Question 1

____ is a process that assesses the quality of internal control performance over time.
A)Control environment
B)Risk assessment
C)Control activities
D)Monitoring

Accepted Answer

Monitoring is the process that assesses the quality of internal control performance over time. It involves ongoing evaluation of the design and operation of internal controls and ensuring that any deficiencies are identified and addressed in a timely manner. Control environment, risk assessment, and control activities are important components of internal control, but do not specifically refer to the process of monitoring.

Question 2

Elements of a control environment might include the following except:
A)organization values and norms
B)management philosophy and operating style
C)means of communications
D)reward systems

Accepted Answer

Means of communications is not typically considered an element of the control environment, which focuses more on the organization's culture, values, and management practices.

Question 3

The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5 million and up to 20 years imprisonment if they knowingly or willfully certify false or misleading information contained in periodic reports:
A)Title V - Analysts Conflicts of Interests
B)Title VIII - Corporate and Criminal Fraud Accountability
C)Title IX - White-Collar Crime Penalty Enhancements
D)Title XI - Corporate Fraud and Accountability

Accepted Answer

Title IX of the Sarbanes-Oxley Act includes provisions for white-collar crime penalty enhancements, which apply to CEOs and CFOs who knowingly certify false financial reports.

Question 4

Which of the following is not a requirement of SOX Section 404?
A)Evaluate the design of the company's controls to determine if they adequately address the risk that a material misstatement of the financial statements would not
Be prevented or detected in a timely manner.
B)Gather and evaluate evidence about the operation of controls.
C)Implement key controls to determine their operating efficiency.
D)Present a written assessment of the effectiveness of internal control over financial reporting.

Accepted Answer

Implementing key controls is not a requirement of SOX Section 404, but rather an action that companies may take in order to evaluate the effectiveness of their internal controls. The other options listed are all requirements of SOX Section 404.

Question 5

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association because of the influence of IT over information systems, financial reporting and auditing.
A)COBIT
B)COSO
C)ERM
D)All of the above.

Accepted Answer

The framework referred to in the question is COBIT, which was issued by the Information Systems Audit and Control Association (ISACA). COSO (Committee of Sponsoring Organizations of the Treadway Commission) and ERM (Enterprise Risk Management) are also frameworks but their issuance is not directly related to the influence of IT over information systems, financial reporting and auditing.

Question 6

A business event which is not properly authorized is an example of:
A)an invalid item
B)an inaccurate item
C)an incomplete item
D)an unusual item

Accepted Answer

An event which is not properly authorized means it does not have the necessary authority or validity to take place, and hence it qualifies as an invalid item. Option B (inaccurate item) implies there is an error in the information provided, option C (incomplete item) suggests something is missing, and option D (unusual item) doesn't fit the scenario described in the question.

Question 7

A computer abuse technique called a ____ involves inserting unauthorized code in a program, which, when activated, may cause a disaster, such as shutting the system down or destroying files.
A)salami slicing
B)back door
C)logic bomb
D)Trojan horse

Accepted Answer

The technique described in the question is that of a logic bomb, where unauthorized code is inserted into a program to cause a specific effect when activated. Salami slicing refers to the fraudulent practice of stealing tiny amounts of money over time and adding them up, back doors are hidden ways of accessing a system or program, and Trojan horses are programs that appear to be harmless but actually have malicious intent.

Question 8

A computer abuse technique where unauthorized instructions are inserted into a program to systemati- cally steal very small amounts, usually by rounding to the nearest cent in financial transactions
A)worm
B)salami slicing
C)logic bomb
D)Trojan horse

Accepted Answer

Salami slicing is a type of computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts, usually by rounding to the nearest cent in financial transactions. Worms are self-replicating programs that spread throughout a computer network. A logic bomb is a type of malware that is triggered by a specific event, such as a particular date or time. A Trojan horse is a type of malware that appears to be a legitimate program but actually contains a hidden malicious function. Therefore, the best choice for this scenario is B) Salami slicing.

Question 9

A computer abuse technique called a ____ involves a virus that replicates itself on disks, in memory, or across networks.
A)worm
B)back door
C)logic bomb
D)Trojan horse

Accepted Answer

The description given matches the behavior of a worm, not the other options. A back door is a hidden method of accessing a computer system without going through the normal authentication process. A logic bomb is a piece of code that is set to execute when certain conditions are met, and a Trojan horse is a program that appears to be benign but actually has malicious intent.

Question 10

____ sets the tone of the organization, influencing the control consciousness of its people.
A)Control environment
B)Risk assessment
C)Control activities
D)Monitoring

Accepted Answer

The control environment sets the tone of the organization and influences the control consciousness of its people. It includes the integrity, ethical values and competence of the entity’s people, and the oversight responsibility exercised by the entity’s board of directors. Risk assessment involves identifying and analyzing relevant risks to achieving objectives, while control activities are policies, procedures, and other actions taken to address those risks. Monitoring involves ongoing review and evaluation of the effectiveness of the control environment, risk assessment, and control activities. However, none of these directly set the tone of the organization like the control environment does.

Question 11

The information system control goal which relates to preventing fictitious events from being recorded is termed:
A)ensure input validity
B)ensure input accuracy
C)ensure input completeness
D)ensure effectiveness of operations

Accepted Answer

Ensuring input validity refers to the control goal of preventing fictitious events from being recorded. This means that the system should only allow input of legitimate and authorized events, and should reject any input of fraudulent or fictitious events. Input accuracy relates to ensuring that the data entered into the system is correct, and input completeness refers to ensuring that all required data fields are filled in. Ensuring effectiveness of operations relates to ensuring that the system is functioning efficiently and effectively.

Question 12

A measure of success in meeting a set of established goals is called system:
A)effectiveness
B)monitoring
C)efficiency
D)control goals

Accepted Answer

Effectiveness measures how well a system or organization is achieving its established goals, making it the best choice for this question. Monitoring refers to the ongoing observation and assessment of a system, while efficiency measures the ratio of input to output or how well resources are used. Control goals are a specific type of goal used in project management, but they do not encompass overall success in meeting established objectives.

Question 13

As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped.Which control goal is being violated?
A)ensure effectiveness of operations
B)ensure efficient employment of resources
C)ensure security of resources
D)ensure input accuracy

Accepted Answer

The control goal of ensuring efficient employment of resources is being violated because the abnormally high amount of raw material scrapped indicates that resources (in this case, raw material) are being wasted, which is inefficient.

Question 14

The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the document's integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is:
A)Title V - Analysts Conflicts of Interests
B)Title VIII - Corporate and Criminal Fraud Accountability
C)Title IX - White-Collar Crime Penalty Enhancements
D)Title XI - Corporate Fraud and Accountability

Accepted Answer

The answer of The section of Sarbanes Oxley that provides...

Question 15

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n)
A)audit
B)embezzlement
C)fraud
D)theft

Accepted Answer

The term "fraud" is defined as a deliberate act or untruth intended to obtain unfair or unlawful gain. Embezzlement and theft also involve obtaining something unlawfully, but they do not require the act to be deliberate or involve an untruth. An audit is a review of financial records to ensure accuracy and compliance, and is not necessarily related to fraudulent activity. Therefore, the correct answer is C - fraud.

Question 16

____ are the policies and procedures that help ensure that management directives are carried out.
A)Control environment
B)Risk assessment
C)Control activities
D)Monitoring

Accepted Answer

Control activities are the policies and procedures implemented by management to ensure that their directives and goals are achieved effectively and efficiently. These activities encompass a wide range of actions, such as authorizing transactions, verifying the accuracy and completeness of information, and segregating duties to prevent errors or fraud. Control activities are an essential component of a company's internal control system, and they help to reduce the risk of financial misstatements and other operational problems.

Question 17

Which of the following statements regarding internal controls systems is false?
A)Effective internal control systems provide complete assurance against the occurrence of material frauds and embezzlements.
B)Internal control systems depend largely on the competency and honesty of people.
C)Because internal control systems have a cost, management should evaluate the cost/benefit of each control plan.
D)The development of an internal control system is the responsibility of management.

Accepted Answer

Effective internal control systems provide reasonable assurance but not complete assurance against the occurrence of material frauds and embezzlements. It is not possible to completely eliminate the risk of fraud and errors.

Question 18

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:
A)Title V - Analysts Conflicts of Interests
B)Title VIII - Corporate and Criminal Fraud Accountability
C)Title IX - White-Collar Crime Penalty Enhancements
D)Title XI - Corporate Fraud and Accountability

Accepted Answer

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is Title VIII - Corporate and Criminal Fraud Accountability. This title also establishes criminal penalties for securities fraud and strengthens the Securities and Exchange Commission's authority to investigate and enforce securities laws.

Question 19

Establishing a viable internal control system is primarily the responsibility of:
A)the external auditors
B)management
C)programmers
D)government authorities

Accepted Answer

The responsibility of establishing a viable internal control system lies with management. It is the management's duty to ensure that the company has effective control measures in place to safeguard its assets, prevent fraud, and maintain accurate financial records. While external auditors may review and provide recommendations for improvement, the primary responsibility lies with management. Programmers may be involved in designing and implementing control procedures, but they are not primarily responsible for establishing the entire control system. Government authorities may require certain controls for regulatory compliance, but they are not responsible for establishing the overall system.

Question 20

According to the 2008 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by:
A)audits
B)internal controls
C)managers
D)tips

Accepted Answer

According to the 2008 Report to the Nation on Occupational Fraud and Abuse, tips were the most common detection method for occupational fraud, accounting for 57.1% of all cases. This is followed by management review (16.2%), internal audits (14.4%), and other mechanisms like surveillance (5.4%). Internal controls were not mentioned as a primary detection method. Therefore, the best choice is D) tips.

Quiz 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

____ is a process that assesses the quality of internal control performance over time.

Elements of a control environment might include the following except:

The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5 million and up to 20 years imprisonment if they knowingly or willfully certify false or misleading information contained in periodic reports:

Which of the following is not a requirement of SOX Section 404?

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association because of the influence of IT over information systems, financial reporting and auditing.

A business event which is not properly authorized is an example of:

A computer abuse technique called a ____ involves inserting unauthorized code in a program, which, when activated, may cause a disaster, such as shutting the system down or destroying files.

A computer abuse technique where unauthorized instructions are inserted into a program to systemati- cally steal very small amounts, usually by rounding to the nearest cent in financial transactions

A computer abuse technique called a ____ involves a virus that replicates itself on disks, in memory, or across networks.

____ sets the tone of the organization, influencing the control consciousness of its people.

The information system control goal which relates to preventing fictitious events from being recorded is termed:

A measure of success in meeting a set of established goals is called system:

As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped.Which control goal is being violated?

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n)

____ are the policies and procedures that help ensure that management directives are carried out.

Which of the following statements regarding internal controls systems is false?

The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:

Establishing a viable internal control system is primarily the responsibility of:

According to the 2008 Report to the Nation on Occupational Fraud and Abuse, frauds are more likely to be detected by: