Question 1

A corrective control plan is designed to discover problems that have occurred.

Accepted Answer

A corrective control plan is designed to correct or remediate problems that have already occurred, not to discover them. A detective control plan, on the other hand, is designed to discover problems or issues as they arise.

Question 2

A manager of a manufacturing plant alters production reports to provide the corporate office with an inflated perception of the plant's cost effectiveness in an effort to keep the inefficient plant from being closed. This action would be classified as a(n):
A) risk
B) hazard
C) fraud
D) exposure

Accepted Answer

The manager altering production reports to provide a false perception of cost effectiveness is committing fraud. Fraud is the intentional misrepresentation or concealment of information for financial gain.

Question 3

A computer abuse technique called a back door involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.

Accepted Answer

This statement is true. A back door is a programming technique where a programmer intentionally inserts a code or password to bypass a program's security features for unauthorized access.

Question 4

A batch of business events is accurately entered into a business event data store, but the computer operator fails to use the data to update master data. This type of processing error would be classified as an operational error.

Accepted Answer

This type of error is a processing error that falls under the category of operational errors. The data was accurately entered into the business event data store, but the failure to use this data to update master data is an operational error.

Question 5

Ensuring the security of resources is the control goal that seeks to provide protection of organization's resources from loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources.

Accepted Answer

Ensuring the security of resources is indeed the control goal that seeks to protect an organization's resources from various forms of misuse or loss.

Question 6

The control goal of ensuring input materiality strives to prevent fictitious items from entering an information system.

Accepted Answer

The answer of The control goal of ensuring input materiality...

Question 7

A computer crime technique called worm involves the systematic theft of very small amounts from a number of bank or other financial accounts.

Accepted Answer

A worm is a type of malware that spreads through networks and can cause harm to computer systems. It does not typically involve the theft of small amounts from multiple financial accounts. This type of crime is more commonly associated with phishing scams or other types of fraud.

Question 8

A process by which organizations select objectives, establish processes to achieve objectives, and monitor performance is:
A) enterprise risk management
B) internal control
C) organizational governance
D) risk assessment

Accepted Answer

Organizational governance is the process by which organizations set objectives, establish processes to achieve objectives, and monitor performance. This includes setting policies, making decisions, and overseeing the implementation of activities to ensure that objectives are met effectively and efficiently. Enterprise risk management and risk assessment are components of organizational governance, while internal control refers to the policies and procedures that organizations put in place to achieve their objectives and manage risks.

Question 9

Ethical behavior and management integrity are products of the "corporate culture".

Accepted Answer

Corporate culture includes the values, beliefs, and norms of behavior that shape the behavior of individuals within the organization. A strong ethical culture and management integrity are key components of a positive corporate culture.

Question 10

Salami slicing is program code that can attach itself to other programs (i.e., "infect" those programs), that can reproduce itself, and that operates to alter the programs or to destroy data.

Accepted Answer

Salami slicing refers to a series of minor actions, often illegal or unethical, that together result in a larger action that would be illegal or unethical if carried out all at once. It does not refer to a type of program code or malware.

Question 11

Business process control plans relate to those controls particular to a specific process or subsystem, such as billing or cash receipts.

Accepted Answer

Business process control plans focus on specific processes or subsystems and therefore relate to controls that are particular to those areas.

Question 12

The ERM framework addresses four categories of management objectives. Which category concerns high-level goals, aligned with and supporting its mission?
A) compliance
B) operations
C) reporting
D) strategic

Accepted Answer

The strategic category concerns high-level goals that are aligned with and supporting the organization's mission. This category addresses how risks are managed to achieve the organization's strategic objectives. The compliance category focuses on complying with laws, regulations, and policies; the operations category focuses on efficient and effective use of resources to achieve operational objectives; and the reporting category is concerned with reliable and timely reporting of information.

Question 13

A process, effected by an entity's board of directors, management and other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that may effect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives is:
A) enterprise risk management
B) internal control
C) organizational governance
D) risk assessment

Accepted Answer

The definition provided describes the process of enterprise risk management (ERM), which involves identifying and managing risks that could affect an entity's objectives. ERM is a comprehensive approach to risk management that involves all levels of the organization and is led by the board of directors and management. Internal control is a component of ERM, focused on ensuring that risks are controlled within acceptable levels. Organizational governance encompasses the entire system of policies, processes, and practices by which an organization is directed, controlled, and held accountable. Risk assessment is a component of ERM, focused on identifying, analyzing, and evaluating risks to an organization. However, it does not capture the entire process of managing risk across the enterprise as ERM does.

Question 14

The control goal of input accuracy is concerned with the correctness of the transaction data that are entered into a system.

Accepted Answer

The statement is true. The control goal of input accuracy focuses on ensuring that the data entered into a system is accurate and free from errors. This helps to minimize the risk of incorrect information being used in decision-making processes or other business operations. Various controls can be used to ensure input accuracy, such as data validation checks, verification procedures, and user training on data entry best practices.

Question 15

A sale to a customer is entered into the system properly, but the event does not accurately update the customer's outstanding balance. This type of processing error would be classified as a user error.

Accepted Answer

This type of processing error would be classified as a system error, as it is not a mistake made by the user but rather an issue with the software or system itself.

Question 16

The control goal called efficiency of operations strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended.

Accepted Answer

The control goal called efficiency of operations focuses on ensuring that operations are conducted in an efficient manner, utilizing resources effectively and minimizing waste, rather than solely on fulfilling the purposes for which the system was intended.

Question 17

A logic bomb is a computer abuse technique in which unauthorized code is inserted in a program, which, when activated, may cause a disaster such as shutting down a system or destroying data.

Accepted Answer

This statement correctly defines what a logic bomb is.

Question 18

Valid input data are appropriately authorized and represent actual economic events and objects.

Accepted Answer

Valid input data must be authorized, meaning they have been approved and verified by authorized personnel, and they also represent actual economic events and objects, which means they accurately reflect actual transactions and activities that have taken place within the organization. Invalid or unauthorized data can lead to errors in financial statements and misinterpretation of financial data, which can have serious consequences for the organization.

Question 19

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by audits or internal controls than through tips.

Accepted Answer

The 2012 Report to the Nation on Occupational Fraud and Abuse actually states that tips are the most common way that fraud is detected, accounting for 40% of cases. Audits and internal controls detect only 15% of cases.

Question 20

The control matrix is a computer virus that takes control of the computer's operating system for malicious purposes.

Accepted Answer

The control matrix is not a computer virus; it is a conceptual framework or tool used in various fields such as management, auditing, and information systems to ensure that internal controls are effectively implemented to manage risks.

Quiz 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control