Question 1

In practice, ________ refers to the structure, roles, procedures, and internal and external relationships that ensure that IT is well managed and can provide the necessary information to run the organization.
A) Business continuity planning
B) IT Governance
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Accepted Answer

The definition provided specifically describes IT Governance as the management structure for IT within an organization. Business continuity planning, security architecture, physical and virtual access, and IT strategic planning are related to IT management but do not encompass all the elements mentioned in the definition.

Question 2

Which of the following IT elements addresses the work that is done to develop or acquire new applications?
A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) IT strategic planning, competitive advantage, increased costs.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Accepted Answer

IT strategic planning, risk assessment, and project management are directly involved in the processes and considerations necessary for developing or acquiring new applications. Strategic planning sets the direction and priorities, risk assessment evaluates potential issues or challenges, and project management oversees the execution of development or acquisition projects.

Question 3

________ is the structure of relationships and processes that enable the enterprise to direct and control IT in order to achieve enterprise goals while balancing risk versus return.
A) Business continuity planning
B) IT Governance
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Accepted Answer

The structure of relationships and processes described in the question is the definition of IT Governance. Business continuity planning, security architecture, physical and virtual access, and IT strategic planning are all related to IT Governance, but do not fully encompass its definition.

Question 4

________ is/are the front line of business support and often are the first to identify problems and risks with systems, operations, and information.
A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Accepted Answer

Help desks are the front line of business support and are responsible for assisting employees and customers with technical issues and identifying problems with systems and operations. They are often the first point of contact for identifying risks related to information security as well.

Question 5

________ oversees existing hardware, software, and networks and ensure ongoing operations, as well as those that make needed changes and deal with problems as they occur.
A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Accepted Answer

Operations and infrastructure support refers to the management and maintenance of existing hardware, software, and networks to ensure their ongoing operations. This includes making necessary changes and resolving any problems as they arise. Help desks, IT governance, IT strategic plans, and training and awareness may also play a role in supporting IT operations and infrastructure, but they do not directly oversee the management and maintenance of existing assets.

Question 6

IT management issues associated with SOX compliance include:
A) increased costs, operational challenges and new opportunities.
B) unforeseen benefits, new opportunities, and operational challenges.
C) competitive advantage, increased costs and new opportunities.
D) increased costs, operational challenges, new opportunities, and unforeseen benefits.

Accepted Answer

The IT management issues associated with SOX compliance include increased costs due to additional staff, technology infrastructure, and audits; operational challenges due to the need to implement controls and maintain accurate records; new opportunities as companies must invest in better systems and processes to achieve compliance; and unforeseen benefits such as improved data accuracy, stronger security controls, and enhanced financial reporting.

Question 7

U.S. companies have found that they spent more than ________ on IT investments to meet SOX requirements.
A) $1 billion
B) $2 billion
C) $3 billion
D) $5 billion
E) $5.5 billion

Accepted Answer

The answer of U.S. companies have found that they spent...

Question 8

The Sarbanes-Oxley Act strongly recommends that companies follow a framework for internal controls known as:
A) Committee of Sponsoring Organizations of the Treadway Commission
B) Control Objectives for Information and related Technology
C) Information Technology Control Guidelines
D) National Institute of Standards and Technology

Accepted Answer

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework is widely considered to be the standard for internal control in the United States, and is strongly recommended by the Sarbanes-Oxley Act. The other options listed may be useful guidelines for specific aspects of internal control, but do not provide as comprehensive a framework as COSO.

Question 9

Industry-specific legislation issues that IT faces include:
A) software standards.
B) homeland security.
C) access to persons with disabilities.
D) Both B and C
E) Both A and B

Accepted Answer

Homeland security and access to persons with disabilities are industry-specific legislation issues that IT faces. Software standards may be considered an issue in IT, but it is not necessarily industry-specific. However, both homeland security and access to persons with disabilities are of great importance in certain industries such as healthcare, finance, and government. Therefore, the best choice is D.

Question 10

Transporting sensitive personal information across organizational and national boundaries could:
A) produce inaccurate or invalid information that could mislead auditors.
B) produce inaccurate or invalid information that could tax officials and inspectors.
C) create a sense if distrust among the public.
D) create a sense of distrust among investors.
E) All of the above

Accepted Answer

Transporting sensitive personal information across organizational and national boundaries has the potential to produce inaccurate or invalid information that could mislead auditors, tax officials, and inspectors. This could also create a sense of distrust among the public and investors. Therefore, all of the above choices are correct.

Question 11

Which of the following IT elements ensure that all work done in IT is properly completed, meets all control standards, and can be demonstrated to do so with reasonable assurance?
A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) Testing and validation, documentation management, and quality assurance.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Accepted Answer

Testing and validation ensure that work is properly completed, documentation management ensures that it meets control standards, and quality assurance ensures that it can be demonstrated to do so with reasonable assurance. The other options do not directly relate to ensuring work is properly completed and meets control standards.

Question 12

To reduce risk, organizations need a planned, integrated, and evolving set of practices for dealing with threat called ________.
A) Business continuity planning
B) Disaster recovery
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Accepted Answer

The planned, integrated, and evolving set of practices for dealing with threats is called security architecture. Business continuity planning and disaster recovery are related to ensuring business operations continue in the event of a disruption. Physical and virtual access involves controlling access to resources. IT strategic planning involves aligning technology with business goals. Of these options, security architecture is the most directly related to reducing risk.

Question 13

Some of the benefits of a properly implemented internal control program include:
A) increased costs, operational challenges, new opportunities, and unforeseen benefits.
B) improved overall IT governance and enhanced understanding of IT by senior executives.
C) effective written documentation of controls and segregation of duties.
D) Both A and C.
E) All of the above.

Accepted Answer

A properly implemented internal control program can lead to improved IT governance and a better understanding of IT by senior executives, which are key benefits.

Question 14

Two particularly challenging aspects of SOX and privacy legislation are:
A) the segregation of duties and technical documentation of controls.
B) the segregation of duties and restrictions on who has access to data.
C) the written documentation of controls and restrictions on who has access to data.
D) the written documentation of controls and segregation of duties.
E) the technical documentation of controls and who has access to the data.

Accepted Answer

Both SOX and privacy legislation require the segregation of duties to ensure that no one person has complete control over a process or system that could be manipulated. Additionally, there are restrictions on who has access to sensitive data to protect individual privacy rights. While written and technical documentation of controls are also important aspects of these regulations, they are not as directly related to the challenge of balancing duties and access to data.

Question 15

The single most challenging regulation that IT faces is:
A) capital management.
B) homeland security.
C) access to persons with disabilities.
D) the Sarbanes-Oxley Act.
E) the impact on the environment.

Accepted Answer

The Sarbanes-Oxley Act (SOX) is a comprehensive regulation that mandates strict financial reporting and accounting rules for public companies. IT departments are directly affected by this regulation, as they are responsible for storing and managing financial data. Compliance with SOX requires significant resources and can be costly for organizations, making it the most challenging regulation that IT faces.

Question 16

SOX requires all of the following EXCEPT:
A) the CEO and CFO to personally certify internal financial controls.
B) internal auditors to personally certify internal financial controls.
C) external auditors to independently attest to the effectiveness of internal financial controls.
D) financial controls designed to achieve control objectives using established criteria.
E) financial control objectives and related controls are appropriately documented.

Accepted Answer

While SOX requires internal auditors to evaluate and monitor internal financial controls, it does not require them to personally certify these controls. The CEO and CFO are required to personally certify them, and external auditors are required to independently attest to their effectiveness. Additionally, SOX requires financial controls to be designed using established criteria and appropriately documented.

Question 17

Companies doing business with the European Union are not required to respect strict EU privacy standards since their systems operate in the United States.

Accepted Answer

This statement is false. If companies are conducting business with EU citizens, they must comply with strict EU privacy standards regardless of where their systems are located. This is enforced by the General Data Protection Regulation (GDPR).

Question 18

Which of the following IT elements addresses all data and information produced and/or stored by IT?
A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) IT strategic planning, competitive advantage, increased costs.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Accepted Answer

Information architecture deals with the organization and structuring of data and information within an IT system. Access to data ensures that authorized users can retrieve and manipulate the data, while data administration ensures the overall management and control of the data. Therefore, option B addresses all data and information produced and/or stored by IT.

Question 19

Which of the following areas is one of the most important areas of control?
A) Testing and validation
B) Documentation management
C) Quality assurance
D) Information architecture and data administration

Accepted Answer

The answer of Which of the following areas is one...

Question 20

________ is essential to ensure that all staff understand their responsibilities in complying with regulations.
A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Accepted Answer

Training and awareness is essential to ensure that all staff understand their responsibilities in complying with regulations. Without proper training and awareness, staff may make unintentional mistakes that could lead to non-compliance with regulations.

Quiz 5: IT in the New World of Corporate Governance Reforms

In practice, ________ refers to the structure, roles, procedures, and internal and external relationships that ensure that IT is well managed and can provide the necessary information to run the organization.

Which of the following IT elements addresses the work that is done to develop or acquire new applications?

________ is the structure of relationships and processes that enable the enterprise to direct and control IT in order to achieve enterprise goals while balancing risk versus return.

________ is/are the front line of business support and often are the first to identify problems and risks with systems, operations, and information.

________ oversees existing hardware, software, and networks and ensure ongoing operations, as well as those that make needed changes and deal with problems as they occur.

IT management issues associated with SOX compliance include:

U.S. companies have found that they spent more than ________ on IT investments to meet SOX requirements.

The Sarbanes-Oxley Act strongly recommends that companies follow a framework for internal controls known as:

Industry-specific legislation issues that IT faces include:

Transporting sensitive personal information across organizational and national boundaries could:

Which of the following IT elements ensure that all work done in IT is properly completed, meets all control standards, and can be demonstrated to do so with reasonable assurance?

To reduce risk, organizations need a planned, integrated, and evolving set of practices for dealing with threat called ________.

Some of the benefits of a properly implemented internal control program include:

Two particularly challenging aspects of SOX and privacy legislation are:

The single most challenging regulation that IT faces is:

SOX requires all of the following EXCEPT:

Companies doing business with the European Union are not required to respect strict EU privacy standards since their systems operate in the United States.

Which of the following IT elements addresses all data and information produced and/or stored by IT?

Which of the following areas is one of the most important areas of control?

________ is essential to ensure that all staff understand their responsibilities in complying with regulations.