UGA ACCT 5310 Midterm

COBIT audience

-Management: to help them balance risk and control investment in an IT environment -Auditors: to provide a framework to assist them to come to an opinion on the level of assurance on the particular subject matter being audited

Online/real-time processing

-as it occurs -data is more timely -provides competitive advantages

batch processing

-periodic updates -cheaper and efficient -lack of timely/updated data -typically used for processes not needing timely data (ex: payroll)

data is captured about

-the event/activity that occurred -the resources affected by the event/activity -the people who participated

important SOX aspects

1) PCAOB 2) Rules for auditors 3) Roles for audit committees 4) Rules for management 5) Internal control requirements

Two fundamentals of Security

1) Security is a management issue, not just an IT issue 2) Defense in depth: Employing multiple layers of controls in order to avoid having a single point of failure

Input controls

1) data entry controls 2) batch processing data entry controls 3) online data entry controls

3 principles of information and communications systems

1) obtain or generate relevant, high quality information to support internal control 2) internally communicate information, such as objectives and responsibilities, to support other components of internal control 3) communicate internal control matters externally

Internal Controls Primary Functions

1) preventive controls 2) detective controls 2) corrective controls

COSO Control Activities

1) proper authorization of transactions and activities 2) segregation of duties 3) design and use of documents and records 4) safeguarding of assets, records, and data 5) independent check on performance 6) project development and acquisition controls 7) change management controls

expenditure cycle journals

1) purchase journal 2) cash disbursements journal

revenue cycle journals

1) sales journal 2) cash receipts journal

4 general guidelines for adequate segregation of duties

1) separate custody of assets from accounting 2) separate authorization from custody of related assets 3) separate operational responsibilities from record-keeping 4) separate IT duties from user departments

6 components of an AIS

1) the people who use the system 2) the procedures and instructions used to collect, process, and store data 3) the data about the organization and its business activities 4) the software used to process the data 5) the information technology infrastructure, including the computers, peripheral devices, and network communications devices used in the AIS 6) the internal controls and security measures that safeguard AIS data

HRM (HCM)/Payroll Cycle

1) update payroll master database 2) validate time and attendance 3) prepare payroll 4) disburse payroll 5) disburse payroll taxes and deductions

internal control objectives

1. Safeguard assets 2. Ensure accuracy and reliability of accounting records (data) and information 3. Promote efficiency in the firm's operations 4. Measure compliance with management's prescribed policies and procedures and/or laws and regulations

Online Data Entry Controls

1. prompting 2. closed-loop verification 3. transaction log

revenue Cycle

1.Sales Order Entry 2.Shipping 3.Billing 4.Cash Collection 5.Sales Return (if applicable)

COBIT 5

1describes best practices for effective governance and management of IT. Main point is to separate governance from management.

primary key

A field (or group of fields) that uniquely identifies a given entity in a table

Database

A set of interrelated, centrally coordinated data files (stored without redundancy

file

A set of logically related records, such as the sales orders of all customers

accounting information system

A system that collects, records, stores, and processes data to produce information for decision makers.

record

All the fields containing data about one occurrence within the entity (e.g., one student)

rules for audit management

CEO and CFO certifications on financial statements and system of internal controls

data processing

CRUD -creating new data records (ex: new employee is hired) -reading, retrieving or viewing existing data (reviewing month end balances) -updating previously stored data (updating credit limits for a customer) -deleting data (purging vendor records from the vendor master file - no activity for X time period)

data input (collection)

Capturing transaction data, usually triggered by a business activity

Blanket Purchase Order

Commitment to purchase specified items at designated prices from a particular supplier for a set time period, e.g. one year.

COSO

Committee of Sponsoring Organizations

turnaround document

Company data sent to an external party and then returned to the system as input

CIRT

Computer Incident Response Team. A group of experts that respond to security incidents. Also known as CERT, SIRT, or IRT.

COBIT

Control Objectives for Information and Related Technology•IT auditors and managers have embraced COBIT as a framework for designing and implementing control over their IT. •COBIT is increasingly adopted as a control framework for compliance purposes for three reasons: •Suggests comprehensive set of risks and controls for IT processes •Control objectives have been mapped to COSO •Has been mapped to popular ERP systems such as SAP, Oracle, and PeopleSoft

ETL Process

Extract, Transform, Load

Redundancy Issues

For example: if customer pays 5 times on 1 bill, customer information must be re-entered 5 times. This increases file maintenance.

Change management controls

Formal process used to ensure that changes to hardware, software or processes do not reduce systems reliability.

fields

Information about the attributes of an entity (e.g., 810 number and birth date)

Proper authorization of transactions & activities

Only Certain people are authorized (or allowed) to do activities.

Vendor Managed Inventory (VMI)

Outsources much of the inventory control and purchasing function to suppliers who have access to sales and inventory data in order to replenish inventory.

Segregation of duties

Segregating duties reduces the opportunity for someone to commit and conceal fraud (or errors)

Independent checks on performance

Someone who did not perform the initial transaction should review to ensure it was processed accurately.

production cycle

Transforming raw materials and labor into finished products

the 5 V's of big data

Volume, Velocity, Variety, Veracity, Value

Design & use of documents and records, and data entry screens.

Well-designed forms and records help ensure transaction data is recorded completely and accurately. •Should include space for authorization •When appropriate, documents should be sequentially pre-numbered, or the system should generate the numbering.

narrative

Written, step-by-step explanation of system components and how they interact

big data

a collection of data sets that are so large or complex that it is impossible to analyze them with traditional databases and tools.

Data Flow Diagram (DFD)

a graphical description of the flow of data within an organization, including data sources/destinations, data flows, transformation processes, and data storage

trial balance

a listing of the name and balance of each account in the general ledger. it is an internal report of which accounts have debit and credit balances and proves the totals are equal

analytics

a means of extracting value from data

business process

a set of related, coordinated, and structured activities and tasks that are performed by a person, a computer, or a machine, and that help accomplish a specific organizational goal

System

a set of two or more interrelated components or subsystems that interact to achieve a goal or common purpose

audit trail

a traceable path of a transaction through a data processing system from point of origin to final output, or backward from final output to point of origin

foreign key

an attribute in a table that is also a primary key in another table

Event

an incident of occurrence due to an internal or external force which impacts achievement of objectives

control

any action taken to mitigate or manage risk and increase the probability that the business/process will achieve its goals and objectives NOT A POLICY STATE OR A PROCESS

update anomaly

any change must be made to every record containing customer information (or else there will be inconsistency). For example, what if the customer address changes.

threat

any potential adverse occurrence or unwanted event that could injure the AIS or the organization

entity

anything about which the organization wishes to store data.

each column in a database

attribute •Contains information about the entity attributes, ex: name, address, customer number, etc.

how does the amount in a journal affect the balances on the trial balance?

balance in the beginning trial balance +/- total from corresponding journal = individual account balance on trial balance

why are there gaps between account numbers?

because over time organizations might need to add account numbers and this allows for future growth

block codes

blocks of numbers reserved for purpose ex: product code

changes in subsystems

cannot be made without considering impact on other subsystems or the main system

information and communication systems

capture and exchange information needed to conduct, manage, and control operations

internal control requirements

companies must issue a report stating that management is responsible for establishing and maintaining an adequate internal control system

sequence codes

consecutive numbering ex: PO#s

general ledger

contains summary-level data for every type of account: asset, liability, equity, revenue, and expense

subsidiary ledger

contains the details related to a given general ledger account

application controls

controls that prevent, detect, and correct transaction errors and fraud in application programs

internal environment

culture of an organization ex: management's philosophy

Insert anomaly

customer information cannot be entered unless there is a related purchase. We may have a new customer we want to enter, but they have not yet made a purchase.

information

data that has been organized and processed to be useful

COSO Internal Control Internal Framework (IC)

defines internal controls and provides guidance for evaluating and enhancing internal control systems -controls based model; very focused on internal controls

subsystems

designed to achieve their own, lower-order goal

general controls

designed to make sure an organization's information system and control environment is stable and well managed ex: IT security, IT infrastructure, software acquisition, maintenance and development

preventive controls

deter problems before they arise

variety

different forms of data

detective controls

discover problems that haven't been prevented

Data Entry Controls

every time data is entered a process is done •Field Check •Sign Check •Limit Check •Range Check •Size Check •Completeness Check •Validity Check •Reasonableness Test •Check Digits and Check Digit Verification

data

facts about the transaction ex: activities that take place, resources affected by the activities, people who participate in the activity

Physical view of database

for every value that is in there, it is very specific about what it should look like

velocity

frequency of incoming data

revenue cycle

goods and services are sold for cash or a future promise to receive cash

inherent risk

gross risk; absent any actions/controls by management

lower goals

help the organization achieve the higher-level goals

human resources / payroll cycle

hiring, training, and paying employees

The logical view of a database:

how users conceptionally organize and understand the relationships between the entries in a database

Corrective Controls

identify and correct problems as well as correct and recover from the resulting errors

document flowchart

illustrates the flow of documents and data among areas of responsibility within an organization

two elements of risk

impact and likelihood

loading data

includes knowing which tool the data should be loaded into for the most efficient and effective analysis

roles for audit committees

independence from the company, financial expertise

Enterprise Resource Planning (ERP) Systems

integrate all aspects of a company's operations with a traditional AIS

data transformation (cleansing)

involves converting data from one format to another to load it into an analytics tool. •This includes making certain that only the data needed is extracted and that this data is complete and accurate. •Data cleansing needs to be performed bothbefore and after the data loading process.

mnemonic codes

letters and numbers ex: item#D300W05

journal

lists a set of transactions that arise from similar business events (i.e. in the same transaction cycle) following a chronological order

residual risk

net risk; remaining risk after management's risk response

financing cycle

obtaining funds from investors and repaying them

Expenditure Cycle

ordering, reviving, approve supplier invoices, cash disbursement

Enterprise Risk Management (ERM)

organizations need a methodology to assess and measure risk so they can address it and implement controls to reduce the risk

PCAOB

oversight board for the auditing profession. sets auditing standards.

service organizations

perform outsourced services for a User Entity (customer), that the User Entity would otherwise need to perform themselves, ranging from performing a specific task under the direction of an entity to replacing an entity's entire business unit or function

Control Activities

policies, procedures, and rules that provide reasonable assurance that control objectives are met and risks are reduced to an appropriate level

Batch Processing Data Entry Controls

processes a large amount of entries periodically •Sequence Check •Batch Totals •Financial Check •Hash Total •Record Count

general journal

records infrequent or non-routine transactions ex: bad debt, prepaid insurance

specialized journal

records large numbers of repetitive transactions ex: sales, cash receipts, cash disbursements

rules for auditors

report specific information to audit committees, prevents auditors from performing certain services, rules about ex-auditors working and company and audit firm doing the work

volume

scale of data

Customer relationship management systems (CRM

software that organizes information about customers in a manner that facilitates efficient and personalized service

data is collected from

source documents

COSO ERM Framework

speaks to the process that a BOD or management uses to set strategy, identify threats and risks, manage those risks, and provide reasonable assurance that a company meets goals -risk based moel

data storage / management

storing, retrieving, deleting data

Delete anomaly

the deletion of a record results in the loss of all the customer information. If a customer only had one sale with us, if we delete that record, we eliminate all information about the customer.

impact

the exposure or dollar loss should a threat become a reality

monitoring

the internal control system is continuously monitored, evaluated and modified

data processing cycle

the operations performed on data to generate meaningful and relevant information

likelihood

the probability that a threat will come to pass

internal controls

the processes and procedures implemented to provide reasonable assurance that control objectives are met

coding

the systematic assignment of numbers or letter to classify and organize items/data

third normal form (3NF)

the tables are free of the update, insert and deleteanomalies. 1.Eliminate repeating groups •Any related attributes that might be repeated in several rows should be put in a separate table. 2.Eliminate redundant data 3.Eliminate columns not dependent of primary key

risk

the threat that an event, action or non-action could adversely affect an organization's ability to achieve its business objectives and execute its strategies successfully

each row in a database

tuple •Represents a unique entity or record, ex: a customer record

veracity

uncertainty of data

group codes

using two or more subgroups to define a digit position ex: position 3 = color

When the invoice is received, the AP reconciles: the

•(1) Invoice •(2) The P.O. •(3) The receiving report (Voucher Package) •These 3 documents make the Voucher Package •This is a 3 - way match

Database advantages

•Data Integration - one central data "pool" that many applications can access •Data Sharing - with authorized users •Minimize data redundancy and data inconsistency - "one version of the truth" •Data Independence - keeping data separate from application programs •Cross-functional Analysis - define and use relationships for management and decision-making. For example: analysis of revenues and selling costs associated with a promotional campaign.

Processing Controls

•Data matching •File labels •Recalculation of batch totals •Cross footing and zero balance tests •Write-protection mechanisms •Concurrent update controls

Safeguarding of assets, records and data.

•Establish and enforce policies & procedures •Maintain accurate records of assets •Restrict physical access to assets and systems •Protect records and documents, including restricting access to what information an individual can electronically access

Project Development and Acquisition Controls

•Executive Sponsorship •Steering Committee •Project Development Planning •Project Schedule •System Performance Measurements •Post-implementation review

Two-way match or Evaluated Receipt Settlement (ERS)

•Invoice less approach •Match PO and receiving report •Based on this information, system calculates the amount owed (quantity received on receiving report x purchase prices from PO) •Pay the supplier

information output (generation)

•Monitors/Devices (soft copy) •Documents (hard copy): e.g. checks, invoices, purchase order •Reports: internal/external users (e.g. monthly sales report, financial statements). These could be hard copy of soft copy. •Query: specific requests, rapid action/decision making (e.g. highest selling item of the year in the southeast) •One-time •Repetitive (report?...)

Output Controls

•User Review •Reconciliation Procedures •External data reconciliation •Data Transmission •Checksums •Parity bits

extraction of data

•What data to ask for •How to ask for data •What format the data needs to be in