Exam 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

A sale to a customer is entered into the system properly,but the event does not accurately update the customer's outstanding balance.This type of processing error would be classified as a user error.

A computer crime technique called worm involves the systematic theft of very small amounts from a number of bank or other financial accounts.

The ERM framework addresses four categories of management objectives.Which category addresses the effective and efficient use of resources?

Under the Sarbanes Oxley Act of 2002,the section on Auditor Independence establishes an independent board to oversee public company audits.

The section of Sarbanes Oxley that makes it a felony to knowingly destroy,alter,or create records and or documents with the intent to impede,obstruct,or influence an ongoing or contemplated federal investigation and offers legal protection to whistle-blowers is ______________________________.

Risk assessment is the entity's identification and analysis of relevant risks to the achievement of its objectives,forming a basis for determining how the risks should be managed.

Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals).

Risk assessment is best described by:

Ensuring the security of resources is the control goal that seeks to provide protection of organization's resources from loss,destruction,disclosure,copying,sale,or other misuse of an organization's resources.

This component of the ERM framework concerns the entirety of enterprise risk management and is accomplished through ongoing management activities,separate evaluations,or both.

A computer abuse technique called a back door involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.

______________________________ provides guidance on how an organization's IT might affect any of COSO's five components of internal control.This standard guides auditors in understanding the impact of IT on internal control and assessing IT-related control risks.

Figure TB-7.1 depicts the objective setting process shown in Chapter 7 but with all labels removed. Required: Complete Figure TB-7.1 by inserting the following labels where they belong in the model: Box Title Box Description A. Related objectives E. e.g. ,expand production of our top-five selling retail products to meet increased demand e.g. ,to be in the top quartile of product sales for retailers of our products B. Strategy F. e.g. ,to be the leading producer of household products in the regions in which we operate C. Mission,vision,purpose G. increase production of x by 15% hire 180 qualified new staff maintain product quality D. Strategic objectives H.

Ethical behavior and management integrity are products of the "corporate culture".

Events that could have a negative impact on organizational objectives:

A process by which organizations select objectives,establish processes to achieve objectives,and monitor performance is:

A(n)______________________________ is a program that secretly takes over another Internet -attached computer and then uses that computer to launch attacks that can't be traced to the creator.

______________________________ is a process,effected by an entity's board of directors,management and other personnel,applied in strategy settings and across the enterprise,designed to identify potential events that may affect the entity,and manage risk to be within its risk appetite,to provide reasonable assurance regarding the achievement of entity objectives.

______________________________ are business process objectives that an internal control system is designed to achieve.

Why is there usually no control goal called update validity?