Exam 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

The control environment reflects the organization's general awareness of and commitment to the importance of control throughout the organization.

According to the 2012 Report to the Nation on Occupational Fraud and Abuse,frauds are more likely to be detected by:

The CFO of Exeter Corporation is very uncomfortable with its current risk exposure related to the possibility of business disruptions.Specifically,Exeter is heavily involved with e-business and its internal information systems are tightly interlinked with its key customers' systems.The CFO has estimated that every hour of system downtime will cost the company about $5,000 in sales.The CFO and CIO have further estimated that if the system were to fail,the average downtime would be about 2 hours per incident.They have anticipated (assume with 100% annual probability)that Exeter will likely experience 10 downtime incidents in a given year due to internal computer system problems,and another 10 incidents per year due to external problems;specifically system failures with the Internet service provider (ISP).Currently,Exeter pays an annualized cost of $25,000 for redundant computer and communication systems,and another $25,000 for Internet service provider (ISP)support just to keep total expected number of incidents to 20 per year. Required: a. Given the information provided thus far,how much ($)is the company's current expected gross risk? b. A further preventative control would be to purchase and maintain more redundant computers and communication lines where possible,at an annualized cost of $30,000,which would reduce the expected number of downtimes per year to 5 per year due to internal computer system problems.What would the dollar amount of Exeter's current residual expected risk at this point?

Management's legal responsibility to prevent fraud and other irregularities is implied by laws such as the Foreign Corrupt Practices Act.

Events that could have a positive impact on organizational objectives:

A corrective control plan is designed to discover problems that have occurred.

The ERM framework addresses four categories of management objectives.Which category addresses the reliability of the financial statements?

A process captures only authorized transactions but fails to record them only once.Which control goal does this fail to achieve?

______________________________ is the possibility that an event will occur.

The section of Sarbanes Oxley that has received the most press as companies and their auditors have struggled to comply with its requirements is ______________________________.

PCAOB Auditing Standard No.5 uses ______________________________ in its description of the conduct of an integrated audit under SOX 404.

A(n)______________________________ is a computer abuse technique in which unauthorized code is inserted in a program,which,when activated,could cause a disaster such as shutting down a system or destroying data.

______________________________ is a deliberate act or untruth intended to obtain unfair or unlawful gain.

A control that involves reprocessing transactions that are rejected during initial processing is an example of:

COSO's ______________________________ is the foundation for all other components of internal control,providing discipline and structure.

Establishing and maintaining a viable internal control system is the responsibility of management.

Opportunities are events that could have a positive impact on organization objectives.

A computer abuse technique called ______________________________ involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.

A batch of business events is accurately entered into a business event data store,but the computer operator fails to use the data to update master data.This type of processing error would be classified as an operational error.

Below is a list of sources of information and guidance on internal controls.The second list contains descriptions or information provided by these sources. Required: On the blank line to the left of each numbered item,place the capital letter of the source that best matches that description.HINT: Some letters may be used more than once.Conversely,some letters may not apply at all.