Flashcards in Computer Systems and Information Technology Deck (26):
List and describe the three broad classes of computer controls?
General Controls - overall operation
Application Controls - Specific programs input, processing and output
User controls - human controls applied by individuals outside of the computer system
Name the categories of general computer controls?
controls over data center and network operations, system software acquisition, change and maintenance
application system acquisition, development and maintenance
How is test data used to check a computer program?
a batch of transactions is entered into a software program with one valid transaction. if programmed properly it should handle the invalid transactions appropriately
What are some of the testing methods in auditing through the computer process?
test data approach
embedded audit module approach
integrated test facility
What is a controlled program?
an original program copy that is kept unchanged to perform a parallel simulation.
What is an integrated test facility?
allows dummy data to be processed along with live data. if dummy data is processed correctly then it assumed live data is also processed correctly
What is a parallel simulation?
client data is processed in some type of controlled process, then same data processed using client's software. results should be the same
What is the definition of online real-time processing?
direct access into the processing unit of main computer, changes made at a terminal are immediately processed and the effect of the changes are immediate
What are several controls to ensure computers, programs and data are adequately secured?
restricted access to all computer hardware
exception reporting for failed attempts to access the system or data files
What separation of duties is particularly important in the IT department?
programmers be separate from system design and computer operators
access to data and system files should also be separate from program and system development
specific individuals charged with IT management who are responsible for oversight of IT functions
What are several application controls to keep bad or faulty data out of the computer system?
What is a self-checking number?
a number where the final digit or a digit in a consistent position within the number derived by some mathematical formula based on other digits in the number
What is being measured by item counts, hash totals, and batch totals?
item count is number of transactions
hash total is a number derived from a group of computer transactions that is not normally determined
batch total is a total normally derived but also used for control purposes
What is a limit test?
an application control where upper and lower limits are set for certain transactions
What is a validity check?
compares data being processed to an independent database
What is a control group?
independent team established for review of computer system controls
How should companies reduce the chance of misuse of EDI transmissions?
authentication controls to ensure proper submission and delivery of information
encryption so that messages are unreadable to unauthorized parties
What prevents mixing of data between several programs running simultaneously?
program boundary protection
What is a generalized audit software package?
a set of programs designed specifically for auditing purposes, which can be easily operated on an auditor's desktop or laptop computers
What is a control total?
a total that has been determined in advance for data being entered into a computer program
What is EDI?
transmission of document image and data within that image directly from a computer at one entity to a computer at another entity
What are the two benefits of an EDI system?
increase the speed of data transmission between two or more entities that are doing business with one another
decrease the opportunity for clerical errors
What is the main problem an auditor faces when auditing a client that uses an online real-time system?
it gives users access into the computerized info systems from a remote terminal location
What controls should an online real-time computer system have?
frequently changing passwords
limit of log-on attempts
What is a value-added network?
an organization that gathers and transmits EDI communications between specific parties