Chapter 7—Controlling Information Systems: Introduction to Internal Control TRUE/FALSE 1. Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals). ANS: F 2. Management is legally responsible for establishing and maintaining an adequate system of internal control ANS: T 3. The exposure of unacceptable accounting is often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision. ANS: F 4. A major reason management must exercise control over an organization’s business processes is to provide reasonable assurance that the company is in compliance with applicable legal and regulatory obligations. ANS: T 5. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is erroneous record keeping. ANS: T 6. The inability of an organization to remain abreast of the demands of the marketplace is lack of competitive advantage. ANS: T 7. Business interruption can be caused by power failures. 129
Transcript
Chapter 7—Controlling Information Systems: Introduction to Internal Control
TRUE/FALSE
1. Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals).
ANS: F
2. Management is legally responsible for establishing and maintaining an adequate system of internal control
ANS: T
3. The exposure of unacceptable accounting is often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision.
ANS: F
4. A major reason management must exercise control over an organization’s business processes is to provide reasonable assurance that the company is in compliance with applicable legal and regulatory obligations.
ANS: T
5. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is erroneous record keeping.
ANS: T
6. The inability of an organization to remain abreast of the demands of the marketplace is lack of competitive advantage.
ANS: T
7. Business interruption can be caused by power failures.
ANS: T
8. Excessive costs may include incurring unnecessary expenses in operating the business.
ANS: T
9. Fraud and embezzlement is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors.
ANS: T
129
130 Chapter 7
10. Under the Sarbanes Oxley Act of 2002, the section on Auditor Independence establishes an independent board to oversee public company audits.
ANS: F
11. Under the Sarbanes Oxley Act of 2002, the section on Corporate Responsibility requires a company’s CEO and CO to certify quarterly and annual reports.
ANS: T
12. Under the Sarbanes Oxley Act of 2002, the section on Enhanced Financial Disclosures requires each annual report filed with the SEC to include an internal control report.
ANS: T
13. Under the Sarbanes Oxley Act of 2002, the section on Corporate Tax Returns Section 1001, conveys a sense of the Senate that the corporate federal income tax returns be signed by the treasurer.
ANS: F
14. Risk is the possibility that an event or action will cause an organization to fail to meet its objectives or goals.
ANS: T
15. A fraud is a deliberate act or untruth intended to obtain unfair or unlawful gain.
ANS: T
16. The Sarbanes Oxley Act of 2002 establishes legal responsibility for management to prevent fraud and other irregularities.
ANS: T
17. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is known as erroneous record keeping.
ANS: T
18. Erroneous management decisions differ from fraud in that they are a willful disregard of GAAP.
ANS: F
19. Fraud and embezzlement is the exposure that is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors.
ANS: T
20. According to the Ernst and Young Fraud survey, the number one fraud worry on the minds of executives is computer crime.
ANS: F
Controlling Information Systems: Introduction to Internal Controls 131
21. A computer crime techniques called worm involves the systematic theft of very small amounts from a number of bank or other financial accounts.
ANS: F
22. A computer abuse technique called a trap door (or back door) involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.
ANS: T
23. A logic bomb is a computer abuse technique in which unauthorized code is inserted in a program, which, when activated, causes a disaster such as shutting down a system or destroying data.
ANS: T
24. A salami is program code that can attach itself to other programs (i.e., "infect" those programs), that can reproduce itself, and that operates to alter the programs or to destroy data.
ANS: F
25. Risk assessment is the entity's identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed.
ANS: T
26. The control environment sets the tone of the organization, influencing the control consciousness of its people.
ANS: T
27. External directives are the policies and procedures that help ensure that management directives are carried out.
ANS: F
28. Establishing a viable internal control system is the responsibility of management.
ANS: T
29. Monitoring is a process that assesses the quality of internal control performance over time.
ANS: T
30. The external environment is a system of integrated elements--people, structures, processes, and procedures--acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals.
ANS: F
132 Chapter 7
31. The control environment refers to an organization's general awareness of and commitment to the importance of control throughout the organization.
ANS: T
32. The control goal called efficiency of operations strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended.
ANS: F
33. Ensuring the security of resources is the control goal that seeks to provide protection against loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources.
ANS: T
34. The control goal of ensuring input materiality strives to prevent fictitious items from entering an information system.
ANS: F
35. An invalid item is an object or event that is not authorized, never occurred, or is otherwise not genuine.
ANS: T
36. The control goal of input accuracy is concerned with the correctness of the transaction data that are entered into a system.
ANS: T
37. Business process control plans relate to those controls particular to a specific process or subsystem, such as billing or cash receipts, or to a particular technology used to process data.
ANS: T
38. A sale to a customer is entered into the system properly, but the event does not accurately update the customer's outstanding balance. This type of processing error would be classified as a user error.
ANS: F
39. A batch of business events is accurately entered into a business event data, but the computer operator fails to use the data to update master data. This type of processing error would be classified as an operational error.
ANS: T
40. A corrective control plan is designed to discover problems that have occurred.
ANS: F
Controlling Information Systems: Introduction to Internal Controls 133
MULTIPLE CHOICE
1. A manager of a manufacturing plant alters production reports to provide the corporate office with an inflated perception of the plant's cost effectiveness in an effort to keep the inefficient plant from being closed. This action would be classified as a(n):a. Riskb. Hazardc. Fraudd. Exposure
ANS: C
2. Events or situations that subject an organization to the possibility of harm, loss, or danger cause:a. risksb. fraudc. controlsd. embezzlement
ANS: A
3. Who is legally responsible for establishing and maintaining an adequate system of internal control?a. the board of directorsb. stakeholdersc. investorsd. management
ANS: D
4. The major reasons for exercising control of the organization’s business processes include all of the following except:a. Provide reasonable assurance that the goals of the business are being achievedb. To mitigate risks of fraud and other intentional and unintentional actsc. To provide reasonable assurance that the company is in compliance with applicable legal
and regulatory obligationsd. All of the above
ANS: D
5. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is:a. Erroneous record keepingb. Unacceptable accountingc. Erroneous management decisionsd. Fraud and embezzlement
ANS: A
6. The establishment of accounting policies that are not GAAP or are inappropriate to the circumstances often caused by improper interpretation or willful disregard of GAAP is:a. Erroneous record keepingb. Unacceptable accountingc. Erroneous management decisionsd. Fraud and embezzlement
134 Chapter 7
ANS: B
7. This exposure is often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision:a. Erroneous record keepingb. Unacceptable accountingc. Erroneous management decisionsd. Fraud and embezzlement
ANS: C
8. This exposure is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors:a. Erroneous record keepingb. Unacceptable accountingc. Erroneous management decisionsd. Fraud and embezzlement
ANS: D
9. Various penalties that may be brought by judicial or regulatory authorities is (are):a. Statutory sanctionsb. Excessive costsc. Loss or destruction of resourcesd. Competitive disadvantage
ANS: A
10. The inability of an organization to remain abreast of the demands of the marketplace is (are):a. Statutory sanctionsb. Excessive costsc. Loss or destruction of resourcesd. Competitive disadvantage
ANS: D
11. The section of Sarbanes Oxley that establishes an independent board to oversee public company audits is:a. Title I – Public Company Accounting Oversight Boardb. Title II – Auditor Independencec. Title III – Corporate Responsibilityd. Title IV – Enhanced Financial Disclosures
ANS: A
12. The section of Sarbanes Oxley that prohibits a CPA firm that audits a public company from engaging in certain non-audit services is:a. Title I – Public Company Accounting Oversight Boardb. Title II – Auditor Independencec. Title III – Corporate Responsibilityd. Title IV – Enhanced Financial Disclosures
ANS: B
Controlling Information Systems: Introduction to Internal Controls 135
13. The section of Sarbanes Oxley that requires a company’s CEO and CFO to certify quarterly and annual reports is :a. Title I – Public Company Accounting Oversight Boardb. Title II – Auditor Independencec. Title III – Corporate Responsibilityd. Title IV – Enhanced Financial Disclosures
ANS: C
14. The section of Sarbanes Oxley that requires each annual report filed with the SEC to include an internal control report is:a. Title I – Public Company Accounting Oversight Boardb. Title II – Auditor Independencec. Title III – Corporate Responsibilityd. Title IV – Enhanced Financial Disclosures
ANS: D
15. The section of Sarbanes Oxley that requires financial analysts to properly disclose any investments they might hold with the companies they recommend:a. Title V – Analysis of Conflicts of Interestsb. Title VIII – Corporate Criminal Fraud Accountabilityc. Title IX – White Collar Crime Enhancementsd. Title XI – Corporate Fraud and Accountability
ANS: A
16. The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is:a. Title V – Analysis of Conflicts of Interestsb. Title VIII – Corporate Criminal Fraud Accountabilityc. Title IX – White Collar Crime Enhancementsd. Title XI – Corporate Fraud and Accountability
ANS: B
17. The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5,000,000 and up to 20 years imprisonment if they certify false or misleading financial statements with the SEC is:a. Title V – Analysis of Conflicts of Interestsb. Title VIII – Corporate Criminal Fraud Accountabilityc. Title IX – White Collar Crime Enhancementsd. Title XI – Corporate Fraud and Accountability
ANS: C
18. The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the document’s integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is:a. Title V – Analysis of Conflicts of Interests
136 Chapter 7
b. Title VIII – Corporate Criminal Fraud Accountabilityc. Title IX – White Collar Crime Enhancementsd. Title XI – Corporate Fraud and Accountability
ANS: D
19. According to the Ernst and Young Fraud survey, the number one fraud worry on the minds of executives is:a. Personal financial pressureb. Computer crimec. Asset misappropriationd. Internal control
ANS: C
20. A computer abuse technique called a __________ involves inserting unauthorized code in a program, which, when activated, causes a disaster, such as shutting the system down or destroying files.a. salamib. trap doorc. logic bombd. Trojan horse
ANS: C
21. A computer abuse technique called a __________ involves a program that replicates itself on disks, in memory, or across networks.a. Wormb. trap doorc. logic bombd. Trojan horse
ANS: A
22. A computer abuse technique called a __________ involves program that can attach itself to other programs thereby “infecting” those programs.a. Wormb. Virusc. logic bombd. Trojan horse
ANS: B
23. In its 1999 report, the COSO Report on Fraudulent Financial Reporting that studied over 200 cases of fraudulent financial reporting from 1987 to 1997:a. The companies looked at were all large companiesb. Some of the companies were at or near loss positionsc. The CEOs were not involved in most casesd. Companies tended to understate assets and understate revenues
ANS: B
Controlling Information Systems: Introduction to Internal Controls 137
24. Which of the following statements regarding internal controls systems is false?a. Effective internal control systems provide absolute assurance against the occurrence of
material frauds and embezzlements.b. Internal control systems depend largely on the competency and honesty of people.c. Because internal control systems have a cost, management should evaluate the cost/benefit
of each control plan.d. The development of an internal control system is the responsibility of management.
ANS: A
25. Elements of a control environment might include the following except:a. organization values and normsb. management philosophy and operating stylec. means of communicationsd. reward systems
ANS: C
26. ____________ sets the tone of the organization, influencing the control consciousness of its people.a. Control environmentb. Risk assessmentc. Control activitiesd. Monitoring
ANS: A
27. ____________ are the policies and procedures that help ensure that management directives are carried out.a. Control environmentb. Risk assessmentc. Control activitiesd. Monitoring
ANS: C
28. ____________ is a process that assesses the quality of internal control performance over time.a. Control environmentb. Risk assessmentc. Control activitiesd. Monitoring
ANS: D
29. A measure of success in meeting a set of established goals is called system:a. Effectivenessb. Monitoringc. Efficiencyd. control goals
ANS: A
138 Chapter 7
30. As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped. Which control goal is being violated?a. ensure effectiveness of operationsb. ensure efficient employment of resourcesc. ensure security of resourcesd. ensure input accuracy
ANS: B
31. Establishing a viable internal control system is primarily the responsibility of:a. The external auditorsb. Management c. The programmersd. Government authorities
ANS: B
32. The information system control goal which relates to preventing fictitious events from being recorded is termed:a. ensure input validityb. ensure input accuracyc. ensure input completenessd. ensure effectiveness of operations
ANS: A
33. A business event which is not properly authorized is an example of:a. an invalid itemb. an inaccurate itemc. an incomplete itemd. an unusual item
ANS: A
34. Achieving which control goal requires that all valid objects or events are captured and entered into a system's database?a. input validityb. update accuracyc. input completenessd. update completeness
ANS: C
35. Failing to record a customer's order for the purchase of inventory violates the information system control goal of:a. ensure input accuracyb. ensure input completenessc. ensure input validityd. ensure input accuracy and input validity
ANS: B
Controlling Information Systems: Introduction to Internal Controls 139
36. Discrepancies between data items recorded by a system and the underlying economic events or objects they represent are a violation of the information system control goal of:a. ensure input validityb. ensure input completenessc. ensure input accuracyd. ensure input accuracy and input validity
ANS: C
37. Assuring that the accounts receivable master data reflects all cash collections recorded in the cash receipts event data addresses the control goal of:a. ensure input accuracyb. ensure input completenessc. ensure update accuracyd. ensure update completeness
ANS: D
38. Assuring that cash collections recorded in the cash receipts event data are credited to the right customer in the accounts receivable master data addresses the control goal of:a. ensure input accuracyb. ensure input completenessc. ensure update accuracyd. ensure update completeness
ANS: C
39. Which of the following is a control goal for the information system for the applicable master data?a. input validityb. update accuracyc. input accuracyd. input completeness
ANS: B
40. Why is there usually no control goal called update validity?a. Update completeness achieves update validity.b. Input validity guarantees update validity.c. Update accuracy guarantees update validity.d. Input accuracy achieves update validity.
ANS: B
41. A programming error causes the sale of an inventory item to be added to the quantity on hand attribute in the inventory master data. Which control goal was not achieved?a. ensure update completenessb. ensure input accuracyc. ensure update accuracyd. ensure input completeness
ANS: C
140 Chapter 7
42. Information processing procedures and policies that assist in accomplishing control goals are known collectively as:a. control plansb. control systemsc. control objectivesd. control outcomes
ANS: A
43. ______________________ relate to those controls particular to a specific process or subsystem, such as billing or cash receipts, or to a particular technology used to process data:a. Control proceduresb. Information processing proceduresc. Business process control plansd. Operations system control plans
ANS: C
44. Control plans that relate to a multitude of goals and applications are called:a. business process control plansb. internal control systemsc. pervasive control plansd. management control systems
ANS: C
45. A control plan requires that a manager sign his/her approval of timecards for employees in that department. This control plan is an example of: a. a systems controlb. the control environmentc. a pervasive control pland. a business process control plan
ANS: D
46. Controls that stop problems from occurring are called:a. preventive controlsb. detective controlsc. corrective controlsd. programmed controls
ANS: A
47. A control that involves reprocessing transactions that are rejected during initial processing is an example of:a. preventive controlsb. detective controlsc. corrective controlsd. programmed controls
ANS: C
Controlling Information Systems: Introduction to Internal Controls 141
48. The programmed verification of a customer number is a ______________ control.a. preventiveb. detectivec. correctived. application
ANS: A
49. Which of the following business scandals involved special purpose entities to hide billions of dollars in corporate liability?a. Enronb. WorldComc. Adelphia Communicationsd. Tyco
ANS: A
COMPLETION
1. ________________ is the possibility that an event or action will cause an organization to fail to meet its objectives or goals.
ANS: Risk
2. A(n) ____________________ is caused by events or situations which subject an organization to the possibility of some type of harm, danger, or loss.
ANS: exposure
3. ____________________ is a deliberate act or untruth intended to obtain unfair or unlawful gain.
ANS: Fraud
4. The ________________________________________ Act establishes legal responsibility for management to prevent fraud and other irregularities.
ANS: Foreign Corrupt Practices
5. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is known as _____________________.
ANS: erroneous record keeping
6. The establishment of accounting policies that are not GAAP or are inappropriate to the circumstances often caused by improper interpretation or willful disregard of GAAP is
ANS: unacceptable accounting
7. The exposure often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision is ______________________.
ANS: erroneous management decisions
142 Chapter 7
8. _______________ is the exposure is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors.
ANS: Fraud and embezzlement
9. Various penalties that may be brought by judicial or regulatory authorities is (are)
ANS: statutory sanctions
10. The inability of an organization to remain abreast of the demands of the marketplace is (are) _________________.
ANS: competitive disadvantage
11. The section of Sarbanes Oxley that establishes an independent board to oversee public company audits is _________________.
ANS: Public Company Accounting Oversight Board or Title I
12. The section of Sarbanes Oxley that prohibits a CPA firm that audits a public company from engaging in certain non-audit services is _______________________.
ANS: Auditor Independence or Title II
13. The section of Sarbanes Oxley that requires a company’s CEO and CFO to certify quarterly and annual reports is ___________________.
ANS: Corporate Responsibility or Title III
14. The section of Sarbanes Oxley that requires each annual report filed with the SEC to include an internal control report is _____________________.
ANS: Enhanced Financial Disclosures or Title IV
15. The section of Sarbanes Oxley that requires financial analysts to properly disclose in research reports any conflicts of interest they might hold with the companies they recommend is ___________________.
ANS: Analysis of Conflicts of Interests or Title V
16. The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is _____________________.
ANS: Corporate and Criminal Fraud Accountability or Title VIII
17. The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5,000,000 and up to 20 years imprisonment if they certify false or misleading financial statements with the SEC is ____________________.
ANS: White Collar Crime Enhancements or Title IX
Controlling Information Systems: Introduction to Internal Controls 143
18. The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the document’s integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is __________________________.
ANS: Corporate Fraud and Accountability or Title XI
19. According to the Ernst and Young Fraud survey, the number one fraud worry on the minds of executives is _______________________.
ANS: asset misappropriation
20. A computer crime techniques called ____________________ involves the systematic theft of very small amounts from a number of bank or other financial accounts.
ANS: salami
21. A computer abuse technique called a __________ involves a program that replicates itself on disks, in memory, or across networks.
ANS: worm or virus
22. A computer abuse technique called a(n) ____________________ involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program.
ANS: trap door
23. A(n) ____________________ is a computer abuse technique in which unauthorized code is inserted in a program, which, when activated, causes a disaster such as shutting down a system or destroying data.
ANS: logic bomb
24. A(n) ____________________ is program code that can attach itself to other programs (i.e., "infect" those programs), that can reproduce itself, and that operates to alter the programs or to destroy data.
ANS: computer virus
25. ____________________ is the entity's identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed.
ANS: Risk assessment
26. The ____________ sets the tone of the organization, influencing the control consciousness of its people.
ANS: control environment
27. ____________________ are the policies and procedures that help ensure that management directives are carried out.
ANS: Control activities
144 Chapter 7
28. Establishing a viable internal control system is the responsibility of _________________.
ANS: management
29. ____________________ is a process that assesses the quality of internal control performance over time.
ANS: Monitoring
30. ____________________ is a system of integrated elements--people, structures, processes, and procedures--acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals.
ANS: Internal control
31. The ____________________ refers to an organization's general awareness of and commitment to the importance of control throughout the organization.
ANS: control environment
32. The control goal called ____________________ strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended.
ANS: ensure effectiveness of operations
33. The control goal that seeks to provide protection against loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources is called ____________________.
ANS: ensure security of resources
34. The control goal of ensure input ____________________ strives to prevent fictitious items from entering an information system.
ANS: validity
35. A(n) ____________________ item is an object or event that is not authorized, never occurred, or is otherwise not genuine.
ANS: invalid
36. The control goal that is concerned with the correctness of the transaction data that are entered into a system is called ensure ____________________.
ANS: input accuracy
37. A missing data field on a source document or computer screen is an example of an error that could undermine the achievement of the control goal of ensure ____________________.
ANS: input accuracy
Controlling Information Systems: Introduction to Internal Controls 145
38. The control goal of ensure ____________________ provides assurance that all valid objects or events which were entered into the computer are in turn reflected in their respective master data.
ANS: update completeness
39. The control goal of ensure input ____________________ requires that all valid objects or events are captured and entered into the computer.
ANS: completeness
40. Information policies and procedures which assist in accomplishing control goals are known as ____________________.
ANS: control plans
41. ______________________ relate to those controls particular to a specific process or subsystem, such as billing or cash receipts, or to a particular technology used to process data.
ANS: Business control plans
42. Control plans that relate to a multitude of goals and applications are called ________________.
ANS: pervasive control plans
43. A control plan requires that a manager sign his/her approval of timecards for employees in that department. This control plan is an example of a ______________________.
ANS: business process control plan
44. A batch of business events is accurately entered into a business event data, but the computer operator fails to use the data to update master data. This type of processing error would be classified as a(n) __________________ error.
ANS: operational
45. Three terms used in the chapter to refer to when a control plan is exercised are ____________________, ____________________, and corrective control plans.
ANS:preventivedetective
46. A(n) ____________________ is designed to discover problems that have occurred.
ANS: detective control plan
47. A(n) ____________________ is designed to rectify problems that have occurred.
ANS: corrective control plan
146 Chapter 7
PROBLEM
1. Below is an alphabetical list of nine common business exposures presented in Chapter 7. The second list contains eight possible causes of exposures (there could be others).
Required:
On the blank line to the left of each numbered item, place the capital letter of the exposure that best matches that cause. Do not use a letter more than once. You should have one letter unused.
Business Exposures
A. Business interruptionB. Competitive disadvantageC. Erroneous management decisionsD. Erroneous record keepingE. Excessive costsF. Fraud and embezzlementG. Loss or destruction of assetsH. Statutory sanctionsI. Unacceptable accounting
POSSIBLE EXPOSURE CAUSES
Answers
_____ 1. Information that is inappropriate for the decision being made
_____ 2. Improper interpretation or disregard of FASB standards
_____ 3. Incomplete or inaccurate processing of a business event
_____ 4. Deliberate misinforming of management or investors
_____ 5. A natural calamity such as a fire
_____ 6. Lack of proper safeguards over an organization's information resources
_____ 7. An information system that has not kept pace with changes in customer needs
_____ 8. Improper interpretation or disregard of SEC regulations
Controlling Information Systems: Introduction to Internal Controls 147
ANS:
PossibleExposure
Cause Answer
1 C2 I3 D4 F5 A (Although we believe answer A is best, E is acceptable.)6 G7 B8 H
2. Below is a list of control goals followed by a list of short scenarios describing system failures (i.e., control goals not met) and/or instances of successful control plans (i.e., plans that helped to achieve control goals).
Required:
On the blank line to the left of each numbered scenario, place the capital letter of the control goal that best matches the situation described. HINT: Some letters may be used more than once. Conversely, some letters may not apply at all.
Control GoalsA. Ensure effectiveness of operations.B. Ensure efficient employment of resources.C. Ensure security of resources.D. Ensure input validity.E. Ensure input accuracy.F. Ensure input completeness.G. Ensure update accuracy.H. Ensure update completeness.
SCENARIOSAnswers
_____ 1. A batch of documents sent by the mail room to the accounts receivable department were lost in the intercompany mail and never recorded.
_____ 2. A mail room clerk fabricated a phony document for a friend to make it look like the friend had paid his account receivable balance. The phony document got recorded.
_____ 3. An accounts receivable clerk made a copy of the company's accounts receivable master data and sold this customer information to a competing company.
_____ 4. Customer checks received in the mail room are batched and sent to the cashier several times a day so that they can be deposited as fast as possible.
148 Chapter 7
_____ 5. A flaw in the processing logic of a computer program resulted in cash received from customers being added to their accounts receivable balances rather than subtracted.
_____ 6. In a manual bookkeeping system, an accounts receivable clerk failed to post an entire page of transactions from the cash receipts journal to the accounts receivable subsidiary ledger.
_____ 7. In a manual bookkeeping system, cash receipts recorded correctly in the cash receipts journal on December 31st were inadvertently posted to customer accounts under a date of January 1st.
_____ 8. In keying remittance advices into his computer terminal, an accounts receivable clerk entered a receipt of $200 as $2,000.
ANS:
Scenario ScenarioNumber Answer Number Answer
1 F 5 G2 D 6 H3 C 7 G4 A 8 E
3. Figure TB-7.1 depicts the "general" control model shown in Chapter 7 but with all labels removed.
Required:
Complete Figure TB-7.1 by inserting the following labels where they belong in the model:
Process Labels Data Flow Labels• Evaluate process • Recommendations• Observe actual state of process • Objectives• Establish desired state of process • Documentation• Recommend changes to process • Observations• Document actual state of process • Evaluation
Controlling Information Systems: Introduction to Internal Controls 149
ANS:For solution, see Figure 7.1 in Chapter 7 of the text.
4. Listed below are 13 specific fraud examples taken from some well-known fraud cases: MiniScribe, ZZZZ Best Carpet Cleaning, Lesley Fay, and Equity Funding.
Required:
For each fraud example, enter a letter corresponding to which information control goal was initially violated--Validity, Completeness, or Accuracy. Some examples might involve more than one violation.
NOTE: When we say initially, we mean what control goal failure led to this example, not what is the present condition. For example, master data might contain information that is inaccurate, but it might have been an inaccurate input that initially caused the data to be inaccurate.
Fraud Examples:
Control Goal
Initially Violated
Scenario
1. MiniScribe: Sales were inflated by shipping disk drives that were not ordered by customers.
2. MiniScribe: Sales of goods were recorded prior to the passing of title.3. MiniScribe: Some sales returns were never recorded.4. MiniScribe: Defective disk drives were included in inventory.5. MiniScribe: Auditors' workpapers were altered to inflate inventory
values.
150 Chapter 7
6. ZZZZ Best Carpet Cleaning: Phony receivable/sales documents were created to overstate sales.
7. ZZZZ Best Carpet Cleaning: Payments were recorded to fictitious vendors.
8. Lesley Fay Cos.: Inventory was overstated, thereby understating cost of goods sold.
9. Lesley Fay: Markdown allowances to retailers were understated or omitted.
10. Lesley Fay: Suppliers' invoices were not recorded.11. Lesley Fay: Revenues and profits were inflated by recording sales
entries for several days after a quarter had ended.12. Equity Funding: 63,000 bogus insurance policies were created and
recorded.13. Other: A bank teller stole $1.5 million by pocketing customer
deposits. He covered his theft by accessing an unsecured computer terminal and transferring funds from dormant bank accounts into the accounts of customers from whom he had received deposits.
ANS:
Scenario Control Goal Initially Violated
1. V2. A or V3. C4. V5. V or A6. V7. V8. V or A9. A or C10. C11. A or V12. V13. V
5. The CFO of Exeter Corporation is very uncomfortable with its current risk exposure relate to the possibility of business disruptions. Specifically, Exeter is heavily involved with e-Business and its internal information systems are tightly interlinked with its key customers systems. The CFO has estimated that every hour of system downtime will cost the company about $5,000 in sales. The CFO and CIO have further estimated that if the system were to fail, the average downtime would be about 2 hours per incident. The have anticipated (assume with 100% annual probability) that Exeter will likely experience 10 downtime incidents in a given year due to internal computer system problems, and another 10 incidents per year due to external problems; specifically system failures with the Internet service provider (ISP). Currently, Exeter pays an annualized cost of $25,000 for redundant computer and communication systems, and another $25,000 for Internet service provider (ISP) support just to keep total expected number of incidents to 20 per year.
Controlling Information Systems: Introduction to Internal Controls 151
Required:a. Given the information provided thus far, how much ($) is the company’s current expected
gross risk?
b. A further preventative control would be to purchase and maintain more redundant computers and communication lines where possible, at an annualized cost of $30,000, which would reduce the expected number of downtimes per year to 5 per year due to internal computer system problems. What would the dollar amount of Exeter’s current residual expected risk at this point?
ANS:a.$5,000 X 2 hours = $10,000 per incident. $10,000 per incident X 20 incidents X 100% probability = $200,000 for expected gross risk.
b.Expected gross risk $200,000 – (5 less internal incidents X $10,000) = $150,000 plus add the cost of the additional computers and communication lines of $30,000 = $180,000 residual expected risk.
6. Matching section on Sarbanes Oxley
1. _____ Section makes it a felony to knowingly destroy, alter, or create records and/or documents with the intent to impede, obstruct, or influence and ongoing or contemplated federal investigation and provides protection for whistle blowers.
2. _____ Section prohibits a CPA firm that audits a public company to engage in certain non-audit services with the same client.
3. _____ Corporate federal income tax returns should be signed by the CEO.
4. _____ Section requires each annual report filed with the SEC to include an internal control report.
5. _____ Section that requires the company’s CEO and CFO to certify quarterly and annual report.
6. _____ Section requires financial analysts to properly disclose in research reports any conflicts of interest they might hold with the companies they recommend.
7. _____ Section establishes an independent board to oversee public company audits.
8. _____ Section authorizes the General Accounting Office (GAO) to study the consolidation of public accounting firms since 1989 and offer solutions to any recognized problems.
a. Public Company Accounting Oversight Boardb. Auditor Independencec. Corporate Responsibilityd. Enhanced Financial Disclosurese. Analysts Conflicts of Interestf. Studies and Reports
152 Chapter 7
g. Corporate and Criminal Fraud Accountabilityh. Corporate Tax Returns
