Exam 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

A(n)______________________________ is program code that can attach itself to other programs or macros thereby infecting those programs and macros.

The ______________________________ states that "a fundamental aspect of management's stewardship responsibility is to provide shareholders with reasonable assurance that the business is adequately controlled."

A computer abuse technique called a ____ involves a virus that replicates itself on disks,in memory,or across networks.

According to the 2012 Report to the Nation on Occupational Fraud and Abuse,frauds are more likely to be detected by audits or internal controls than through tips.

SAS No.99 emphasizes auditors should brainstorm fraud risks,increase professional skepticism,use unpredictable audit test patterns,and detect management override of internal controls.

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.

Listed below are 13 specific fraud examples taken from some well-known fraud cases: MiniScribe,ZZZZ Best Carpet Cleaning,Lesley Fay,and Equity Funding. Required: For each fraud example,enter a letter corresponding to which information control goal was initially violated-Validity,Completeness,or Accuracy.Some examples might involve more than one violation. NOTE: When we say initially,we mean what control goal failure led to this example,not what is the present condition.For example,master data might contain information that is inaccurate,but it might have been an inaccurate input that initially caused the data to be inaccurate.

Management selects risk ________________________- avoiding,accepting,reducing or sharing risk - developing a set of actions to align risks with the entity's risk tolerances and risk appetite.

The control goal that seeks to protect an organization's resources from loss,destruction,disclosure,copying,sale,or other misuse of an organization's resources is called ensure ______________________________.

The ERM framework addresses four categories of management objectives.Which category of concerns laws and regulations?

Achieving which control goal requires that all valid objects or events are captured and entered into a system's database once and only once?

Control goals of operations processes include:

Monitoring is a process that assesses the quality of internal control performance over time.

As described in COSO,elements of a control environment might include the following:

The section of Sarbanes Oxley that requires a company's CEO and CFO to certify quarterly and annual reports is ______________________________.

The control goal of ensure ______________________________ provides assurance that all valid objects or events which were entered into the computer are in turn reflected in their respective master data once and only once.

Under the Sarbanes Oxley Act of 2002,the section on Corporate Tax Returns conveys a sense of the Senate that the corporate federal income tax returns be signed by the treasurer.

According to the 2011 PricewaterhouseCoopers (PwC)Global Economic Crime Survey:

Expected gross risk is a function of the initial expected gross risk,reduced risk exposure due to controls,and cost of controls.

A(n)______________________________ relates to a specific AIS process,such as billing or cash receipts.