AIS Chapter 6

any potential adverse occurrence or unwanted event that could be injurious to either the AIS or the organization

the potential dollar loss should a particular threat become a reality

the probability that the threat will happen

the process implemented by the board of directors, management, and those under their direction to provide reasonable assurance that the control objectives are achieved

Controls that deter problems before they arise

Controls that discover problems as soon as they arise

controls that remedy control problems that have been discovered

controls that are designed to make sure an organization's control environment is stable and well managed

controls that prevent, detect, and correct transaction errors and fraud

1977 act, with the primary purpose of preventing the bribery of foreign officials in order to obtain business. A significant effect of the act was to require corporations to maintain good systems of internal accounting control.

2002 act intended to prevent financial statement fraud, make financial reports more transparent, provide protection to investors, strengthen the internal controls at public companies, and punish executives who perpetrate fraud

A five-member board that controls the auditing profession

a lever of control that communicates company core values to employees and inspires them to live by them

a lever of control that helps employees act ethically by setting limits beyond which an employee must not pass

a control lever that ensures efficient and effective achievement of important goals by measuring company progress by comparing actual performance to planned performance

a control lever that helps top-level managers with high-level activities that demand frequent and regular attention, such as developing company strategy, setting company objectives, understanding & assessing threats and risks, etc.

a framework of generally applicable information systems security and control practices for IT control from the vantage points of business objectives, IT resources, and IT processes

a private-sector group consisting of the American Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the Financial Executives Institute

framework which defines internal controls and provides guidance for evaluating and enhancing internal contorl systems

A framework which expands on the elements of the internal control integrated framework and provides an all-encompassing focus on the broader subject of enterprise risk management

high level goals that are aligned with and support the company's mission

deal with the effectiveness and efficiency of company operations

help ensure the accuracy, completeness, and reliability of internal and external company reports of both a financial and nonfinancial nature

help the company comply with all applicable laws and regulations

the tone or culture of a company, which helps determine how risk conscious employees are

the amount of risk a company is willing to accept in order to achieve its goals and objectives, in alignment with company strategy

board composed entirely of outside, independent directs, which is responsible for overseeing the corporation's internal contro lstructure, its financial reporting process, and its compliance with related laws, regulations, and standards.

explains proper business practices, describes the knowledge and experience needed by key personnel, spells out management policy for handling specific transactions, and documents the systems and procedures employed to process those transactions

verification of educational and work experience, talking to references, checking for a criminal record, and checking credit records

an incident or occurrence emanating from internal or external sources that affects implementation of strategy or achievement of objectives; may have positive or negative impacts or both; represent uncertainty

the risk that exists before management takes any steps to control the likelihood or impact of a risk

the risk that remains after management implements internal controls, or some other response to risk

• the mathematical product of impact and likelihood
• Impact  Likelihood

the policies, procedures, and rules that provide reasonable assurance that management's control objectives are met and the risk responses are carried out

approving transactions and decisions; empowerment of employees

a means of signing a document with a piece of data that cannot be forged

when an employee must get special approval before handling a transaction

when management can authorize employees to handle routine transactions without special approval

separation of the authorization, recording, and custody functions

when two or more people cooperate to thwart internal controls

separation of systems administration, network management, security management, change management, users, systems analysis, programming, computer operations, information system library, and data control

those responsible for ensuring that the different parts of an information system operate smoothly and efficiently

one that ensures all applicable devices are linked to the organization's internal and external networks and that the networks operate continuously and properly

ensures that all aspects of the system are secure and protected from all internal and external threats

helps users determine their information needs and then designs an information system to fit those needs

takes the design provided by systems analysts and creates an information system by writing the computer programs

runs the software on the company's computers, ensuring that data are input properly and correcly processed and the needed output is produced

a separate storge area that maintains custody of corporate databases, files, and programs

ensures that source data have been properly approved, monitors the flow of work through the computer, reconciles  input and output, maintains a record of input errors to ensure their correction and resubmission, and distributes systems output

a multiyear plan that aligns an organization's information system with its business strategies by showing the projects that must be completed to achieve long-term company goals and addresses the company's hardware, software, personnel, and infrastructure requirements

shows how a project will be completed, including the modules or tasks to be performed and who will perform them, the dates they should be completed, and project costs

a significant point when progress is reviewd and actual & estimated completion times are compared

a project development control that requires evaluating each module or task as it is completed

organizes all data processing tasks to maximize use of scarce computer resources

committee formed to guide and oversee systems development and acquisition

measurements used to evaluate and assess a system; common measurements include throughput, utilization, and response time

output per unit of time

percentage of time the system is being productively used

how long it takes the system to respond

review made after a new system has been operating for a brief period; its purpose is to ensure that the new system is meeting its planned objectives, to identify the adequacy of system standards, and to review system controls

a vendor who uses common standards and manages a cooperative systems development effort involving its own development personnel and those of the client and other vendors

the process of making sure changes do not negatively affect systems reliability, security, confidentiality, integrity, and availability

an examination of the relationships between different sets of data

exists when individual company transactions can be traced through the system from where they originate to where they end up on the financial statements, and vice versa

officer in charge of AIS security and should be independent of the information system function & report to the COO or the CEO

in charge of all compliance issues

specialize in fraud detection and investigation

specialists who discover, extract, safeguard, and document computer evidence such that its authenticity, accuracy, and integrity will not succumb to legal challenges

programs that mimic the brain and have learning capabilities

anonymous whistle-blower tip line