1
Q
Types of Computer Systems
A
- Transaction Processing System (TPS) - older 2. Management Reporting Systems – more recent
2
Q
Management Information System (MIS)
A
- form of management reporting system - organized assembly of resources & procedures required to collect, process, & distribute data for use in decision-making process
3
Q
Decision Support System (DSS)
A
- form of management reporting system - INTERACTIVE system that provides the user with easy access to decision models & data, to support semi-structures decision-making tasks
4
Q
Expert System
A
- form of management reporting system - A.I. Development - has built in hierarchy of rules which are acquired from human experts in the field - with a provided input, the ES should be able to define the nature of the problem and provide recommendations to solve the problem
5
Q
Executive Support Information System
A
- form of management reporting system - supports executive work: non-routine decisions, helps answer questions regarding competitors, ID new acquisitions
6
Q
Analytical Processing System
A
- form of management reporting system - enables user to ask (query) the system, retrieve data, & conduct analysis
7
Q
Systems Development Life Cycle Approach (SDLC) Steps
A
- Feasibility Study 2. Requirements Definition 3. Software Selection & Acquisition (purchased) / Software Design (in-house) 4. Configuration (purchased) / Development (in-house) 5. Final Testing & Implementation 6. Post-Implementation 7. Maintenance Phase
8
Q
Feasibility Study
A
- 1st Step of SDLC - determine strategic benefits of the system (gains or cost avoidance) - Estimate Payback schedule - Readiness of the organization’s users - maturity of the organization’s processes
9
Q
Requirements Definition
A
- 2nd step of SDLC - define the problem/need that requires resolution - define the functional/qualitative requirements of the selection - use in house or purchase but must entail a defined & documented acquisition process - user needs to be actively involved
10
Q
Software Selection & Acquisition Or Software Designs
A
- 3rd step of SDLC - Purchased: request for proposal, consider operational, support, tech requirements, & financial viability (escrow) - In-house: baseline, specifications, implementation with hardware software, program/database specs, security considerations, formal control process
11
Q
Configuration Or Development
A
- 4th step of SDLC - Purchased: tailor system to requirements (via settings NOT coding), may beed to build interface for implementation with existing system - In-House: program & develop supporting operation processes, testing to verify/validate, iterations of user acceptance testing
12
Q
Final Testing & Implementation
A
- 5th step of SDLC - establish actual operation of the new system - final iteration of user acceptance & user sign-off - may go through certification or accreditation process to assess effectiveness of business application in mitigating risk to appropriate level - providing management accountability over effectiveness of the system in meeting it goals - establish appropriate level of internal control
13
Q
Post Implementation
A
- 6th step of SDLC - formal process that assess the adequacy of the system & projected cost-benefit or ROI measurements in relation to feasibility stage (step 1) - provide lessons learned and/or plans for addressing system deficiencies - recommendations for future projects regarding systems development & project management processes followed
14
Q
Maintenance Phase
A
- 7th step of SDLC (not included in other interpretations) - monitor & support of the new system - training, help desk resources, & permissions system for changes (authorizations & tested) to system
15
Q
Transaction Processing System (TPS) 2 ways
A
- Online Transaction Processing (OLTP), Real-Time (OLRT) 2. Batch Processing
16
Q
Online Transaction Processing
A
- database updated as soon as transaction is received (immediate) - up to date at being keyed/transmitted - Issue: computers continually running & accessible at all points of transaction - Good for retail businesses
17
Q
Batch Processing
A
- gathering information & entering transaction or groups periodically - greater control over input process (verify, authorize before input) - Problem: delay between transaction & input (accounting records may not always accurately reflect current)
18
Q
Centralized vs Distributed Processing
A
- Centralized is 1 computer for whole firm that could be addressed by multiple people through remote terminals - Distributed is virtually 1 computer per employee at different locations (network used to connect)
19
Q
LANs
A
- within specific georgraphical area - each computer does its own processing & manages some of its data - file server acts like a remote disk drive - good management control: access code and passwords
20
Q
WANs
A
- different remote locations
21
Q
VANs
A
- links computer files of different companies together - increased security (prevent access to inappropriate data information)
22
Q
Problem with WLAN’s
A
- unauthorized access (both ENCRYPTION of data and PASSWORDS to connect are critical)
23
Q
Bus (topology)
A
- common path in a communications network
24
Q
Star (topology)
A
- there is one computer (central hub) to which all computers connect - all data is first received by the hub and then sent by the hub (email systems)
25
Ring (topology)
- each computer is connected to 2 closest neighbors in a closed loop (relay info) - 2 directions because 1 interruptions won't bring down the network
26
Tree (topology)
- groups of star-configured networks are organized in branches with 1 computer at the base - if within a branch, don't have to to go the root computer - if in a different branch, may have to go through the root computer
27
Mesh (topology)
- connected to many redundant interconnections between network nodes
28
Intranet
network limited to the computers of 1 company
29
Extranet
similar to intranet but select customers and vendors are able to participate as well
30
Client/Server Computing
networks for operating another computer - users of the client computer will be bale to access a server computer or even operating programs running on the server
31
Enterprise Resource Planning (ERP)
- packaged business software that allows an organization to automate & integrate the majority of its business practices, processes, and share common data across the entire organization - produce & access information in a real-time environment
32
Transmission Control Protocol and Internet Protocol
TCP/IP: communication protocol designed to network dissimilar systems
33
Electronic Data Interchange (EDI)
extranets set up as VANs to enable process of communication between suppliers & customers
34
EDI Special Considerations
1. Strict Standards (completeness & accuracy) 2. Translation Software (mapping) 3. Unauthorized Access (encryption, firewall, EFT concern)
35
Encryption
application control that make stole data unreadable to someone without knowing the coding method
36
Advantages of EDI
- eliminates need for human intervention - can be more efficient that other systems - when inventory is ordered @ reorder point, EDI eliminates gaps & shortens the cycle - payments are made & received automatically (reduces AR float)
37
Risks of E-Commerce
1. Confidentiality 2. Integrity 3. Availability (system failures) 4. Authentication & Non-repudation 5. Power shift to customers
38
Controls for E Commerce
1. Security mechanism & procedures 2. firewalls 3. process where participants are identified positively and uniquely 4. Routing Verification procedures 5. Message acknowledgement procedures
39
Network Firewall
for company computers - easier & cheaper to set up - huge risk if penetrated
40
Application Firewall
- for individual program protection - also allows user authentication
41
List Computers (most to least in size)
1. Supercomputers 2. Mainframe Computers 3. Minicomputers 4. Microcomputers (PCs) 5. Personal Digital Assistants
42
Magnetic tape vs Magnetic discks
- Tape is used mainly for back up & only sequential access to data is possible - Disks: random access to data and used inside computers
43
System Software
run system and direct operations (OS & Utility applications)
44
Utility Programs
for sorts, merges, & other routine functions to maintain & improve efficiency of computer
45
Algorithms
instruction sets used in programs to define and control processes
46
Heuristic
software that can learn and modify its operations (ie spell checking)
47
Source Program
written in the language by the programmer
48
Object Program
form the machine understands (1s & 0s)
49
Compiler
converts source programs into machine language
50
Protocol
rules determine the required format & methods for transmission of data
51
A Query Program
application that counts, sums, & retrieves items from a database based on user criteria
52
Fourth Generation Programming Language (4GL)
- commonly used in the development of business applications - distinguished by their use of “natural language” commands making them self-documenting
53
2 Popular Programming Language
C++ & Java
54
Data Structure List
1. Bit 2. Byte 3. Character 4. Alphanumeric 5. Field 6. Record (Primary & Secondary) 7. File (Master & Detail) 8. Database 9. Table 10 Data Detention File (describes)
55
Database Management System (DBMS)
- software system that controls the organization, storage, & retrieval of data in a database - organized & efficient manner to track information - program & database should be independent of each other (multiple access & control access) - goal: data normalization
56
Data Mining
analysis of data which looks for trends or anomalies WITHOUT advanced knowledge of the meaning of data
57
Data Normalization
to minimize the repetition & redundancy in the database (efficiency & remove danger of inconsistent data storage)
58
Systems Analyst
- prepares specifications for application programmers - middle man between users and programmers - designs IS using flowcharts (documenting, procedures, isolate control weaknesses)
59
Application Programmers
- writes, tests, & Debugs programs that will be used in the system - develops instructions for operations to follow
60
Database Administrator
- responsible for the security & information classification of shared data stored on the DB - design, definition, & maintenance of DB
61
Computer Operator
operate computer in data center - command the OS, mount disks/tapes, & placing paper in the printer - may also wirte in JCL – Job Control Language
62
Systems Programmer
Tech Support - updates and maintains the OS
63
Systems Development & Maintenance (Personnel)
1. Systems Analyst 2. Application Programmers 3. Database Administrator
64
Operations in an IT function (personnel)
Input 1. Data Entry 2. Computer Operator Output 3. Data Control Clerk 4. Data Control Department 5. Librarians
65
Major Security Risk when an employee leaves a client
failure to remove user accounts
66
Parity Check
odd parity computer uses a dummy bit to check total # of bits ON (if odd = OK, if even = malfunction)
67
Microcomputers Controls
1. inventory lists 2. keyboard locks 3. secured to desk 4. periodic PW change 5. periodic data backup 6. sensitive info in offline storage
68
ICE RACE
7 Principles of Information Criteria in COBIT I – Integrity C – Confidential E – Efficient R – Reliable A – Availability C – Compliance E – Effective
69
Control Risks for Microcomputers
- portable/small (steal or damage) - data & software accessible (easily access unauthorized records, Modify/copy/delete)
70
Which objective are applications controls for?
the financial reporting objective
71
What is included in Application controls?
1. Preventive Controls (errors & fraud) 2. Detective Controls & Automated Controls (error & fraud – credit log review) 3. User Controls & Corrective Controls – individuals to follow up and detect errors/fraud
72
What do Application controls relate to in an IT environment?
- data input, data processing, & data output
73
Contingency Planning
controls for accidental or intentional destruction or alteration
74
Field Checks
validated by characters, length, & format accepted
75
Limit Test
AKA “reasonable tests” Numbers are compared to limits that have been set for acceptance (i.e. wages)
76
Validity Checks
Data is compared to a list of acceptable entries to be sure it matches with one of them (ie. CA for state vs IX for state)
77
Check Digits
numbers or letters with not obvious meaning but is part of a formula - computer applies the formula to entered digits to verify as acceptable or not
78
Edit Checks
on Batch Processing data (input control) - verify each individual entry is appropriate - if not, generates list of rejected transaction for review by the control clerk
79
Types of Processing Controls
1. Systems & Software Documentation 2. Computer programs tested (language) 3. Test Data 4. System testing (interacting properly)
80
Output Controls (Data Processing)
- concerned with detecting errors (opposed to preventing) - reasonable assurance that ONLY AUTHORIZED persons receive output for review
81
Benefit of XBLR
- reduces chance of error when generating reports - can handle data in different languages & accounting standards
82
Risks of IT (auditing)
1. Over-reliance 2. Access 3. Changes in Programs 4. Failure to Change
83
2 Major Risks (IT & auditor)
1. Unauthorized Access – Distributed computing can cause more harm than centralized 2. Audit Trail
84
What can an Auditor do when client provides a program to verify that is not actually used by the client?
Include TEST DATA in a INTEGRATED TESTING FACILITY (simulated + actual data during a program run)
85
If Integrated Testing Facility is not practical, what approach should an Auditor use?
controlled reprocessing approach
86
Controlled Reprocessing approach
used when integrated testing facility is not practical - auditor supervises the entry of actual client data into the client program to reproduce results of a previous program run by the client - if results are identical, then program is the actual one used
87
Generalized Audit Software Package may include
1. Programs to access client files 2. Source Code Comparison 3. Parallel simulation 4. Spreadsheets for working trial balances and similar audit needs
88
Trust Services Main Principles for SSAE
Meet one or more of SAC PO 1. Security 2. Availability 3. Confidentiality 4. Processing Integrity 5. Online Privacy
89
Trust Services Sub-Principles
1. Policies 2. Communications 3. Procedures 4. Monitoring
90
Webtrust (assurance)
Websites 1. company existence 2. reliability of key business information placed on its website
91
Systrust Service
Information Systems assurance SAC – PO
92
COBIT Principles
1. Meeting Stakeholders Needs 2. End to End Applications 3. Development of a Single Integrated Framework 4. Enabling a Holistic Approach 5. Separating Governance from Management
93
Steering Committee
- plan and oversee the IS function (systems development and acquisition) - address the complexities created by function and divisional boundaries
94
COBIT Definition
framework provides managers, auditors, and IT users with a set of measure, indicators, processes, and best practices to maximize the benefit of IT
95
COBIT Business Objectives
1. Effective Decision Support 2. Efficient Transaction processing 3. Compliance
96
COBIT Governance Objectives
1. Strategic Alignment 2. Value Delivery (cost/benefit) 3. Resource Management (optimize knowledge/infrastructure) 4. Risk Management 5. Performance Measurement
97
COBIT Information Criteria
ICE RACE mnemonic
98
COBIT IT Resources
1. Applications 2. Information 3. Infrastructure 4. People
99
COBIT Domains and Processes
PO AIDS ME 1. Plan & Organize 2. Acquire & Implement 3. Deliver & Support 4. Monitor & Evaluate
100
General Controls for IT
ensure that control environment is stable and well managed 1. Systems Development Standards 2. Security Management Controls 3. Change Management Procedures 4. Software acquisition, dev., operations, & maint. Controls
101
Header (IT)
use to ID records on an accounting system file - located at the beginning of each file and contains the file name, expiration date, and orther ID data
102
High-Level Statements
provide guidance to works who must make present and future decisions (IT Security)+
103
Program Level Policy
the mission statement for IT security program
104
Program-Framework Policy
IT security strategy (overall approach)
105
EDI Controls
1. Activity logs of failed transactions 2. Network and sender/receipt acknowledgements
106
Supply Chain Management
1. What: goods received = goods order 2. When: goods delivered on/before date promised 3. Where: delivered to location requested 4. How much: COGS low as possible
107
Supply Chain Management Objectives
1. Planning 2. Sourcing 3. Making 4. Delivery
108
Customer Relationship Management Systems (CRM)
provide sales force automation and customer services in an attempt to manage customer relationships - objective is to increase customer satisfaction (profit & revenue)
CPA BEC 1
flashcards
Decks in class (16)
# Cards
-
Capital Budgeting28
-
Corporate Governance18
-
Cost Accounting36
-
Economics67
-
Financial Management41
-
Financial Planning19
-
Information Technology70
-
Performance Measures28
-
Risk Management17
-
BEC 1 - Economic Concepts & Strategy157
-
BEC 2 - Corporate Governance, Internal Control, & Enterprise Risk Management128
-
BEC 5 - Costing Accounting and Performance17
-
BEC 4 - Decision Making24
-
BEC 3 - Financial Management & Capital Budgeting155
-
BEC 6 - Planning, Control, Analysis, & Risk Management130
-
BEC 7108
