Chapter 11

The system designed, implemented, and maintained by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of an entity's objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations

An act of two or more employees who conspire to steal assets or misstate records

Represent the fundamental concepts related to each of the five components of internal control; all principles must be functioning for controls to be effective

The actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity

The person(s) with responsibility for overseeing the strategic direction of the entity and its obligations related to the accountability of the entity, including overseeing the financial reporting and disclosure process

Management's identification and analysis of risks relevant to the preparation of financial statements in accordance with an applicable accounting framework

Policies and procedures, in addition to those included in the other four component of internal control, that help ensure that necessary actions are taken to address risks in the achievement of the entity's objectives; they typically include the following five specific control activities:
1. adequate separation of duties
2. proper authorization of transactions and activities
3. adequate documents and records
4. physical control over assets and records
5. independent checks on performance

Separation of the following activities in an organization:
1. custody of assets from accounting
2. authorization from custody of assets
3. operational responsibility from record keeping
4. IT duties from outside users of IT

Companywide policies for the approval of all transactions within stated limits

Case-by-case approval of transactions not covered by companywide policies

A listing of all the entity's accounts that classifies transactions into individual balance sheet and income statement accounts

Internal Control Activities designed for the continuous internal verification of other controls

The set of manual and/or computerized procedures that initiate, record, process, and report an entity's transactions and maintain accountability for the related assets

Management's ongoing and periodic assessment of the quality of internal control performance to determine that controls are operating as intended and are modified when needed

Controls that have a pervasive effect on the entity's sustem of internal control; also referred to as company-level controls

Controls that relate to all parts of the IT function and affect many different software applications

Controls typically at the business process level that apply to processing transactions, such as the inputting, processing, and outputting of sales or cash receipts

The information technology and internal control processes an organization has in place to protect computers, networks, programs, and data from unauthorized access

A company's computer testing approach that involves implementing a new system in just one part of the organization while maintaining the old system at other locations

A company's computer testing approach that involves operating the old and new systems simultaneously

Controls built into the computer equipment by the manufacturer to detect and report equipment failure

Application controls done by people

Application controls done by the computer

Controls designed by an organization to ensure that the information to be processed by the computer is authorized, accurate, and complete

Controls designed to ensure that data input into the system are accurately and completely processed

Controls designed to ensure that computer-generated data are valid, accurate, complete, and distributed only to authorized people

Encrypted connection over the Internet from a device into a network

Preconfigured images of operating systems and applications

Networks that connect computer equipment, data files, software, and peripheral equipment within a local area, such as a single building or a small cluster of buildings, for intracompany use

Networks that connect computer equipment, databases, software, and peripheral equipment that reside in many geographic locations, such as client offices located around the world

Hardware and software systems that allow clients to establish and maintain databases shared by multiple applications

Systems that integrate numerous aspects of an organization's activities into one accounting information system

A system of hardware and software that monitors and controls the flow of e-commerce communications by channeling all network connections through a control gateway

Computer programs that change a standard message or data file into one that is coded and then decoded using a decryption program

Electronic certificates that are used to authenticate the validity of individuals and companies conducting business electronically

An organization that provides IT services for companies on an outsourcing basis

Third-party entities that manage and supply software applications or software-related services to customres through the Internet

A computer resource deployment and procurement model that enables an organization to obtain IT resources and applications at an IT service center shared with other organizations from any location via an Internet connection