ais chapter 10

correct statements about COBIT

-COBIT 5 integrates other frameworks and standards such as ITIL and ISO 2700 series -COBIT 5 enables IT to be governed in a holistic manner by taking in IT responsibility and considering the IT-related interest of stakeholders -COBIT is a generally accepted framework for IT governance and management

monitoring component of the COSO ERM framework

-the ERM components and internal control process should be monitored continuously and modified as necessary -It is the process of evaluating the quality of internal control design and operation and the effectiveness of the ERM model

what is the impact of Sarbanes Oxley Act 2002 (SOX) on the accounting profession?

-under SOX, the PCAOB replaces AICPA to issue audit standards -SOX established the PCAOB to regulate and audit public accounting firms

COBIT 199

(control objectives for information and related technology) an internationally accepted set of best IT security and control practices for IT management release by the IT Governance Institute (ITGI)

Sound internal control dictates that immediately upon receiving checks from customers by mail, a responsible employee should a. Prepare a summary listing of checks received. b. Add the checks to the daily cash summary. c. Record the checks in the cash receipts journal. d. Verify that each check is supported by a pre-numbered sales invoice.

A

Which edit check compares entered data to a predetermined acceptable upper and lower limit? A) Range check B) Valid check C) Field check D) Sequence check

A

Which of the following is a computer test made to ascertain whether a given characteristic belongs to the group? a. Validity check. b. Limit check. c. Check digit. d. Echo check.

A

Which of the following is considered an application input control? a. Edit check. b. Run control total. c. Exception report. d. Reporting distribution log.

A

Which of the following is not a COSO ERM framework objective? a. risk assessment b. compliance c. reporting d. operations e. strategic

A

Which of the following items is one of the eight components of COSO's enterprise risk management framework? A. Monitoring. B. Operations. C. Compliance. D. Reporting.

A

According to COSO, which of the following components of the enterprise risk management addresses an entity's integrity and ethical values? A. Information and communication B. Risk assessment. C. Control activities. D. Internal environment.

D

Control risk should be assessed in terms of a. Types of potential fraud. b. Specific controls. c. Control environment factors. d. Financial statement assertions

D

Obtaining an understanding of an internal control involves evaluating the design of the control and determining whether the control has been: a. Monitored. b. Tested. c. Authorized. d. Implemented.

D

Proper segregation of duties calls for separation of the following functions: a. Custody, execution, and reporting. b. Authorization, payment, and recording. c. Authorization, execution, and payment. d. Authorization, recording, and custody.

D

Which is not an example of a batch total? a. record count b. financial total c. hash total d. exception total

D

Which of the following control activities should be taken to reduce the risk of incorrect processing in a newly installed computerized accounting system? a. Ensure proper authorization of transactions. b. Adequately safeguard assets. c. Segregation of duties. d. Independently verify the transactions.

D

Which of the following is not a component of COSO ERM? A) Event identification B) External environment C) Internal control evaluation D) B and C

D Internal environment, objective setting, event Identification, risk assessment, risk response, control activities, information and communication, and monitoring activities are the eight components in the COSO ERM framework.

Under COSO ERM framework, which of the following objectives involves parties external to the organization? A) Strategic objectives B) Compliance objectives C) Operation objectives D) Reporting objectives

D The ERM framework takes a risk-based, rather than a control-based approach to achieving the firm's objectives in four categories: Strategic, compliance, operation and reporting. The reporting objective is about the reliability of internal and external reporting. Hence, it may involve external parties.

Example of IT general controls:

IT control environment

.. provides the details for IT service management which is released by the UK Office of Government Commerce (OGC) and is the most widely accepted model for IT service management

ITIL

COBIT

a comprehensive framework for IT governance and management

COSO ERM

a framework expands from internal control to risk management that can be applied to all firms

ITIL

a framework focusing on IT infrastructure and IT service management

ISO 27000 series

a framework for information security management

COSO

a general internal control framework that can be applied to all firms

enterprise risk management 201 (ERM)

a process, affected by the entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within the risk appetite, to provide reasonable assurance regarding the achievement of objectives

Sarbanes Oxley Act of 2002 (SOX) 196

a response to business scandals such as Enron, WorldCom, and Tyco International, requires public companies registered with the SEC and their auditors to annually assess and report on the design and effectiveness of internal control over financial reporting

Information Technology Infrastructure Library (ITIL) 199

a set of concepts and practices for IT service management

IT application controls 206

activities specific to a subsystem's or an application's input, processing and output

main purpose of ISO 27000 series

address information security issues

when entering a sales transaction, use an input control to ensure the customer account number is entered accurately

application control

IT application controls

are activities specific to a subsystem's or an application's input, processing, and output.

validity checks

compares data entering the system with existing data in a reference file to ensure only valid data are entered

COSO

composed of several organizations (AAA, AICPA, FEI, IIA, and IMA); studies the causal factors that lead to fraudulent financial reporting and develops recommendations for public companies, independent auditors, the SEC and other regulators, and educational institutions to improve the quality of financial reporting through internal controls and corporate governance

Three of the seven key criteria of business requirements for information in COBIT are about security and people often call then CIA:

confidentiality integrity availability

general controls 198

pertain to enterprisewide issues such as controls over accessing the network, developing and maintaining applications, and documenting changes of programs

concurrent update control

prevent two or more users updating the same record simultaneously

output controls 207

provide output to authorized people and ensure the output is used properly

main purpose of COBIT

provides the best IT security and control practices for IT management

main purpose of ITIL

provides the concepts and practices for IT service management

IT application control ( output controls)

providing output to authorized people and ensuring the output is used properly

closed-loop verifications

retrieve and display related information to ensure accurate data entry

the process, ....., is to identify and analyze risks systematically to determine the firm's risk response and control activities. It allows a firm to understand the extent to which potential events might affect corporate objectives

risk assessment

avoiding, accepting, reducing and sharing are components of .... in ERM . 1.risk response 2.risk assessment 3.control activities 4.communication and monitoring

risk response

information technology controls involve assurance for information and help to mitigate ... associated with the use of ... . Firms need such controls to protect information assets, remain competitive, and control costs in implementing IT projects

risks; technology

range checks

test a numerical amount to ensure that it is within a predetermined range

processing controls 207

ensure that data and transactions are processed accurately

input controls 206

ensure the authorization, entry, and verification of data entering the system

reasonableness checks

ensure the logical relationship between two data values is correct

IT application control ( processing control)

ensuring that data and transactions are processed accurately

IT application control (Input controls)

ensuring the authorization, entry, and verification of data entering the system

IT general controls (ITGC) (206)

enterprise level controls over IT

Public Company Accounting Oversight Board (PCAOB) (196)

established by SOX to provide independent oversight of public accounting firms

corrective controls 198

fix problems that have been identified such as using backup files to recover corrupted data

require a policy on developing and maintaining applications

general control

require using user names and passwords to access the company's network

general control

segregation of duties (COSO)

to prevent fraud and mistakes

correct statements regarding information technology governance and corporate governance:

1. information technology governance is the responsibility of management 2.information technology governance is a subset of corporate governance

COSO ERM framework indicates that :

1.ERM provides reasonable assurance regarding the achievement of the firm's objectives 2.ERM manages risk to be within the firm's risk appetite

Four categories of COSO's ERM framework

1.strategic - high level goals, aligned with and supporting the firm's mission and vision 2.operations - effectiveness and efficiency of operations 3. reporting - reliability of internal and external reporting 4.compliance -compliance with applicable laws and regulations

corporate governance

197 a set of processes and policies in managing an organizations with sound ethics to safeguard the interests of its stakeholders

control risk

203 the threat that errors and irregularities in the underlying transactions will not be prevented, detected, and corrected by the internal control system

A field check is: a. preventive control b. detective control c. corrective control d. general control e. output control

A

The framework could be used by management in its internal control assessment under requirements of SOX is the: -COSO internal framework. -COSO enterprise risk management framework. -COBIT framework. -All of the above are correct.

All of the above are correct.

Controls that are designed to prevent, detect or correct errors in transactions as they are processed through a specific subsystem are referred to as: a. general controls b. application controls c. physical controls d. two of the above are correct

B

Which of the following is considered a control environment factor by the COSO definition of internal control? A) Control objectives B) Integrity and ethical values C) Reasonable assurance D) Risk assessment

B

Which of the following statements is correct? a. SOX requires all public companies to use the COSO ERM framework to meet the requirements of Section 404. b. regarding IT control and governance, the COBIT framework is most commonly adopted by companies in the US. c. ITIL is the best internal control framework for the high tech industry d. ISO 27000 series are best practices for IT service management

B

prenumbering of source documents helps to verify that a. multiple types of source documents have a unique identifier b. all transactions have been recorded because the numerical sequence serves as control c. no inventory has been misplaced d. document have been used in order

B

Which duties should be completed by different people to achieve strong separation of duties? A) Journalizing and posting B) Receivables and payables C) Authorization, custody and recordkeeping D) Document numbering and document completion

B Separation of duties requires segregation of authorization, custody and recordkeeping.

Based on SOX, which of the following sections is about internal controls? a. 302 b.401 c.404 d. 906

C

Bill is responsible for custody of the finished goods in the warehouse. If his company wishes to maintain strong internal control, which of the following responsibilities are incompatible with his primary job? A) He is responsible for the company's fix asset control ledger. B) He is responsible for receiving of goods into the warehouse. C) He is responsible for the accounting records for all the receipts and shipments of goods from the warehouse. D) He is responsible for issuing goods for shipment.

C

When considering internal control, an auditor should be aware of reasonable assurance, which recognizes that a.Establishing and maintaining internal control is an important responsibility of management. b. Internal control may be ineffective due to mistakes in judgment and personal carelessness. c. The cost of an entity's internal control should not exceed the benefits expected to be derived. d. Adequate safeguards over access to assets and records should permit an entity to maintain proper accountability.

C

Which is least likely to be provided by an application control? A) Accuracy B) Completeness C) Reliability D) Authorization

C

the computer sums the first four digits of a customer number to calculate the value of the fifth digit and then compares that calculation to the number typed ruing data entry. This is an example of a a. field check b. parity check c. check digit verification d.batch total

C

... defines the overall IT control framework

COBIT

physical controls 207

mainly manual but could involve the physical use of computing technology

Backup is a preventive control. T/F

F

SOX requires companies to use COSO or COSO ERM as the framework in evaluating internal controls T/F

F

A major reason of internal controls implemented for an information system is to provide perfect assurance that the goals of each business process are achieved.A major reason of internal controls implemented for an information system is to provide perfect assurance that the goals of each business process are achieved. T/F

FALSE

T/F Each company should use only one of the control/governance frameworks in corporate and IT governance

FALSE

the control objectives for information and related technology (COBIT) framework is an internationally accepted set of best IT security control practices and is required by PCAOB to be used for SOX section 404 audit

FALSE

The Sarbanes-Oxley Act of 2002 (SOX) 2002 requires the management of all companies and their auditors to assess and report on the design and effectiveness of internal control over financial reporting annually. True False

False

Batch Processing is the aggregation of several business events over a set period of time with eventual processing of the related data (periodic processing). T/F

TRUE

Internal control is a process consisting of ongoing tasks and activities. It is a means to an end, not an end in itself. True False

True

Processing controls are IT general controls. True False

True

Segregation of duties reduces the risk of errors and irregularities in accounting records. True False

True

... controls find problems when they arise

detective

preventative controls 198

deter problems before they arise

Four of the seven key criteria of business requirements for information in COBIT are similar to COSO control objectives:

effectiveness efficiency compliance reliability

cost/benefit analysis 205

important in determining whether to implement an internal control

International Organization for Standardization (ISO) 27000 series is designed to address ... ... issues

information security

IT controls 205

involve processes that provide assurance for information and help to mitigate risk associated with the use of technology

residual risk 203

the product of inherent risk and control risk ( residual risk = inherent risk x control risk )

inherent risk 203

the risk related to the nature of the business activity itself

International Organization for Standardization (ISO) 27000 series (199)

this series contains a range of individual standards and documents specifically reserved by ISO for information technology

supervision (COSO)

to compensate imperfect segregation of duties

independent verification (COSO)

to double check for errors and misrepresentations

authorization ( COSO)

to ensure transactions are valid

access control (COSO)

to enure only authorized personnel have access to physical assets and information

accounting document and records (COSO)

to maintain audit trails and accuracy of the financial data