Chapter 3- Acc 3300

What is the primary aim of internal control?

To mitigate identified risks to the company's financial information.

What are the three functions of internal controls?

Preventing, detecting, and correcting risks.

What type of controls are proactive and prevent problems from occurring?

Preventive controls.

What is an example of a preventive control?

Segregation of duties.

What are detective controls designed to do?

Alert management to issues once they have occurred.

What is the role of corrective controls?

To change undesirable outcomes after a risk has materialized.

What does management override refer to?

When internal control activities fail because management does not follow policies or procedures.

How does the time-based model of controls measure effectiveness?

By comparing the relationship of preventive, detective, and corrective control functions.

What are the three locations for controls?

Physical controls, IT general controls (ITGCs), and IT application controls.

What are entity-level controls?

Controls that oversee and influence the effectiveness of internal controls across the entire organization.

What are IT general controls (ITGCs)?

Controls that apply to the entire operation of the full system and its environment.

What distinguishes IT application controls?

They apply only to specific applications and the business processes linked to them.

What are the two methods of implementing a control?

Manual and automated.

Why are manual controls still significant?

They are used when human judgment or physical interaction is required.

What is an example of an automated control?

Using drones to scan inventory and directly import data into the system.

What is continuous monitoring in the context of internal controls?

A process that uses data analytics to monitor business data for risks.

What is the importance of frameworks in an internal control environment?

They provide structure and guidance for implementing effective controls.

What is the significance of segregation of duties?

It reduces the risk of error and fraud by ensuring different employees handle different parts of business activities.

What is the purpose of exception report reviews?

To identify problems and provide evidence of errors or irregularities.

What does the acronym AIS stand for?

Accounting Information Systems.

What is the relationship between preventive and detective controls?

Preventive controls aim to stop issues before they occur, while detective controls identify issues after they happen.

What are the characteristics that define a control?

Its function, location, and implementation method.

What is the role of internal auditors in continuous monitoring?

They use technology to create detective controls that monitor data for risks.

What is the risk associated with management override?

It can lead to the failure of internal controls.

How can collusion among employees affect internal controls?

It can circumvent controls and lead to increased risk of fraud.

What is the main goal of risk management in internal controls?

To ensure the reliability, completeness, and validity of financial information.

What do IT General Controls (ITGCs) apply to?

The entire operation of the full system and its environment.

What is an IT Application Control?

A control that applies only to a specific application, including all linked business processes and accounts.

What is a manual control?

A control that requires human judgment or physical interaction.

What is an automated control?

A control that uses technology to implement control activities.

What is continuous monitoring in internal controls?

A process using technology to create detective controls that monitor data for risks.

What are the three lines of defense in internal controls?

First line: Business operations, Second line: Risk Management and Compliance, Third line: Internal Audit.

What is the role of management in the first and second lines of defense?

Management controls business processes and mitigates risk through preventive, detective, and corrective actions.

What does a maturity model show?

How far along a company is on its journey to reach the ideal state compared to best practices.

What characterizes Phase 1 of a maturity model?

Limited: Business processes are poorly defined.

What characterizes Phase 2 of a maturity model?

Informal: Some processes are defined, but inconsistencies and reliance on key individuals exist.

What characterizes Phase 3 of a maturity model?

Defined: Policies and procedures are formally documented.

What characterizes Phase 4 of a maturity model?

Optimized: Considered the gold standard in business process maturity.

What is the role of Internal Audit?

To provide assurance, insight, and objectivity while remaining independent of the functions they audit.

What is the purpose of the Sarbanes-Oxley Act of 2002 (SOX)?

To protect investors from fraud by improving the reliability and accuracy of financial statements.

Who is required to comply with SOX?

Publicly traded companies in the U.S., their subsidiaries, foreign companies publicly traded in the U.S., and private companies planning IPOs.

What is the COSO Framework?

A framework used for SOX compliance that provides guidance on internal controls.

What are the key parts of the COSO Framework?

Control objectives and control components.

What are the three areas of focus for control objectives in the COSO Framework?

Operations objectives, Reporting objectives, Compliance objectives.

What are the five key steps to implementing effective internal controls?

Control components and their related principles.

What does the COSO Cube represent?

How all parts of the Internal Control - Integrated Framework are related.

What is the ERM Framework?

Enterprise Risk Management Framework that highlights the importance of risk in creating strategies and driving performance.

What is the significance of frameworks in internal control environments?

They provide a set of specifications and criteria to achieve objectives and act as a roadmap for businesses.