Data Risk Quiz 1 Study Guide

Part 1: Detailed Study Guide

This study guide is designed to help you review and deepen your understanding of the provided source materials on IT controls, processing integrity, and related concepts.

I. Core Concepts of IT Controls and Processing Integrity

Application Controls:
Definition and Objectives: Understand what application controls are, their purpose, and how they contribute to processing integrity. Refer to the GTAG (Global Technology Audit Guide - IIA) definition.
Types of Application Controls:Configurable Controls: Define configurable controls, provide examples (e.g., SAP three-way match configuration), and explain how they are tested (screenshot of setting, walkthroughs, access review).
Non-Configurable Controls: Define non-configurable controls, provide examples (e.g., SAP duplicate journal entry number), and explain how they are tested (negative and positive testing).
Relationship to Processing Integrity: How do these controls ensure data is processed accurately, completely, authorized, and timely?
Processing Integrity (Romney, Steinbart, Summers, Wood):
Data Entry Controls for Validation:Field Check: Proper character type.
Sign Check: Appropriate arithmetic sign.
Limit Check: Numerical amount does not exceed a predetermined value.
Range Check: Numerical amount within upper and lower limits.
Size Check: Input data fits assigned field.
Completeness Check: All required data items entered.
Validity Check: ID code/account number exists in master file.
Reasonableness Test: Logical relationship between two data items.
Check Digit Verification: Detecting errors in ID numbers using a computed digit.
Additional Batch Processing Data Entry Controls:Sequence Check: Batch input data in proper numerical/alphabetical sequence.
Error Log: Recording data input/processing errors for correction and resubmission.
Batch Totals:Financial Total: Sum of dollar values.
Hash Total: Sum of non-financial numeric field.
Record Count: Sum of records in a batch.
Additional Online Data Entry Controls:Automatic Data Entry: System automatically enters transaction data.
Prompting: System requests each input item, ensuring completeness.
Preformatting: System displays document with blank spaces for data entry.
Closed-Loop Verification: Checks accuracy by retrieving related information.
Transaction Log: Detailed record of all transaction data.
Error Messages: Clear indications of errors and correction instructions.
Processing Controls:Data Matching: Two or more data items matched before an action.
File Labels: Header and trailer records to ensure correct and current files.
Recalculation of Batch Totals: Recomputing and comparing to trailer record values; understanding transposition errors.
Cross-Footing and Zero-Balance Test: Calculating totals in multiple ways to verify accuracy (e.g., debits = credits, subsidiary ledger = general control account).
Write-Protection Mechanisms: Protecting data files from accidental overwrite/erasure.
Concurrent Update Controls: Preventing errors when multiple users update the same record simultaneously (locking mechanisms).
Output Controls:User Review of Output: Examining output for reasonableness, completeness, and intended recipient.
Reconciliation Procedures: Reconciling transactions to control reports, file status reports, and general ledger to subsidiary accounts.
External Data Reconciliation: Reconciling database totals with external data (e.g., payroll file with HR records).
Data Transmission Controls:Parity Checking: Adding a parity bit to detect transmission errors (even/odd parity).
Message Acknowledgment Techniques:Echo Check: Sending unit calculates summary statistic, receiving unit performs same and sends back for comparison.
Trailer Record: Sending unit stores control totals, receiving unit verifies.
Numbered Batches: Sequential numbering of segments for reassembly.

II. IT Environment, Governance, and Risk

IT Environment & Infrastructure:
Definition of IT Environment: IT applications, supporting IT infrastructure, IT processes, personnel, IT governance, and strategy.
Definition of IT Infrastructure: Combined components for operation and management of enterprise IT services and environments.
Components of IT Infrastructure: Data/Database, Application, Operating System, Hardware, Network, Data Center. Be able to differentiate between them with examples.
IT Organization Structures:Centralized Approach: Characteristics, advantages, disadvantages.
Distributed Approach (DDP): Characteristics, advantages, disadvantages.
IT Governance:
Definition: Ability for enterprise's IT to sustain and promote the organization's strategies and objectives. Differentiate from IT management.
IT Concerns: Consistency between IT and corporate strategy, delivery of organizational capability and value from IT investment.
Dual Role: Governing outcomes (strategic) and governance assurance (accountability for IT investments).
Five Elements of IT Governance (COBIT): Strategic Alignment, Performance Management, Risk Management, Resource Management, Value Delivery.
SOX Compliance and IT's Role: Sections 302, 404, 409, 802 – understand IT's responsibilities in each.
Data Governance:
Definition: System of decision rights and accountabilities for information-related processes; quality control discipline for managing, using, improving, and protecting organizational information.
Why it's important: Improved data quality, standard processes, better analytics, decision-making, consistency, reduced data risk/costs.
Key Elements (Gartner): Data Strategy, Data Ownership, Data Stewardship, Data Policies & Standards, Data Quality Management, Data Security & Privacy, Data Life Cycle Management, Data Tools, Compliance & Regulatory Requirements.
Data Strategy: Dynamic process supporting data acquisition, organization, analysis, delivery aligned with business objectives.
Data Ownership: Who "owns" the data (data trustee, steward, custodian).
Data Stewardship: Responsibility for data (e.g., data definition, access).
Data Policies & Standards: Accuracy, consistency, completeness, reliability, data dictionaries, formats, naming conventions, record management, compliance standards.
Data Quality Management (DQM): Measuring and enhancing data quality (accuracy, completeness, validity, uniqueness, timeliness, consistency).
Data Security & Privacy: Protection from unauthorized access/use vs. controls over PII access.
Data Life Cycle: Understanding the stages of data.
Common Compliance/Regulatory Requirements: HIPAA, GDPR, SOX, PCI-DSS, CCPA.
Evolution of Data Governance: From hygiene/control to critical business capability.
Responsible AI and AI Governance:
Drivers for AI Governance: Trust, ethical considerations.
Key Practices:Data & AI Ethics: Moral implications, codified values.
Policy & Regulation: Anticipating and aligning with trends.
Governance: Oversight across three lines of defense.
Compliance: Adherence to regulations, policies, standards.
Risk Management: Addressing AI-specific risks.
Quality Practices: Bias & Fairness, Security, Safety, Sustainability, Robustness, Privacy, Interpretability & Explainability, Validation, Standards, Monitoring, Problem Formulation.
IT Risk and Control Frameworks:
Three Widely Used Frameworks: COSO Internal Control, COBIT, AICPA Trust Services Criteria.
COBIT (Control Objectives for Information and Related Technologies):Purpose: Guidebook for IT organization and auditors to align IT with enterprise governance and goals, balancing risk and control investment.
Focus: Enterprise information and technology.
Audience: Management, Auditors.
Governance & Management Objectives: Five elements of IT Governance.
Risk Profile Categories & Factors: Threat landscape, regulatory environment, role of IT, sourcing model, technology adoption, enterprise size.
AICPA Trust Services Criteria (TSC):Alignment: Aligned with COSO framework principles.
Purpose: Framework for evaluating IT risks and reporting on controls, used in attest and advisory engagements (e.g., SOC reports).
Five Key Areas: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Organization: Supplemental criteria for logical/physical access, system operations, change management, risk mitigation, and specific criteria for each of the five areas.

III. Data, Databases, and SQL

Data vs. Metadata: Define and differentiate.
Data Storage:Database: Set of interrelated, structured data stores.
Types: Relational, NoSQL, Hierarchical, Network, Cloud.
Files: Set of logically related records.
Data Warehouse: Large set of structured databases for analysis.
Data Mart: Subset of data warehouse for a specific area.
Data Lake: Collection of structured, semi-structured, and unstructured data.
SQL (Structured Query Language):Definition: Powerful language to manage, query, and interact with relational databases.
Purpose: Retrieve information, manipulate data, define database structures, control access.
SuiteQL: NetSuite's customized query language based on SQL-92.
ERP Systems (NetSuite):Components: Understanding primary and foreign keys in transactional and master file tables.
Metadata in ERP: How it's useful to auditors and consultants/advisors.

IV. Systems Thinking and Control Spectrum

Systems Thinking:Definition: Framework for seeing relationships and patterns to explain how systems function, recognizing interconnected and interdependent nature, shifting from linear to circular causality.
Application: Examples like the cashless stadium project or Cash App's control deficiencies.
Control Spectrum (EY):Types of Controls: Manual, IT-dependent manual, Application controls, IT general controls.
Objectives: Prevent misstatement, detect and correct misstatement, support continued functioning of automated controls.
Manual vs. Automated: Position on the spectrum.

V. Attest vs. Advisory Services

Attestation Engagements:Purpose: Provide users (third-parties) with an opinion, conclusion, or findings on the reliability of subject matter against suitable criteria.
Outcomes: Opinion (examination), conclusion (review), findings (agreed-upon procedures).
Enhances: Credibility.
Examples: SOC Reports, IT tests of controls for financial statement audits.
Advisory Engagements:Purpose: Professional services to improve client's operational efficiency and effectiveness.
Characteristics: Wide range of service types, non-audit clients.
Dual Role of Advisory Service Units: Work with financial audit teams (attest) and provide non-audit advisory services (consulting).

Part 2: Quiz

Instructions: Answer each question in 2-3 sentences.

Distinguish between a configurable and a non-configurable application control. Provide a brief example for each type.
Explain the primary difference between a limit check and a range check in data entry controls. When would you typically use one over the other?
Describe the purpose of a hash total in batch processing data entry controls. How does it differ from a financial total?
What is closed-loop verification in the context of online data entry controls? How does it enhance data accuracy?
Define "IT Governance" and differentiate it from "IT Management." What is the core responsibility of IT Governance?
Identify two key benefits an organization gains from implementing robust Data Governance. Briefly explain how each benefit is achieved.
Briefly explain the concept of "Systems Thinking." Why is it important in understanding how IT controls contribute to processing integrity?
What is the primary objective of a cross-footing balance test? Provide a simple example of where it might be applied.
Describe the role of the AICPA Trust Services Criteria (TSC) in both attest and advisory engagements. What are its five key areas?
Explain how write-protection mechanisms contribute to processing integrity. What specific risk do they mitigate?

Part 3: Quiz Answer Key

Distinguish between a configurable and a non-configurable application control. Provide a brief example for each type.
Configurable controls allow for variation in their behaviour through user-setups, like an SAP setting preventing invoice payment without a three-way match. Non-configurable controls are hard-coded without variable settings, such as an SAP system rejecting duplicate journal entry numbers.
Explain the primary difference between a limit check and a range check in data entry controls. When would you typically use one over the other?
A limit check tests if a numerical amount does not exceed a single predetermined maximum value, useful for ensuring, for example, an order quantity doesn't exceed inventory. A range check, however, has both upper and lower predetermined limits, making it suitable for fields like age or temperature, where values must fall within a specific acceptable range.
Describe the purpose of a hash total in batch processing data entry controls. How does it differ from a financial total?
A hash total sums a non-financial numeric field, such as the total of all quantity ordered fields in a batch, to ensure all records have been processed. It differs from a financial total, which sums dollar values, as a hash total has no intrinsic meaning but serves purely as an error detection mechanism.
What is closed-loop verification in the context of online data entry controls? How does it enhance data accuracy?
Closed-loop verification checks input data accuracy by using it to retrieve and display related information for the user to confirm. For example, entering a customer ID might display the customer's name, allowing the user to visually verify the correct customer is selected and enhancing accuracy.
Define "IT Governance" and differentiate it from "IT Management." What is the core responsibility of IT Governance?
IT Governance is the ability for the enterprise's IT to sustain and promote the organization's strategies and objectives. It sets the strategic direction and ensures alignment, while IT Management focuses on the operational execution of IT services and projects. Its core responsibility is to ensure IT investments and services contribute accountably to improved organizational performance.
Identify two key benefits an organization gains from implementing robust Data Governance. Briefly explain how each benefit is achieved.
One key benefit is improved data quality, achieved by establishing standards for accuracy, consistency, and completeness, which leads to more reliable information. Another benefit is better decision-making, as access to high-quality, consistent data allows management to make more informed and effective strategic choices.
Briefly explain the concept of "Systems Thinking." Why is it important in understanding how IT controls contribute to processing integrity?
Systems thinking is a framework for understanding how interconnected and interdependent parts of a system function, shifting from linear to circular causality. It's crucial for processing integrity because it helps recognize how a change in one IT control or process can have ripple effects across the entire system, impacting the overall accuracy and reliability of data.
What is the primary objective of a cross-footing balance test? Provide a simple example of where it might be applied.
The primary objective of a cross-footing balance test is to verify the accuracy of totals by comparing results produced by calculating them in multiple ways. For instance, in a general ledger, the sum of all debit column totals should equal the sum of all credit column totals, providing an internal check on the processing integrity of transactions.
Describe the role of the AICPA Trust Services Criteria (TSC) in both attest and advisory engagements. What are its five key areas?
The AICPA Trust Services Criteria (TSC) serve as a framework for evaluating IT risks and reporting on controls in both attest engagements (like SOC reports) and advisory services. Its five key areas are Security, Availability, Processing Integrity, Confidentiality, and Privacy, providing a comprehensive standard for assessing system reliability.
Explain how write-protection mechanisms contribute to processing integrity. What specific risk do they mitigate?
Write-protection mechanisms contribute to processing integrity by preventing the accidental writing over or erasing of data files stored on magnetic media. They mitigate the specific risk of data loss or corruption due to inadvertent user actions or system errors, ensuring the continued accuracy and availability of information.

Part 4: Essay Format Questions (No Answers)

Imagine you are the general manager of Mercedes-Benz Stadium transitioning to a completely cashless transaction model. Using the concepts of application controls (data entry, processing, output), systems thinking, and data governance, analyze the potential risks to processing integrity you would be most concerned about and propose a set of controls to mitigate these risks.
The Cash App settlement for "failure to maintain sufficient controls to protect against money laundering and/or other illegal activities" highlights the importance of robust IT controls. Discuss how different types of application controls (configurable vs. non-configurable), online data entry controls, and the principles of IT governance and responsible AI could be leveraged to prevent such failures and ensure compliance with regulatory requirements.
Compare and contrast the roles of Data Governance and IT Governance within an organization. Explain how the "Five Elements of IT Governance" (Strategic Alignment, Performance Management, Risk Management, Resource Management, Value Delivery) are supported by specific "Key Elements of Data Governance" (e.g., Data Strategy, Data Quality Management, Data Security & Privacy). Provide examples of their interdependencies.
Discuss the significance of the AICPA Trust Services Criteria (TSC) in both attest and advisory engagements. Choose two of the five key areas (Security, Availability, Processing Integrity, Confidentiality, Privacy) and explain how specific application controls and processing controls contribute to achieving the objectives outlined within those chosen criteria.
Explain the Control Spectrum, detailing the differences between manual controls, IT-dependent manual controls, application controls, and IT general controls. Discuss how the objectives of each control type contribute to the overall processing integrity of an accounting information system and provide examples of how testing these controls might differ based on their nature.

Part 5: Glossary of Key Terms

Application Controls: Controls that apply to specific applications or systems, ensuring the integrity of data within them (e.g., data entry, processing, and output controls).
Attestation Engagement: A professional service where a practitioner provides an opinion, conclusion, or findings regarding the reliability of subject matter or an assertion about it, enhancing its credibility for users.
Advisory Engagement: Professional services offered by public accounting firms to improve a client’s operational efficiency and effectiveness, often involving IT risk management or consulting.
Availability (Trust Services Criteria): Refers to the accessibility of the system and information for operation and use as committed or agreed.
Batch Totals: Totals calculated for a batch of input transactions, used to verify the completeness and accuracy of data processing. Includes financial totals, hash totals, and record counts.
Check Digit Verification: A data entry control where an extra digit (check digit) is computed from the other digits in an identification number and appended to it, used to detect data entry errors.
Closed-Loop Verification: An online data entry control that checks the accuracy of input data by using it to retrieve and display other related information for user confirmation.
COBIT (Control Objectives for Information and Related Technologies): An IT governance framework that provides a comprehensive set of guidelines for IT management and auditing, focusing on aligning IT with business goals.
Confidentiality (Trust Services Criteria): Pertains to the protection of information designated as confidential from unauthorized access and disclosure.
Configurable Control: An application control whose programming permits variation in its behaviour, often set up by users of the IT application (e.g., settings for a three-way match).
Concurrent Update Controls: Mechanisms that protect records from errors that occur when two or more users attempt to update the same record simultaneously, often by locking out one user.
Control Spectrum: A classification of controls ranging from purely manual to fully automated, including manual controls, IT-dependent manual controls, application controls, and IT general controls.
Cross-Footing Balance Test: A processing control that compares totals calculated in multiple ways (e.g., summing rows vs. summing columns) to verify accuracy.
Data Center: A departmental room, facility, or campus that houses and maintains back-end IT systems and data stores.
Data Governance: A system of decision rights and accountabilities for information-related processes, serving as a quality control discipline for managing, using, improving, and protecting organizational information.
Data Lake: A collection of structured, semi-structured, and unstructured data stored in a single location.
Data Mart: A subset of a data warehouse focused on a particular line of business, department, or subject area.
Data Matching: A processing control where two or more items of data must be matched before an action can take place, ensuring consistency.
Data Quality Management (DQM): Practices or actions to define, measure, understand, prevent, address, and enhance data quality to support effective use and decision making.
Data Warehouse: A large set of structured databases containing detailed and summarized data, typically used to facilitate data analysis.
Echo Check: A data transmission control where the receiving unit performs a calculation on the received message and sends the result back to the sending unit for comparison to verify accuracy.
Enterprise Resource Planning (ERP) System: Integrated software applications used to manage internal and external resources, including financials, human resources, manufacturing, and supply chain.
File Labels (Header/Trailer Records): Internal labels at the beginning (header) and end (trailer) of a file that contain identification data and control totals, used to ensure the correct and most current files are being updated.
Financial Total: A batch total that sums a field containing dollar values (e.g., total dollar amount of all sales).
Hash Total: A batch total that sums a non-financial numeric field (e.g., total of quantity ordered), used for error detection rather than financial value.
IT General Controls (ITGCs): Controls that apply to the overall IT environment, supporting the continued functioning of automated aspects of preventive, detective, and corrective controls.
IT Governance: The ability for an enterprise's IT to sustain and promote the organization's strategies and objectives, including strategic alignment, risk management, and value delivery.
IT Infrastructure: The combined components needed for the operation and management of enterprise IT services and IT environments (e.g., hardware, software, networks).
Limit Check: A data entry control that tests a numerical amount to ensure it does not exceed a predetermined maximum value.
Metadata: Data that provides information about other data (e.g., data type, source, creation date).
Non-Configurable Control: An application control programmed within an application that does not involve tolerances or other variable configurations and cannot be changed by users (e.g., rejection of duplicate journal entry numbers).
Operating System (OS): Software that manages computer hardware and software resources, controlling the flow of information and providing user interfaces.
Parity Checking: A data transmission control where an extra digit (parity bit) is added to every character to detect errors in data transmission.
Privacy (Trust Services Criteria): Pertains to the collection, use, retention, and disclosure of personal information in conformity with the entity’s commitments and criteria set forth in its privacy policy.
Processing Integrity (Trust Services Criteria): Refers to whether system processing is complete, accurate, timely, and authorized.
Prompting: An online data entry control in which the system requests each input data item and waits for an acceptable response, ensuring all necessary data are entered.
Range Check: A data entry control similar to a limit check but with both upper and lower predetermined limits for a numerical amount.
Reasonableness Test: A data entry control that determines the correctness of the logical relationship between two data items.
Record Count: A batch total that sums the number of records in a batch.
Responsible AI: Practices and principles for designing, developing, and deploying AI systems in an ethical, fair, secure, and transparent manner.
Security (Trust Services Criteria): Pertains to the protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
Sequence Check: A batch processing data entry control that tests if a batch of input data is in the proper numerical or alphabetical sequence.
Sign Check: A data entry control that determines if the data in a field has the appropriate arithmetic sign (positive or negative).
SQL (Structured Query Language): A powerful and widely used programming language designed to manage, query, and interact with relational databases.
SuiteQL: NetSuite's customized query language based on the SQL-92 standard, used for database management within NetSuite.
Systems Thinking: A framework for seeing relationships and patterns to explain how systems function, recognizing their interconnected and interdependent nature.
Three Lines of Defense: A model of risk management and governance, typically comprising product/process teams (1st line), risk/compliance functions (2nd line), and internal audit (3rd line).
Transaction Log: A detailed record of all transaction data, including identifiers, dates, times, and operator information, for online data entry controls.
Trust Services Criteria (TSC): A framework from the AICPA used to evaluate IT risks and report on controls, covering Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Validity Check: A data entry control that compares an ID code or account number in transaction data with similar data in the master file to verify that the account exists.
Write-Protection Mechanisms: Controls that protect against the accidental writing over or erasing of data files stored on magnetic media, contributing to processing integrity.
Zero-Balance Test: A processing control that applies cross-footing logic to control accounts, ensuring that the difference between related accounts (e.g., general ledger and subsidiary ledger totals) is zero.