Risk Management: Exposure, Likelihood and Controls
Study these flashcardsFree · spaced repetition · iPhone, Android, Mac & web
All cards
1
deter/prevent problems from occurring
Example: an employee who records cash received from customers dose not also have access to the cash itself
Example: an employee who records cash received from customers dose not also have access to the cash itself
preventive control
2
discover problems that are not prevented
Example: reconciling bank accounts
Example: reconciling bank accounts
detective controls
3
: fix and recover from the problems
Example: maintaining backup copies of files, correcting data entry errors and resubmitting transactions for subsequent processing
Example: maintaining backup copies of files, correcting data entry errors and resubmitting transactions for subsequent processing
corrective controls
4
Who is responsible for documenting and maintaining internal control procedures and evaluating their effectiveness?
managment
5
managment is responsbilie for 4
Select and develop the internal control procedures.
Ensure they are documented and maintained.
Continuously monitor and evaluate whether each component of internal control is present and functioning.
See that deficiencies are communicated and corrected, with serious matters reported to senior management and the board of directors.
Ensure they are documented and maintained.
Continuously monitor and evaluate whether each component of internal control is present and functioning.
See that deficiencies are communicated and corrected, with serious matters reported to senior management and the board of directors.
6
framework for enterprise internal controls (control-based approach). Goldstand/commonly use reference for internal controls (benchmark)
COSO internal control intergated framework
7
COSO: internal control integrated framework parts 5
control environment
risk assessment
control activies
information and communication
monitoring
risk assessment
control activies
information and communication
monitoring
8
or company culture, influences how organizations establish strategies and objectives; structure business activities; and identify, assess, and respond to risk. It is the foundation for each of the other principles
1. Demonstrate commitment to integrity and ethical values
2. Ensure that board exercises oversight responsibility
3. Establish structures, reporting lines, authorities and responsibilities
4. Demonstrate commitment to a competent workforce
5. Hold people accountable for internal control responsibilities
1. Demonstrate commitment to integrity and ethical values
2. Ensure that board exercises oversight responsibility
3. Establish structures, reporting lines, authorities and responsibilities
4. Demonstrate commitment to a competent workforce
5. Hold people accountable for internal control responsibilities
COSO: internal control integrated framework: control environment
9
6.Specify appropriate objectives
7.Identify and analyze risks
8.Evaluate fraud risks
9. Identify and analyze changes that could significantly affect internal control
7.Identify and analyze risks
8.Evaluate fraud risks
9. Identify and analyze changes that could significantly affect internal control
COSO: internal control integrated framework: risk assessment
10
estimate potential loss if event occur
Exposure/impact:
11
probability that the event will occur
likelihood
12
risk that exists before plans are made to control it
inherent risk
13
risk that is left over after you control it
residual risk
14
implement effective internal control
risk reduce
15
do nothing, accept likelihood and impact of risk
risk accept
16
buy insurance, outsorce or hedge
share risk
17
do not engage in the activity
avoid risk
18
Assessing and responding to risk process: 5
Identify risks/threats
Estimate likelihood and impact
Estimate expected loss = impact * likelihood
Identify controls
Estimate cost and benefits from instituting controls
Estimate likelihood and impact
Estimate expected loss = impact * likelihood
Identify controls
Estimate cost and benefits from instituting controls
19
Benefits > Costs =
reduce risk
20
Costs > benefits =
avoid, accept or share risk
21
10.Select and develop control activities that mitigate risks
11.Select and develop technology controls
12.Deploy control activities through policies and procedures
11.Select and develop technology controls
12.Deploy control activities through policies and procedures
COSO: internal control integrated framework: control activities
22
13.Use relevant, quality information to support the internal control function
14.Communicate internal control information internally
15.Communicate internal control information externally
14.Communicate internal control information internally
15.Communicate internal control information externally
COSO: internal control integrated framework: informattion and communication
23
Information and communication principles: 3
Obtain or generate relevant, high-quality information to support internal control
Internally communicate the information, including objectives and responsibilities, necessary to support the other components of internal control
Communicate relevant internal control matters to external parties
Internally communicate the information, including objectives and responsibilities, necessary to support the other components of internal control
Communicate relevant internal control matters to external parties
24
16.Perform ongoing or periodic evaluations of internal controls
17.Communicate internal control deficiencies
17.Communicate internal control deficiencies
COSO: internal control integrated framework: monitoring
25
What are the factors or considerations that influence the control environment, and how can they be managed? 6
management philosophy and risk appetite
commitment to integrity and ethics
board oversigh
organizational structure
HR standards
external infleunces
commitment to integrity and ethics
board oversigh
organizational structure
HR standards
external infleunces
26
When does an organization choose risk avoidance
An organization chooses risk reduction when it is cost‑effective to lower the likelihood or impact of a risk by implementing internal controls.
Example in the text: reduce risk “by implementing an effective system of internal controls.”
Example in the text: reduce risk “by implementing an effective system of internal controls.”
27
When does an organization choose risk reduction
Risk is accepted when, after considering controls, the remaining (residual) risk is:
Within the company’s risk appetite / tolerance range, and
There is no cost‑beneficial way to reduce it further.
The text notes this is appropriate for risks with a small likelihood and a small impact, or generally when “risk can be accepted if it is within the company’s risk tolerance range.”
Within the company’s risk appetite / tolerance range, and
There is no cost‑beneficial way to reduce it further.
The text notes this is appropriate for risks with a small likelihood and a small impact, or generally when “risk can be accepted if it is within the company’s risk tolerance range.”
28
When does an organization choose risk sharining
risk sharing (or transfer) is chosen when the company wants to reduce its exposure without eliminating the activity, so it passes some or all of the risk to another party.
The text gives examples: “buying insurance, outsourcing an activity, or entering into hedging transactions.
The text gives examples: “buying insurance, outsourcing an activity, or entering into hedging transactions.
29
When does an organization choose risk acceptance
An organization chooses risk avoidance when there is no cost‑effective way to bring the risk into an acceptable tolerance range.
In that case, the company stops or does not start the risky activity—for example:
Not engaging in the activity at all
Selling a division
Exiting a product line
Not expanding as anticipated
In that case, the company stops or does not start the risky activity—for example:
Not engaging in the activity at all
Selling a division
Exiting a product line
Not expanding as anticipated
30
What are the three categories of accounting related duties we should keep separated?
Authorization
Recording
Custody
Recording
Custody
31
How does the segregation of IT duties help prevent fraud and errors in IT systems?
Segregation of IT (systems) duties helps prevent fraud and errors by making sure no single person has enough control over the system to both commit and hide improper actions.
32
What can effective information and communication systems help achieve? 3
create an ethical, transparent culture
reduce the likelihhood of fraud and errors
improve detection and response
reduce the likelihhood of fraud and errors
improve detection and response
33
What are the main differences between the COSO internal control framework and the COSO ERM framework in terms of scope and purpose?
the COSO Internal Control–Integrated Framework (ICIF) focuses narrowly on evaluating specific controls for operations, reporting, and compliance, while the COSO Enterprise Risk Management (ERM) Framework broadens that scope to integrate risk management directly with organizational strategy, performance, and value creation.
34
expands COSO framework taking a risk-based approach
COSO - Enterprise risk management framework (COSO ERM):
35
COSO - Enterprise risk management framework (COSO ERM): process 5
government and culture
strategy and objective setting
performance
review and revsion
information, communication and reportin
strategy and objective setting
performance
review and revsion
information, communication and reportin
36
1. Exercises Board risk oversight.
2. Establishes operating structures.
3. Defines desired culture.
4. Demonstrates commitment to core values.
5. Attracts, develops, and retains capable individuals.
2. Establishes operating structures.
3. Defines desired culture.
4. Demonstrates commitment to core values.
5. Attracts, develops, and retains capable individuals.
COSO - Enterprise risk management framework (COSO ERM): goverment and culture
37
ERM Compare to COSO internal control framework governance and culture (similaries and difference)
Similarity: Both frameworks regard governance as foundational,influencing the tone and efficiency of risk management and control practices.
Difference: COSO ERM expands on the concept of control environment to include a broader cultural perspective and the role of the board and senior management in setting the tone at the top.
Difference: COSO ERM expands on the concept of control environment to include a broader cultural perspective and the role of the board and senior management in setting the tone at the top.
38
Analyzes business context.
7. Defines risk appetite.
8. Evaluates alternative strategies.
9. Formulates business objectives
7. Defines risk appetite.
8. Evaluates alternative strategies.
9. Formulates business objectives
COSO - Enterprise risk management framework (COSO ERM): strategy and objective setting
39
ERM Compared to COSO internal control framework strategy and objective-setting: (similarity and difference)
Similarity: Both require clear objective-setting to ensure alignment with the organization’s goals and risk tolerance.
Difference: COSO ERM more explicitly connects the dots between strategy, objective-setting, and risk appetite
Difference: COSO ERM more explicitly connects the dots between strategy, objective-setting, and risk appetite
40
10. Identifies risk.
11. Assesses severity of risk.
12. Prioritizes risks.
13. Implements risk responses.
14. Develops portfolio view.
11. Assesses severity of risk.
12. Prioritizes risks.
13. Implements risk responses.
14. Develops portfolio view.
COSO - Enterprise risk management framework (COSO ERM): perfomance principles
41
ERM Compare to COSO internal control framework perfromance (similarity and diffence)
Similarity: Both consider the importance of performance as it relates to the achievement of objectives.
Difference: COSO ERM is more dynamic in assessing performance from a risk perspective, including identifying and responding to performance variances.
Difference: COSO ERM is more dynamic in assessing performance from a risk perspective, including identifying and responding to performance variances.
42
15. Assesses substantial change.
16. Reviews risk and performance.
17. Pursues improvement in enterprise risk management.
16. Reviews risk and performance.
17. Pursues improvement in enterprise risk management.
COSO - Enterprise risk management framework (COSO ERM): review and revision principles
43
ERM compared to COSO internal controls review and revison (similarity and difence)
Similarity: Both frameworks stress the importance of review and the need for iterative improvement.
Difference: COSO ERM is expansive, emphasizing strategic adaptation to changing risks and business landscapes, while COSO Internal Control focuses more on maintaining the integrity of the control processes themselves.
Difference: COSO ERM is expansive, emphasizing strategic adaptation to changing risks and business landscapes, while COSO Internal Control focuses more on maintaining the integrity of the control processes themselves.
44
18. Leverages information and technology.
19. Communicates risk information.
20. Reports on risk, culture, and performance.
19. Communicates risk information.
20. Reports on risk, culture, and performance.
COSO - Enterprise risk management framework (COSO ERM): information, communication and reporting principles
45
ERM compare to COSO internal controls information, communication and reporting (similarity and difference)
Similarity: Timely and accurate information and communication are essential in both frameworks for operational effectiveness and decision-making.
Difference: COSO ERM extends the scope of communication to a strategic level, emphasizing the alignment with enterprise-wide risk management and overall strategy, whereas COSO Internal Control traditionally concentrates on the effectiveness of communicating internal control information specifically
Difference: COSO ERM extends the scope of communication to a strategic level, emphasizing the alignment with enterprise-wide risk management and overall strategy, whereas COSO Internal Control traditionally concentrates on the effectiveness of communicating internal control information specifically
46
COBIT stresses the need to manage IT risks and controls across the entire enterprise and emphasizes taking into account both the technical and business aspects of IT. Why is this important for organizations? 3
Stakeholder value and risk-reward balance
hollstic, end-to-end governance
regulatory compllance and rellability
hollstic, end-to-end governance
regulatory compllance and rellability
47
Prevent financial statement fruad and make financial reports transparent. Protect investors, strengthen internal controls and require evaluation. Increase executive accountability for financial reporting and establish auditor independence provisions
Sarbanes-Oxley Act (SOX) 2002
48
Established that CEOs are directly responsible for any financial report filed with the SEC. Requires senior corporate officers to certify personally the accuracy and completeness of all financial reports
Section 302: Corporate Responsibility for Financial Reports
49
Requires an annual internal control report stating that management is responsible for an "adequate" internal control structure, and an assessment by management of the effectiveness of the control structure. Any deficiencies in the internal control structure and procedures are reported. Requires the company's auditor to attest to, and report on, management's assessment.
Section 404: Management Assessment of Internal Controls:
50
Benefits of SOX compliance: 6
Strengthened control environment
Improved documentation
Increased audit committee involvement
Standardized processes
Reduced complexity
Minimization of human error
Improved documentation
Increased audit committee involvement
Standardized processes
Reduced complexity
Minimization of human error
51
SOX applies to:
Publicly trade firms and their auditors
52
Rules/Roles required of audit committee: 3
Members must be on the board of directors and be independent of the company
Audit committee hire, compensate and oversee any registered public accounting firm that is employed by the company
One member of the audit committee must be a financial expert
Audit committee hire, compensate and oversee any registered public accounting firm that is employed by the company
One member of the audit committee must be a financial expert
53
Rules and roles required of management: 3
- SOX requires CEOs and CFOs to certify that (1) financial statements and disclosures are fairly presented, have been reviewed by management, and are not misleading; and (2) the auditors were informed of all material internal control weaknesses and fraud.
- Management must prepare an annual internal control report that states they are responsible for establishing and maintaining an adequate internal control structure.
- Management must prepare an annual internal control report stating that significant control changes after management's evaluation were disclosed and corrected.
- Management must prepare an annual internal control report that states they are responsible for establishing and maintaining an adequate internal control structure.
- Management must prepare an annual internal control report stating that significant control changes after management's evaluation were disclosed and corrected.
54
report is generated by an independent audit of a company’s information security systems and the controls it has in place to secure those systems and the information stored, processed, and/or transmitted by them.
Service organization controls (SOC):
55
SOC1 Purpose, scope, and typical providers
Purpose: Audit of controls at a service provider that protect client-owned data involved in client financial reporting.
Scope: Focuses on the provider’s internal control over financial reporting (ICFR).
Typical providers: Payroll processors, billing management, trust companies, financial reporting software, data centers of financial data.
Scope: Focuses on the provider’s internal control over financial reporting (ICFR).
Typical providers: Payroll processors, billing management, trust companies, financial reporting software, data centers of financial data.
56
SOC1 purpose, scope and typical providers
Purpose: Audit of controls over non‑financial client data and customer data.
Scope: Controls evaluated against AICPA trust principles: security, availability, processing integrity, confidentiality, and privacy. It can cover all or only selected principles.
Typical providers: Cloud services, SaaS, HR management, data centers.
Scope: Controls evaluated against AICPA trust principles: security, availability, processing integrity, confidentiality, and privacy. It can cover all or only selected principles.
Typical providers: Cloud services, SaaS, HR management, data centers.
57
Why would a company providing outsourced IT or financial services need to obtain a SOC report?
Theiir controls are part of client's internal control over finanical reproting
clients auditors must test those outsoruced
SOC report is shared with all clients and their auditors
clients auditors must test those outsoruced
SOC report is shared with all clients and their auditors
58
Trust services Framework: dite COBIT
Security
Confidentiality
privacy
processing intergity
availability
Confidentiality
privacy
processing intergity
availability
59
access to the system and data is controlled and restricted to legitimate users. Systems are protected against unauthorized access, both physical and logical, to safeguard data and operations. It is the foundational criterion, all other criteria depend on effective security (bedrock of Trust services framework)
security
60
How can an organization mitigate potential security risks associated with human behavior? 3
build a secuirty-consious culture
use HR pollcies and training
strenghten controls
use HR pollcies and training
strenghten controls
61
formula used to evaluate if security procedures are effective. An effective combination of preventive, detective, and corrective controls that protect information assets long enough to enable an organization to recognize that an attack is occurring and take steps to thwart it before any information is lost or compromised.
The time-based model of information security:
62
The time-based model of information security formlua
P > D + R/C
P = time to break through preventive controls
• D = is time to detect an attack is in progress
R or C = time to respond to the attack and take corrective actio
P = time to break through preventive controls
• D = is time to detect an attack is in progress
R or C = time to respond to the attack and take corrective actio
63
What are examples and best practices of physical access controls? 4
Limit entry to building
Restrict access to computer/sever room
Secure laptops and mobile devices
Secure network printers
Note: Generally, these are general controls!
Restrict access to computer/sever room
Secure laptops and mobile devices
Secure network printers
Note: Generally, these are general controls!
64
logical secuirty 2
authentication
authorization
authorization
65
process of verifying the identity of the person or device attempting to access the system
Something person knows
Something person has
Some biometric characteristic
Combination of at least two (multifactor authenticationzation MFA)
Something person knows
Something person has
Some biometric characteristic
Combination of at least two (multifactor authenticationzation MFA)
authentication
66
process of restricting access of authenticated users to specific portions of the system and limiting what actions they are permitted to perform
authorization
67
authorization controls 2
access control matrix
compatibility test
compatibility test
68
table used to implement authorization controls
access control matrix
69
Matches user's authentication against the access control matrix to determine if the user can use a resource or perform a task. Test can be applied to network addresses as well as people. Authorizations can be built into business process management systems, sometimes called workflow
compatibility test
70
authorization account role 2
Employees can acquire authorizations over time that are not needed for current job duties: review authorization/access for employees
Segregation of duties is determined by access and authorizations in the computer system: Review all employees’ access to sensitive transactions
Segregation of duties is determined by access and authorizations in the computer system: Review all employees’ access to sensitive transactions
71
Give a user who needs access to unlimited or administrative rights 2 user ids:
ID 1: limited normal rights for everyday used
ID2: powerful administrative rights for limited used only which is logged and reviewed
ID 1: limited normal rights for everyday used
ID2: powerful administrative rights for limited used only which is logged and reviewed
Accounts with elevated or admin rights:
72
sensitive organizational data is protected
confidentiality
73
personal information about trading partners, investors, and employees is protected
privacy
74
data are processed accurately, completely in a timely manner, and only with proper authorization
processing intergity
75
system and information are avaliable
availability
76
How do network access controls help prevent unauthorized access and security breaches on a company's network?
controlling who get in (authentication)
limiting what they can do (authorization)
permieter and physical control
limiting what they can do (authorization)
permieter and physical control
77
Steps in an incident response process 3
Recognition
Containment (stop the attack)
Recovery (repiar)
Follow-up (learn from attack)
Containment (stop the attack)
Recovery (repiar)
Follow-up (learn from attack)
78
Key component for an organization to be able to respond to security incidents promptly and effectively/ Should include IT and senior management (CFO, COO)
Needs to be practiced:
• Consequences of taking down the network
• Communication when the network is down
Needs to be practiced:
• Consequences of taking down the network
• Communication when the network is down
Computer incident response team (CIRT):
79
a senior-level corporate executive who builds and oversees an organization's cybersecurity strategy, data protection policies, and risk management programs
Chief information security officer (CISO)
80
What are some potential consequences of a breach of privacy in the trust services framework, and how can these consequences impact customers? 3
Financial identity theft: thieves obtain loans, open credit cards, or loot bank accounts in the victim’s name.
Medical identity theft: fraudulently obtaining medical care can create dangerous errors in medical records (e.g., wrong allergies or prescriptions) and may exhaust insurance benefits.
Tax identity theft: perpetrators file fraudulent tax returns using the victim’s Social Security number, causing long delays in receiving legitimate refunds.
Medical identity theft: fraudulently obtaining medical care can create dangerous errors in medical records (e.g., wrong allergies or prescriptions) and may exhaust insurance benefits.
Tax identity theft: perpetrators file fraudulent tax returns using the victim’s Social Security number, causing long delays in receiving legitimate refunds.
81
What are some potential consequences of a breach of privacy in the trust service framework, ahd how can these consequences impact the company? 2
Regulatory obligations such as notifying affected individuals and providing compensation (e.g., free credit monitoring), increasing costs.
Ethical and reputational damage, since customers, employees, suppliers, and partners entrust them with personal data and expect it to be protected.
Ethical and reputational damage, since customers, employees, suppliers, and partners entrust them with personal data and expect it to be protected.
82
Protecting confidentiality and privacy: 4
Identify and classify the information to be protected: Where is it located and who has access?Classify value of information to organization
Encrypt the information In transit and in storage
Control access to the information
Tran employees to properly handle the information
Encrypt the information In transit and in storage
Control access to the information
Tran employees to properly handle the information
83
Employee training for protecting confidentiality and privacy
What data or processes should be protected
What to share with outsiders
Appropriate discussion areas for sensitive data
Proper use of email, blogs, chat and social media
Basic data security measures
how to use encryption
What to share with outsiders
Appropriate discussion areas for sensitive data
Proper use of email, blogs, chat and social media
Basic data security measures
how to use encryption
84
Basic data security measures 3
Use a password-protected screen saver
Always log out of applications
Lock up documents containing sensitive data
Always log out of applications
Lock up documents containing sensitive data
85
controls outbound communications and mitigates insider threats by screening outgoing documents to identify and block transmission of sensitive information
Data Loss prevention (DLP) software
86
adds protection to sensitive digital content. Defines user permissions
Information rights management (IRM) software:
87
Information rights management (IRM) software can do what?
Specify the actions individuals granted access to information can perform
Limit action privileges to a specific time period
Limiting access to specific files
Limit action privileges to a specific time period
Limiting access to specific files
88
detective control to trace data breaches. Identifiers source of leakage (intentional or accidental)
digtial watermark
89
replaces real data with generic or fake values, reduces exposure risk. Use to protect the privacy of a customer's personal information when giving programmers a realistic data set with which to test a new application?
Data masking (tokenization):
90
secures data awhile stored or in transmission, it is not effective during processing and must be paired with access controls and user training
encryption
91
Protects data in storage or in transit over the Internet. Provides one last barrier for an intruder. Strengthens authentication procedures. Plays an essential role in ensuring and verifying the validity of e-business transaction
encryption preventive controls
92
Factors that influence encryption strength 3
Key length (longer =stronger)
Algorithm
Cryptographic key management
Algorithm
Cryptographic key management
93
Steps in Encryption and Decryption process: 2
Takes plain text and with an encryption key and algorithm, converts to unreadable ciphertext (sender of message)
To read ciphertext, encryption key reverses process to make information readable (receiver of message
To read ciphertext, encryption key reverses process to make information readable (receiver of message
94
Uses one key to encrypt and decrypt. Both parties need to know the key
– Need to securely communicate the shared key
– Cannot share key with multiple parties, they get their own (different) key from the organization
– Need to securely communicate the shared key
– Cannot share key with multiple parties, they get their own (different) key from the organization
Symmetric Encryption:
95
Uses two keys and can create digital signatures
Public: everyone has access and can be used by all your trading partners
Private: only know by one party
Public: everyone has access and can be used by all your trading partners
Private: only know by one party
Asymmetric Encryption:
96
is a distributed ledger of hashed documents with copies stored on multiple computers. When implemented correctly, it can provide a high degree of trust, increase transaction security, and automate transactions minimizing errors. For accountants, using blockchain provides clarity over ownership of assets and existence of obligations, and could dramatically improve efficiency. The parts of accounting concerned with transactional assurance and carrying out transfer of property rights will be transformed by blockchain and smart contract approaches
blockchain
97
Basic block in a blockchain contents 3
Data
Hash
Hash of pervious block
Hash
Hash of pervious block
98
Chains form in a blockchain because:
: information about the has of the previous block is in the current block
99
Tampering with a block in a blockchain would:
change the hash of the block, causing following blocks in turn to be invalid because they no longer store a valid hash of the previous block
100
Extra layers of security in the blockchain
3
3
Proof of work
Proof of stake
Permissioned chain
Proof of stake
Permissioned chain
101
Securely transmits encrypted data between sender and receiver. Encrypts your internet traffic while also hiding your IP address by routing your traffic through a proxy server
Virtual private network (VPN):
102
: encrypted packets can’t be read/filtered by firewall or router
VPN limitation
103
: a process that takes plain text of any length and creates a short code called a message digest, popularly referred to as a hash.
Hashing:
104
Pros of Hashing: 4
provide a means to test the integrity of a document
Used to verify whether two copies of a document, each stored on a different device, are identical
Plays an important role in creating legally binding digital signatures
Essential component underlying blockchains
Used to verify whether two copies of a document, each stored on a different device, are identical
Plays an important role in creating legally binding digital signatures
Essential component underlying blockchains
105
Encryption vs hashing
Hashing:
One-way function (cannot reverse or unhash to recover original document)
Any size input yields the same fixed-size output
Encryption:
Reversible
Output size approximately the same input size.
One-way function (cannot reverse or unhash to recover original document)
Any size input yields the same fixed-size output
Encryption:
Reversible
Output size approximately the same input size.
106
Which form of encryption is used to create digital signatures
asymeetric encryption
107
What are some potential limitations to using encryption? 3
only protects at rest or in transit, not during processing
dosen't protect what's visble
limited protection after logon
dosen't protect what's visble
limited protection after logon
108
Purpose of digital signatures 3
Authentication: digital signatures can be used to authenticate the source of messages
Integrity: the sender and receiver of a message may need confidence that the message was not altered during transmission. If a message is digitally signed, any change in the message after signature invalidates the signature.
Non-repudiation: An entity that has signed some information cannot at a later time deny having signed it. Similarly, access to the public key only does not enable a fraudulent party to fake a valid signature. Extremely important to e- business.
Integrity: the sender and receiver of a message may need confidence that the message was not altered during transmission. If a message is digitally signed, any change in the message after signature invalidates the signature.
Non-repudiation: An entity that has signed some information cannot at a later time deny having signed it. Similarly, access to the public key only does not enable a fraudulent party to fake a valid signature. Extremely important to e- business.
109
Steps to create digital signatures 2
Hashing (signing)
- Hash function
- Encrypt hash using signer’s private key, creating a signature and certificate
- Attach the signature to data
Asymmetric encryption (verifcation)
- Digitally signed data
- Data get convert with a hash function
- Signature is decrypt using signer’s public key
- Hash function
- Encrypt hash using signer’s private key, creating a signature and certificate
- Attach the signature to data
Asymmetric encryption (verifcation)
- Digitally signed data
- Data get convert with a hash function
- Signature is decrypt using signer’s public key
110
Privacy management framework 9
management
agreement,notice and communication
collection and creation
use, retention, and disposal
Access
disclosure to thrid parties
security for privacy
data integrity and quality
monitoring and enforcement
agreement,notice and communication
collection and creation
use, retention, and disposal
Access
disclosure to thrid parties
security for privacy
data integrity and quality
monitoring and enforcement
111
Procedures and policies with assigned responsibility and accountability
managment
112
Provide notice of privacy policies and practices prior to collecting data
agreement, notice and communication
113
only collect need information
collection and creation
114
Use information only for stated business purpose. When no longer useful, dispose in a secure manner.
Use, Retention, and Disposal
115
Customer should be able to review, correct, or delete information collected on them
access
116
protect from loss or unathroized access
Security for Privacy:
117
Accuracy & completeness
Data Integrity and Quality
118
procedures in responding to complaints and compliance
Monitoring and Enforcement
119
The first step in protecting the privacy of personal information is to identify.
who has access to sensitive information.
where sensitive information is stored.
what sensitive information is possessed by the organization.
All of the above are first steps in protecting privacy
who has access to sensitive information.
where sensitive information is stored.
what sensitive information is possessed by the organization.
All of the above are first steps in protecting privacy
all of the above
120
Which of following action(s) must an organization take to preserve the confidentiality of sensitive information?
Create a digital signature of that information
Implement a blockchain
Train employees to properly handle information
All of the above are correct.
Create a digital signature of that information
Implement a blockchain
Train employees to properly handle information
All of the above are correct.
train employees to properly handle information
121
in your textbook is described as information that must be protected from unauthorized access and disclosure because of its importance or sensitivity.
Proprietary manufacturing processes
Product development data
Proprietary business processes
Competitive bidding data
Proprietary manufacturing processes
Product development data
Proprietary business processes
Competitive bidding data
Highly confidential
122
is any sensitive information an organization possesses that must be protected from unauthorized access and disclosure.
Strategic plans
Trade secrets
Cost information
Legal documents
Process improvements
Strategic plans
Trade secrets
Cost information
Legal documents
Process improvements
Confidential (internal)
123
information avaiable to the public
Earnings announcement data
Security and exchange commission fillings
Product spefiication data
Financial statements
Marketing information
Earnings announcement data
Security and exchange commission fillings
Product spefiication data
Financial statements
Marketing information
public
124
System processing is complete, valid, accurate, timely, and authorized. Does the system work as intended free from error, delay, omission, and unauthorized or inadvertent manipulation? Focuses on the correctness and reliability of the processes and systems that handle data. Is closely related to and often overlaps with data integrity.
Processing integrity
125
maintain the accuracy, completeness, and reliability of data throughout this cycle
The goal of data processing cycle
126
input risk 4
Invalid data
• Unauthorized input
• Incomplete data
• Inaccurate data
• Unauthorized input
• Incomplete data
• Inaccurate data
127
processing risks 3
Errors in programming leading to incorrect output and stored data
• Processing interruptions
• Concurrency issues
• Processing interruptions
• Concurrency issues
128
output risks 4
Inaccurate or incomplete reports or documents
• Unauthorized disclosure of sensitive information
• Loss, alteration, or disclosure of information
• Data interception and tampering
• Unauthorized disclosure of sensitive information
• Loss, alteration, or disclosure of information
• Data interception and tampering
129
What are the best practices for designing forms 4
Source documents and other forms should be designed to minimize errors and omissions.
All source documents should be sequentially prenumbered so missing or duplicate documents can be detected.
Turnaround documents should be used where possible to reuse existing data (for example, preprinted account numbers), reducing manual input errors.
Forms and records should be as simple as possible, with clear spaces for authorizations and, where assets are transferred, for the receiver’s signature.
All source documents should be sequentially prenumbered so missing or duplicate documents can be detected.
Turnaround documents should be used where possible to reuse existing data (for example, preprinted account numbers), reducing manual input errors.
Forms and records should be as simple as possible, with clear spaces for authorizations and, where assets are transferred, for the receiver’s signature.
130
best pratiaces for cancellation and storage of documents 2
Once entered, source documents must be canceled (e.g., stamped “paid” or electronically flagged) so they cannot be reentered, inadvertently or fraudulently.
Canceled originals or their images must be retained as part of the audit trail and to meet legal and regulatory requirements.
Canceled originals or their images must be retained as part of the audit trail and to meet legal and regulatory requirements.
131
best prataices for authoriation and segreation of duities 2
Only authorized personnel acting within their authority should prepare source documents.
Input controls include explicit authorization and segregation of duties controls to prevent invalid or unauthorized data from entering the system
Input controls include explicit authorization and segregation of duties controls to prevent invalid or unauthorized data from entering the system
132
best prataices for procedures and ongoing maintance 2
Written procedures must address input preparation, transaction processing, error detection and correction, controls, reconciliations, database access, and output preparation and distribution.
Training, manuals, and help screens should support consistent application of these controls so errors are minimized and detected and corrected when they occur.
Training, manuals, and help screens should support consistent application of these controls so errors are minimized and detected and corrected when they occur.
133
To ensure the accuracy, authorization, and completeness of the data entered into the system
input control
134
Forms of input controls
Authorizations
Segregation of duties
Forms design:
Cancelation and storage of source document
Visual scanning
Data entry controls:
Segregation of duties
Forms design:
Cancelation and storage of source document
Visual scanning
Data entry controls:
135
sequential numbering of source documents and turnaround documents
forms design
136
assigns a unique identifier to each document. Every transaction is recorded and can be traced back to a specific source. Documents can be easily filed,located, and referenced. Gaps or irregularities in the sequence can indicate problems
Sequentially numbered source documents:
137
Forms are preprinted with certain information and are designed to be completed and returned to the company. Facilitate the accurate capture of data. Ensure uniformity in the data collected. Electronic forms are increasingly replacing paper turnaround documents
Preprinted Turnaround documents:
138
be it basic data entry controls, additional batch processing controls, or additional online processing controls
data entry controls
139
: Input constraints & field validation. Ensures that the data entered into each field of a form meets specific criteria. Help prevent errors
basic data entry controls
140
field check
sign check
limit check
range check
size check
completness check
validity check
reasonableness test
check digit verifcation
sign check
limit check
range check
size check
completness check
validity check
reasonableness test
check digit verifcation
basic data entry controls
141
characters in a field are proper type (numerical, text, date/time)
Field check
142
data in a field is appropriate sign (+/-)
sign check
143
test numerical amounts of date/time against a fixed value
limit check
144
tests numerical amount or date/time against lower and upper limits
range check
145
input data fits into the filed
size check
146
verifies that all required data is entered
completeness check
147
compares data to that of master file to verify existence
valifity check
148
correctness of the logical relationship between two data itmes
reasonableness test
149
recalculating the check digit to verify that no data entry
check digit verifcation
150
A single digit computed from the other digits in the numb and appended to the end of the number; provides a quick way to verify the correctness of the entered number
Check digits:
151
: test of batch data in proper numerical or alphabetical sequence
sequence check
152
summarize numeric values for a batch of in put recorders (finanical total, hash total, record count)
batch totals
153
system prompts you for input (online completeness checks)
prompting
154
checks accuracy of input data by using it to retrieve and display other related information (e.g customer account # retrieves the customer name
close-loop verifcation
155
to verify that data is processed correctly, including error detection and correction mechanisms
Processing controls:
156
Processing controls: 7
data matching
fuke kabkes
recal batch totals
cross-footing
zero-balance tests
duplication checks
write-protection mechanisms
concurrent update controls
fuke kabkes
recal batch totals
cross-footing
zero-balance tests
duplication checks
write-protection mechanisms
concurrent update controls
157
two or more items must be matched before an action takes place
data matching
158
: ensure correct and most updated file is used
file labels
159
located at the beginning of each file and contains the file name, expiration date, and other identification data
header records
160
located at the end of the file and contains the batch totals calculated during input
trailier recorder
161
verifies accuracy by comparing two alternative ways of calculating the same total
cross-footing
162
protect against overwriting or erasing data
write-protection mechanisms
163
prevent error of two or more users updating the same record at the same time. Need to agree in order of changes, especially when there are multiple writes
concurrent update controls
164
Key objectives of availability controls 2
Key objectives of availability controls
Quick and complete recovery and resumption of normal operations
Quick and complete recovery and resumption of normal operations
165
Minimizing downtime controls 5
Preventive maintenance
Training
Patch management and antivirus software
Fault tolerance:
Data center location and design
Training
Patch management and antivirus software
Fault tolerance:
Data center location and design
166
: ability of a system to continue functioning in the event that a particular component fails through the used of redundant components (extra servers, virtualization, RAID used as mirroring)
fault tolerance
167
Good practices for data center location/design
Raised floor
• Fire suppression
• Air conditioning
• Uninterruptible power supply (UPS)
• Surge protection
• Physical access controls
• Fire suppression
• Air conditioning
• Uninterruptible power supply (UPS)
• Surge protection
• Physical access controls
168
Recovery controls:
backup procedures
Diaster recovery plan
business continutiy plan
Diaster recovery plan
business continutiy plan
169
is an exact copy of the entire database (or file set). Because it backs up everything, it is accurate and straightforward to restore from, but it is also time‑consuming. For that reason, most organizations:
Full backup procedures
170
is any backup that does not copy the entire database or file system. In your text, partial backups are done daily to supplement less frequent full backups.
Partial backup procedure
171
Copies only items that have change since last partial backup
Incremental backup procedure: Copies
172
copies all changes made since last full backup
Differential backup procedure:
173
focuses on preserving data long term as a historical record, often for legal or regulatory reasons, rather than restoring an entire system.
Archive backup procedure:
174
Procedures to restore organization’s IT function. Temporarily replacing the necessary computer infrastructure, such as computers, network equipment and access, telephone lines, other office equipment.
Disaster recovery plan (DRP):
175
How to resume all operations, not just IT
Business continuity plan (BCP):
176
Recovery options 5
recciprocal agreement
cold site
warm standby
hot site
real-time mirrorting
cold site
warm standby
hot site
real-time mirrorting
177
agreements with another organization that uses similar equipment to have temporary access to and use of their information system resources
reciprocal agreement
178
an empty building that is prewired for necessary telephone and Internet access, plus a contract with one or more vendors to provide all necessary computers, and other office equipment within a specified period of time. Backup once per day
Prolonged periods of downtime
4-8 day recovery time and 24 hour recovery point objective
Prolonged periods of downtime
4-8 day recovery time and 24 hour recovery point objective
cold site
179
facility that is prewired for telephone and Internet access and also contains all the needed computing and office equipment. Continuous data replication
Fault-tolerant and zero downtime
2-4 hour RTO and RPO
Fault-tolerant and zero downtime
2-4 hour RTO and RPO
hot site
180
maintaining two copies of the database at two separate data centers both updated in real time at the same time
real-time mirroring
181
Key information for accounting dep (2)
recovery point objective (RPO)
Recovery time objective (RTO)
Recovery time objective (RTO)
182
The maximum mount of data that the organization is willing to have to reenter or potentially lose. Data created since last backup
Recovery point objective (RPO)
183
maximum tolerable time to restore an information system after a disaster. How long will transactions need to be processed manually
Recovery time objective (RTO)
More Business & economics flashcards
Marketing Basics: Exchange, Markets and MixBusiness & economics · EnglishCallieFacilities Layout and Location PlanningBusiness & economics · EnglishPsalmsco ja vimBusiness & economics · CzechZuzanaLESSON 1: INTRODUCTION TO I.T. IN BUSINESSBusiness & economics · EnglishDionHealthcare FinancingBusiness & economics · Englishkay24Man Ind Exam 1Business & economics · EnglishLexieeconBusiness & economics · EnglishMaddoxW45abreviation 60Business & economics · EnglishLoïcE2 Business ModelsBusiness & economics · EnglishEllaProperty and Casualty Insurance Exam (California)Business & economics · EnglishashACG3341 Chapter 13 (Cost Accounting & Control 1) (6th chapter we did; after Chapter 5)Business & economics · EnglishAndrewACESSFMBusiness & economics · EnglishDigby
All Business & economics decks
Study these decks in the app
Free on iPhone, Android, Mac and the web. Add any deck to your account in one tap.
