CON WICK
What are the three types of access scenarios that typically require sufficient user access management CONtrols?
New users, transferred users, and Terminated users
Which of the following fraud risk factors is generally higher in a computer environment?
A. The degree of competence of operating personnel.
B. The motivation of executive management.
C. The possibility of large monetary amounts being involved.
D. The number of persons having access to systems and assets.
C. The possibility of large monetary amounts being involved. The monetary amounts of frauds perpetrated in computer systems have usually been very large compared with amounts of frauds that did not involve computers. The potential for individuals, including those implementing controls, to gain unauthorized access to data, to alter data without visible trace, or to gain access (direct or indirect) to assets may be greater in computer systems. Decreased human involvement in handling transactions can reduce the potential for observing errors and fraud. Errors or fraud in the design or modification of application programs can remain undetected for a long time.
Which among the following would have the most pervasive access in a system:
A. Analyst
B. Manager
C. Senior Vice President
D. System Administrator
System Administrator
Unauthorized alteration of online records can be prevented by employing
A. Key verification.
B. Computer sequence checks.
C. Computer matching.
D. Database access controls.
D. Database access controls
What function in ACL should be used to determine the number of transactions in a data file?
COUNT
Draft a CONtrol objective that focuses on audit trail and logging of user activities
To evaluate how effectively system usage is recorded and accounted for
A production manager for a moderate-sized manufacturing organization began ordering excessive raw materials and had them delivered to a wholesaler that the manager was running as a side business. The manager falsified receiving documents and approved the invoices for payment.
Will the following procedure most likely detect this fraud:
Take a sample of cash disbursements; compare purchase orders, receiving reports, invoices, and check copies.
Yes / No and rationale.
No, because given that documents have been falsified, supporting documents exist for each cash disbursement.
The concept of timeliness of data availability is most relevant to
A. Payroll systems.
B. Manual systems.
C. Computerized systems.
D. Online systems.
D. Online systems
Computer program libraries should be kept secure by
A. Installing a logging system for program access.
B. Monitoring physical access to program library media.
C. Restricting physical and logical access.
D. Denying remote access via terminals.
C. Restricting physical and logical access.
MS Excel, ACL, SAS, Archer GRC, and Timesheet Management programs are good examples of CAATs.
Agree / Disagree with Rationale.
Disagree.
Archer GRC and Timesheet management programs are examples of CAATTs, but cannot be actively used for data extraction, analysis, continuous auditing, and fraud investigation.
List three characteristics of password requirements that may strengthen password security CONtrols.
Minimum Password Length
Password Complexity
Password History
Account Lockout
Password Expiry
A production manager for a moderate-sized manufacturing organization began ordering excessive raw materials and had them delivered to a wholesaler that the manager was running as a side business. The manager falsified receiving documents and approved the invoices for payment.
Will the following procedure most likely detect this fraud:
Take a sample of cash disbursements and confirm the amount purchased, purchase price, and date of shipment with the vendors.
Yes / No and rationale.
No, because the vendors will confirm all transactions.
Which of the following security controls might prevent unauthorized access to sensitive data via an unattended workstation directly connected to a mainframe?
A. Use of a screen saver.
B. Use of passwords to identify users.
C. Encryption of data files.
D. Automatic log-off of inactive users.
D. Automatic log-off of inactive users.
Automatic log-off of inactive users is a utility that disconnects a workstation from the mainframe or server after a certain amount of time. Once the workstation has been disconnected, the user must log back into the system.
Data access security related to applications may be enforced through all the following except
A. User identification and authentication functions incorporated in the application.
B. Utility software functions.
C. User identification and authentication functions in access control software.
D. Security functions provided by a database management system.
B. Utility software functions.
Rationale: Utility programs perform routine functions (e.g., sorting and copying), are available to all users, and are promptly available for many different applications. Utility programs are one of the more serious weaknesses in data access security because some can bypass normal access controls.
The internal auditor is concerned about whether all the debits to the computer security expense account are appropriate expenditures. The most appropriate engagement procedure is to:
A. Take an attribute sample of computing invoices and determine whether all invoices are properly classified.
B. Perform an analytical review comparing the amount of expenditures incurred this year with the amounts incurred on a trend line for the past 5 years.
C. Take an attribute sample of employee wage expenses incurred by the outsourcing organization and trace to the proper account classification.
D. Take a sample of all debits to the account and investigate by examining source documents to determine the nature and authority of the expenditure.
D. Take a sample of all debits to the account and investigate by examining source documents to determine the nature and authority of the expenditure.
Rationale: The sample should be taken from the population of interest, that is, debits to the expense account. The proper engagement procedure is to vouch the accounting records to the source documents.
Identify the underlying risk and impact addressed by management's CONtrol objective of "Systems and data are secure from unauthorized access and usage"
Unauthorized access to the systems and data resulting in inappropriate changes to the underlying data
A production manager for a moderate-sized manufacturing organization began ordering excessive raw materials and had them delivered to a wholesaler that the manager was running as a side business. The manager falsified receiving documents and approved the invoices for payment.
Will the following procedure most likely detect this fraud:
Observe the receiving dock and count materials received; compare the counts with receiving reports completed by receiving personnel.
Yes / No and rationale.
No, because given that the improper orders are shipped to another location, observing receiving dock counts will not detect the fraud.
In the organization of the information systems function, the most important separation of duties is
A. Not allowing the data librarian to assist in data processing operations.
B. Assuring that those responsible for programming the system do not have access to data processing operations.
C. Having a separate information officer at the top level of the organization outside of the accounting function.
D. Using different programming personnel to maintain utility programs from those who maintain the application programs.
B. Assuring that those responsible for programming the system do not have access to data processing operations.
Rationale: Systems analysts and programmers should be separate from computer operators. Both programmers and analysts may be able to modify programs, files, and controls, and should therefore have no access to those programs nor to computer equipment. Operators should not be assigned programming duties or responsibility for systems design, and should have no opportunity to make changes in programs and systems.
The primary objective of security software is to
A. Control access to information system resources.
B. Restrict access to prevent installation of unauthorized utility software.
C. Detect the presence of viruses.
D. Monitor the separation of duties within applications.
A. Control access to information system resources.
Rationale: The objective of security software is to control access to information system resources, such as program libraries, data files, and proprietary software. Security software identifies and authenticates users, controls access to information, and records and investigates security related events and data.
A subsidiary president terminated a controller and hired a replacement without the required organizational approvals. Sales, cash flow, and profit statistics were then manipulated by the new controller and president via accelerated depreciation and sale of capital assets to obtain larger performance bonuses for the controller and the subsidiary president. An approach that might detect this fraudulent activity is
A. Analysis of overall management control for segregation of duties.
B. Required exit interviews for all terminated employees.
C. Periodic changes of outside public accountants.
D. Regular analytical review of operating divisions.
D. Regular analytical review of operating divisions.
Rationale: Analytical procedures permit evaluations of financial information made by a study and comparison of the relationships among data. The premise is that certain relationships prevail in the absence of known conditions to the contrary. Analytical procedures identify such things as the existence of unusual transactions and events and amounts, ratios, and trends that might indicate matters that have financial statement ramifications. Deviations from expectations should be investigated and the reasons therefore determined.
Define the use of roles-based access as a CONtrol mechanism under user access management
Within an organization, roles are created for various job functions. The permissions to perform certain operations are assigned to specific roles. Members or staff (or other system users) are assigned particular roles, and through those role assignments acquire the permissions needed to perform particular system functions. Since users are not assigned permissions directly, but only acquire them through their role (or roles), management of individual user rights becomes a matter of simply assigning appropriate roles to the user's account; this simplifies common operations, such as adding a user, or changing a user's department.
A production manager for a moderate-sized manufacturing organization began ordering excessive raw materials and had them delivered to a wholesaler that the manager was running as a side business. The manager falsified receiving documents and approved the invoices for payment.
Will the following procedure most likely detect this fraud:
Perform analytical tests, comparing production, materials purchased, and raw materials inventory levels; investigate differences.
Yes / No and rationale.
Yes, because this procedure will identify an unexplained increase in materials used.
Which of the following statements accurately describes the impact that automation has on the controls normally present in a manual system?
A.Transaction trails are more extensive in a computer-based system than in a manual system because there is always a one-for-one correspondence between data entry and output.
B. Responsibility for custody of information assets is more concentrated in user departments in a computer-based system than it is in a manual system.
C. Controls must be more explicit in a computer-based system because many processing points that present opportunities for human judgment in a manual system are eliminated.
D. The quality of documentation becomes less critical in a computer-based system than it is in a manual system because data records are stored in machine-readable files.
C. Controls must be more explicit in a computer-based system because many processing points that present opportunities for human judgment in a manual system are eliminated.
Rationale: Using a computer does not change the basic concepts and objectives of control. However, the use of computers may modify the control techniques used. The processing of transactions may be combined with control activities previously performed separately, or control function may be combined within the information system activity.
Which of the following is the most effective user account management control in preventing the unauthorized use of a computer system?
A. Management enforces an aggressive password policy that requires passwords to be 10 characters long, to be non-reusable, and to be changed weekly.
B. An account manager is responsible for authorizing and issuing new accounts.
C. The passwords and usernames of failed log-in attempts are logged and documented in order to cite attempted infiltration of the system.
D. Employees are required to renew their accounts semiannually.
D. Employees are required to renew their accounts semiannually.
Rationale: Management’s network security policy should include measures to ensure that old and unused accounts are removed promptly. If employees’ accounts expire semiannually, reasonable assurance is provided that accounts in use by unauthorized employees do not exist.
While performing analytical procedures related to an engagement involving a social services agency of a government entity, the internal auditor noted an unusually large increase in payments to individual recipients who are under the direction of a particular social worker in the agency.
Which of the following engagement procedures is the best procedure to investigate this observation?
A. Use generalized audit software to sort payments to recipients by social worker. Then sort the payments by common addresses and names.
B. Implement an integrated test facility and monitor transactions throughout the year to identify unusual items.
C. Implement the snapshot approach and tag transactions that are related to the social worker identified with the unusually large increases.
D. Use generalized audit software to take a random sample of recipients and investigate by sending confirmations to them to determine whether they had received proper payments.
A. Use generalized audit software to sort payments to recipients by social worker. Then sort the payments by common addresses and names.
Rationale:
Generalized audit software (GAS) is appropriate for such routine computer tasks as extracting, sorting, comparing, and summarizing data. Sorting payments by social worker and by addresses and names is the best procedure because it efficiently determines whether an obvious fraudulent pattern exists in the payments under the control of the social worker.