CGFM > exam 3 section 3 > Flashcards

exam 3 section 3 Flashcards

(54 cards)

Study These Flashcards
1
Q

internal control

A

systems and methods managers use to ensure their organization accomplishes what is intended while avoiding undesirable results, safeguard assets, comply with rules and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

budget and accounting procedures act

A

required each federal agency head to establish and maintain internal controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

federal managers financial integrity act (FMFIA)

A

required GAO to prescribe standards of internal control (Green Book) and OMB to establish guidlines for evaluating systens of control on an annual basis

– report weaknesses and prescribe a corrective action plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

single audit act

A

audits of state and local, nonprofits receiving federal financial assistance of a certian amount

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

sarbanes oxley act

A

restrictions on publicly traded companies
- on annual report must report on assessment of effectivness of internal controls for financial reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

cfo act

A

requires cfo to develop and maintain an integrated agency accoutning and financial management system including financial reporting and internal controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

fraud reduction and data analytics act

A

OMB established guidlines for federal agencies to use GAO’s framweork for internal controls/risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

green book

A

provides framework for establishing and maintaining internal control
- required by FMFIA
- uses components/principles identified by committe of sponsoring orgs (COSO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OMB Circular A-123

A

managements response for enterprise risk management and internal control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

omb circular a-130

A

management of federal information resources
- minimum set of controls in federal automated info security program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

reasonable assurance

A
  • internal controls can’t provide absolute assurance
  • satisfactory level of confidence that org will achieve goals and minimize fraud/waste/abuse
  • cost shouldn’t outweigh beneft
    -typically prevention type more costly than detection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

internal control framework

A
  • developed by COSO
  • 5 components, 17 principles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

internal controls meet 3 objectives

A

-operations: effectiveness/efficiency
- reporting: internal/external reports
- compliance: adherence with laws and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

5 internal control components

A
  • control environment
  • risk assessment
  • control activities
  • info and communication
  • monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

control environment

A
  • foundation for internal control system / most important
  • discipline and structure
  • integrity and ethical values
  • commitment to competence
  • management philosophy and operating style
  • human resources and policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

5 principles of control environment

A
  • oversight body and management demonstrate commitmenet to integrity and ethical values
  • oversight body oversees entity’s internal control system
  • management establishes an org structure, assign responsibilities, and delegate authority to achieve objectives
  • management demonstrates committment to recruit, develop and retain competent individuals
  • management evaluates performance and hold individuals accountable for internal control responsiblities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

risk assessment principles (4)

A
  • management defines objectives clearly to enable identification of risks and define risk tolerance
  • management identify, analyze, and respond to risks related to achieving defined objectives
  • management considers potential for fraud
  • management identify, analyze, and respond to significant changes that could impact itnernal control system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

risk assessment

A

express objectives and determine what could go wrong

  • determine where material internal control weaknesses are likely to exist
  • identity theft fastest rising crim
  • program that disburse cash riskier than social services
  • fraud risk almost always present
  • must establish entity wide risk profiles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

omb a-123 asses risk and decide

A
  • accept risk and do nothing
  • not accept risk because it is too consequential (stop doing it)
  • accept and work to reduce
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

control activities

A

internal controls
- procedures that organziatons establish to ensure they accomplish goals and avoid what they want to avoid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

3 principles of control activities

A
  • management designs control activities to achieve objectives and respond to risk
  • management designs entity’s inforomation system and related control activities to achieve objectives and respond to risks
  • management should impleement control activities through policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

conflict between effectiveness and efficiency

Study These Flashcards
A

choose effectiveness

23
Q

4 purposes of control activities

Study These Flashcards
A
  • efficient and effective program operations
  • validity and reliability of data (accounting and performance data)
  • compliance with laws and regulations
  • safeguarding of resources (including misuse and loss)
24
Q

typical control activities

Study These Flashcards
A
  • separation of duties (violated regularly due to insufficient staff)
  • restricting access to resources and records
  • periodic reconciliations
25
info and communications
written definitions of an org's policies and procedures and its records of actual events
26
3 principles for info and communications
- management use quality info to achieve entity's objectives - management internally communicate necessary quality info to achieve entity's objectives - management externally communicates necessary quality info to achieve objectives
27
monitoring
- supervision most common activity - techiniques orgs use to ensure they continue to operate efficiently and effectively
28
2 principles of monitoring
- management establishes and operates monitoring activities to monitor internal control system and evaluate results - management remediates identified internal control deficiancies on timely basis
29
information technology
- general control - application control
30
general control
- applies to all IT systems - policies and procedures that apply to all or a large segment of an entity's info systems
31
application control
- desinged to cover processing of data within application software - ensure completeness, accuracy, authorization, and validity of all transactions during application processing
32
enterprise risk management process
- establish the context - initial risk identification - analyze and evaluate risks - develop alternatives - respond to risks - monitor and review - continuous risk identificaiton
33
analyze and evaluate risk - ERM
likelihoof and impact - compare identified risks to risk appetite and prioritize potential treatment
34
establish the context - ERM
consider internal and external environments - define the org's objectives and risk appetite
35
develop alternatives - ERM
- avoid - reduce - share/transfer: likelihood is small but potential impact is beyond willing to bear - accept
36
respond to risks - ERM
choice made how to treat risk - maximize ROI while staying in risk appetite
37
Enterprise risk management (ERM)
addresses full spectrum of org's significant risks and doing so through interrelated portfolio rather than on a function by function basis - largest challenege is changing behaviors of individuals
38
portfoloio management approach to risk
maximize entire portfolio by linking risks across the organization and diversifying
39
continuity of operations (COOP)
required written contingency plan that provides guidance
40
internal control vs risk management vs erm
internal control: manage risk to current business operations within control of agency risk management: risks outside control of business processes erm: all risks across enterprise should be evaluated as a portfolio of risk to balance
41
inherent risk
exposure arising from risk before any action taken to manage it beyond normal operations
42
residual risk
exposure remaining after action taken to manage it
43
segments of a risk assessment
- organize the process: assignment of responsibilities - segment the agency - conduct risk assessment - develop control plans - conduct control reviews - identify corrective actions - track corrections - report results
44
shared services
- reduce costs, increase efficiencies -GSA and OMB lead effort - management still responsible so must provide oversight of service provider
45
system and organization controls (SOC) engagement
provide a report on a service provider's ability to design, implement, and operate controls to achieve objectives
46
SOC 1
most common - examination of controls at a service provider likely to be relevant to user agencies internal control over financial reporting - evaluate effect of controls at the service provider on the user agencies financial reports
47
type 1 report for SOC
fairness of presentation of managments description of service providers system and sustainability of design of controls to achieve objectives
48
type 2 report for SOC
fairness of presentation of managments description of service providers system and sustainability of design and operative effectiveness of controls to achieve objectives - restricted access to management of service provider, user agencies, user auditors
49
SOC 2
exam of controls at service provider relevant to security, availability, processing integrity, confidentiality - restricted access to management of service provider, user agencies, user auditors
50
SOC 3
same as SOC 2 but less detail - general use, can be freely distributed
51
complementary user entity controls (CUEC)
controls for user agency to have in place for service provider to achieve objectives
52
financial audits performed in accordance to
GAGAS issued by GAO
53
chief internal auditor
supports overall objective or org - collabs iwth management to ensure controls in place, assess effectiveness and promote improvement
54
CGFM
flashcards
Decks in class (8)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions