Acc 3510 Exam 2

UVU, Helquist

COSO operations

what they do day in and day out

COSO control environment

how serioues mgmt is about internal control

Risk response options

1. reduce risks

   1. internal controls

2. share risk

   1. insurance, outsource, hedge

3. avoid risks

   1. do not engage

4. accept risks

   1. do nothing

There will always be residual risk

Cost and implementation

internal benefits > costs = implement

ABC

Authorization

Bookkeeping/records

Custody of assets

should be different people

Accurate info

record correctly

timeliness

no delays

accessibility

available to right people at the right time

effective communication

report issues and then act

COSO monitoring activities

monitor what have been put into place, seperate evaluations, surprise

COSO Cube framework

obectives on top (the why)

components on front (the how)

orginzational level on side (the where)

COSO Operations

effectiveness and effciency of operations

COSO reporting

reliability of reporting to external parties

COSO compliance

adherence to laws and regulations

COSO hows

• control environment

  • management and board environment, want good employees staying

• risk assessment

  • process of identifying risks

• AIS and communication

  • identify and record transactions

• Control Activities

  • ensure policies are followed

  • ABC segregation

  • physical controls

• Monitoring

  • internal controls monitored

Controls

• Preventive

  • deter/prevent

• Detective

  • find error/fraud after it happened

• Corrective

  • correct/mitigate after detection

Physical control

People doing it

• proper authorization

• segregation of duties (ABC)

• independent checks

• safegaurd asset

Computer based control (IT control)

General controls - affects most, generic, broad use

• backups, firewalls

• access controls (passwords)

Application controls

• more direct and specific

• netsuite approvals

• validity checks

  • input controls (range, size, field checks etc)

Field checks

entry is right type (number, date, currency, etc)

Validity checks

acceptable values

dropdown, calendar

limit checks

entries are less than the upper bound

reasonable test

size checks

right # of characters (enough # for zip code)

completeness checks

required fields

reasonable check

same as range, does it make sense

compare the field against others

range check

between upper and lower

check digit verification

• Add 1st three digits of # together, then the 4th digit is the answer

  • 3216

    • 3+2+1=6

  • 3316

    • 3+3+1 not 6, transposed issue

    • 
      

“A check digit is a form of redundancy check used for error detection on identification numbers, such as bank account numbers, to help identify input errors. It is calculated from the other digits in the sequence and can catch simple mistakes like a single mistyped digi”

Processing controls

• pre-numbered docs

• sequence checks

• batch totals

• cross footing balance

  • concurrent update

GIGO

garabage in, garabage out

limitations of internal controls

• errors arise from misunderstanding of instructions, mistake of judgment, fatigue

• controls depend on segregation of duties, collusion can bypass

• mmgt can override internal controls

• compliance fall apart over time

  • manual controls

What two duties need to be seperated

bookkeeping and custody of assets

CIA

Confidentiality

• not availble to all people

• need to know basis

Integrity

• accuracte and complete

• free from unauthorized changes

Availbility

• accessible on demand

Virus

• self replicating program, spreads by modifying other programs/files

• bad piece of software that attaches to docs and when opened spread

NEEDS HUMAN INTERACTION

Worm

• like virus

NO HUMAN INTERACTION

Trojan horse

• not self replicating

• looks like it is useful, but not

• think downloaded good, but its bad

Spam

• unsolicited bulk info

• uses trojan horses to send out

Botnet (Bot)

• computer that has been taken over

• group of computers is called botnet

Denial of service

• prevent real users from getting to website

• uses botnet to overwhelm website

Spyware

secretly install spyware to gather info

Ransomware

malicious code, encrypt info, if want info back need to pay up

Spoofing

network pacjets appears to come from other source

gets through firewalls

Social engineering

• manipulate others to take action they wouldn’t normally

• use people to gain acces to data

  • impersonation, blackmail, etc…

Encryption

• takes readable data (plain text) and turns into unreadable (cipher text)

  • reversable, but only those with right key

hashing/ message digests

like encryption but only 1 way. IMPOSSIBLE TO REVERSE

fingerprint for data

easy to see if any differences

number output is the message digest/hash

fraud triangle

motivation

oppurtunity

rationalization

Uninterreuptible power supply (UPS)

device using battery power to enable system operate long enough to back up data and shut down right, then switches to generates

fault tolerance

use redundants/backups to be able to continue if some fail

is something bad happens, wants to keep running

Business continuty management (BCM)

activites required to keep running during interruption

Disater recovery planning (DRP)

documentation, able to start over if needed

Risk appetite

control environment

sql relational operators

sql aggregate functions

sql inner join

SELECT

FROM

INNER JOIN ON

WHERE

GROUP BY