Chapter 10: Information Systems Controls

Vocabulary flashcards covering information systems controls, risks, exposures, Sarbanes-Oxley (SOX), SAS No. 109, COSO, COBIT, general controls, application controls, and database integrity rules from Chapter 10.

Controls

Mechanisms or procedures designed to prevent, detect, or correct errors and irregularities.

Procedure

A series of steps undertaken to accomplish a particular task.

Errors

Unintentional mistakes arising in data and systems processing.

Irregularities

Intentional alterations, mistakes, or misstatements of data.

Risk

The likelihood that an information system will experience an error or irregularity.

Exposure

The dollar amount of loss that could occur if a risk is realized (i.e., if errors actually occur).

Reasonable Assurance

The principle that controls are designed to provide reasonable rather than absolute assurance that accounting data are error-free, because the cost of protecting against every conceivable risk would be prohibitive.

Preventive Controls

Controls designed to prevent the occurrence of errors or unwanted acts, typically halting processing once an error occurs or an exception condition is identified.

Detective Controls

Controls aimed at detecting errors or unwanted acts once they have occurred, typically permitting data to complete processing while relying on human follow-up or corrective action.

Corrective Controls

Controls that assist in both the investigation and correction of errors or unwanted acts after they have been detected.

Suspense Files

A detective control that involves holding incomplete or out-of-balance transactions in a temporary file until balancing can be finalized.

Limit Check

A detective, computer-based machine edit that flags transactions exceeding a predefined ceiling (for example, a payroll payment exceeding $\$50,000$ in a single month).

Label Matches

A preventive control involving the electronic comparison of an internally written label on a mass storage file with a file label supplied by a human to abort processing if they do not match.

Management Fraud

Intentional alterations or misstatements of data in information systems performed by management to mislead investors or creditors.

Defalcation

Intentional alteration or misstatement of data performed by employees, typically to conceal the theft or misappropriation of assets.

Lapping

A fraudulent scheme where collections from one customer are applied to the account of another customer whose payment was misappropriated by the perpetrator.

Computer Crime

Any intentional act involving unauthorized access to, use of, alteration of, or destruction of computer hardware, software resources, or data.

Public Company Accounting Oversight Board (PCAOB)

A private-sector, non-profit corporation created by the Sarbanes-Oxley Act of 2002, overseen by the SEC, with broad powers to regulate audits and auditors of public companies.

Sarbanes-Oxley Act of 2002 (SOX)

Sweeping federal legislation passed in response to high-profile corporate financial failures (such as Enron and WorldCom) to reform public company corporate governance, accounting, and auditing.

SOX Section 404

The section of the Sarbanes-Oxley Act requiring management to acknowledge responsibility for and assess internal controls over financial reporting (404a), while requiring independent auditors to attest to and report on management's assertions (404b).

COSO Internal Control—Integrated Framework

The de facto standard internal control framework (from the Committee of Sponsoring Organizations of the Treadway Commission) consisting of five components: control environment, risk assessment, control activities, information and communication, and monitoring.

Statement on Auditing Standards (SAS) No. 109

An auditing standard issued in March 2006 titled 'Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement,' which supersedes SAS Nos. 55, 74, and 94, and adopts the COSO framework.

Control Environment

The collective effect of factors—including management philosophy, organizational structure, board/audit committee oversight, assignment of authority, and human resource policies—on establishing or mitigating the effectiveness of specific policies and procedures.

Management's Risk Assessment

The process management undertakes to identify and analyze risks relevant to the preparation of financial statements in conformity with GAAP, focusing on balance-related and transaction-related assertions.

COBIT (Control Objectives for Information and Related Technology)

An IT governance and control framework issued by the Information Systems Audit and Control Association (ISACA) that defines good practices organized across four interrelated domains: APO, BAI, DSS, and MEA.

COBIT Four Domains

The four interrelated IT process areas within COBIT: Align, Plan, and Organize (APO / 'Plan'); Build, Acquire, and Implement (BAI / 'Build'); Deliver, Service, and Support (DSS / 'Run'); and Monitor, Evaluate, and Assess (MEA / 'Evaluate').

General Control Procedures

Entity-level methods and measures that facilitate the effective operation and management of an organization's overall computer systems and all its applications.

Application Control Procedures

Controls programmed into individual computer applications to ensure the accuracy, completeness, and validity of transactions during the input, processing, and output stages.

Segregation of Programming from Operations

An essential organizational control where programmers have access only to source code and test data, while computer operators have access only to executable object code and live operational data.

Access Control Matrix (Authorization Table)

A general access control table listing user names as row entries and files/programs as column entries to indicate authorized permissions (such as read, add, update, delete, or no access).

Role-Based Security

A security model where security profiles specifying resource access permissions are assigned to organizational positions or roles rather than individual employees.

Private Key Encryption (Symmetric)

An encryption scheme where a single shared key is used for both encoding and decoding data.

Public Key Encryption (Asymmetric)

An encryption scheme that uses a pair of keys: a publicly distributed key for encryption and a private secret key held only by the recipient for decryption.

Grandparent-Parent-Child Backup Convention

A batch processing backup technique maintaining three successive generations of master files (previous input, current input, and current output) to allow reconstruction if files are corrupted or lost.

Cold Site

An alternative backup processing facility that has necessary physical space, software, and documentation, but requires substantial setup and configuration before transaction processing can resume.

Hot Site

An alternative backup processing location fully configured with hardware, software, and data that can immediately take over transaction processing on short notice.

Business Continuity Plan

A comprehensive disaster plan addressing management support, vital applications, backup processing sites, personnel, forms, and procedures necessary to sustain organizational operations.

Field Test

An input control procedure that checks whether data entered into a field matches the designated data type (e.g., Number, Text, or Date/Time).

Range Test

An input validation rule checking whether entered data falls within specified lower and/or upper numerical or chronological boundaries.

Validity Test

An input control check that ensures data entered into a field matches one of a list of predefined, acceptable values.

Valid Combinations Test

A table-level input validation rule that compares values across two or more fields to verify that a logical relationship between them is satisfied (e.g., delivery date occurring on or after order date).

Closed Loop Verification

An on-line input control procedure where entering a key data value causes the system to retrieve and display related descriptive data (e.g., displaying a student name after entering a student number) for confirmation.

Completeness Test

An input control procedure (such as setting the 'Required' field property to 'Yes') that prevents a record from being saved if mandatory fields are left blank.

System Generated Data

An automated control feature in database and on-line systems where the software automatically populates specific fields without human data entry (e.g., system date or AutoNumber).

Entity Integrity

A relational database integrity rule requiring that the primary key attribute must be unique and cannot contain a null value.

Referential Integrity

A relational database integrity rule requiring that every foreign key value entered in a child table must match an existing primary key value in the related parent (master) table.

Sequence Check

A batch processing control procedure that verifies transaction records are in sequential numerical order so that missing transactions can be detected and flagged.

Control Total Verification

A batch processing control comparing summary totals (such as transaction counts or batch dollar amounts) computed after processing against the totals established prior to input.

SOX Title I

Established PCAOB to oversee the audits of public companies and protect the interests of investors, 5 members appointed by SEC, and lays out responsibility, authority, and structure.

SOX Title II

Auditor independence provisions; requires auditors to be free from conflicts of interest and implements stricter rules for auditor-client relationships to enhance the integrity of financial reporting.

SOX Title III

Imposes new responsibilities on all corporate participants in financial reporting process, including executives and Board of Directors, to ensure accuracy and integrity, and establishes penalties for fraudulent financial activity. Management must formally acknowledge its participation.

SOX Title IV

Requires increased disclosures of material off-balance-sheet arrangements and relationships, sets standards for non-GAAP (pro forma) information, mandates companies whose audit committees don’t have an “audit committee financial expert” to disclose that fact.