this separates event auth (as reflected by picking ticket) from execution of the shipment (as represented by the packing slips). -input accuracy: using a prerecorded bar code to trigger the event reduces the possibility of input errors

preformatted screens

-effectiveness goal a, efficient employment of resources: by structuring the data entry process, automatically populating fields, and prventing errors, preformatted screens simplify data input and save time (effectiveness goal A), allowing a user to input more data over a period of time (efficiency) -input accuracy: as each field is completed on a preformatted screen, the curser moves ot the next field on the screen, thus preventing the user from omitting any required data. the data for fields that are automatically populated need not be manually entered, thus reducing input errors. incorrectly formatted fields are rejected like doc design but for screens. lets u be efficient doing ur order entries

Manually reconcile batch totals

0input validity, input completeness, input accuracy: agreement of the batch totals at this point ensures that only valid source docs comprising the original batch have been input (input validity), that all the source docs were input once and only once (input completeness), and that data elements appearing on the source docs have been input correctly (input accuracy).

COSO's Five Interrelated Components of Internal Control

1. Control environment - Sets the tone at the top. influences the control consciousness of its ppl. its the foundation for all other components of internal control, providing discipline and structure 2. Risk assessment - Identification and analysis of risks. 3. Control activities - Policies and procedures to ensure directives are carried out. 4. Information & communication - Processing information in a form and time frame to enable people to do their jobs. 5. Monitoring - Process that assesses the quality of internal control over time.

Top IT Security Concerns

1. Data breaches 2. Cybercrimes, including cyber attacks 3. Workforce mobility 4. Outsourcing 5. Cloud computing 6. Mobility devices, including laptops and cell phones 7. P2P (person-to-person) file sharing 8. Web 2.0, for example, blogs and social networking sites.

Steps in Sampling: Planning

1. Determine the objective of sampling 2. Define the characteristic of interest 3. Define the population

Steps in Preparing a Control Matrix Step 1. Specify Control Goals

1. Identify operations process control goals: a. Effectiveness goals • Developed during risk management • Describe measures of success for the operations process • Provide timely acknowledgement of customer orders • Provide assurance of customer creditworthiness b. Efficiency goals • Relate to ensuring resources used in the business process are being employed in the most productive manner. • People and computers c. Security goals • Relate to protecting entity resources from loss, destruction, disclosure, copying, sale or other misuse. Cash, inventory and information (customer data) must be secured. • Security over hard assets handles through pervasive, general, and IT controls 2. Identify information process control goals: a. Input goals • Relate to ensuring input validity (IV), completeness (IC) and accuracy (IA) with respect to all business process data entering the system. a. Update goals • Ensure update completeness (UC) and accuracy (UA) when there is a periodic process - a delay between input and update.

• Four levels of expertise can be applied to decisions

1. Manager make decisions without assistance • Based on their expertise 2. Decision assisted by problem-solving aids such as checklist and manuals 3. Checklist or manuals automated 4. System itself replaces the decision maker • Expert systems

COBIT 5's Five GEIT Principles

1. Meeting Stakeholder Needs 2. Covering the Enterprise End-to-End 3. Applying a Single, Integrated Framework 4. Enabling a Holistic Approach - 7 enablers on next slide 5. Separating Governance from Management

Three classifications of control plans

1. Preventive control plans • Stop problems from occurring 2. Detective control plans • Discover that problems have occurred. 3. Corrective control plans • Rectify problems that have occurred.

2 parts of monitoring

1. putting controls into place to periodically follow up on the operation of control plans. the proceses include determining a baseline to know when a control is operating effectively, to identify if there is a change in a process or a control plan itself, and to periodically test tht a control is operating. 2. ensuring that appropriate communications are taking place. a control weakness should be reported to the person responsible for the controls operation and at least 1 person at a higher level.no monitoring was in place to make sure that personnel higher than the direct supervisor were aware of the violation of the forced vacation control plan

continuity between cobit 4.1 and 5's frameworks

5 is an integration of 4.1 w two other widely used isaca it frameworks: val IT and risk IT. val it deals w how businesses can create value from their it investments risk it addresses the risks involved in it use. isaca is stressing that cobit 5 is not just evolution but also revolution.

Identify Entities

A "thing" is an that is an important element in a business process can be modeled as an entity - Only one instance of a "thing" it is not modeled as an entity • REA (Resources-Events-Agents) approach - Popular data modeling approach. - Entities and relationships are determined through systems analysis. - Common accounting entities include: • Resources - Assets the company owns. • Events - Occurrences related to resources. • Agents - People or organizations that participate in events.

document design

A control plan in which a source document is designed to make it easier to prepare the document initially and later to input data from the document into a computer or other input device. output for orders in logical order for data entry. tab through order invoice goes to efficient employment of assets on control matrix ex: org has properly designed this doc to facilitate the data preparation and entry processes

• Primary key

A value that uniquely identifies a specific row in a table. - Typically stored in the tables first column. - A candidate attribute (a column or collection of columns) is that table's primary key if: • All attributes in the table are functionally dependent on the candidate attribute • No collection of other columns in the table, taken together, has the first property

goal of input completeness is concerned w the

ACTUAL NUMBER of events or objects to be processed

• Executive information systems (EIS)

Also called executive support systems (ESS) - Combine information from the organization and the environment, organize and analyze the information, and present the information to the manager in a form that assists in decision making - Most have highly interactive graphical user interfaces (GUIs) - Mainly about collecting and presenting information to executives and less about doing processing and calculations

• Group support systems (GSS)

Also known as Group Decision Support Systems (GDSS) - Computer-based systems that support collaborative intellectual work such as: idea generation, elaboration, analysis, synthesis, information sharing, and decision making - Supports brainstorming • A method for freely and creatively generating as many ideas as possible without undue regard for their practicality or realism - Creates virtual meeting for a group - Member contribute as necessary to achieve group objectives

Off-Site Storage

Alternate facility, other than the primary production site, where duplicated vital records and documentation may be stored for use during disaster recovery. not necessarily comp storage. storage somewhere else just in case something happens to originals.

sequence checks

Applied to sequentially numbered and prenumbered documents to determine that all documents have been processed (completeness) and that no extra documents have been processed (completeness, validity). two kinds: batch sequence check and cumulative sequence check

business process control plans

Are applied to a particular business process, such as billing or cash receipts

application controls

Are automated business process controls contained within IT application systems (i.e., computer programs).

• Significant digit coding

Assigns meanings to specific digits

Ratio estimation:

Assumes a constant percentage misstatement in population Estimates recorded balance by multiplying recorded balance by ratio of audited value to recorded balance to come up w estimate for pops

Risk of Incorrect Rejection result

Auditors conclude that account is misstated Auditors perform additional procedures Efficiency loss (perform more effective substantive procedures than necessary)

Risk of Incorrect Acceptance result

Auditors conclude that account is not misstated Effectiveness loss (issue incorrect opinion on misstated F/S)

result of risk of overreliance

Auditors conclude that controls are functioning effectively Effectiveness loss (do not reduce audit risk to sufficient level)

1. determine the objective of sampling

Auditors identify key controls upon which they intended to rely objective is typically related to the assertion being tested in the controlled pop.

In downsizing / retirement environments, ES can be used to:

Capture and retain the expertise of the departing employee - Distribute the expertise to remaining employees - Distribute expertise to employees who do not timely access to the expert - Train new employees - Create an electronic colleague • Guide human experts by suggesting trends, asking questions, highlighting exceptions, etc.

retention control plans

Companies should provide create and challenging work opportunities as well as channels for advancement whenever possible.

Additional Considerations in Classical Variables Sampling

Consider the following additional factors in determining sample size: Risk of incorrect rejection Population variability To reduce population variability, auditors may choose to stratify the population

- Difference between DSS and EIS

DSS is created to suit the user, EIS is preformatted in advance (i.e., dashboard containing specific company performance information)

Database Essentials Relational Database Model

Data are logically organized into two-dimensional tables (i.e., "relations") • Allows users to query the tables to obtain information from one or more table in a very flexible way • Able to handle complex queries • Requires more computer resources than hierarchical or network DB models - I.e., more memory and processing time • Allows only text and numerical data to be stored - Does not allow the inclusion of complex object types such as graphics, audio, video, or geographic information

network database model

Data is organized in tree's according to relationships (many to many). for more complex data structures. a child record an have more than one parent record.

data redundancy

Data stored in multiple locations within a system. occurs among various files consequence of apps approach

business is becoming more and more "it centric"

Database Management Systems (DBMS) at the heart of this evolution

• Noteworthy aspects of centralized database approach

Database is now shared by multiple system applications that support related business processes - Data can be accessed through report generation and ad hoc user inquiries (queries) which allows users to ask questions using query language software - Two layers of software needed 1. Logical view (how users see) 2. Physical view (how data is stored on computer hardware)

Expert Systems (ES)

Decision support systems for complex decisions, where consistency is desirable and the decision maker wants to minimize time and maximize quality • Emulates the problem solving techniques of human experts • Appropriate when: - Decisions are extremely complex - Consistency in decision-making is desirable - Desire to minimize time spent on decision and maximize the quality of the decision - Experts are utilized and such knowledge can be captured and modeled via software • Utilized in downsizing and retirements

• Block coding

Dedicates groups of numbers to particular object characteristics - Numbers within each block are generally assigned sequentially - This leads to some of the same adding and deleting limitations as sequential coding

Monetary Unit Sampling (MUS)

Defines the sampling unit as an individual dollar (or other monetary unit) in an account balance Auditor will select individual dollars (or monetary units) for examination Auditor will verify the entire "logical unit" containing the selected dollar (or monetary unit) -Accounts receivable: Customer account -Inventory: Inventory item (that contains the $ we collected)

MUS: Evaluating Sample Results

Determine the upper limit on misstatements, which has a (1 - Risk of incorrect acceptance) of equaling or exceeding the true amount of misstatement Components: Projected misstatement Incremental allowance for sampling risk Basic allowance for sampling risk

• Application Approach to Business Event Processing

Each application collects and manages its own data, generally in dedicated, separate, physically distinguishable files for each application

Acquire and Implement Domain: IT Process 5 Integrate IT Solutions Into Operational Processes

Ensures that the new or significantly revised system is suitable - Must provide for a planned, tested, controlled, and approved conversion to the new system • After installation review to determine that the new system has met users' needs in a costeffective manner

Tolerable rate of deviation

Establish based on desired level of control risk Lower control risk = lower tolerable rate of deviation

Expected population deviation rate

Estimate based on past audits or pilot sample if this is greater than the tolerable amt theres no reason to test this control bc we already think its broken so we typiclly would expect the expected pop deviation rate to be lower than the tol rate of deviation if we gonna test a control

Variables Sampling process

Estimate the amount of misstatement (upper limit on misstatements) Compare upper limit rate on misstatements to an allowable level (tolerable misstatement)

risk

Events that would have a negative impact on organization objectives

opportunities

Events that would have a positive impact on organization objectives

Disadvantages of the centralized approach

Expensive to implement and maintain - If the DBMS fails, all the organization's information processing halts - Large magnitude of damage from unauthorized access - Increased potential for damage should unauthorized access to the database occur - Database recovery and contingency planning are more important than in the applications approach - Concurrent access causes contention or concurrency problems - Territorial disputes over how owns the data and who is responsible for data maintenance • Most companies that have adopted this approach have created a database administrator function to cope with the administrative and technical issues related to the DBMS

• Centralized Database Approach to Business Event Processing

Facts about events are stored in relational database tables instead of separate files, which solves many of the problems caused by data redundancy

Steps in Preparing a Control Matrix Step 2. Identify Recommend Control Plans

Focuses on the nature and extent of control plans that should be in place to reach objectives and lower residual risk • Most difficult part, identifying controls that should be in place and controls that are not in place 1. Identify "present" control plans and annotate them on the systems flowchart: - General rule, each process symbol on flowchart should be associated with at least one control - 2 categories of controls, (1) generic and (2) specific business processes a. Place P-1, P-2 through P-n beside all present controls, starting at the upper-left column. 2. Evaluate "present" control plans: - Common for a control plan to address more than one control goal - Important to write description of control goal a. Place the number and name of the plan on the control matrix, enter the control plan number in the matrix cells, and explain how each control addresses each control goal. 3. Identify and evaluate "missing" control plans: a. Examine the control matrix to see if there are any control goals not being addressed with the present plan. If so, develop a control plan and explain the nature and extent of the missing plan. b. Analyze the systems flowchart for further risk exposures for which you would recommend adding additional or strengthening existing controls. • It takes training, and teamwork, to become proficient at spotting risk and control weaknesses.

Characteristics of Relationships

In the E-R diagram previously show, read - ORDERS are received from CUSTOMERS • Cardinality - The degree to which each entity participates in the relationship. Can have a value of "one" ("1) or "many" ("N" or "M") • 1:N, one-to-many • M:N, many-to-many • 1:1, one-to-one • Maximum cardinality - Measure of the highest level of participation that one entity can have in another entity - Shown as number or N/M

there are problems with 1NF

Include functional dependencies which cause several problems called update anomalies, including: 1. Updates may require changes to multiple rows 2. Data may be inconsistent 3. Additions and deletions are problematic - Problems arise because an attribute is dependent on a portion of the primary key - a partial dependencies - In the example table, the attribute Item_Name is dependent on a portion of the primary key, Item_Number, not the entire key

Event Identification

Internal and external events affecting achievement of an entity's objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management's strategy or objective-setting processes. must be monitored to determine that evolving events have been identified and evaluated. as an org and its environment change, controls often become less effective

documentation

Involves all seven steps of sampling process Important judgments include: • Factors affecting sample size and rationale for those factors • Method of selecting sample and summary of items selected • Method of measuring sample items and summary of measurements • Evaluation of sample results and overall conclusion

COSO Definition of Internal Control

Is a process—effected by an entity's board of directors, management, and other personnel— designed to provide reasonable assurance regarding the achievement of objectives in the following categories: - Effectiveness & efficiency of operations - Reliability of financial reporting - Compliance with applicable laws & regulations

Review tickler file (file of pending shipments)

Manual file of documents, or a computer file, that contains business event data that is pending further action. such files must be reviewed on a regular basis for the purp of taking action to clear items form that file. if ticker file docs remain in the file for an extended period of time, the person or computer monitoring the file determines the nature and extent of the delay. ex: after packing slips are received, hte picking tickets are compared to their associated packing slipts and removed from the pending shipments file. we are classifying this as a present control bc we are assuming that the shipping clerk periodically reviews the file looking for picking tickets that have been pending for too lonh

Selecting Sample Items

Methods -Unrestricted random selection: Select items based on random numbers matched to items in population -Systematic random selection: Bypass a fixed number of items in population, selecting every nth item. select a random starting point. n is number of item in population divided by the sample size. -Block selection: Select contiguous/adjacent units. not used very much for random selection -Haphazard selection: Select items in a nonsystematic manner. unstructured w/o intentional bias. could not be replicated when defined carefully (other 3 methods can) and still coould have bias so not rly random sample. Can only use unrestricted random selection or systematic random selection with statistical sampling

COBIT 5

Newer framework that has been adopted • COBIT 5 is a new departure in the corporate governance of information technology. • Restructuring and reorganizing of the framework from being an IT process model into an IT governance model. • More inclusive, "strategic" and "big picture" oriented than COBIT 4 .1. • Uses a "holistic" approach that is more flexible, more principles-based and less proceduresbased than COBIT 4.1. - An enterprise tailors to its own needs - Putting internal controls within the larger context of enterprise-wide governance and management • GEIT - Governance of Enterprise IT

Database Essentials Object-Oriented Database Model

Object-relational databases - Include a relational DBMS framework with the capability to store complex data types • Includes abstract data types that allow users to define characteristics of the data to be stored when developing an application • Overcomes the limitations of relational databases

objective setting

Objectives must exist before management can identify potential events affecting their achievement. ERM ensures that management has a process in place to set objectives and that the chosen objectives support and align with the entity's mission and are consistent with its risk appetite. strategic objectives are established as well as related objectives for ops, reporting, and compliance. risk appetite guides strategy setting to balance, for ex, growth, risk, and return. risk appetite drives risk tolerances -- acceptable levels of variation in achieving objectives.

• Costs / Benefits Dilemma

Organizations want to have enough controls to ensure objectives are achieved without paying more for the controls than can be derived from their implementation

Example

Parameters Population size = $12,563,336 (recorded balance) Risk of incorrect acceptance = 10 percent Expected misstatement = $188,450 (1.5 percent of recorded balance) Tolerable misstatement = $628,167 (5 percent of recorded balance) Calculations Ratio of expected to tolerable misstatement: $188,450 ÷ $628,167 = 0.30 Tolerable misstatement as a percentage of population: $628,167 ÷ $ 12,563,336 = 5%

Nonstatistical Sampling

Permissible under GAAS Does not permit auditors to control exposure to sampling risk Major differences in: Determining sample size Selecting sample items Evaluating sample results

Losses due to accidental, nonmalicious acts far exceed those caused by intentional acts - This is why the system of controls must be capable of:

Preventing crimes Minimizing simple, innocent errors

COBIT 5's five GEIT principles

Principle 1: Meeting Stakeholder Needs Principle 2: Covering the Enterprise End-to-End Principle 3: Applying a Single, Integrated Framework Principle 4: Enabling a Holistic Approach Principle 5: Separating Governance From Management

reports

Printed lists and summaries of data stored in tables or collected by queries from one or more tables

program change controls

Provide assurance that all modifications to programs are authorized and that the changes are completed, tested and properly implemented. changes in documentation should mirror the changes made to the related programs. improper change controls could allow a programmer to change, for ex, the payroll program so that salaries for all programmers are increased each pay period separate org entities are responsible for each stage in the change process formal way of making sure programmers are doing what they should be doing. librarian. supervisor has list

Basic Allowance for Sampling Risk

Provides a measure of the misstatement that might exist in sampling intervals in which a misstatement was not detected Calculated as: Sampling interval x Confidence factor

2. Define the characteristic of interest

Question of interest to person conducting sampling plan (e.g., resting heart rate)

Incremental Allowance for Sampling Risk procedure

Rank all projected misstatements in descending order by tainting factor Determine incremental confidence factor for each misstatement Multiply projected misstatement by (incremental confidence factor - 1)

If ULRD > Tolerable Rate of Deviation

Reduce reliance on controls, increase control risk, and reduce detection risk (perform more effective substantive procedures) Expand sample to examine additional items and potentially reduce ULRD if we think our sample is not representative of the population

• Knowledge

Refers to information that has been formatted and distributed in accordance with an organization's routines, processes, practices and norms

Sarbanes-Oxley Act of 2002

Resulted from actions of failed publicly traded companies such as Enron, WorldCom, and Tyco • Government forced to interject its will into governance • Created public company accounting oversight board (PCAOB) • Strengthened auditor independence rules • Increased accountability of company officers and directors • Mandated upper management to take responsibility for the company's internal control structure • Enhanced the quality of financial reporting • Increased white collar crime penalties

Advantages of MUS

Results in more efficient (smaller) sample sizes bc the stats in mus have smaller sample sizes than var sampling Selects transactions or components reflecting larger dollar amounts more likely than smaller amts bc we test single dollar bc more dollars in the pool. probability proportional to size sample: probability of being selected is greater when we're larger and smaller when the bal is smaller. Effective in identifying overstatement errors (things that are overstated are larger so more likely to be selected) -use it to focus on Asset and revenue accounts Generally simpler to use than classical variables sampling bc dont have to do as many statistical estimates like variance or assuming a normal pop using monetary unit sampling its much simpler t apply than classical var sampling.

effectiveness losses

Risk of overreliance (assessing control risk too low) Risk of incorrect acceptance most concerned w these bc issue an unqual opinion when we shouldnt have

efficiency losses

Risk of underreliance (assessing control risk too high) Risk of incorrect rejection dont care as much about these but still important

inherent risk

Risk that exist in the absence of any actions management might take to reduce the likelihood or impact of the risk

How to Determine ULRD

Sample Evaluation Tables in Appendix F.B Process: Select AICPA Sample Evaluation table corresponding to desired risk of overreliance Identify row related to the appropriate sample size Identify column related to the appropriate number of deviations Determine ULRD at junction of row and column

risk of underreliance occurs when

Sample indicates controls are not functioning effectively Controls are functioning effectively

Using MUS Tables

See Exhibit G.2 for excerpted Sample Size Table (full tables in Appendix G.A) Inputs: Risk of incorrect acceptance Expected misstatement Tolerable misstatement Population size

electronic vaulting

Service whereby data changes are automatically transmitted over the Internet on a continuous basis to an off-site server maintained by a third party. when needed, the backed up data can be retrieved from the electronic vault to recover from a data loss at the primary comp facility or to resume interrupted ops at an alternative facility

3. define the population

Should include all potential applications of the control during the period examined ex: all invoices generated between the 1st day of the period and the last day of the period (includes all of the pop of potential transactions which should have those supporting shipping docs)

document/record counts

Simple counts of the number of documents entered (e.g., 25 documents in a batch). This procedure represents the minimum level required to control input completeness (input doc once). it is not sufficient if there are multiple parts to an event. for ex, consider a sales doc that can include 1 or more items. a doc record coutn would not reflect the # of individual items sold, but rather, only the 1 doc. this total would not be enough to ensure input accuracy. also, bc one doc could be intentionally replace w another, this control is not effective for ensuring input validity and input completeness (the insertion of a duplicate doc, a completeness violation, or the insertion of a bogus doc, a validity violation)

Plan and Organize Domain: IT Process 1 Establish Strategic Vision for Information Technology

Strategic planning and corresponding activities include: 1. A summary of the organization's strategic goals and plans and how they are related to IT. 2. IT goals and strategies and a statement of how each will support organizational goals and strategies. 3. An information architecture model encompassing the corporate data model and the associated information systems. 4. An inventory of current IT capabilities. 5. Acquisition and development schedules for hardware, software, applications, personnel and finances. 6. IT-related requirements to comply with industry, regulatory, legal and contractual obligations including safety, privacy, transborder data flows, e-business, and insurance contracts. 7. IT risks and risk action plans. 8. Process for modifying the plan to accommodate changes to the organization's strategic plans and IT conditions.

dollar totals

Sum of dollar value of batch items. Reduces possibility that documents could be duplicated, added to or lost from a batch or that amounts were incorrectly input and improves input validity, completeness, and accuracy.

Ensure effectiveness of operations

The control plan compare vendors for favorable prices, terms, quality, and product availability is directed primarily at which of the following control goals? a. ensure effectiveness of operations b. input validity c. input accuracy d. input completeness ex: timely acknowledgement and customer creditworthiness created by ppl, subjective, no uniform set of ops process goals exists.

• Classifying

The process of grouping or categorizing data according to common attributes

Risk of Incorrect Rejection

The risk that the sample supports the conclusion that the control is not operating effectively when it actually is or that the recorded account balance is materially misstated when it is not materially misstated. Type I error, false rejection

Risk of Incorrect Acceptance

The risk that the sample supports the conclusion that the control is operating effectively when it is not or that the recorded account balance is not materially misstated when it is materially misstated. Type II Error, false acceptance embodiment of audit risk audit is ineffective

Personnel Development Control Plans

Training must occur regularly and be a top priority. Performance reviews should assess strengths and weaknesses and identify opportunities for promotion, training and personal growth.

4. determine sample size (upfront)

Under statistical sampling, sample size considers desired exposure to sampling risk 5% SR = 95% CI willing to take 5% chance that sample does not represent population what affects sample size: pop size for small pops, expected deviation rate, tolerable deviation rate, sr, ci,

• Data warehousing

Use of information systems facilities to focus on the collection, organization, integration, and longterm storage of entity-wide data - Purpose is to provide users with easy access to large quantities of varied data from across the organization to improve decision-making capabilities - Firms copy data from transactional / organizational DBs to the data warehouse - Additional nonorganizational / external data is added • Such as governmental or industry statistics

MUS: Selecting Sample Items

Use systematic random sampling Calculate sampling interval as: Population size ÷ Sample size Process: Identify random start Skip number of items equal to sampling interval Select item (dollar in account) and examine entire logical unit containing that item (customer account) May select same logical unit multiple times any logical unit w a $ value greater than the sampling interval will have a 100% chance at being selected. high dollar values always selected!!

attributes sampling

Used to estimate the extent to which a characteristic exists within a population Used in the auditor's study of internal control

both dsss and ess can assist a user in prob solving but in diff ways

a dss is a passive tool. it depends on the human users knowledge and ability to provide the right data to the sys's decision model. an es is an active teacher or partner tht can guide the user in deciding what dat ato enter and in providing hints about further actions that are indicated by the analysis to date

rotation of duties

a policy that requires an employee to alternate jobs periodically

Enterprise Risk Management (ERM)

a process effected by an entity's board of directors, management, and other personnel applied in strategy setting and across the enterprise that is designed to identify potential events that may affect the entity and to manage risks to be within its risk appetite to provide reasonable assurance regarding the achievement of entity objectives helps mgmt identify, assess, and manage risk.

IT governance

a process that ensures that the enterprise's IT sustains and extends the organization's strategies and objectives

changes

can include changes to process acts (purchasing raw materials) or changes to process controls (approving purch orders). if changes in the process do not reduce the variance from objectives, changes to process objectives (increase production by only 5%) might also be considered.

Ensure efficient employment of resources

can only be evaluated in the relative sense

to achieve the goal of input accuracy, we must

capture and enter into a system all important data elements. all important data elements must be identified for each economic event or object that we want to include in a systems database

data input incldues

capturing data (completing a source doc such as a customer order) (if necessary) converting the data to machine-readable form event data are the target of the input control goals. only actual authorized events have validity

to ensure update accuracy relates to

correctly recording (correct customer, correct items and quantities) customer orders in the sales order and inventory master data

ensure input accuracy

correctness of data put into the system relates to the various data items that usually constitute a record of an event, such as a source doc. to achieve this goal, we must minimize discrepancies between data items entered into a sys and the economic events or objects they represent. mathematical mistakes and inaccurate transcription of data from one doc or medium to another may cause accuracy hours. order is for 200 for customer 159, sales rep mistakenly enters the customer number as 195, resulting in another customers name. missing data fields on a source doc or computer screen represent another type of accuracy error. absence of a customer number on an order would result in a lost sale (orders that cant be shipped to a particular customer). this is an accuracy error rather than a completeness error bc the mere presence of the source doc suggests that the event itself has been captured and that the input data are complete.

detective control plans

discover that problems have occurred ex: review and compare. comparison is done to ensure that no discrepancies exist between customer orders displayed by the customer and the totals that accompany those orders.

the purpose of ______ control goals is to ensure that all resources used throughout the business process are being employed in the most productive manner

efficiency

Principle 4: Enabling a Holistic Approach

enablers, as the word suggests, are the means to achieving cobit 5's governance objectives for the enterprise. specifically, enablers support the implementation in an enterprise of an all inclusive governance and mgmt structure for it. the cobit 5 framework specifies 7 categories of enablers: -processes -principles, policies, and frameworks -org structures -ppl, skillls, and competencies -culture, ethics, and behavior -services, infrastructure, and applications -info

internal environment

encompasses the tone of an org and sets the basis for how risk is viewed and addressed by an entitys people, including risk mgmt philosophy and risk appetite, integrity AND ETHICAL VALUES, AND THE ENVIRONMENT IN WHICH THEY OPERATE

Achieving which control goal requires that all valid objects or events are captured and entered into a system's database once and only once?

ensure input completeness

a process, affected by an entity's board of directors, management, and other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives is:

enterprise risk mgmt

NNs supplement ESs in areas where

expertise has not yet been captured. by examining data, NNS can identify and replicate the patterns that exist

centralized database approach to business event processing

facts about events are stored in relational database tables instead of separate files, solves many of the problems caused by data redundancy.

1. Determine the objective of sampling

Drawing conclusion about some population of interest (e.g., does aerobics program lead to a reduction in resting heart rate?) (e.g., does brand of golf ball provide increased distance?)

planning (attributes)

1. determine the objective of sampling 2. define deviation condition 3. define the population

Upper Limit Rate of Deviation

(1 - risk of overreliance) probability that the true rate of deviation is less than or equal to the ULRD (Risk of overreliance) probability that the true rate of deviation exceeds the ULRD Consists of: Sample rate of deviation Allowance for sampling risk its the most conservative estimate

Risk of Overreliance

(Risk of Assessing Control Risk too Low) referred to as type II error, false acceptance

automated data entry

-effectiveness goal A, efficient employee of resources: inputs are entered more quickly and w fewer personnel resources than are inputs entered manually -input accuracy: by elminating manual keying and using scanning and other tech, the input accuracy is improved

review tickler file (file of pending shipments)

-effectiveness goal a, input completeness, update completeness: a file of picking tix is retained in shippin awaiting packing slips. if the packing slips are received ina timely manner, nad the corresponding picking tiz are removed from the pending shipments file, we can ensure that goods will be shipped in a timely manner and that the picking tix were indeed input and the master data updated. if picking tix do not receive packing slips within a reasonable period of time, then an inquiry procedure is initiated to determine the nature and extend of the delay in a warehouse -- all open doors that havent been fulfilled. it addresses security and update completeness and update accuracy. saves mgr reviewing tickler file and open orders to work w warehouse mgr to create plan. have a doc that sales mgr reviews and signs and says plan of open invoices

attributes sampling

-planning -Determining Sample Size -Selecting and Measuring Sample Items -Evaluating Sample Results

InformationWeek Top-10 CIO Concerns

1. Business analytics 2. 80/20 IT operations vs. investment gap 3. Mobile devices 4. Digitize the enterprise 5. Social media 6. Customer engagement 7. Data center / cloud computing 8. CIO as Chief Acceleration Officer 9. Importance of Being Global 10. Optimizing systems

Create the E-R Diagram in 5 Steps

1. Create a relational table for each entity - CUSTOMERS, INVENTORY, ORDERS, and SALES 2. Determine primary keys for each entity table 3. Determine attributes for each entity - Sometimes called a field and represented as a column in a table 4. Implement relationships among the entities (primary keys exist as attributes in other tables) - Ensure that the primary key of one table exits as an attribute in every table (entry) for which there is a relationship - For many-to-many, relationship (junction) tables 5. Determine attributes for each relationship table

8 components of ERM

1. Internal Environment - Tone of an organization - Sets the basis for how risk is viewed and addressed by an entity's people - Risk management philosophy and risk appetite - Integrity and ethical values - The environment in which they operate 2. Objective Setting - Objectives must exist before management can identify potential events affecting their achievement - ERM ensures management has a process in place to set objectives and that the objectives support and align with the entity's mission and are consistent with its risk appetite 3. Event Identification - Events affecting achievement of objectives must be identified, distinguishing between risks and opportunities. - Opportunities are channeled back to management's strategy or objective-setting processes. 4. Risk Assessment - Risks are analyzed - Evaluated considering likelihood and impact of risk as a basis for determining how they should be managed - core of effective compliance w sox section 404 5. Risk Response - Management selects risk responses • Avoiding, accepting, reducing, or sharing risk - Develop a set of actions to align risks with the entity's risk tolerances and appetite 6. Control Activities - Establish and implement policies and procedures to help ensure the risk responses are effectively carried out 7. Information and Communication - Relevant information is identified, captured, and communicated to enable people to carry out their responsibilities - Effective communication flows down, across and up the organization - narratives, systems flowcharts, written policies and procedures 8. Monitoring - ERM is monitored and modifications are made as necessary. - Monitoring is accomplished through ongoing management activities and separate evaluations. - assesses the qual of ic performance over time - key element in the lt success of a sys of ic. - includes org gov, mgmts compliance w soz s. 404, the activities of internal and external auditors, and certain control activities • Audit risk model (AR=IR*CR*DR)

Ensure security of resources

A control goal of an operations process ex: protect assets from damage, fraud, or misappropriation ex: suprinas customer data represent an importance resource for this company bc it tells them a lot must protect both tangible and intangible resources

Residual expected risk

A function of initial expected gross risk, reduced risk exposure due to controls and the cost of controls

object-oriented database model

A model that allows the storage of both simple and complex objects (including items such as video, audio, and pictures). Characteristics also include inheritance and encapsulation. other types of data can be stored. like video clips or pics can be stored in an object oriented database. include abstract data types that allow users to define characteristics of the data to be stored when developing an application. this overcomes the limitations of relational databases. relational databases limit the types of data that can be stored in table columns. instead of tables, oo dbms stores data in objects

Acquire and Implement Domain: IT Process 8 Ensure Security and Continuous Service

A number of business continuity planning models are available • We'll look at one developed by the Business Continuity Institute • Six elements 1. BCM policy and program management provides the framework around which the BCM is designed and built (hub of wheel) 2. Understand the organization 3. Determine business continuity strategies 4. Develop and implement a BCM response 5. Exercise (rehearse), maintain and review 6. Embed BCM in the organization's culture

hash totals

A summation of any numeric data existing for all documents in the batch, such as a total of customer numbers or invoice numbers in the case of remittance advices; used for control purposes only. can be a powerful batch control bc they can determine whether inputs have been altered (accuracy), added (validity), duplicated (completeness), or deleted (completeness). these batch hash totals operate for a batch in a manner similar to the operation of doc record hash totals (a type of programmed edit check for individual inputs).

Second Normal Form (2NF)

A table is in second normal form (2NF) if it is in 1NF and has no partial dependencies - I.e., no non-key attributes that are dependent on only a portion of the primary key • Non-key attributes: - An attribute that is not part of the primary key • This resolves update anomaly problems • Two steps to get from 1NF to 2NF 1. Create a new table for each subset of the table that is partially dependent on a part of the composite primary key 2. Place each of the non-key attributes that are dependent on a part of the composite primary key into the table that now has a primary key that is the field on which the non-key attribute is partially dependent.

Decisions under MUS

Account balance is not misstated Suggest correction of identified misstatements Investigate cause of misstatements Account balance is misstated Increase sample size to attempt and reduce upper limit on misstatements Recommend adjustment to reduce misstatement below tolerable misstatement

Incremental Allowance for Sampling Risk

Adjusts the projected misstatement to control exposure to risk of incorrect acceptance Allows for the possibility that the remainder of the sampling interval might be misstated by a higher percentage than the logical unit

• Functional dependence

An attribute (column in a table) is functionally dependent on a second attribute (or a collection of other attributes), if a value for the first attribute determines a single value for the second attribute at any time - When functional dependence exists, the first attribute determines the second attribute

Mean-per-unit:

Assumes each item in population (component of account) has similar balance Estimates recorded balance by multiplying number of components by average audited value Use amts similar in size

Difference estimation:

Assumes each item in population (component of account) has similar difference between recorded and audited value Estimates the amount of misstatement by multiplying number of components by average misstatement Estimates recorded balance using estimated misstatement

Projected Misstatement

Assumes entire sampling interval contains same percentage of misstatement as the logical unit examined by auditors Calculated for each misstatement as: Sampling interval x Tainting % Do not project misstatements if the logical unit > sampling interval

risk of underreliance result

Auditors conclude that controls are not functioning effectively Auditors assess control risk at higher than necessary levels Efficiency loss (perform more effective substantive procedures than necessary)

When a business purchases a DBMS, it becomes an audit problem

Auditors need to expand their knowledge of DBMS

sampling risk cause

Caused by selecting a nonrepresentative sample

• Other coding schemes

Check digit: is a code that includes an extra digit that can be used to check the accuracy of the code

Database Essentials Network Database Model

Child records can have more than one parent record - Solved joint account problem • Significant improvement over the early hierarchical designs • Eclipsed by relational databases which are vastly more flexible

Expert Systems

Computerized advisory programs that imitate the reasoning processes of experts in solving difficult problems ESs appropriate in situations w these characteristics: decisions are extremely complex, consistency of decision making is desirable, the decision maker wants to minimize time spent making decision while maxing qual of decision, experts familiar w the knowledge and content of the decision are involved, and their knowledge can be captured and modeled via computer software sometimes used as part of a downsizing strategy.

Sequential Sampling

Conducting a pilot study to estimate the population parameters so that another, larger sample of the appropriate sample size may be drawn. also known as stop or go sampling stop after evaluating a relatively small sample and evaluate your results. if ur results are clearly acceptable or unacceptable u would stop. if the results are inconclusive u would examine more items. most used to determine quickly that results are clearly not acceptable, we're less likely to use stop and go to determine that something is acceptable w a small small sample size. advantage is that sample may be more efficient than a fixed sample plan

item or line counts

Counts of number of items or lines entered. Improves input validity, completeness, and accuracy by reducing possibility that line items or entire documents could be added to the batch or not be input.

attributes sampling process

Estimate the rate at which the client's internal control is failing to function effectively (upper limit rate of deviation) Compare upper limit rate of deviation to an allowable level (tolerable rate of deviation)

Using Databases and Intelligent Systems to Aid Decision Makers

Decision aids - Information tools that can help decision makers - Computerized tools used to assist, and in some cases replace, the decision maker - Decision aids include: • Decision support systems • Executive information systems • Group support systems • Expert systems • Intelligent agents Many decisions are unstructured - Especially, at higher levels of an organization

Personnel termination control plans

Defines procedures when an employee leaves an organization. more important when fired for cause bc the employee is likely to be upset or angry and damage the org. collecting any items displaying the companys identification (letter head), reclaiming office and building keys, and removing password access to data

• Data model

Depicts user requirements for data stored in a database

sampling risk can be controlled by

Determining an appropriate sample size (higher % of items sampled in the population, sampling risk decreases bc more likely to have a representative sample) Ensuring that all items have an equal likelihood of selection (more random, less risk) Evaluating sample results to control risk (if u evaluate using statistical methods u can control the level of sampling risk and that makes ur results more meaningful)

Precision (allowance for sampling risk)

Distance from the estimated population value in which the true (but unknown) population value may lie with a given probability +- range (precision interval). 5% SR = 95% reliability level. compare ippder end of precision interval to tolerable amt to decide if pop is materially misstated or not.

• Advantages of the centralized approach

Eliminating data redundancy - Ease of maintenance - Reduced labor and storage costs - Data integrity - Data independence - Privacy

knowledge mgmt sys

Employees can access database and contribute of extract knowledge from anywhere in the world • DBs provide orderly storage and retrieval of captured knowledge

• Control goals of operations processes

Ensure effectiveness of operations Ensure efficient employment of resources Ensure security of resources

5. select sample items

Ensure that all items are available for selection

Sampling risk (Risk of overreliance)

Establish based on desired level of control risk Lower control risk = lower risk of overreliance (less substantive testing)

Batch sequence check:

Event data within a batch are checked as follows: 1. The range of serial numbers constituting the documents in the batch is entered. 2. Each individual serially prenumbered document is entered. 3. Computer program sorts input documents into numerical order; checks documents against the sequence number range; and reports missing, duplicate, and out-of-range data.

Centralized Database Approach To Business Event Processing

Facts about events are stored in relational database tables instead of separate files • Solves the problems caused by data redundancies • Improves efficiency, eliminates data redundancies, and improves data integrity • Enables integrated business information systems that include data about all of a company's operations - In one massive relational table • Multiple users from throughout the organization can view and aggregate event data in a manner most conducive to their needs • Management increasingly views information systems as a decision-support activity first and reporting second (CRM and ERP)

example

If Sample estimate = 17.5 bpm Precision = 2 bpm Reliability = 90 percent There is a 90 percent likelihood (reliability) that the true population value is between 15.5 bpm (17.5 - 2) and 19.5 bpm (17.5 + 2)

Qualitative Considerations

In addition to number of deviations (quantitative) consider qualitative nature of deviations Examples: Pervasive (a few affect a lot of things-special circumstance for invoices done incorrectly. follow up on) vs. isolated deviations? Unintentional vs. intentional deviations (greater concern-maybe some fraud going on)? Misunderstanding (less concern-training can fix it) vs. carelessness (ppl dont care, not good)? these all have implications on the audit and for publicly traded companies we may consider these to indicate sig deficiencies or material weaknesses

access control software

In an online environment, it ensures that (1) only authorized users gain access to a system through a process of identification (e.g., a unique account number for each user) and authentication (e.g., a password to verify that users are who they say they are), (2) restricts authorized users to specific data they require and sets the action privileges for that data (e.g., read, copy, write data), and (3) monitors access attempts and violations.

• Mnemonic coding

Includes letters as some or all of the code which is done to help humans remember them

• Decision support systems (DSS)

Information systems that assist managers with unstructured decisions by retrieving and analyzing data and generating information - Possesses interactive capabilities - Can answer ad-hoc inquires - Provides data modeling facilities such as spreadsheets - Artificial intelligence • Can imitate human decision making (i.e.,) when confronting complex and ambiguous situations

sampling risk

Likelihood that the decision based on the sample differs from the decision that would have been made if the entire population were examined

• Hierarchical coding

Orders items in descending order where each successive rank order is a subset of the rank above it. Specific meaning is attached to particular positions

ULRD Example

Parameters: Risk of overreliance = 5% Sample size = 127 (use row for n = 125) Number of deviations = 2 Sample rate of deviation = 2 ÷ 127 = 1.6%

6. measure sample items

Perform procedure and make appropriate evaluation/measurement Determine sample estimate Nonsampling risk can occur if incorrect procedures are performed or mistakes in evaluation or measurement are made

Acquire and Implement Domain: IT Process 8 Ensure Security and Continuous Service

Plan for contingencies for processes, not resources • Two elements required 1. Programs, data, and documentation 2. Alternative computer facility • Backup - Making a copy of data • Recovery - Use the backup to restore lost data and resume operations. • Continuous Data Protection (CDP) - All data changes are date stamped and saved to secondary systems as the changes are happening.

Disadvantages of MUS

Provides a conservative (higher) estimate of misstatement than classical var sampling so ur more likely to determine that the bal is materially misstated than if u use cvs Not effective for understatement or omission errors which is more important for Liabilities and expenses. smaller amts/understatements or items left our are less likely to be selected and u have a 0 chance of selecting something w a 0 bal which would be our omission errors using mus. Expanding sample is difficult if initial conclusion is to reject the account balance bc of the way we select our sample using a systematic sampling technique it becomes much more difficult to expand the sample than in other methods Requires special consideration for accounts with zero or negative balances since these accts would have a 0 chance of being selected in this method u would need to alter ur selection process to somehow include these balances to be selected if u are going to use mus and areas like liabs and exps

cumulative sequence check

Provides input control when the serial numbers are assigned within the organization (e.g., sales order numbers issued by the sales order department) but later are not entered in perfect serial number sequence (i.e., picking tickets do not necessarily arrive at the shipping department in sequence). periodically, reports of missing numbers are produced for manual follow up ex: reconciling checkbook

cumulative sequence check

Provides input control when the serial numbers are assigned within the organization (e.g., sales order numbers issued by the sales order department) but later are not entered in perfect serial number sequence (i.e., picking tickets do not necessarily arrive at the shipping department in sequence). in this case, the mathcing of individual event data (picking ticket) numbers is made to a file that contains all doc numers (all sales order numbers). periodically, reports of missing numbers are produced for manual follow up. check register assists for reconciling checkboook to know complete sequenc eof checks

hierarchical database model

Records are organized in a pyramid structure the records at or near the top of the structure contain records below them. works well for simple situations ex: a bank that wants to record info ab its customers and their accts couold use this. top level records may hold info ab customers. next level down could include reocrds w info abt accts. a custoemr might have a savings acct, a checking acct, and a loan acct. all of a customers accts would be below that customer record in the hierarchy. the next level down may include records that store info ab transactions in each acct.

Database Essentials Hierarchical Database Model

Records are organized in a pyramid structure • Child records - Records that are included in a record one level above them (a parent record) • Parent records - Include the lower-level child records • Each parent can have many child records, but each child record can only have one parent • Example - Customer master record and child accounts for the customer • Works well for simple data structures only - Problem for joint accounts (i.e., child having two parents)

big data

Refers to the massive amount of data collected from human- and machine-generated sources

Information and Communication

Relevant information is identified, captured, and communicated in a form and time frame that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the entity.

If ULRD ≤ Tolerable Rate of Deviation

Rely on controls as planned Maintain planned level of control risk and detection risk

online prompting

Requests user input or asks questions user must answer. Includes context-sensitive help. ex: after entering all the input data for a particular customer order, u might be presented w 3 options: accept the completed screen, edit the completed screen, or reject the completed screen. by forcing u to stop and accept the data, online prompting is advising u to check ur data entries b4 moving on. in addition, many systems provide context service help, whereby the user is automatically provided w, or can ask 4, descriptions of the data to be entered into each input field

how to determine sample size

Sample size tables in Appendix F.A Process: Select AICPA Sample Size table corresponding to desired risk of overreliance Identify row related to the appropriate expected population deviation rate Identify column related to the appropriate tolerable rate of deviation Determine sample size at junction of row and column

MUS: Evaluating Sample Results (Basic Allowance for Sampling Risk)

Sampling Interval x Confidence Factor $147,804 x 2.31 = $341,427

written approvals

Signature or initials to indicate someone authorized the event. Ensures data input arises from a valid business event and appropriate authorizations have been obtained. another control aspect of approving an input document is that such of an approval segregates authorizing events from recording events might use electronic approvals in some situations. whereby bus events are routed, using a computer systems workflow facility, to persons authorized to approve the event. ex: purch requisitions might be routed for approval to those w budgetary authority

document/record counts

Simple counts of the number of documents entered (e.g., 25 documents in a batch). This procedure represents the minimum level required to control input completeness (i.e., input the document once). putting batch in. physically count when submitting invoice. if u put wrong #, it wont process. input accuracy and completeness. make sure ur putting in right # of docs.

2. define deviation condition

Situation in which control is not functioning as intended ex: shipping docs missing, shipping and invoices dont match all the things that indicate the control isnt working, not just the most obvious things

• Now let's discuss using the top-down approach to database design

Sometimes called event-driven approach • Because it attempts to describe all aspects of the business events and processes under consideration • As opposed to bottom-up (or user-driven) approach • Usually results in better DB design

PCAOB Inspection Results

The Firm failed to perform sufficient substantive procedures to test the [client's] loan charge-offs and recoveries...the sample the Firm used in its testing was too small to provide the necessary level of assurance, as the risk factor the Firm used to calculate its sample size was inconsistent with its own risk assessment. The Firm failed to perform sufficient procedures to test revenue and accounts receivable...in performing tests of details of accounts receivable, the Firm selected a sample only from subsidiary ledgers that exceeded a certain threshold, and therefore a significant portion of accounts receivable was not subject to testing.

When is sampling used?

The need for exact information is less important The number of items comprising the population is large

COBIT 4.1 Definition for Control

The policies, procedures, practices, and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected.

organizational goverance

The process by which organizations select objectives, establish processes to achieve objectives, and monitor performance. • Processes to achieve the objectives including essential internal controls and monitoring activities are then designed and implemented

• Knowledge management

The process of capturing, storing, retrieving, and distributing the knowledge of the individuals in an organization for use by others in the organization to improve the quality and efficiency of decision making across the firm - Next logical step after DBMS - Why?

turnaround documents

These are used to capture and input a subsequent event. picking tickets, inventory count sheets, and remittance advice stubs attached to customer invoices are examples of this. for ex, we have seen picking tix that are printed by the computer, used to pick the goods, and sent to shipping, where the bar code on the picking ticket is scanned to trigger the recording of the shipment. thus, turnaround docs can facilitate automated data entry. they can be used for the input of individual items rather than batches. in such cases, the scanning computer displays the scanned data, such as items and quantities to be shipped, to the data entry clerk or shipping clerk. if the data has been scanned correctly, the clerk need only press 1 key or click the mouse button to record the input remittance devices and picktick

First Normal Form (1NF)

Unnormalized table - Contains repeating attributes (fields) within each row (or record) • We call these attributes repeating groups • A table is in first normal form (1NF) if it doesn't contain repeating groups. • A primary key that is formed by the combination of two or more columns is called a composite primary key

Discovery Sampling

Used when deviations occur at a very low rate, but are critical in nature • Extremely important controls • Possible existence of fraud we use the sample sizes from the tables that show an expected pop dev rate of 0% bc in this case these are v important or there might be fraud so we're saying we expect 0 deviations here. if u find even 1 deviation u would stop testing immediately and conclude that the control is not working If one deviation is identified, audit team concludes control is not operating effectively

Classical Variables Sampling

Uses normal distribution theory and the central limit theorem to provide an estimated range of: Recorded account balance or class of transactions Misstatement in an account balance or class of transactions Basic methodology: Determine estimated range of account balance or misstatement Evaluate using tolerable misstatement

Applications Approach To Business Event Processing

View that concentrates on the process being performed • Data plays a secondary role to the programs • Each application collects and manages its own data files • Data redundancy Same fact in multiple files violates the integrity of the data

policy

a plan or process put into place to guide actions and achieve goals. applies to company activities in a variety of areas law can compel behaviors and enforce penalties for noncompliance, policies merely guide behavior toward the actions that are most likely to achieve desired goals. one major policy area that significantly affects internal control in an org is the area of personnel policies

ensure input completeness

all true or authorized transactions are put into the sys ex: there are 48 valid orders to be processed but the order entry clerk makes a mistake and only requests the processing of 38 orders

General Controls

also known as IT general controls are applied to all it service activities for ex, preventing unauthorized access to the computer system would protect all of the specific business processes that run on the computer (such as order entry/sales, billing/accounts receivable/cash receipts, inventory, payroll, and so on.).

erm process

and its components are evaluated -- via ongoing mgmt activites, separate evaluations, or both -- to determine its effectiveness and to make necessary modifications. for ex, bus processes put into place to accomplish objectives are reviewed to determine their effectiveness.

business process control plans

applied to a particular business process, such as billing or cash receipts

control effectiveness

are all the control goals achieved

application controls

are automated business process controls contained within IT application systems (i.e., computer programs).

control goals

are business process objectives that an internal control system is designed to achieve

neural networks (NNs)

are computer hardware and software systems that mimic the human brains ability to recognize patterns or predict outcomes using less than complete info used to recognize faces, voices, and handwrittem characters, and apples from bad to good

audit sampling

attributes sampling variables sampling effect of factors on sample size

mus best and worst

best used when audit team expects to find few or no misstatements and when overstated, the existence assertion is of greatest concern. in contrast, when a relatively large number of misstatements is expected or when understatement (the completeness assertion) is of greater concern then mus is less effective and we may want to go w some other method

alternative names for contingency planning include all of the following except:

business disaster planning

Principle 5: Separating Governance From Management

cobit 5 strongly differentiates governance and mgmt. these two functions have different acts, organizational structures, and purposes. this distinction is critical to cobit 5. accordingly, we quote below cobit 5's definition of these two terms governance ensures that stakeholder needs, conditions, and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting directions through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives

Principle 2: Covering the Enterprise End-to-End

cobit 5's holistic and enterprise orientations make integrating geit into overall enterprise governance a top priority. cobit 5 is not "it-focused" but instead takes an enterprise wide view. it covers all funcs and processes in the enterprise and views all it governance and mgmt enablers to apply to the entire enterprise--end to end

group support systems

computer-based systems designed to improve various aspects of group work also called group decision support systems support collaborative intellectual work. sue tech to solve the time and place dimension problems associated w group work creates a virtual meeting for a group. while attending, memebrs of group work toward completing their tasks and achieving the groups objectives.

which of the following control plans is designed to achieve the goal of input completeness

confirm input acceptance

preformatted screens

control the entry of data by defining the acceptable format of each data field. ex: screen might force users to key exactly 9 alphabetic characters in 1 field and exactly 5 numerals in another field. or the sys may provide drop down lists of data that are acceptable for a given field, such as shipping methods and sales terms. to facilitate the data entry process, the cursor may require that certain fields be completed, thus preventing the user from omitting any mandatory data. finally, the sys may automatically populate certain fields w data, such as the current data, sales tax rates, and other terms of a bus event. this reduces the # of keystrokes required, making data entry quicker and more efficient. also, w fewer keystrokes and by using the default data, fewer keying mistakes are expected, which makes the data entry more accurate. to ensure that the sys has not provided inappropriate defaults, the clerk must compare the data provided by the sys w that of the input

entity level controls

controls that have a pervasive effect on the entity's system of internal control; also referred to as company-level controls levels 1 and 2 of control hierarchy control environment and general controls the standard emphasizes the pervasive effect that entity level controls have on the achievement of control objectives and the effectiveness of specific controls, such as business process controls. many of these entity level controls, including it general controls, such as controls over computer program development, program change controls, controls over computer operations, and access to programs and data

nonstatistical sampling

does not allow audit team to control exposure to sampling risk when the auditor does not use statistical methods in either determining the sample size or selecting the sample or both which means the auditor cannot evaluate the results statistically in nonstatistical sampling we determine the sample results and use auditor judgment to decide if theres enough of a cushion between projected pop misstatement and tolerable misstatement to give a large enough cushion for sampling which in this case cannot be quantified so we're making a judgement call on whether theres enough of a gap between those 2 things to control for sampling risk so its a little less precise.

org gov, as implemented w a framework such as erm, begins w

establishing mission, vision and purpose; then, strategy and objectives directed at the mission are established and risks, are identified. after assessing risks and deciding how to respond to the risks, controls are put into palce to ensure that responses to the risks are carried out.

personnel control plans

help to protect an organization against certain types of risks. ex: hiring incompetent employees could result in time and money being wasted on futile training programs. alternatively, offering employment to an individual unqualified to fill a position may preclude efficient, effective ops or, if the person cannot follow instructions, may lead to inaccurate info processing. hiring an employee with a prior record or dishonesty exposes the org to a greater possibility of fraud.

operational errors

human error when entering inventory or other forms of data todays customer orders may be processed against an out of data (yesterdays) sales order master data or we may fail to execute some intermediate steps in a process. this may happen if input data are used for more than one applicatioin and we fail to use the inputs for all of the intended processes (should not be a problem w enterprise systems where one input automatically impacts all relevant applications). some appplications (such as in banking) process "memo" updates during the day to immediately reflect activity, such as cash withdrawals. the "real" updates take place overnight in a batch process. if we fail to properly execute the overnight process, the updates may be incomplete or inaccurate

for org gov, ic are

implemented to help ensure that risk responses are effectively carried out, or the controls themselves are the responses to risks. a

Knowledge Mangement

is the process of capturing, storing, retrieving, and distributing knowldeg of the individuals in an org for use by other s in the prg to improve the qual and efficiency of dec making across the firm primary enabler of km efforts is info ttech logical next step after dbms in bus info sys

attributers sampling

is used to estimate the extent to which a characteristic (attribute) exists within a population Used during auditors' tests of controls Estimate the rate at which internal control activities are not functioning as intended (deviation conditions) Compare estimated rate to an allowable rate (tolerable rate of deviation)

job description control plans

lay out the responsibilities for each position on an organization chart and identify the resources to be used in performing those responsibilities

manual reconciliation of batch totals

operates as follows: 1. One or more batch totals are established manually. 2. As individual event descriptions are entered the data entry program accumulates independent batch totals. 3. Computer produces reports that includes relevant control totals that must be manually reconciled with totals established prior to the process. 4. Person who reconciles batch total must determine why totals do not agree and make necessary corrections to ensure the integrity of the input data

categories of pervasive control plans

org design, policies, monitoring, and it general controls. pervasive control plans provide a second umbrella of protection, in addition to the control environment, over all AIS bus processes. pervasive control plans are particularly important bc they operate across all business processes and affect a company's capability to meet a multitude of control goals.

even if a malfunction occurs, it is usually detected and corrected automatically. in addition to relying on the controls contained within the computer hardware, organizations should perform regular

preventive maintenance (period cleaning, testing, and adjusting of computer equipment) to ensure their equipments continued efficient and correct operation

program documentation

provides a description of an application program and usually includes the programs purpose; program flowcharts; source code listings; descriptions of inputs, data, and outputs; program test data and test results; and a history of program changes and approvals of such changes

ensure of input completeness ex

recording all csutomer orders in the sales order and inventory master data for all customer orders recorded in the customer orders file.

corrective control plans

rectify problems that have occurred ex: if discrepancies are detected, suprina should have a procedure for resolving the discrepancy. this procedure would constitute a corrective control

document/record hash totals

reflect a summarization of any numeric data field within the input document or record, such as item numbers or quantities on a customer order. the totaling of these numbers typically serves no pup other than as a control. calculated b4 and then again after entry of the doc or record, this total can be used to determine that the applicable fields were entered accurately. you use this to look for any 1 thing in all docs on a certain type of docs. for vendor invoices, vendor zip code. something that is numeric and u add them up to get has total

control plans (first level of overall protection)

reflect information-processing policies and procedures that assist in accomplishing control goals control environment appears at the top of the hierarchy and it comprises a multitude of factors that can either reinforce or mitigate the effectiveness of the pervasive and application control plans

The model that logically organizes data into two-dimensional tables is the:

relational database model

risk assessment

risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. risks are assessed on an inherent and a residual basis two factors to consider: likelihood and impact inherent risk exists in the absence of any actions that mgmt might take to reduce likelihood or impact. the fin serv industry firms that failed in 2008 either did not identify the investment risks they were facing or did not adequately respond to those risks

Statistical Sampling

sampling applies laws of probability in selecting sample items and evaluating sample results Allows audit team to control exposure to sampling risk enables the auditor to make quantitative stmts about the results and to measure the sufficiency of the evidence gathered must follow statistical methods for determining sample size, selecting the sample, and evaluating the results (for all 3 steps). this allows u to quantify sampling risk and make precise decisions on sample results when extrapolating to the population. projective misstatements can be very close to but still below tolerabe misstatement and we can still determine that the population is not materially misstated bc we have statistically quantified sampling risk w this method.

Factors Affecting Sample Size

sampling risk (risk of overreliance) tolerable rate of deviation expected population deviation rate population size

Searching through rubbish for system information such as passwords is called:

scavenging

the first step, identification and authentication, involves

what is commonly known as the user id and password. however, passwords are a notoriously weak method for authenticating user identification bc, for ease of use, most people choose simple passwords. free software already exists that can decode simple word passwords n seconds. employees should be trained to use longer passwords and those made up of random characters, including letters, numbers, and symbols. employees should also be instructed not to write down or divulge their passwords.

Plan and Organize Domain: IT Process 2 Develop Tactics to Plan, Communicate, and Manage Realization of the Strategic Vision

• IT steering committee - Coordinates the organizational and IT strategic planning processes and reviews and approves the strategic IT plan • Security officer - Safeguards the IT organization by 1. Establishing employee passwords and access to data, 2. Ensuring the IT organization is secure from physical threats

Acquire and Implement Domain: IT Process 8 Ensure Security and Continuous Service

• Two important aspects of Process 8: - Ensure continuous service - Secure IT assets • Business continuity planning (also known as disaster recovery planning, contingency planning, and business interruption planning) - A process that identifies events that may threaten an organization and provides a framework to ensure that the organization will continue to operate when the threatened event occurs or will resume operations with a minimum of disruption

2012 ACFE Report to the Nation on Occupational Fraud and Abuse

• Typical organization lost 5% of annual revenues to fraud - $3.5 trillion worldwide • Typical fraud was underway 18 months before detection. • Frauds were more likely detected by tips than through audits or internal controls. • Median loss of the 1,388 reported cases was $140,000. • One-fifth of losses were at least $1 million.

Monitor and Evaluate Domain: IT Process 10 Trust Services Principles and Criteria

• WebTrust - Best practices and e-business solutions related to B2B and B2C electronic commerce • SysTrust - Assurance service designed to test and monitor the reliability of an entity's information systems and databases including ERP systems

measuring sample items

• perform appropriate tests of controls -look for presence or absence of control applied by entity -if item cannot be located, consider as a deviation • determine sample rate of deviation number of deviations/sample size


संबंधित स्टडी सेट्स

Chapter 2: Starting the Planning Process

View Set

Abeka Science 8.5 Types Of Birds

View Set

MODULE 5: MANAGEMENT AND CONTROL OF THE CORP.

View Set

Algebra 1 Lesson 3.1 Graphing Linear Equations - Intercepts

View Set

evolution and the history of life exam 1

View Set

NSG 334 Chapter 29: Growth and Development of the Adolescent

View Set

Chapter 10- Customer Relationship Management

View Set

Verbs:Datıf -a/w, -ya/ye (movement to)

View Set