Deck 14: Enterprise System Risks and Controls

Question 1

The materiality of a risk is determined solely by its impact on the organization; that is, by the size of the potential loss and its impact on achieving the organization's objectives.

Answer 1

False

Question 2

Management may choose to ignore risks that have a low impact and a low likelihood of occurrence unless controls to mitigate those risks are costless.

Answer 2

True

Question 3

The control environment sets the tone of the enterprise and can contribute to a high-risk environment.

Answer 3

True

Question 4

The attitudes and actions of top management typically do not affect the climate of an enterprise, because they are rarely onsite.

Question 5

An error is an intentional effort to do something undesirable to an enterprise, while an irregularity is an unintended mistake on the part of an employee.

Question 6

Corrective controls focus on preventing an error or irregularity.

Question 7

Economy risks include those resulting from war, epidemics, financial market changes, terrorist attacks, and natural disasters such as floods, hurricanes, and drought.

Question 8

The risk of recording incomplete, inaccurate, or invalid data about a business event is considered a business process risk.

Question 9

Enterprises should create contingency plans for transferring operations to a backup location in case of business interruptions.

Question 10

Lapping is a method of stealing cash in which an employee steals a customer payment and uses funds from a subsequent customer payment to post to the first customer's account, using funds from a third customer payment to post to the second customer's account, and continuing on in that pattern until a valid account is written off as a bad debt, the perpetrator is caught, the perpetrator leaves the firm, or some combination of those three possibilities.

Question 11

Radio frequency identification tags are increasingly used to track the chain of custody of resources.

Question 12

Many of the risks associated with instigation events in the sales/collection process relate to the salesperson's efficiency and effectiveness.

Question 13

Accepting duplicate cash receipts for the same sale is a mutual commitment event risk.

Question 14

Encryption requires fingerprint matches of the authorized sender and the authorized receiver.

Question 15

An uninterruptible power supply (UPS) is a combination of hardware and software used to shield a computer network from unauthorized users or from file transfers of unauthorized types.

Question 16

A worm is more insidious than a normal computer virus.

Question 17

A master reference check highlights illogical balances in a master file, for example a negative value for quantity on hand.

Question 18

Which of the following is a risk or threat that has plagued many companies?

A) Bad decisions by management to discontinue popular product lines
B) Faulty product design that causes costly recalls
C) Recognition of revenues a company has not actually earned
D) Invasion of a company's network by hackers through the Internet
E) All of the above

Question 19

Which of the following approaches is often recommended for enterprises to control a risk that has a high impact and a low likelihood of occurrence?

A) To purchase insurance
B) To discontinue the activity from which the risk results
C) To ignore the risk
D) To convince the enterprises' competitors to engage in the same risky activity
E) To charge higher prices to consumers in case the risk results in loss

Question 20

Who is ultimately responsible for a company's internal control structure?

A) The company's management
B) The company's internal auditors
C) The company's external auditors
D) The government
E) The company's stockholders

Question 21

In assessing risk, enterprises should consider which of the following?

A) Previous company losses and the reasons for those losses
B) Communication with employees about where errors and irregularities are likely to occur
C) Historical analysis of past errors and irregularities
D) Analysis of other companies' mistakes
E) All of the above

Question 22

All other things being equal,

A) Detective controls are superior to preventive and corrective controls
B) Corrective controls are superior to detective and preventive controls
C) Preventive controls are superior to detective and corrective controls
D) Detective and corrective controls are both superior to preventive controls
E) There is no preference between corrective, detective, and preventive controls

Question 23

Which of the following is NOT a preventive control:

A) The general ledger master file is locked in a safe each night
B) All bills are marked "paid" to preclude duplicate payment
C) The accounts receivable subsidiary ledger is reconciled against the general ledger accounts receivable control account.
D) Only the credit manager may approve customers' credit sale orders
E) Customer numbers are verified by the computer before a sale order is accepted to ensure the sale order is from an established customer

Question 24

Seamore's Seafood Grill is an upscale yet casual restaurant on the Atlantic coast of North Carolina. Seamore's recognized that the risk of property damage and lost revenues due to hurricanes is significant because of its coastal location. To mitigate these risks, Seamore's purchased a sizable hurricane insurance policy. This control is best described as

A) Primarily preventive
B) Primarily detective
C) Primarily corrective
D) Equally preventive and corrective
E) Equally preventive and detective

Question 25

Which of the following are used as part of the monitoring component of the COSO internal control integrated framework?

A) Preventive control procedures
B) Corrective control procedures
C) Backup procedures
D) Performance reviews
E) Bonding of key employees

Question 26

Which of the following is an example of an economy risk?

A) A global epidemic
B) Unexpected competition from another industry
C) An industry-wide cost increase
D) A merger or acquisition of another enterprise
E) Failure to record information about an economic resource acquisition

Question 27

Which of the following is an example of a business process risk?

A) A global economic downturn
B) Receipt of goods that were not ordered
C) Low employee morale
D) Reduction of perceived brand quality
E) Unexpected competition from another industry

Question 28

Which of the following risks does separation (segregation) of duties control?

A) Errors only
B) Irregularities only
C) Collusion only
D) Errors and irregularities, but not collusion
E) Irregularities and collusion, but not errors

Question 29

An employee steals cash and makes a journal entry to cover up evidence of the theft. Which two duties should have been separated to prevent this problem?

A) Custody and Authorization
B) Custody and Recording
C) Authorization and Recording
D) Authorization and Approval
E) No separation of duties would have helped; the case involved collusion

Question 30

Which resource are employees most likely to steal from their employer?

A) Cash
B) Computer equipment
C) Furniture
D) Supplies
E) Radio frequency id tags

Question 31

The inventory part numbers for an enterprise consist of even numbers that range from 700 to 798. If a clerk mistakenly enters a part with an odd number, which control is most likely to detect and correct the error?

A) Sequence check
B) Range check
C) Validity check
D) Field or mode check
E) Completeness check

Question 32

Which of the following is a risk associated with the Customer Order event?

A) Salespeople spending time doing unproductive things that do not influence potential customers
B) Shipping poorly packaged products
C) Lapping
D) An employee making an unauthorized allowance to a customer's account
E) Accepting an order for a product or service that is not currently sold by the company and can't be made available

Question 33

Which of the following is a risk associated with the Shipping activity?

A) Selecting a poor carrier or route
B) Salespeople spending a lot of time with non-target customers
C) Taking an order for a product or service that is not currently sold by the company and can't be made available
D) Moving the incorrect inventory type or amount from warehousing to shipping
E) Approving the write-off of a customer's account with invalid justification

Question 34

Which of the following is not a risk associated with the sale of merchandise?

A) Merchandise is sold to an invalid customer
B) The wrong type or quantity of merchandise is delivered to the customer
C) The credit manager does not authorize the sale
D) The salesperson receives sales commission based on net cash sale amounts
E) The sale is made for a wrong dollar amount

Question 35

A normally trustworthy cashier who opened a company's mail discovered a customer paid off his account in cash ($500). The cashier was working alone at the time and pocketed the cash. She couldn't resist the temptation because she needed to buy some expensive medicine for her infant daughter and the company's insurance policy wouldn't cover the expense. Later, the cashier accessed the company's accounting system and entered a credit memo for that customer in the amount of $500 (so the customer wouldn't receive another bill and complain that he had already paid it). Which of the following controls would have been LEAST effective in PREVENTING this crime?

A) Require the credit manager's password to be used to enter credit memos into the system
B) Require more than one employee to be present when opening mail
C) Restrict physical access to the company's system so only employees who have no custody or authorization functions can access it
D) Require the cashier to be bonded
E) Monitor the cashier workstation with video cameras and make employees aware their actions are being monitored in that way

Question 36

A company has established its customer defaults and has entered its customer records into its information system. A sales clerk entering a sales transaction into the system begins by entering the Customer ID code. In response, the system displays the default information (e.g. Name, Ship-to address, Telephone number) for that customer. This is an example of

A) A field check
B) A reasonableness check
C) Closed loop verification
D) A foreign key check
E) Roll back and recovery

Question 37

The sum of a field that has no meaning itself is called a

A) Record control total
B) Dollar amount total
C) Default value
D) Financial total
E) Hash control total

Question 38

What is risk?

Question 39

Why do enterprises take risks?

Question 40

What factors should an organization consider when determining whether to implement controls to reduce a particular risk?

Question 41

Name two examples of economy risk.

Question 42

What kind of risk is a crisis involving a major business partner?

Question 43

List two important control principles for business process risks related to all types of resources.

Question 44

What type of risk is a mistake made in the advertising or promotions regarding a product available for sale?

Question 45

What is an independent check on performance?

Question 46

To what business process risk are economic increment events particularly susceptible, and why?

Question 47

Discuss the importance of an enterprise's control environment and describe each of the seven areas within the control environment.

Question 48

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-compares entered data to a predetermined acceptable upper and/or lower limit.

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 49

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-verifies that the entered data type is appropriate for a field (e.g. date, numeric, text)

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 50

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-uncontrolled risk

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 51

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-applies a formula to an account number, and if an expected sum is derived, gives some assurance that the number is valid

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 52

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-verifies that an event/transaction record entered for updating correctly matches the corresponding master file record

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 53

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-restrict unauthorized access to the system itself, to physical devices, and to data in the system.

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 54

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-are used to verify that all transactions within batches are processed

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 55

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-used by data base management systems to prevent two applications from updating the same record at the same time

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 56

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-the keying of input data twice, with the computer comparing the two entries and highlighting any discrepancies for correction

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 57

Write the CAPITAL letter of the term from the list below that most closely matches each of the following definitions.

-a process of encoding data entered into a system, storing or transmitting the data in coded form and then decoding the data upon their use or arrival at their destination

A) E Access controls
B) Batch control totals
C) Check digit
D) Closed loop verification
E) Completeness check
F) Echo check
G) Encryption techniques
H) Field or mode check
I) Exposure
J) Lock out procedures
K) Master file
L) Master reference check
M) Range check
N) Referential integrity
O) Rekeying (key verification)
P) Sequence check
Q) Uninterruptible power source
R) Valid sign check

Question 58

Think of a local convenience store in your town. List at least three risks associated with this store's sale of merchandise to customers, and propose one or more internal controls that would mitigate those risks.

Question 59

Bartt's Boxes manufactures and distributes boxes of various sizes and strengths. They take mail and telephone orders from customers. They ship the boxes according to the customer orders and send monthly statements to the customers who pay on a monthly basis. What are at least three risks associated with Bartt's sales/collection process, and what are internal controls that would mitigate these risks?

Question 60

Explain the grandparent-parent-child backup and file reconstruction procedure. Should this procedure be used for real-time processing systems? If not, what alternative procedure should be followed?