Question 1

According to the 2012 Report to the Nation on Occupational Fraud and Abuse,frauds are more likely to be detected by:
A) Audits
B) internal controls
C) Managers
D) Tips

Accepted Answer

According to the 2012 Report to the Nation on Occupational Fraud and Abuse, tips were the most common way frauds were detected at 43.3% compared to audits (14.4%), internal controls (14.0%), and management review (3.0%). Therefore, the best choice is D, tips.

Question 2

____ sets the tone of the organization,influencing the control consciousness of its people.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

The control environment sets the tone for the organization and influences the control consciousness of its people. It includes factors such as the integrity and ethical values of management, the organizational structure, and the commitment to competence. The control environment is an important component of a strong internal control system.

Question 3

The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter,destroy,mutilate,or conceal documents with the intent to impair the document's integrity or availability for use in an official proceeding,or to otherwise obstruct,influence or impede any official proceeding is:
A) Title V - Analysts Conflicts of Interests
B) Title VIII - Corporate and Criminal Fraud Accountability
C) Title IX - White-Collar Crime Penalty Enhancements
D) Title XI - Corporate Fraud and Accountability

Accepted Answer

The answer of The section of Sarbanes Oxley that provides...

Question 4

____ is a process that evaluates the quality of internal control performance over time.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

Monitoring is the process that evaluates the quality of internal control performance over time. It involves regularly reviewing and testing the effectiveness of control activities and making necessary adjustments to address any weaknesses or deficiencies. The other options listed are components of internal control, but they do not directly pertain to the evaluation of internal control performance over time.

Question 5

A(n)____ is a computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts,usually by rounding to the nearest cent in financial transactions.
A) worm
B) salami slicing
C) logic bomb
D) Trojan horse

Accepted Answer

This is referred to as salami slicing, where small amounts are taken and accumulated over time. Worms, logic bombs, and Trojan horses are different types of computer abuses that involve different techniques.

Question 6

Achieving which control goal requires that all valid objects or events are captured and entered into a system's database once and only once?
A) ensure input validity
B) ensure update accuracy
C) ensure input completeness
D) ensure update completeness

Accepted Answer

Ensuring input completeness means that all valid objects or events are captured once and only once. This control goal helps to prevent errors such as duplicate data entry and incomplete records in the system's database.

Question 7

Establishing a viable internal control system is primarily the responsibility of:
A) the external auditors
B) management
C) programmers
D) government authorities

Accepted Answer

Establishing a viable internal control system is primarily the responsibility of management. While external auditors may provide recommendations and assess the effectiveness of the system, it is ultimately up to management to design and implement internal controls. Programmers may be involved in developing and implementing specific controls, but they are not solely responsible for the overall system. Government authorities may set regulations regarding certain controls, but they do not establish the entire system.

Question 8

As a result of an inadequate design,a production process yields an abnormally high amount of raw material scrapped.Which control goal is being violated?
A) ensure effectiveness of operations
B) ensure efficient employment of resources
C) ensure security of resources
D) ensure input accuracy

Accepted Answer

The control goal of ensuring efficient employment of resources is being violated in this scenario because an abnormally high amount of raw material is being scrapped, indicating a waste of resources.

Question 9

Which of the following statements regarding a system of internal control is false?
A) Effective internal control systems provide complete assurance against the occurrence of material frauds and embezzlements.
B) Internal control systems depend largely on the competency and honesty of people.
C) Because internal control systems have a cost,management should evaluate the cost/benefit of each control plan.
D) The development of an internal control system is the responsibility of management.

Accepted Answer

Effective internal control systems cannot provide complete assurance against the occurrence of material frauds and embezzlements. While they can help reduce the risk, they cannot completely eliminate it.

Question 10

A control goal that is a measure of success in meeting a set of established goals is called:
A) effectiveness
B) monitoring
C) efficiency
D) risk

Accepted Answer

Effectiveness is the measure of how well established goals are being met. This includes setting and achieving goals within a specified time frame, meeting customer needs, and ultimately delivering value to stakeholders. Monitoring, efficiency, and risk are also important control goals, but they do not directly measure success in meeting established goals.

Question 11

Failing to record a customer's order for the purchase of inventory violates the control goal of:
A) ensure input accuracy
B) ensure input completeness
C) ensure input validity
D) ensure input accuracy and input validity

Accepted Answer

Failing to record a customer's order for the purchase of inventory violates the control goal of ensuring input completeness, as the order was not captured in the system. Input completeness ensures that all necessary data is captured and entered into the system, which was not accomplished in this scenario. The other control goals (input accuracy and input validity) were not directly violated in this specific scenario, as there is no information suggesting that the order was incorrectly entered or fraudulent.

Question 12

A computer abuse technique called a ____ involves inserting unauthorized code in a program,which,when activated,may cause a disaster,such as shutting the system down or destroying files.
A) salami slicing
B) back door
C) logic bomb
D) Trojan horse

Accepted Answer

The given scenario describes a logic bomb, which is a type of malicious code that is intentionally inserted into a program to execute a harmful action when triggered. Salami slicing involves stealing tiny amounts of money from different accounts or transactions over a long period of time. Back door involves creating a hidden entry point for unauthorized access to a system. Trojan horse involves disguising malware as a legitimate software to deceive users into installing and executing it.

Question 13

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.
A) Control environment
B) Risk assessment
C) Control activities
D) Monitoring

Accepted Answer

Control activities are the policies and procedures established by management to help ensure that risk responses are effectively carried out. These control activities can include things like segregation of duties, physical controls, and access controls. The other options listed (control environment, risk assessment, and monitoring) are all important parts of an effective internal control system, but are not specifically focused on ensuring that risk responses are carried out.

Question 14

The information process control goal which relates to preventing fictitious events from being recorded is termed:
A) ensure input validity
B) ensure input accuracy
C) ensure input completeness
D) ensure effectiveness of operations

Accepted Answer

The goal of ensuring input validity aims to prevent fictitious events from being recorded. This is achieved by verifying the authenticity and correctness of data as it is being entered into the system. Validity checks help to ensure that only genuine transactions are recorded and that data is not manipulated or misrepresented. Accuracy and completeness are also important goals, but they do not specifically target the prevention of fictitious events. Ensuring effectiveness of operations is a broader goal that encompasses all aspects of information processing, including input, processing, and output.

Question 15

A computer abuse technique called a ____ involves a virus that replicates itself on disks,in memory,or across networks.
A) worm
B) back door
C) logic bomb
D) Trojan horse

Accepted Answer

The technique described matches the characteristics of a worm, which is a type of virus that can spread and replicate itself across disks, memory, and networks. Back doors, logic bombs, and Trojan horses may also be used in computer abuse, but they do not specifically involve the replication of a virus.

Question 16

A business event which is not properly authorized violates the control goal of:
A) input validity
B) input completeness
C) input accuracy
D) update validity

Accepted Answer

Input validity refers to ensuring that all input data or transactions are authorized and intended, thus an unauthorized business event directly violates this control goal.

Question 17

As described in COSO,elements of a control environment might include the following:
A) commitment to the importance of control
B) reward systems
C) tone at the top of the organization
D) all of the above

Accepted Answer

The control environment consists of various factors that influence the control consciousness of an organization. Commitment to the importance of control, reward systems, and tone at the top are all important elements of the control environment. Therefore, the best choice is D, all of the above.

Question 18

This framework was issued in 1996 (and updated in 2007)by the Information Systems Audit and Control Association (ISACA)because of the influence of IT over information systems,financial reporting and auditing.
A) COBIT
B) COSO
C) ERM
D) All of the above.

Accepted Answer

COBIT (Control Objectives for Information and Related Technology) was issued by ISACA in 1996 (and updated in 2007) to provide a framework for control and governance of IT. COSO (Committee of Sponsoring Organizations of the Treadway Commission) and ERM (Enterprise Risk Management) are both frameworks for control and governance, but they were not specifically issued by ISACA in response to the influence of IT over information systems, financial reporting, and auditing.

Question 19

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n):
A) audit
B) embezzlement
C) fraud
D) Theft

Accepted Answer

Fraud involves intentionally deceiving someone in order to gain something (typically money or property) that you are not entitled to. The other choices may involve illegal or unethical behavior, but do not necessarily involve intentionally deceiving someone for personal gain.

Question 20

Which of the following is not a requirement of SOX Section 404?
A) Evaluate the design of the company's controls to determine if they adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner.
B) Gather and evaluate evidence about the operation of controls.
C) Implement key controls to determine their operating efficiency.
D) Present a written assessment of the effectiveness of internal control over financial reporting.

Accepted Answer

SOX Section 404 requires companies to evaluate the design and effectiveness of their internal controls over financial reporting, gather and evaluate evidence about the operation of controls, and present a written assessment of the effectiveness of internal control over financial reporting. However, it does not explicitly require companies to implement key controls to determine their operating efficiency, making choice C the correct answer.

Quiz 7: Controlling Information Systems: Introduction to Enterprise Risk Management and Internal Control

According to the 2012 Report to the Nation on Occupational Fraud and Abuse,frauds are more likely to be detected by:

____ sets the tone of the organization,influencing the control consciousness of its people.

____ is a process that evaluates the quality of internal control performance over time.

A(n) ____ is a computer abuse technique where unauthorized instructions are inserted into a program to systematically steal very small amounts,usually by rounding to the nearest cent in financial transactions.

Achieving which control goal requires that all valid objects or events are captured and entered into a system's database once and only once?

Establishing a viable internal control system is primarily the responsibility of:

As a result of an inadequate design,a production process yields an abnormally high amount of raw material scrapped.Which control goal is being violated?

Which of the following statements regarding a system of internal control is false?

A control goal that is a measure of success in meeting a set of established goals is called:

Failing to record a customer's order for the purchase of inventory violates the control goal of:

A computer abuse technique called a ____ involves inserting unauthorized code in a program,which,when activated,may cause a disaster,such as shutting the system down or destroying files.

____ are the policies and procedures that help ensure that the risk responses are effectively carried out.

The information process control goal which relates to preventing fictitious events from being recorded is termed:

A computer abuse technique called a ____ involves a virus that replicates itself on disks,in memory,or across networks.

A business event which is not properly authorized violates the control goal of:

As described in COSO,elements of a control environment might include the following:

This framework was issued in 1996 (and updated in 2007) by the Information Systems Audit and Control Association (ISACA) because of the influence of IT over information systems,financial reporting and auditing.

A deliberate act or untruth intended to obtain unfair or unlawful gain is a(n) :

Which of the following is not a requirement of SOX Section 404?