ACC 401 Exam 2

What are the 3 types of fraud?

Corruption

Asset Misappropriation

Financial Statement Fraud

What are the three areas of the fraud triangle?

Opportunity, Pressure, Rationalization

What are the types of threats to Accounting Systems?

Natural Disasters

Intentional Acts

Unintentional Acts

Software and equipment errors and malfunctions

Cookie

Text file created by a website to store user information on user’s device hard drive. Stores info on who the user is and what they have done on the site

Fraud

Any means a person uses to gain unfair advantage over another person

White-Collar Criminals

A person who commits non-violent crimes for financial gain, typically in business or professional settings. These crimes often involve deceit, concealment, or violation of trust.

Corruption

Dishonest conduct by those in power which involves illegitimate, immoral, or incompatible actions with ethical standards. l

Investment Fraud

Misrepresenting or leaving out facts in order to promote and investment that promises fantastic profits with little to no risk

Misappropriation of Assets

theft of company assets by employees

Fraudulent Financial Reporting

Intentional or reckless conduct, whether by act or omission that results in materially misleading financial statements

What are the types of pressures that lead to an employee committing fraud?

Financial, emotional, and lifestyle pressure

Lapping

concealing the theft of cash by means of a series of delays in posting collections to A/R

Check Kitting

creating cash using the lag between the time a check is deposited and the time it clears the bank

inherent risk

the susceptibility of a set of accounts or transactions to significant control problems in the absence of internal controls

Residual Risk

the risk that remains after management implements internal controls or some other response to risk

Expected loss

Product of the potential dollar loss that would occur should a threat become a reality

Impact x Likelihood =

What are the types of risk responses?

Accept

Reduce

Share

Avoid

Accept

The ability to recognize that there is an inherent risk associated with an activity

Reduce

Action of minimizing a risk by certain means

Share

Action of offloading a risk to a 3rd party so its not your responsibility

Avoid

The action of removing some business activity to completely remove the risk associated

Risk Appetite

The amount and type of risk an organization or individual is willing to accept in pursuit of their goals

Pressure

A persons incentive or motivation for committing fraud

Opportunity

The condition or situation in which the person or organization can commit and conceal a dishonest act and convert it into personal gain

Rationalization

The excuse that fraud perpetrators use to justify their illegal behavior

Threat

any potential adverse occurrence or unwanted event that could injure the AIS or organization. Also referred to as an event.

Exposure/Impact

The potential dollar loss if a particular threat happens

Likelihood/Risk

the probability that a threat will come to pass

Internal Controls

processes and procedures implemented to provide reasonable assurance that control objectives are met

Preventative controls

controls that deter problems before they arise like hiring qualified employees, appropriately segregating employee duties, and effectively controlling physical access to assets, facilities, and information.

Detective controls

Controls designed to discover control problems that were not prevented, such as duplicate checking of calculations and preparing bank reconciliations and monthly trial balances

Corrective Controls

Controls that identify and correct problems as well as correct and recover from the resulting errors, such as maintaining backup copies of files, correcting data entry errors, and resubmitting transactions for subsequent processing

What two categories are internal controls placed into

General Controls

Application Controls

General Controls

Controls designed to make sure an organization’s control environment is stable and well managed like security, IT infrastructure, software acquisition controls

Application Controls

Controls that prevent, detect, and correct transaction errors and fraud in application programs. Concerned with validity, completeness, accuracy, authorization of the data captured.

Belief System

System that describes how a company creates value, helps employees understand managements vision, communicates company core values, and inspires employees to live by those values.

Boundary System

System that helps employees act ethically by setting boundaries on employee behavior. Instead of telling them what to do they are encouraged to solve problems to meet customer needs while meeting minimum standards and shunning off limit activities and avoiding actions that could damage reputation

Diagnostic Control System

Measures, monitors, and compares actual company progress to budgets and performance goals.

Interactive Control System

System that helps managers to focus subordinates’ attention on key strategic issues and to be more involved in their decisions.

Foreign Corrupt Practices Act (FCPA)

Legislation passed to prevent companies from bribing foreign officials to obtain business; also requires all publicly owned corporations maintain a system of internal accounting controls

Public Company Accounting Oversight Board (PCAOB)

Board created by SOX that regulates the auditing profession; creates as a part of SOX

Control Objectives for Information and Related Technology (COBIT)

A security and control framework that allows (1) management to benchmark the security and control practices of IT environments, (2) users of IT services to be assured that adequate security and control exist, and (3) auditors to substantiate their internal control opinions and advice on IT security and control matters.

COBIT Governance and Management objectives

Governance:

EDM

Management Objectives:

APO

BAI

DSS

MEA

EDM

Evaluate, Direct, and Monitor

the Governance objectives in COBIT

Evaluate strategic options, direct the chosen options, and monitor strategy achievement.

APO

A management objective of COBIT

Align, Plan, and Organize

Organization, Strategy, and supporting activities for I&T

BAI

A management objective of COBIT

Build, Acquire, and Implement

Definition, acquisition, and implementations of I&T solutions.

DSS

a management objective of COBIT

Deliver, service and Support

Operational Delivery and support of I&T services

MEA

a management objective of COBIT

Monitor, Evaluate, and Asses

Performance and conformance monitoring of I&T

Committee of Sponsoring Organizations (COSO)

Private Sector Committee Consisting of the American Accounting Association, The AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the financial Executives institute

Issued the Internal Control - Integrated Framework (IC)

Internal Control - Internal Framework

A COSO framework that defines internal controls and provides guidance for evaluating and enhancing internal control systems.

CERAMIC

Acronym to remember the five COSO components

CE - Control Environment

RA - Risk Assessment

M - Monitoring

I - Information and Communication

C - Control Activities

Control Environment

Management’s philosophy, operating style, and risk appetite

commitment to integrity, ethical values, and competence

internal control oversight by separate board of directors

organizing structure

methods of assigning authority and responsibility

Human resource standards

Risk Assessment

Likelihood

• Probability that the event will occur

Impact

• Estimate potential loss if event occurs

Types of risk:

Inherent

Residual

Risk Reponse

Reduce

• implement effective internal controls

Accept

• Do nothing, accept likelihood, and impact of risk

Share

• Buy insurance, outsource, or hedge

Avoid

• Do not engage in activity

Control Activities

Proper authorization of transactions and activities

Segregation of duties

Project development and acquisition controls

Change management controls

Design and use of documents and records

safeguarding assets, records, and data

independent checks on performance

Two important Control Classifications

Internal controls are often classified as

• application controls

• general controls (ITGCs)

Internal controls are also classified as

• preventative

• detective

• corrective

Information and Communication

Obtain or generate relevant, high-quality information to support internal control

Internally communicate the information, including objectives and responsibilities, necessary to support the other components of internal controls

Communicate relevant internal control matters to external parties

Monitoring

Perform internal control evaluations

implement effective supervision

use responsibility accounting (budgets)

Monitor System activities

track purchased software and mobile devices

conduct periodic audits

employ computer security officer

engage forensic specialists

install fraud detection software

implement fraud hotline

What does the top of the COSO cube represent?

What are we trying to accomplish?

What does the front of the cube represent?

How do we accomplish it?

What does the side of the cube represent?

Where do controls operate?

Sarbanes-Oxley Act (SOX)

Legislation intended to prevent financial statement fraud, make financial reports more transparent, provide protection to investors, strengthen internal controls at public companies, and punish executives who perpetrate fraud.

Service Organization Control report (SOC)

An audit report based on the Service Organization Control Framework that service providers share with their clients. Addresses the effectiveness of the service providers controls

SOC-1

An audit of controls at a service provider implemented to protect client-owned data involved in client financial reporting.

SOC-2

an audit to assess service provider controls that adress client-owned non-financial data and customer-owned data. Typically requested from providers of cloud services and data centers

SOC-3

Much like a SOC-2 but written for the general public

Audit Committee

Outside, independent board of director members responsible for financial reporting, regulatory compliance, internal controls, and hiring and overseeing internal and external auditors

Policy and Procedures Manual

Document that explains proper business practices, describes needed knowledge and experience, explains document procedures, explains how to handle transactions, and lists the resources provided to carry out specific duties

Authorization

Process of restricting access of authenticated users to specific portions of the system and limiting what actions they are permitted to perform

Analytical Reveiw

Examination of relationships between different sets of data

Fault Tolerance

Capability of a system to continue performing when there is a hardware failure

Redundant arrays of independent drivers (RAID)

Fault tolerance technique that records data on multiple disk drives instead of just one to reduce the risk of data loss

Uninterruptible power supply (UPS)

Alternative power supply device that protects against the loss of power and fluctuations in the power level by using battery power to keep the system up

Recovery point objective (RPO)

Maximum amount of data that the organization is willing to reenter or potentially lose

Recovery Time Objective (RTO)

Maximum tolerable time to restore an information system after a disaster.

Full Backup

Exact copy of an entire database

Incremental backup

only copying data items that have changed since the last partial backup, each containing the results of one day’s transactions

differential backup

partial backup that involves copying all changes made since the last full backup. each new backup contains the cumulative effects of all activity since the last full backup

Deduplication

Use of Hashing to identify and backup only those portions of a file or database that have been updated since the last backup

Archive

copy of a database, masterfile, or software retained indefinitely as a historical record, usually to satisfy legal and regulatory requirements.

Disaster Recovery Plan (DRP)

Procedures to restore an organization’s IT function in the event that its data center is destroyed

Cold site

Empty building prewired for necessary telephone internet access but doesnt have any computing equipment

Hot site

facility that is prewired for telephone and internet access and also contains all the computing equipment an organization needs to perform its essential business activities.

Real-time Mirroring

maintaining two copies of the databse at two separate data centers at all times and updating both databases in real-time as each transaction occurs.

Business Continuity Plan (BCP)

how to resume all business processes, including relocation to new offices and hiring temporary replacements, in the event of a major calamity.

Time-based model of information security

combination of preventative, detective, and corrective controls to protect information assets long enough for an organization to detect that an attack is occuring and to take timely steps to thwart the attack

P>D+R

P = time attacker to break in

D = Time it takes to detect attack

R = time to stop attack

Defense-in depth

multiple layers of control in order to avoid having a single point of failure. If one control may fail, another with succeed

Authentication

the process of verifying the identity of the person or device attempting to access the system

Biometric identifier

Physical or behavioral characteristic used as an authentication credential

Multifactor authentication

use of two or more types of authenticating credentials in conjunction to achieve greater security levels

Multimodal authentication

The use of multiple authentication credentials of the same type to achieve a greater level of security

Access control matrix

table used to implement authorization controls

Compatibility Test

Matching the user’s authentication credentials against the access control matrix to determine whether that employee should be allowed to access that resource perform the requested action.

Border Router

connects an information system to the internet

Firewall

behind a border router which can be either a special-purpose hardware device or software running on a generall-purpose computer that controls both inbound and outbound communication between the system behind the firewall and other networks

Demilitarized Zone (DMZ)

Separate network located outside the organizations internal information system that permits controlled access from the internet to selected resources, such as the organizations e-commerce web server.

Routers

special purpose devices designed to read the source and destination address fields in IP packets headers to decide where to send the packets next

Access Control Lists (ACLs)

Sets of IF-THEN rules used to determine what to do with arriving packets