Deck 7: Internal Controls I

Question 1

Protecting the IT resources,ensuring the reliable and continuous operations and developing a disaster recovery plan are all aspects of:

A)IT governance
B)corporate governance
C)managing risk
D)IT management

Answer 1

A

Question 2

Which of the following principle is not part of the principles for corporate governance identified by the ASX Corporate Governance Council?

A)Respect the rights of shareholders
B)Keep disclosure of business information to a minimum
C)Safeguard integrity in financial reporting
D)Structure the board to add value

Answer 2

B

Question 3

Organisational decisions about IT infrastructure does NOT necessarily include:

A)what type of processing is required
B)the location of the processing
C)the upgradability of the processing
D)the integration of processing

Answer 3

C

Question 4

In Australia,it is recommended that the board is made up of:

A)full time employees of the company
B)a mixture of executive and independent directors
C)CEO plus external directors who are not involved in the business
D)accountants,auditors and executive director

Question 5

In terms of IT governance,which of the following is NOT one of the five specific areas that need to be considered by those with the responsibility of managing IT?

A)Matching IT to strategy
B)Adding value
C)Managing resources
D)Reducing costs

Question 6

What part of an organisation determines the corporate governance?

A)shareholders
B)board of directors
C)employees
D)Government

Question 7

Which of the following is related to corporate governance? (i)Goal setting (ii)Risk management (iii)Performance measurement and management

A)(i)(ii)(iii)
B)(i)(ii)only
C)(ii)(iii)only
D)(i)(iii)only

Question 8

In the Australian Securities Exchange's definition of corporate governance,risks should be:

A)monitored and assessed
B)assessed and minimised
C)identified and monitored
D)assessed and controlled

Question 9

The OECD's definition of corporate governance has specifically outlined the relationships between:

A)a company,its customers,and its suppliers
B)a company's management,its board,its employees,and its suppliers
C)a company's management,its board,its shareholders,and other stakeholders
D)a company and various government agencies

Question 10

To promote ethical and responsible decision making,an organisation should: (i)have clearly specified codes of conduct for employees and management (ii)have standards for dealing with various organisational stakeholders (iii)have procedures to be followed when investigating potential unethical activities within the organisation (iv)take legal actions immediately against unethical conducts.

A)(i)only
B)(i)(iii)(iv)only
C)(i)(ii)(iii)only
D)(i)(ii)(iii)(iv)

Question 11

What is the connection between the concept of accountability and corporate governance?

A)the board reviews poor decisions and punishes the person responsible
B)the board delegates decision making to employees but retains ultimate responsibility
C)decisions are made by the person who needs to act on the decision irrespective of their position in the organisation
D)board members are only accountable for decisions made by the board.

Question 12

The aspect referring to how IT is going to be used in the organisation and will be a general statement or specification about how IT will be positioned and the role it will play in the organisation as it embarks on meeting customer needs is:

A)IT governance
B)IT principles
C)IT objectives
D)IT control

Question 13

The current eight principles for corporate governance outlined by the ASX Corporate Governance Council do not include:

A)Recognise and minimise risk.
B)Safeguard integrity in financial reporting.
C)Make timely and balanced disclosure.
D)Remunerate fairly and responsibly.

Question 14

Which of the following is the objective(s)of a corporate governance system? (i)To ensure that minority shareholders receive reliable information about the value of firms and that a company's managers and large shareholders do not cheat them out of the value of their investments.(ii)To motivate managers to maximise firm value instead of pursuing personal objectives.(iii)To encourage companies to create value,through entrepreneurialism,innovation,development and exploration,and provide accountability and control systems commensurate with the risks involved.

A)(ii)only
B)(iii)only
C)(i)(iii)only
D)(i)(ii)(iii)

Question 15

Corporate governance is about: (i)the many relationships in which an organisation is involved and how these relationships are managed (ii)putting in place policies that allow for the various relationships of the organisation to be successfully managed (iii)putting in place structures that allow for the various relationships of the organisation to be successfully managed.

A)(i)only
B)(i)(ii)only
C)(i)(iii)only
D)(i)(ii)(iii)

Question 16

What could be the result of poor corporate governance in an organisation?

A)poor returns on investment for minority shareholders
B)bad publicity from environmental groups
C)company failure and potential damage to economy
D)managers who are influenced by self-interest rather than the longevity of the company

Question 17

In corporate governance principles,remunerate fairly and responsibly means:

A)All board members should be paid the same amount of remuneration.
B)All employees of an organisation should be paid fairly.
C)The organisation should be able to demonstrate a clear link between company performance and executive remuneration.
D)The organisation should be able to demonstrate a clear link between employee performance and employee remuneration.

Question 18

The current eight principles for corporate governance outlined by the ASX Corporate Governance Council do not include:

A)Lay solid foundations for management and oversight.
B)Structure the board to add value.
C)Promote ethical and responsible decision making.
D)Respect the rights of customers.

Question 19

The basis that the firm's information system rests upon is called:

A)IT structure
B)IT architecture
C)IT infrastructure
D)IT foundation

Question 20

Which of the following is not part of the four main objectives of IT governance?

A)Ensuring the organisation has appropriate management strategies and techniques in place for dealing with IT related risks.
B)Ensuring that the IT being used or adopted within an organisation is consistent with the organisation's goals and meets expectations.
C)Ensuring the organisation's IT resource are used responsibly.
D)Using IT to make the most of future business opportunities and benefits.

Question 21

Who is responsible for setting the tone in which control policies within an organisation will function?

A)Internal auditors
B)External auditors
C)Top management
D)Shareholder committees

Question 22

Which of the following is the most important requirement of internal control?

A)effectiveness and efficiency of operations
B)reliability of financial reporting
C)compliance with applicable laws and regulations
D)systems and procedures that help to manage risk and achieve objectives

Question 23

Different transactions and events are NOT impacted by the which of the following assertion?

A)Completeness and accuracy
B)Occurrence and cut-off
C)Classification
D)Timeliness

Question 24

Control activities: (i)are the responses by management to the risks identified in the risk assessment stage (ii)are policies and procedures that help ensure that management directives are carried out (iii)are also called control procedures.

A)(i)only
B)(ii)only
C)(i)(ii)only
D)(i)(ii)(iii)

Question 25

All account balances should demonstrate the following assertions:

A)completeness,accuracy,classification,and valuation and allocation
B)valuation and allocation,rights and obligations,completeness,and existence
C)rights and obligations,completeness,accuracy,classification
D)classification,value and allocation,existence,and rights and obligations

Question 26

The focus of the plan and organise stage in the COBIT framework include: (i)being aware of the current organisational use of IT (ii)being aware of opportunities that may exist for future IT developments (iii)planning for the future IT needs of the organisation (iv)how the new system is to be used by the users within the organisation.

A)(i)(ii)(iii)only
B)(i)(ii)(iv)only
C)(i)(iii)only
D)(i)(ii)(iii)(iv)

Question 27

Into which stage would providing backup and disaster recovery procedures fit?

A)COBIT stage Acquiring
B)COBIT stage Delivering
C)COSO stage Control Environment
D)COSO stage Monitoring

Question 28

Which of the following best sums up objective for internal controls of information and communication?

A)accurate capture of data
B)the right information to the right person at the right time
C)ensuring information flows up and down the organisation
D)control of accountability

Question 29

Based on the COSO definition of internal controls,which of the following is NOT an aim of internal controls?

A)Effective and efficient operations
B)Reliable financial reporting
C)Compliance with laws and regulations
D)Safe workplace

Question 30

Which of the following is a concern of the acquire and implement stage in the COBIT framework?
(i)How various IT solutions are to be acquired by the organisation and how well they map to existing organisational processes.
(ii)The selection and implementation processes that will provide complete assurance that any adopted system will work as intended once implemented and will communicate with existing systems.
(iii)The selection and implementation processes that will provide complete assurance that any adopted system can be put in place on time.
(iv)The selection and implementation processes that will provide complete assurance that any adopted system will meet the business needs.

A)(i)only
B)(ii)(iv)only
C)(ii)(iii)(iv)
D)(i)(ii)(iii)(iv)

Question 31

Control environment is

A)The attitude,emphasis and awareness of an organisation's management towards internal control and its operation within the organisation.
B)The attitude,emphasis and awareness of the government towards internal control and operations within organisations.
C)The attitude,emphasis and awareness of the legislative entities towards internal control and operations within organisations.
D)The attitude,emphasis and awareness of the society towards internal control and operations within organisations.

Question 32

COBIT offers control objectives and guidance that relate to the stages of: (i)planning for IT acquisition (ii)acquiring IT resources (iii)operating IT resources (iv)monitoring and assessing IT resources

A)(i)(ii)(iii)
B)(ii)(iii)(iv)
C)(iii)(iv)
D)(i)(ii)(iii)(iv)

Question 33

The effectiveness of internal control systems is determined by:

A)reports by the external auditor
B)reports by the internal auditor
C)the need to comply with applicable laws and regulations
D)the actions of the board

Question 34

Risk assessment is:

A)the process of scanning the organisation for risks that could inhibit the attainment of the organisation's goals.
B)the process of scanning the organisation and its environment for risks that could inhibit the attainment of the organisation's goals.
C)the process of scanning the organisation for risks that could inhibit the attainment of the organisation's goals and devising appropriate corrections.
D)the process of scanning the organisation and its environment for risks that could inhibit the attainment of the organisation's goals and devising appropriate corrections.

Question 35

Major IT stages outline by the COBIT framework do not include:

A)Plan and organise
B)Deliver and support
C)Monitor and evaluate
D)Recycle and disposal

Question 36

ERM stands for:

A)Enterprise Resource Management
B)Enterprise Risk Management
C)Enterprise Resource Model
D)Enterprise Risk Model

Question 37

If sales have not been entered into the Accounting Information System,this is an example of which type of transaction risk?

A)occurrence
B)completeness
C)accuracy
D)cut-off

Question 38

The "plan and organise" stage of the COBIT framework includes:

A)strategies for acquiring and implementing IT solutions
B)evaluating how the system operates within the organisation
C)reviewing how well IT systems match the needs of the organisation
D)deciding which communication standards will be used.

Question 39

The COBIT framework:

A)is locally recognised framework for Australia and New Zealand
B)targets large organisations
C)is a framework for corporate governance
D)is a framework for IT governance

Question 40

Which of the following is NOT one of the principles identified in the IT governance standard released by Standards Australia that encapsulate the domain of IT governance?

A)Ensure ICT performs well,with performance including the satisfaction of business needs,responding to changing business needs and being a reliable support for organisational activities whenever required.
B)Ensure ICT conforms with any external obligations as well as any internal policies that may exist in the organisation.
C)Put in place well understood responsibilities for ICT throughout the organisation and the greater society.
D)Ensure ICT use respects human factors,particularly the meeting of the needs of the different system stakeholders.

Question 41

Which of the following is NOT one of the objectives of the organisation as stated in the ERM framework?

A)strategic
B)reporting
C)planning
D)compliance

Question 42

What is groupthink and how is it relevant to great governance?

Question 43

List and briefly discuss at least four specific components of the control environment to be aware of,as mentioned in ASA 315.

Question 44

Which of the following is NOT a duty normally performed by internal auditors?

A)Examining financial and operating information.
B)Reviewing the economy,effectiveness and efficiency of the organisation's operations.
C)Reviewing the adequacy of compliance with external laws and regulations.
D)Reviewing the fit between IT and business strategy.

Question 45

To which of the following risks are organisations that depend on the Internet for trading through e-commerce particularly vulnerable.

A)risk of network disruption
B)risk of key suppliers moving to other organisations
C)risk of new competitors taking market position
D)risk of unauthorised access to online systems

Question 46

List and discuss four typical advantages of cloud computing.

Question 47

What are the eight principles for corporate governance outlined by the ASX Corporate Governance Council?

Question 48

Specific components of the control environment to be aware of,as mentioned in ASA 315,do not include:

A)Organisational structure.
B)Distribution of responsibility.
C)Recruitment policies
D)IT policies

Question 49

Briefly explain the four areas of IT governance.

Question 50

The external audit will provide reasonable assurance that:

A)transactions that occurred have been carried out efficiently and effectively
B)assets and liabilities in the financial statements exist and transactions reported actually occurred
C)assets listed are owned by the organisation and liabilities owed are repaid
D)amounts on the financial statements have been calculated in accordance with company policies

Question 51

In terms of IT governance,what are the five specific areas within the objectives of IT governance that need to be considered by those with the responsibility of managing IT? Explain in details.

Question 52

What are the six principles that encapsulate the domain of IT governance,as outlined by Standards Australia?

Question 53

Under the ERM,the objectives of the organisation are:

A)operations,performance,reporting,and compliance
B)strategic,reporting,compliance,and operations
C)environmentally friendly,reporting,profitable and compliance
D)socially responsible,profitable,compliance,and environmentally friendly

Question 54

What are the four main objectives of IT governance?

Question 55

Specific components of the control environment to be aware of,as mentioned in ASA 315,do not include:

A)The communication and policing of ethical behaviour in the organisation.
B)Commitment to competence.
C)Risk assessment.
D)Management philosophy and operating style.

Question 56

Describe the merits and nature of audit committees.

Question 57

The internal control structure of the ERM does NOT include:

A)Internal environment
B)External environment
C)Event identification
D)Information and communication

Question 58

The internal control structure of the ERM does NOT include:

A)Risk assessment
B)Risk response
C)Control activities
D)Resource management

Question 59

Identify and briefly explain the major IT stages in the COBIT framework.

Question 60

Which of the following descriptions of cloud computing is NOT true?

A)Cloud computing offers advantages for new and emerging businesses,since it is easily scalable and can grow with the organisation.
B)The task of keeping the applications and technology up to date is left to the cloud service subscriber.
C)Cloud computing offers a risk-management technique,since in the event of disaster the IT services are based in a different location and still accessible.
D)Security and maintenance can be managed by the cloud provider.