IT Risks, IT Controls, and Overview of Internal Audit Engagements

Comprehensive practice flashcards covering IT infrastructure, IT system risks, IT General and Application Controls, SOC reporting, and the planning, execution, and criteria evaluation of internal audit engagements.

What is the definition of IT infrastructure?

The composite set of hardware, software, networks, facilities, and services that support an organization's information technology operations and enable the storage, processing, and delivery of data and applications.

What are the three main types of IT infrastructure?

Traditional (On-Premises), Cloud-Based, and Hybrid.

What are the key control risks associated with the database administrator's (DBA) area?

Data are not captured, data becomes corrupted, and data cannot be accessed by users.

What are the primary responsibilities of a systems analyst?

To analyze and design computer information systems, design new systems to meet company needs, and act as liaisons between the organization and the IT function.

How do the responsibilities of an application programmer differ from those of a system programmer?

Application programmers design, write, test, and document specific programs developed by systems analysts, whereas system programmers implement and maintain system-level software like operating systems, access control software, and database systems software.

What are the primary responsibilities of data processing or computer operators?

Running computer operations, processing and providing data for end users, ensuring systems and hardware are in good working condition, troubleshooting, and monitoring error messages and incident logs.

What is selection risk in an IT system, and what causes it?

Selection of an IT solution that is misaligned with strategic objectives or insufficiently flexible and scalable; it is caused by unqualified decision makers and inadequate information supporting the selection decision.

What causes development/acquisition and deployment risk, and what are its effects?

It is caused by insufficient in-house expertise, inadequate vendor support, and resistance to change; its effects include unforeseen delays, cost overruns, or abandonment of the project.

What is availability risk, and what can cause it?

The unavailability of the system when needed, which causes delays in decision-making, business interruptions, lost revenue, and customer dissatisfaction; caused by hardware/software failures, unscheduled maintenance, viruses, and other malicious acts.

What causes system reliability and information integrity risk?

Software programming errors and unauthorized changes to software, leading to systematic errors or inconsistencies in processing that produce irrelevant, incomplete, inaccurate, and/or untimely information.

What are examples of physical security controls compared to logical security controls?

Physical security controls include facility monitoring, access control, alarms, shredding sensitive documents, and secure storage of backups; logical security controls include usernames and passwords, biometrics, firewalls, logs of logon attempts, and encryption.

Which organization developed COBIT 2019, and what is its primary compliance focus?

ISACA (Information Systems Audit and Control Association); it is the most widely used framework for achieving compliance with regulations like the Sarbanes-Oxley Act (SOX).

According to the GTAG IT Control Framework diagram, what are the three overarching levels of control from top to bottom?

Governance, Management, and Technical.

According to the GTAG IT Control Framework, which specific layers belong to the Technical control level?

Systems Software Controls, Systems Development Controls, and Application-based Controls.

What are the four key objectives of IT General Controls (ITGC)?

Data Integrity, System Security, Operational Efficiency, and Compliance.

What is required under systems development controls before deploying code changes?

A formal change request (CR) that includes a risk assessment, impact analysis, and approval by a Change Advisory Board (CAB).

What are the key risks of combining the roles of DBA and Programmer?

One person controls both the database structure/schema and application code, enabling them to embed backdoors, modify data directly via code, or alter logs without detection.

What risk arises when Programmer and Operations roles are combined?

A developer can write, test, and directly execute their own code in the live production environment without independent operations review, potentially introducing logic bombs, unauthorized batch jobs, or malware.

What is the consequence of combining Database Administrator (DBA) privileges with End User duties?

The end user gains direct database access (schema changes, raw SQL, or admin privileges), allowing direct manipulation of records and deletion of audit trails while bypassing all application controls and approvals.

What compensating control and focus are used when Developer equals Operations ($\text{Dev} = \text{Ops}$)?

Audit Trail Review, with a focus on Detection (seeing what they did).

What compensating control and focus are used when User equals Administrator ($\text{User} = \text{Admin}$)?

Managerial Sign-off, with a focus on Authorization (getting a second pair of eyes).

What compensating control and focus are used for a Single IT Point of Failure?

Mandatory Rotation, with a focus on Exposure (revealing hidden issues).

How does the "two-key" system work as a compensating control for segregation of duties?

While one person performs the technical work (such as initiating a change), a manager or third party must digitally sign off or finalize the deployment to production.

How do automated reconciliation scripts serve as compensating controls for DBA activities?

Automated scripts compare database states (e.g., at 9:00 AM vs. 5:00 PM) to flag manual table edits and trigger automated email alerts to independent auditors if manual "INSERT" or "DELETE" commands occur outside standard processes.

What is the purpose of periodic access reviews in an IT environment?

The IT Director periodically reviews a report of all "Superuser" or "Admin" accounts to confirm permissions remain strictly necessary and remove leftover rights from prior projects.

How do IT application controls differ from IT general controls?

General controls apply broadly across all IT systems to secure the environment, whereas application controls are granular and embedded within specific software applications to control data input, processing, and output.

What are the three types of control totals used as input controls?

Record count, financial total, and hash total.

What is the function of a check digit verification in IT input controls?

A programmed edit check that verifies the mathematical validity of an extra appended digit to detect transcription or transposition errors in identification numbers.

What are the four components of input error correction?

Error detection, user notification, correction facilitation, and prevention of progression.

What are processing controls, and what are common examples?

Controls that verify data is processed correctly according to application logic and business rules; examples include calculation checks, sequence checks, error handling, reconciliation, and batch controls.

What is the purpose of Master Data Controls (Configuration Controls)?

To protect the integrity of static or reference data that the application relies on for processing (such as price lists, vendor details, or chart of accounts).

What four methods do auditors use to evaluate IT application controls?

Walkthroughs, testing (inputting dummy data), reviewing evidence (logs or reports), and focusing on high-risk areas.

What is the definition of a Service Organization Control (SOC) report?

An independent evaluation conducted by third-party auditors (such as CPAs) of an organization's ability to implement and maintain controls to protect their clients' data.

What is the difference between a SOC Type 1 report and a SOC Type 2 report?

A Type 1 report documents internal controls at a specific point in time, whereas a Type 2 report documents internal controls and their operating performance over a period of time, usually between 6 to 12 months.

What are the five SOC 2 Trust Services Categories (TSCs)?

Security, Availability, Processing integrity, Confidentiality, and Privacy.

How does a SOC 3 report differ from a SOC 2 report?

SOC 3 is a scaled-down, less technical version of SOC 2 meant for a broader audience that can be shared publicly or posted on an organization's website because it omits detailed testing procedures.

What is a subservice organization in a SOC 2 context, and how frequently must it be reviewed?

A vendor used by a service organization that performs necessary controls to achieve service commitments and system requirements (e.g., cloud hosting providers); it must undergo an annual security review.

What is an internal audit engagement?

A specific internal audit assignment or project that includes multiple tasks or activities designed to accomplish a specific set of related objectives.

What are the three steps in the planning and risk assessment phase of an internal audit engagement?

1) Understand the context, purpose, and expectation of the engagement; 2) Gather information to understand the area or process under review; 3) Conduct a preliminary assessment of relevant risks.

How are internal audit engagement objectives and scope established?

They are established based on the risks identified and prioritized from the preliminary risk assessment, with the scope defined by and designed to suffice the objectives.

What elements must an internal audit scope specify to establish boundaries?

The activities, locations, processes, systems, components, time period, costs, and other elements to be reviewed.

What is an audit scope limitation?

Resource constraints or restrictions on access to personnel, facilities, data, and information that prevent internal auditors from implementing the work program.

What must occur if a scope limitation cannot be resolved with management in an assurance engagement?

The Chief Audit Executive (CAE) must escalate the issue to the board.

Who must approve changes to engagement objectives and scope during an audit?

The Chief Audit Executive (CAE).

How must an internal auditor respond if a client proposes additional testing during an engagement?

Document the request, assess its relevance to the engagement objectives, and modify the scope accordingly if it aligns with the objectives and available resources.

What should an internal auditor do when new information, such as regulatory requirements, emerges during an engagement?

Assess its relevance to the engagement objectives and risks, and update the scope if relevant to ensure alignment with organizational needs.

In an internal audit engagement, what are "criteria"?

The standards, policies, or benchmarks (representing the desired state or condition) against which the audit subject will be evaluated.

What are the characteristics and functions of adequate audit criteria?

They represent the desired state (condition), are specific and practical, identify differences between the desired state and existing condition (findings), and help assess finding significance.

In internal auditing, what are "procedures"?

The specific actions or steps the auditor takes to gather evidence of the existing state (condition) and assess whether criteria are being met.

What are the four core steps in performing an internal audit engagement?

1) Information Gathering; 2) Analyzing information; 3) Documentation, evaluation, and conclusion; 4) Engagement supervision.