Deck 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

Question 1

The external environment is a system of integrated elements-people, structures, processes, and procedures-acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals.

Answer 1

False

Question 2

SAS No. 99 emphasizes auditors should brainstorm fraud risks, increase professional skepticism, use unpredictable audit test patterns, and detect management override of internal controls.

Answer 2

True

Question 3

Organizational governance is a process by which organizations select objectives, establish processes to achieve objectives, and monitor performance.

Answer 3

True

Question 4

Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals).

Question 5

Management is responsible for establishing and maintaining an adequate system of internal control.

Question 6

Establishing and maintaining a viable internal control system is the responsibility of management.

Question 7

A fraud is a deliberate act or untruth intended to obtain unfair or unlawful gain.

Question 8

Under the Sarbanes Oxley Act of 2002, the section on Corporate Tax Returns conveys a sense of the Senate that the corporate federal income tax returns be signed by the treasurer.

Question 9

A major reason management must exercise control over an organization's business processes is to provide reasonable assurance that the company is in compliance with applicable laws and regulations.

Question 10

Under the Sarbanes Oxley Act of 2002, the section on Corporate Responsibility requires a company's CEO and CFO to certify quarterly and annual reports.

Question 11

Monitoring is a process that assesses the quality of internal control performance over time.

Question 12

Risks are those events that could have a negative impact on organization objectives.

Question 13

The control environment reflects the organization's general awareness of and commitment to the importance of control throughout the organization.

Question 14

Under the Sarbanes Oxley Act of 2002, the section on Auditor Independence establishes an independent board to oversee public company audits.

Question 15

Expected gross risk is a function of the initial expected gross risk, reduced risk exposure due to controls, and cost of controls.

Question 16

Opportunities are events that could have a positive impact on organization objectives.

Question 17

External directives are the policies and procedures that help ensure that management directives are carried out.

Question 18

Management's legal responsibility to prevent fraud and other irregularities is implied by laws such as the Foreign Corrupt Practices Act.

Question 19

Risk assessment is the entity's identification and analysis of relevant risks to the achievement of its objectives, forming a basis for determining how the risks should be managed.

Question 20

Under the Sarbanes Oxley Act of 2002, the section on Enhanced Financial Disclosures requires each annual report filed with the SEC to include an internal control report.

Question 21

A corrective control plan is designed to discover problems that have occurred.

Question 22

A manager of a manufacturing plant alters production reports to provide the corporate office with an inflated perception of the plant's cost effectiveness in an effort to keep the inefficient plant from being closed. This action would be classified as a(n):

A) risk
B) hazard
C) fraud
D) exposure

Question 23

A computer abuse technique called a back door involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.

Question 24

A batch of business events is accurately entered into a business event data store, but the computer operator fails to use the data to update master data. This type of processing error would be classified as an operational error.

Question 25

Ensuring the security of resources is the control goal that seeks to provide protection of organization's resources from loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources.

Question 26

The control goal of ensuring input materiality strives to prevent fictitious items from entering an information system.

Question 27

A computer crime technique called worm involves the systematic theft of very small amounts from a number of bank or other financial accounts.

Question 28

A process by which organizations select objectives, establish processes to achieve objectives, and monitor performance is:

A) enterprise risk management
B) internal control
C) organizational governance
D) risk assessment

Question 29

Ethical behavior and management integrity are products of the "corporate culture".

Question 30

Salami slicing is program code that can attach itself to other programs (i.e., "infect" those programs), that can reproduce itself, and that operates to alter the programs or to destroy data.

Question 31

Business process control plans relate to those controls particular to a specific process or subsystem, such as billing or cash receipts.

Question 32

The ERM framework addresses four categories of management objectives. Which category concerns high-level goals, aligned with and supporting its mission?

A) compliance
B) operations
C) reporting
D) strategic

Question 33

A process, effected by an entity's board of directors, management and other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that may effect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives is:

A) enterprise risk management
B) internal control
C) organizational governance
D) risk assessment

Question 34

The control goal of input accuracy is concerned with the correctness of the transaction data that are entered into a system.

Question 35

A sale to a customer is entered into the system properly, but the event does not accurately update the customer's outstanding balance. This type of processing error would be classified as a user error.

Question 36

The control goal called efficiency of operations strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended.

Question 37

A logic bomb is a computer abuse technique in which unauthorized code is inserted in a program, which, when activated, may cause a disaster such as shutting down a system or destroying data.

Question 38

Valid input data are appropriately authorized and represent actual economic events and objects.

Question 39

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by audits or internal controls than through tips.

Question 40

The control matrix is a computer virus that takes control of the computer's operating system for malicious purposes.

Question 41

The ERM framework addresses four categories of management objectives. Which category addresses the effective and efficient use of resources?

A) compliance
B) operations
C) reporting
D) strategic

Question 42

Approvals, authorizations, verifications, reconciliations, reviews of operating performance, security procedures, supervision, audit trails, and segregation of duties are examples of:

A) control activities
B) event identification
C) monitoring
D) risk response

Question 43

The section of Sarbanes Oxley that requires a company's CEO and CFO to certify quarterly and annual reports is:

A) Title I - Public Company Accounting Oversight Board
B) Title II - Auditor Independence
C) Title III -Corporate Responsibility
D) Title IV - Enhanced Financial Disclosures

Question 44

The major reasons for exercising control of the organization's business processes include:

A) to provide reasonable assurance that the goals of the business are being achieved
B) to mitigate risks of fraud and other intentional and unintentional acts
C) to provide reasonable assurance that the company is in compliance with applicable legal and regulatory obligations
D) all of the above

Question 45

This component of the ERM framework that encompasses the tone of an organization and sets the basis for how risk is viewed and addressed by an entity's people, including risk management philosophy and risk appetite, integrity and ethical values and the environment in which they operate.

A) control activities
B) internal environment
C) risk assessment
D) risk response

Question 46

With the issuance of the SEC Interpretative Guidance and the implementation of AS5:

A) Auditors no longer opine on the effectiveness of management's internal control reporting process.
B) The number of controls that need to be documented, evaluated, and tested is reduced.
C) Both a. and b.
D) Neither a. nor b.

Question 47

Which component of the ERM framework is best described here: Internal and external events affecting achievement of an entity's objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management's strategy or objective-setting processes.

A) control activities
B) event identification
C) risk assessment
D) risk response

Question 48

According to the COSO Fraudulent Financial Reporting 1998- 2007 update:

A) The most common fraud scheme used was improper revenue recognition.
B) Most companies engaged in fraudulent activities were able to recover and resume operations.
C) CEO's and CFO's were named by the SEC for involvement in approximately 50% of fraud cases.
D) All of the above.

Question 49

Events that could have a negative impact on organizational objectives:

A) opportunities
B) embezzlement
C) fraud
D) risks

Question 50

The ERM framework addresses four categories of management objectives. Which category addresses the reliability of the financial statements?

A) compliance
B) operations
C) reporting
D) strategic

Question 51

The effect of an event's occurrence is:

A) control
B) impact
C) risk
D) opportunity

Question 52

The ERM framework is comprised of eight components. Which component includes the policies and procedures established and implemented to help ensure the risk responses are effectively carried out?

A) control activities
B) event identification
C) risk assessment
D) risk response

Question 53

Who is legally responsible for establishing and maintaining an adequate system of internal control?

A) the board of directors
B) stakeholders
C) investors
D) management

Question 54

According to the 2011 PricewaterhouseCoopers (PwC) Global Economic Crime Survey:

A) Internal audit is the most effective fraud detection method.
B) Cybercrime ranks as one of the top four economic crimes worldwide.
C) Accounting fraud has increased significantly over the last two years.
D) All of the above.

Question 55

The ERM framework addresses four categories of management objectives. Which category of concerns laws and regulations?

A) compliance
B) operations
C) reporting
D) strategic

Question 56

This component of the ERM framework concerns the entirety of enterprise risk management and is accomplished through ongoing management activities, separate evaluations, or both.

A) control activities
B) Monitoring
C) objective setting
D) risk response

Question 57

The section of Sarbanes Oxley that requires each annual report filed with the SEC to include an internal control report is:

A) Title I - Public Company Accounting Oversight Board
B) Title II - Auditor Independence
C) Title III - Corporate Responsibility
D) Title IV - Enhanced Financial Disclosures

Question 58

Which component of the ERM framework is best described here: Management selects whether to avoid, accept, reduce, or share risk - developing a set of actions to align risks with the entity's risk tolerances and risk appetite.

A) control activities
B) event identification
C) risk assessment
D) risk response

Question 59

Events that could have a positive impact on organizational objectives:

A) controls
B) fraud
C) opportunities
D) risks

Question 60

Risk assessment is best described by:

A) Internal and external events affecting achievement of an entity's objectives must be identified, distinguishing between risks and opportunities.
B) Management selects whether to avoid, accept, reduce, or share risk -developing a set of actions to align risks with the entity's risk tolerances and risk appetite.
C) The entirety of enterprise risk management is monitored and modifications made as necessary.
D) The likelihood and impact of risks are analyzed, as a basis for determining how they should be managed.

Question 61

____ sets the tone of the organization, influencing the control consciousness of its people.

A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Question 62

____ is a process that evaluates the quality of internal control performance over time.

A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Question 63

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association (ISACA) because of the influence of IT over information systems, financial reporting and auditing.

A) COBIT
B) COSO
C) ERM
D) All of the above.

Question 64

A computer abuse technique called a ____ involves inserting unauthorized code in a program, which, when activated, may cause a disaster, such as shutting the system down or destroying files.

A) salami slicing
B) back door
C) logic bomb
D) Trojan horse

Question 65

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by:

A) Audits
B) internal controls
C) Managers
D) Tips

Question 66

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:

A) Title V - Analysts Conflicts of Interests
B) Title VIII - Corporate and Criminal Fraud Accountability
C) Title IX - White-Collar Crime Penalty Enhancements
D) Title XI - Corporate Fraud and Accountability

Question 67

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.

A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Question 68

The information process control goal which relates to preventing fictitious events from being recorded is termed:

A) ensure input validity
B) ensure input accuracy
C) ensure input completeness
D) ensure effectiveness of operations

Question 69

As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped. Which control goal is being violated?

A) ensure effectiveness of operations
B) ensure efficient employment of resources
C) ensure security of resources
D) ensure input accuracy

Question 70

Which of the following is not a requirement of SOX Section 404?

A) Evaluate the design of the company's controls to determine if they adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner.
B) Gather and evaluate evidence about the operation of controls.
C) Implement key controls to determine their operating efficiency.
D) Present a written assessment of the effectiveness of internal control over financial reporting.

Question 71

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n):

A) audit
B) embezzlement
C) fraud
D) Theft

Question 72

A computer abuse technique called a ____ involves a virus that replicates itself on disks, in memory, or across networks.

A) worm
B) back door
C) logic bomb
D) Trojan horse

Question 73

A control goal that is a measure of success in meeting a set of established goals is called:

A) effectiveness
B) monitoring
C) efficiency
D) risk

Question 74

Establishing a viable internal control system is primarily the responsibility of:

A) the external auditors
B) management
C) programmers
D) government authorities

Question 75

A business event which is not properly authorized violates the control goal of:

A) input validity
B) input completeness
C) input accuracy
D) update validity

Question 76

A(n) ____ is a computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts, usually by rounding to the nearest cent in financial transactions.

A) worm
B) salami slicing
C) logic bomb
D) Trojan horse

Question 77

The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the document's integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is:

A) Title V- Analysts Conflicts of Interests
B) Title VIII - Corporate and Criminal Fraud Accountability
C) Title IX - White-Collar Crime Penalty Enhancements
D) Title XI - Corporate Fraud and Accountability

Question 78

Regarding internal control systems:

A) ultimate ownership of the system should rest with the board of directors.
B) a properly implemented system can be expected to provide 100 percent assurance that the organization will meet its objectives.
C) both a. and b.
D) neither a. not b.

Question 79

As described in COSO, elements of a control environment might include the following:

A) commitment to the importance of control
B) reward systems
C) tone at the top of the organization
D) all of the above

Question 80

Which of the following statements regarding a system of internal control is false?

A) Effective internal control systems provide complete assurance against the occurrence of material frauds and embezzlements.
B) Internal control systems depend largely on the competency and honesty of people.
C) Because internal control systems have a cost, management should evaluate the cost/benefit of each control plan.
D) The development of an internal control system is the responsibility of management.