Question 1

Which of the following is a component of COSO ERM 2017?
A)Governance and culture.
B)Strategy and objective setting.
C)Performance.
D)Review and revision.
E)All of the choices are correct.

Accepted Answer

All of the choices - governance and culture, strategy and objective setting, performance, review and revision are components of COSO ERM 2017.

Question 2

Which of the following is not one of the key COBIT 5 principles for governance and amangement of enterprise IT?
A)Enabling a holistic approach.
B)Meeting stakeholder needs.
C)Separating management from shareholders.
D)Applying an integrated framework.

Accepted Answer

COBIT 5 principles include enabling a holistic approach, meeting stakeholder needs, applying an integrated framework, and separating governance from management. The principle of separating management from shareholders is not one of the key principles.

Question 3

The COSO ERM framework encourages a review of risks as they apply to achieving firms' objectives.Which of the following is not one of the listed categories of objectives to be considered?
A)Environment.
B)Operations.
C)Strategic.
D)Compliance.

Accepted Answer

The COSO ERM framework lists four categories of objectives to be considered: strategic, operations, reporting, and compliance. "Environment" is not a listed category.

Question 4

The IT Infrastructure Libarary (ITIL)is considered a de facto standard in which of the following regions?
A)Asia and Australia.
B)North America.
C)The UK.
D)Europe.

Accepted Answer

While ITIL is used globally, it originated in the UK and has had a strong impact in Europe. Therefore, the best choice is Europe.

Question 5

The ISO 27000 Series of standards are designed to address which of the following?
A)Corporate governance.
B)Internal controls.
C)Information security issues.
D)IT value.

Accepted Answer

The ISO 27000 Series of standards primarily address information security issues. While they indirectly impact corporate governance, internal controls, and IT value, their primary focus is on establishing a framework for effective information security management.

Question 6

Which of the following provides the advantage of incorporating other widely accepted standards and frameworks?
A)ITIL.
B)COBIT 2019.
C)COSO 2013.
D)ISO 27000.

Accepted Answer

COBIT 2019 provides the advantage of incorporating other widely accepted standards and frameworks such as ITIL, ISO 27000, COSO 2013 and others, making it a comprehensive and integrated framework for IT governance and management.

Question 7

In a computerized environment,internal controls can be categorized into which of the following?
A)General controls and application controls.
B)Detective controls and protective controls.
C)Network controls and transaction controls.
D)Preventive controls and mandatory controls.

Accepted Answer

Internal controls in a computerized environment are categorized into general controls and application controls. General controls ensure the proper functioning of the overall information technology environment, while application controls are specific to individual systems and applications, ensuring the processing and accuracy of data. Detective, protective, network, transaction, preventive, and mandatory controls are types of controls but do not categorize internal controls in a computerized environment.

Question 8

Which of the following is not one of the responses to risk presented in COSO ERM?
A)Share the risk.
B)Accept the risk.
C)Eliminate the risk.
D)Reduce the risk.

Accepted Answer

The response "Eliminate the risk" is not one of the options presented in COSO ERM. The four responses provided are Share, Accept, Reduce, and Avoid (which involves changing the course of action to avoid the risk altogether).

Question 9

If a Chief Technology Officer wanted to ensure a new system had appropriate processing controls which of the following would he/she require?
A)Disposal of excess documents.
B)URL Class diagram.
C)A record count.
D)Password management.

Accepted Answer

A record count is a form of processing control that ensures the data being processed through the system matches expected volumes, helping to identify any discrepancies or errors in data handling.

Question 10

If a Chief Technology Officer wanted to ensure a new system had appropriate input controls which of the following would he/she require?
A)Disposal of documents.
B)Access control.
C)Sequence checks.
D)URL Class diagram.

Accepted Answer

Access control is an input control that ensures that only authorized users can access the system and its data.

Question 11

COBIT framework takes the view that all IT processes should provide clear links between all of the following except:
A)IT processes.
B)IT controls.
C)IT components.
D)IT governance requirements.

Accepted Answer

The COBIT framework emphasizes the need for clear links between IT processes and IT controls to ensure efficient and effective governance. It also considers IT governance requirements to ensure that IT aligns with business objectives. However, it does not focus on IT components as a factor in this linkage.

Question 12

Which of the following is an example of a validity check?
A)The computer ensures that a numerical amount in a record does not exceed some predetermined amount.
B)As the computer corrects errors and data are successfully resubmitted to the system,the causes of the errors are printed out.
C)The computer flags any transmission for which the control field value did not match that of an existing file record.
D)After data for a transaction are entered,the computer sends certain data back to the terminal for comparison with data originally sent.

Accepted Answer

A validity check involves verifying that data matches or is valid according to certain criteria or against a known set of data. Option C, where the computer flags any transmission for which the control field value did not match that of an existing file record, is an example of a validity check because it involves comparing input data against existing data to ensure it is valid.

Question 13

In addition to focusing on controls,COBIT 5 expands its scope by incorporating which of the following broad perpsectives?
A)How IT brings value to the firm.
B)How IT can automate specific business processess.
C)IT networking requirements.
D)IT cost reductions.

Accepted Answer

COBIT 5 incorporates the broad perspective of how IT brings value to the firm, along with a focus on controls. It does not specifically address automating business processes, networking requirements, or cost reductions.

Question 14

Which of the following is not a component of COSO ERM 2017?
A)Information communication and reporting.
B)Strategy and objective setting.
C)Control activities.
D)Review and revision.

Accepted Answer

Control activities are part of the COSO Internal Control Framework, not specifically a component of the COSO ERM 2017 framework.

Question 15

Which of the following best describes why firms choose to create codes of ethics?
A)Because most people will not behave ethically without a written set of guidelines.
B)Codes of ethics protect firms against lawsuits that may be filed due to corporate fraud.
C)They allow firms to create a formal set of expectations for employees who may have different sets of personal values.
D)Companies must have a written code of ethics in order to conduct interstate commerce in the U.S.

Accepted Answer

Codes of ethics allow firms to establish a formal set of expectations for employees who may have different sets of personal values. It helps to ensure that all employees operate within a consistent ethical framework and uphold the values and standards of the company. While some companies may be required to have a code of ethics due to regulatory requirements or industry standards, it is generally not a legal requirement for conducting interstate commerce in the U.S.

Question 16

The Sarbanes-Oxley Act (SOX)was passed as a response to which of the following events?
A)The savings & loan scandals of the 1980s.
B)The bust of dot-com bubble companies such as pets.com and Webvan.
C)Corporate reporting scandals by companies such as WorldCom,Enron,and Tyco.
D)Securities manipulation and insider trading in the 1930s.

Accepted Answer

The Sarbanes-Oxley Act (SOX) was passed in response to the corporate reporting scandals by companies such as Enron, WorldCom, and Tyco, which shook public confidence in financial reporting and resulted in billions of dollars of losses for investors.

Question 17

In the event identification component of the COSO ERM framework,management must classify events into which of the following?
A)Weaknesses and vulnerabilities.
B)Risks and opportunities.
C)Risks and rewards.
D)Controls and vulnerabilities.

Accepted Answer

In the event identification component of the COSO ERM framework, management must classify events into risks and opportunities. This involves identifying potential threats to the organization's objectives as well as identifying potential opportunities for improvement. Option A is incorrect because it only identifies weaknesses and vulnerabilities, and options C and D are incorrect because they do not capture the full spectrum of potential events that need to be identified.

Question 18

Ethical principals are derived from all of the following except:
A)Personal attitudes on issues of right and wrong.
B)Cost benefit analysis.
C)Cultural values.
D)Societal traditions.

Accepted Answer

Ethical principles are not based on cost benefit analysis, but on values such as honesty, respect for others, and fairness. Personal attitudes, cultural values, and societal traditions may all influence ethical principles.

Question 19

According to COSO ERM,which of the following is not one of the bases that should be used to analyze the risks of an identified event?
A)Inherent risk.
B)Organizational risk.
C)Residual risk.
D)Control risk.

Accepted Answer

According to COSO ERM, the bases that should be used to analyze risks of an identified event are inherent risk, control risk, and residual risk. Organizational risk is not a term used in COSO ERM.

Question 20

Which of the following best describes what is meant by corporate governance?
A)The organizational structure and responsibilities of the executive team and board of directors of a corporation.
B)Regulatory bodies,such as the SEC and PCAOB,that govern the behavior of corporations.
C)The ability of a corporation's management team to meet earnings forecasts over an extended period of time.
D)Management's processes,policies,and ethical approach to safeguarding stakeholder interests.

Accepted Answer

Corporate governance refers to the processes, policies, and ethical approach of a corporation's management team to safeguard the interests of all stakeholders, including shareholders, employees, customers, suppliers, and the community. It encompasses the way a company is managed and the systems in place to ensure accountability, transparency, and integrity in decision-making. While A may be a component of corporate governance, it is not a comprehensive definition. B is incorrect as regulatory bodies are not considered corporate governance in and of themselves. C is incorrect as meeting earnings forecasts is not the only or even the primary goal of corporate governance.

Quiz 13: Accounting Information Systems and Internal Controls

Which of the following is a component of COSO ERM 2017?

Which of the following is not one of the key COBIT 5 principles for governance and amangement of enterprise IT?

The COSO ERM framework encourages a review of risks as they apply to achieving firms' objectives.Which of the following is not one of the listed categories of objectives to be considered?

The IT Infrastructure Libarary (ITIL) is considered a de facto standard in which of the following regions?

The ISO 27000 Series of standards are designed to address which of the following?

Which of the following provides the advantage of incorporating other widely accepted standards and frameworks?

In a computerized environment,internal controls can be categorized into which of the following?

Which of the following is not one of the responses to risk presented in COSO ERM?

If a Chief Technology Officer wanted to ensure a new system had appropriate processing controls which of the following would he/she require?

If a Chief Technology Officer wanted to ensure a new system had appropriate input controls which of the following would he/she require?

COBIT framework takes the view that all IT processes should provide clear links between all of the following except:

Which of the following is an example of a validity check?

In addition to focusing on controls,COBIT 5 expands its scope by incorporating which of the following broad perpsectives?

Which of the following is not a component of COSO ERM 2017?

Which of the following best describes why firms choose to create codes of ethics?

The Sarbanes-Oxley Act (SOX) was passed as a response to which of the following events?

In the event identification component of the COSO ERM framework,management must classify events into which of the following?

Ethical principals are derived from all of the following except:

According to COSO ERM,which of the following is not one of the bases that should be used to analyze the risks of an identified event?

Which of the following best describes what is meant by corporate governance?