Question 1

____ sets the tone of the organization, influencing the control consciousness of its people.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

The control environment sets the tone for the entire organization and influences the control consciousness of its people. It includes factors such as the integrity, ethical values, and competence of the organization's people, and the leadership's commitment to ethical values and integrity. The control environment sets the foundation for effective control activities, risk assessment, and monitoring.

Question 2

____ is a process that evaluates the quality of internal control performance over time.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

Monitoring is the process of evaluating the quality of internal control performance over time. It involves the ongoing review and assessment of internal control processes and procedures to ensure that they remain effective and efficient in mitigating risks and achieving organizational objectives. It is an essential component of any effective internal control system and helps to ensure that the system can adapt to changing risks and circumstances over time.

Question 3

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association (ISACA) because of the influence of IT over information systems, financial reporting and auditing.
A) COBIT
B) COSO
C) ERM
D) All of the above.

Accepted Answer

The framework referred to in the question is COBIT (Control Objectives for Information and Related Technology) which was issued by ISACA in 1996 and updated in 2007. COSO (Committee of Sponsoring Organizations of the Treadway Commission) and ERM (Enterprise Risk Management) are related frameworks, but they do not specifically address the influence of IT over information systems, financial reporting, and auditing like COBIT does.

Question 4

A computer abuse technique called a ____ involves inserting unauthorized code in a program, which, when activated, may cause a disaster, such as shutting the system down or destroying files.
A) salami slicing
B) back door
C) logic bomb
D) Trojan horse

Accepted Answer

The definition provided is that of a logic bomb, which involves the insertion of unauthorized code that is activated to cause harm to a system. Salami slicing refers to the act of stealing small amounts of resources from multiple accounts, while a backdoor is a hidden entry point into a system used for unauthorized access. A Trojan horse is a type of malicious code that disguises itself as a harmless program to deceive users into downloading and installing it.

Question 5

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by:
A) Audits
B) internal controls
C) Managers
D) Tips

Accepted Answer

The report states that tips are by far the most common way frauds are detected, accounting for 43.3% of all cases. The next most common detection method is management review, which accounts for just 15% of cases. Audits and internal controls are also important components in detecting and preventing fraud, but they lag behind tips and management review as detection methods.

Question 6

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:
A) Title V - Analysts Conflicts of Interests
B) Title VIII - Corporate and Criminal Fraud Accountability
C) Title IX - White-Collar Crime Penalty Enhancements
D) Title XI - Corporate Fraud and Accountability

Accepted Answer

Title VIII - Corporate and Criminal Fraud Accountability, specifically Section 802, establishes the criminal offense of knowingly destroying, altering or creating records with the intent to impede, obstruct or influence an ongoing or contemplated federal investigation or other legal proceeding. It also provides protections for whistleblowers who report such illegal activities.

Question 7

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

Control activities are the policies and procedures implemented by an organization to help ensure that risk responses are effectively carried out. This includes things like segregation of duties, proper authorization processes, and regular monitoring and testing of controls. The control environment and risk assessment are also important components of an effective risk management framework, but they are not focused specifically on ensuring that risk responses are carried out. Monitoring is the process of reviewing and evaluating the effectiveness of an organization's risk management activities, and is not a policy or procedure in itself.

Question 8

The information process control goal which relates to preventing fictitious events from being recorded is termed:
A) ensure input validity
B) ensure input accuracy
C) ensure input completeness
D) ensure effectiveness of operations

Accepted Answer

Ensuring input validity is the goal that focuses on preventing fictitious events from being recorded in the information process control. This goal ensures that the data entered into the system is authentic and accurate. It verifies that the data entered conforms to the specifications of the system and is acceptable for processing. This helps to prevent errors from being introduced into the system and improves the overall quality of the information.

Question 9

As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped. Which control goal is being violated?
A) ensure effectiveness of operations
B) ensure efficient employment of resources
C) ensure security of resources
D) ensure input accuracy

Accepted Answer

An abnormally high amount of raw material scrapped indicates inefficient employment of resources. The production process is wasting resources by using a flawed design that generates excess waste, violating the control goal of ensuring efficient employment of resources.

Question 10

Which of the following is not a requirement of SOX Section 404?
A) Evaluate the design of the company's controls to determine if they adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner.
B) Gather and evaluate evidence about the operation of controls.
C) Implement key controls to determine their operating efficiency.
D) Present a written assessment of the effectiveness of internal control over financial reporting.

Accepted Answer

Implementing key controls is not a direct requirement under SOX Section 404. The other three choices are all requirements of this section.

Question 11

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n):
A) audit
B) embezzlement
C) fraud
D) Theft

Accepted Answer

Fraud involves intentionally deceiving or misrepresenting information to gain something of value, such as money or power. Embezzlement and theft are specific types of fraud that involve the taking of someone else's property, money, or assets without their consent. An audit is an official examination of an organization or individual's financial records.

Question 12

A computer abuse technique called a ____ involves a virus that replicates itself on disks, in memory, or across networks.
A) worm
B) back door
C) logic bomb
D) Trojan horse

Accepted Answer

The technique described in the question involves a virus that is able to self-replicate on various forms of media. This is characteristic of a worm, making it the best choice among the options given. A backdoor is a method of bypassing security controls to gain unauthorized access to a system, a logic bomb is a type of malware that is triggered under specific conditions, and a Trojan horse masquerades as a legitimate program but contains hidden malicious functionality. None of these options directly relate to the self-replication behavior described in the question.

Question 13

A control goal that is a measure of success in meeting a set of established goals is called:
A) effectiveness
B) monitoring
C) efficiency
D) risk

Accepted Answer

Effectiveness is a measure of success in meeting established goals, indicating that the goals have been achieved. Monitoring refers to the process of observing and measuring performance, but it is not a measure of success in meeting goals. Efficiency refers to doing things in a cost-effective manner, which does not necessarily indicate whether goals have been achieved. Risk is related to the potential for negative outcomes or harm, but it is not a measure of success in meeting goals.

Question 14

Establishing a viable internal control system is primarily the responsibility of:
A) the external auditors
B) management
C) programmers
D) government authorities

Accepted Answer

The primary responsibility for establishing and maintaining a viable internal control system rests with management. While external auditors may provide recommendations and review the effectiveness of the system, it is ultimately the responsibility of management to ensure that internal controls are in place and operating effectively. Programmers and government authorities may play a role in implementing or enforcing certain aspects of internal controls, but they are not primarily responsible for establishing the system as a whole.

Question 15

A business event which is not properly authorized violates the control goal of:
A) input validity
B) input completeness
C) input accuracy
D) update validity

Accepted Answer

Input validity refers to ensuring that all input data or transactions are authorized and intended, thus an unauthorized business event directly violates this control goal.

Question 16

A(n) ____ is a computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts, usually by rounding to the nearest cent in financial transactions.
A) worm
B) salami slicing
C) logic bomb
D) Trojan horse

Accepted Answer

Salami slicing is a type of computer abuse technique in which small amounts are systematically stolen by rounding to the nearest cent in financial transactions. Worms, logic bombs, and Trojan horses are all different types of computer malware aimed at causing harm to computer systems or data.

Question 17

The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the document's integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is:
A) Title V- Analysts Conflicts of Interests
B) Title VIII - Corporate and Criminal Fraud Accountability
C) Title IX - White-Collar Crime Penalty Enhancements
D) Title XI - Corporate Fraud and Accountability

Accepted Answer

The answer of The section of Sarbanes Oxley that provides...

Question 18

Regarding internal control systems:
A) ultimate ownership of the system should rest with the board of directors.
B) a properly implemented system can be expected to provide 100 percent assurance that the organization will meet its objectives.
C) both a. and b.
D) neither a. not b.

Accepted Answer

The answer of Regarding internal control systems:
A) ultimate ownership of...

Question 19

As described in COSO, elements of a control environment might include the following:
A) commitment to the importance of control
B) reward systems
C) tone at the top of the organization
D) all of the above

Accepted Answer

The control environment consists of the overall attitude, awareness, and actions of management and employees regarding the significance of control. It includes the commitment to the importance of control, reward systems, and the tone at the top of the organization. Therefore, all of the above elements are part of the control environment.

Question 20

Which of the following statements regarding a system of internal control is false?
A) Effective internal control systems provide complete assurance against the occurrence of material frauds and embezzlements.
B) Internal control systems depend largely on the competency and honesty of people.
C) Because internal control systems have a cost, management should evaluate the cost/benefit of each control plan.
D) The development of an internal control system is the responsibility of management.

Accepted Answer

Effective internal control systems can provide reasonable assurance, but not complete assurance against the occurrence of material frauds and embezzlements. No system can provide a 100% guarantee against fraud or errors.

Quiz 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

____ sets the tone of the organization, influencing the control consciousness of its people.

____ is a process that evaluates the quality of internal control performance over time.

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association (ISACA) because of the influence of IT over information systems, financial reporting and auditing.

A computer abuse technique called a ____ involves inserting unauthorized code in a program, which, when activated, may cause a disaster, such as shutting the system down or destroying files.

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by:

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.

The information process control goal which relates to preventing fictitious events from being recorded is termed:

As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped. Which control goal is being violated?

Which of the following is not a requirement of SOX Section 404?

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n) :

A computer abuse technique called a ____ involves a virus that replicates itself on disks, in memory, or across networks.

A control goal that is a measure of success in meeting a set of established goals is called:

Establishing a viable internal control system is primarily the responsibility of:

A business event which is not properly authorized violates the control goal of:

A(n) ____ is a computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts, usually by rounding to the nearest cent in financial transactions.

Regarding internal control systems:

As described in COSO, elements of a control environment might include the following:

Which of the following statements regarding a system of internal control is false?