Auditing Mid Term Flashcards

IT Governance, Risk Management and Compliance (IT GRC)

to align technology decisions with business goals while keeping data safe and meeting legal rules

Governance

overall framework of leadership, organization structures, policies, processes, and decisions that ensures information technology supports and aligns with an organization’s goals and strategy, delivers value, and uses resources responsibly.

Risk Management

the process of identifying, assessing, prioritizing, and mitigating risks related to information technology that could threaten the organization’s operations, data, or objectives.

Compliance

the process of ensuring that an organization’s IT systems, processes, and practices adhere to laws, regulations, standards, and internal policies.

A joint effort of the IT and the Business is to __

Perform GRCs

Information Systems General Controls (ITGC)

management procedures and policies (controls) implemented to safeguard the information system assets.

Manage Access Process

An ITGC process that deals with physical access to data center and facilities and logical access to controls over applications, data & supporting infrastructure.

Manage Change Process

An ITGC process that deals with program change management controls and system development life cycle (i.e., acquisition, change, and maintenance) controls

Manage Operations Process

An ITGC process that deals with computer operation and maintenance controls, such as incident & patch management controls and backup and recovery controls

Segregation of Duties

an internal control principle that divides critical tasks and system privileges among multiple people so no single individual controls a process from start to finish

Sarbanes Oxley Act (SOX)

is a 2002 U.S. federal law enacted to protect investors from corporate fraud by improving financial reporting accuracy and accountability. [1, 2]

SOX Section 404

A) requires all public companies to be responsible for assessing the effectiveness of the company’s Internal Control over Financial Reporting (ICFR) and B) required for large companies requires an external auditor to attest to/ report on management’s assessment of internal controls.

System and Organization Controls (SOC)

a suite of voluntary audit reports created by the American Institute of Certified Public Accountants (AICPA) to evaluate a service organization's internal controls.

SOC 1

Controls relevant to financial reporting typically for Financial/accounting auditors, clients, and management

SOC 2

Controls related to security, availability, processing integrity, confidentiality, and privacy typically for Financial/accounting auditors, clients, management, and security/compliance regulators

SOC 3

Similar subject matter to SOC 2, but designed for general/public distribution typically for the general public

Data Normalization

A systematic approach to decompose data tables tominimize redundant data (decrease data repetitiveness at multiple places in the same database)

Insertion Anomalies

the addition of new data to the database is hindered because specific dependencies between data elements exist.

Update Anomalies

occur when the same piece of data is stored in multiple locations, and data changes aren't reflected uniformly across all instances.

Deletion anomalies

unintentionally lose other valuable information while removing certain data. This typically happens when multiple pieces of information are stored together and the deletion of one affects the others.

1NF

• All rows must be unique (no duplicate rows).

• One atomic value each cell.

• Each attribute (column) has a unique name and

stores the same type of values

• Create a primary key (can be a composite key) to

uniquely identify each row

2NF

• No partial dependency – all non-prime attributes are

fully functionally dependent on the primary key, or

depend on the composite key (combined key).

3NF

• No transitive dependency - all non-prime attributes

cannot be determined by other attributes, must only

be determined by the primary/composite key,