Accounting Information Systems: Logical & Physical Design, Controls, and Auditing

Comprehensive vocabulary flashcards covering logical and physical database design (EER, REA, DFDs, normalization), internal control frameworks (COSO, COBIT, general and application controls), and computerized information systems auditing.

Logical Database Design

The process of translating a business system description into logical models showing required information, data relationships, business processes, and data flows.

Extended Entity-Relationship (EER) Model

A conceptual data modeling tool that expands on basic ER models by adding cardinality, optionality, and attributes to depict entities and their relationships.

Data-Flow Diagram (DFD)

A process-oriented model that depicts how data moves through a system using processes, data flows, data stores, and external entities.

Cardinality

A property specifying how many instances of one entity can be associated with another entity, commonly categorized as $1:1$, $1:M$, or $M:M$.

Optionality

A relationship characteristic indicating whether participation by an entity is mandatory (symbolized by $|$) or optional (symbolized by $O$).

Context Diagram

The highest-level data-flow diagram that models the entire information system as a single process, omitting data stores and showing external entities and data flows.

Level 0 DFD

A DFD that decomposes the whole system into its major numbered processes (e.g., 1.0, 2.0) and introduces data stores, major inputs, and major outputs.

Level 1 DFD

A DFD that provides detailed subprocesses (e.g., 2.1, 2.2, 2.3) for a single Level 0 process.

REA Modeling

An event-oriented accounting framework used to design databases by identifying the Resources, Events, and Agents involved in business activities.

Economic Events

Business events that directly increase or decrease an organization's resources and typically result in journal entries.

Non-economic Events

Business activities, such as customer feedback or machinery inspections, that do not directly alter resources but can influence future business activities.

Commitment Events

Agreements to execute an economic event in the future, such as sales orders or purchase orders, that establish a future resource exchange without altering resources immediately.

Stock-Flow Relationship

An REA relationship linking events and resources to indicate whether an event causes a resource inflow (increase) or outflow (decrease).

Duality Relationship

An REA relationship linking economic events to represent the reciprocal give-and-take nature of business exchanges (such as a sale paired with a cash collection).

Participation/Control Relationship

An REA relationship linking events with agents, wherein internal agents control or perform the event and external agents participate in it.

Information Process

A process modeled in DFDs that records, maintains, or reports existing data without generating a new business event.

Physical Database Design

The technical phase that converts logical models into physical database components, including relational tables, primary keys, foreign keys, relationships, forms, queries, and reports.

Bridge / Associative Table

A new relational table created to implement a many-to-many ($M:M$) relationship, containing the primary keys of both related tables as a composite primary key.

Database Normalization

The multi-stage process of structuring relational tables to eliminate repeating groups, partial dependencies, and transitive dependencies in order to prevent data anomalies.

Data Anomalies

Database inconsistencies resulting from poor table design, categorized as insert anomalies, update anomalies, and delete anomalies.

Functional Dependency

A formal relationship between attributes where knowing the value of one attribute ($X$) unambiguously determines the value of another attribute ($Y$).

First Normal Form (1NF)

The state of a relational table where every cell holds exactly one single value and repeating groups are eliminated.

Second Normal Form (2NF)

The state of a relational table that meets 1NF criteria and has no partial dependencies, meaning every non-key attribute depends on the full composite primary key.

Third Normal Form (3NF)

The state of a relational table that meets 2NF criteria and contains no transitive dependencies, meaning no non-key attribute determines another non-key attribute.

Partial Dependency

A dependency where a non-key attribute relies on only a portion of a composite primary key rather than the entire key.

Transitive Dependency

A dependency where a non-key attribute determines another non-key attribute, making an attribute indirectly dependent on the primary key.

Controls

Systematic procedures implemented to prevent, detect, or correct unintentional mistakes (errors) and intentional manipulation (irregularities).

Reasonable Assurance

The principle that internal controls provide an acceptable level of protection based on cost-benefit considerations rather than an absolute guarantee against every risk.

Preventive Controls

Procedures designed to stop errors or irregularities before they occur, such as passwords, segregation of duties, and batch totals.

Detective Controls

Procedures designed to discover and flag errors or irregularities after they have taken place, such as audits, limit checks, and suspense files.

Corrective Controls

Procedures designed to remedy problems after detection, such as data backups, uninterruptible power supplies (UPS), and discrepancy reports.

Sarbanes-Oxley Act (SOX) Section 404

A federal statutory section requiring corporate management to document, test, assess, and report on internal controls over financial reporting.

COSO Framework

A widely used internal control framework composed of five interrelated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring.

General Controls

Information system controls that safeguard the overall computing environment and impact multiple computer applications simultaneously.

Application Controls

Specific controls embedded within a single program or processing flow to ensure that transactions are authorized, processed, and recorded reliably.

Public/Asymmetric Key Encryption

A cryptographic method using two distinct mathematical keys: a publicly shared key to encrypt data and a private key to decrypt it.

Hot Site

A fully configured disaster recovery facility that is pre-equipped with hardware, network access, and software, capable of resuming operations quickly.

Cold Site

An alternate disaster recovery facility that provides space and basic infrastructure but requires substantial equipment setup before processing can commence.

Closed-Loop Verification

An input validation control where the system uses an entered key value to look up and display related data so the user can verify data accuracy.

Entity Integrity

A relational database integrity rule mandating that every table must have a primary key that is unique and not null.

Referential Integrity

A database rule mandating that foreign key values must match an existing primary key value in the related master table.

COBIT

An IT governance framework developed by ISACA organized around four domains: Align, Plan, and Organize; Build, Acquire, and Implement; Deliver, Service, and Support; and Monitor, Evaluate, and Assess.

Information Systems Auditing

The formal evaluation of an organization's systems, records, and operations to deliver assurance that financial and operational data are accurate, reliable, and fairly stated.

Audit Trail

A visible or electronic path of documentation tracking transaction history from its initial source document through intermediate files to final financial reports.

Materiality

The auditing threshold where a discovered error or omission is considered significant enough to influence the decisions of a knowledgeable financial statement user.

Audit Risk

The total risk that an auditor will provide an inappropriate audit opinion on misstated statements, consisting of inherent risk, control risk, and detection risk.

Inherent Risk

The baseline susceptibility of an account balance or transaction class to a material misstatement prior to evaluating internal controls.

Control Risk

The likelihood that a client's internal controls will fail to prevent or detect a material misstatement on a timely basis.

Detection Risk

The probability that an auditor's substantive procedures will fail to detect an existing material misstatement.

Auditing Around the Computer

An audit technique that treats computer processing as a black box by reconciling input documents directly to output results without examining internal programming logic.

Auditing Through the Computer

An audit approach where the auditor directly tests and examines automated controls, program logic, and internal processing routines.

Auditing With the Computer

An audit approach where the auditor uses computer software tools to interrogate, recompute, and evaluate client databases and transaction populations.

Test Data

An auditing through-the-computer technique where the auditor submits a batch of dummy transactions containing valid and invalid conditions to evaluate programmed controls offline.

Integrated Test Facility (ITF)

A continuous audit technique that inserts fictitious test transactions and dummy master records into the client's regular processing stream while normal operations run.

Embedded Audit Module (EAM)

Auditor-written program code incorporated directly into a host application to monitor transactions in real time and capture data matching predetermined criteria.

Parallel Simulation

A dual-purpose audit technique where the auditor processes live client transactions through an independent auditor-written program to compare generated results with client output.

Mapping

A computer-auditing procedure that analyzes program execution to identify whether all logical paths and programmed controls were executed during processing.

Generalized Audit Software (GAS)

Specialized software (such as CaseWare IDEA or ACL/Galvanize) enabling auditors to independently extract, query, sort, recalculate, and statistically analyze massive client datasets.

End-User Computing (EUC)

The practice of operational personnel creating standalone, informal applications (such as spreadsheets) that frequently suffer from inadequate testing, controls, and documentation.

Definition of Logical Data Modeling

Shows data item of interest in an information system

Example of Logical Data Modeling

Managers supervise Professionals

Objective of Logical Data Modeling?

To capture information about all entities, and indicate how these are related

E-R Diagrams

Uses rectangles to represent entities (aka classes, tables) and Uses diamonds to represent relationships (associations)

Extended Entity Relationship Model

Expansion of E-R Diagram. It models the data and relationship between entities. (but also includes multiplicities and attributes)

What do Data Flow Diagrams (DFDs) show?

Show how data is processed and modified and can be used at different level of aggregation. How data moves through them.

Data Flow Diagram Notations - How is process depicted?

A circle

Data Flow Diagram Notations - How is data flow depicted?

An arrow

Data Flow Diagram Notations - How is data store depicted?

An open ended box

Data Flow Diagram Notations - How are external entities/agents depicted?

Rectangles

Context Diagram

Depicts information processes at highest level of aggregation (treats the entire system as one process)

Cardinality definition

How many instances of one entity can be related to another (multiplicities)

Optionality definition

Tells you whether participation in a relationship is required or optional (also multiplicities)

What does a Context Diagram show?

Who provides information to the system. What information enters. Who receives the information

Level 0 DFD

breaks the overall systems into its major processes

Level 1 DFD

provides more detail about one Level 0 process

Recording DFD

records information about business events

Maintenance DFD

Maintains information about resources and agents. (add, update, delete)

REA Modeling Process

1. Events → 2. Resources → 3. Agents → 4. Relationships → 5. Cardinality/optionality → 6. Attributes → 7. Information processes → 8. Data repository → 9. Implementation

Identify Significant Events

Step 1. of REA Modeling Process ask What is happening?

Identify Resources

Step 2. of REA Modeling Process ask What is being used or obtained?

Identify Agents

Step 3. of REA Modeling Process ask Who is involved?

Identify Relationships

Step 4. of REA Modeling Process determine how the resources, events, and agents are related

Specify Cardinality and Optionality

Step 5. of REA Modeling Process determine multiplicities

Identify Attributes

Step 6. of REA Modeling Process ask What do we need to know about each entity?

Identify Information Processes

Step 7. of REA Modeling Process create DFDs for recording, maintenance, and reporting

Design the Data Repository

Step 8. of REA Modeling Process determine the tables, PKs, FKs, and relationships

Implement the Design

Step 9. of REA Modeling Process actually build the database

Level 0 DFD

aka recording process

What does a Level 0 DFD show

the major processes in the system, the external entities involved, and the data stores accessed and/or updated

Stockflow

Connects events and resources

Duality

connects economic events (represents the give and take)

Participation

connects events and agents

Business process

Creates new information (customer purchases merchandise)

Information process

Records, updates, or retrieves existing information

Maintenance DFD

One needed for each resource and agent appearing in the data model. Each contains at least one external entity, one process, and one data store. Addresses 3 types of maintenance processes (add, update, delete).

Reporting DFD

Pertains to creation of information using one or more data stores. Each contains at least on external entity, one process, at least one data store, and at least one external entity (agent) receiving the report.

What is the heuristic for car inventory

..* to ..1

What is the requirement to form an association class

Must have a many to many relationship

What does Expanded Entity Relationship model have that ER Diagrams do not?

Multiplicities and attributes