Internal Control Monitoring Purpose and Terminology Flashcards
Define “evaluator.”
An individual who monitors internal control. Must have skills, knowledge, and authority sufficient to understand risks and identify the controls needed to manage those risks. Two most important attributes are competence and objectivity.
Define “verifiable or verifiability.”
Can be established, confirmed, or substantiated as true or accurate.
Define “ persuasiveness of information or persuasive information.”
The degree to which the information provides support for conclusions. Derived from its suitability (i.e., its relevance, reliability, and timeliness) and its sufficiency.
Define “compensating controls.”
Controls that accomplish the same objective as another control and will “compensate” for deficiencies in the first control.
Define “key performance indicators.”
Metrics that reflect critical success factors. They help organizations measure progress towards critical goals and objectives.
Define “key controls.”
Controls that are most important to monitor in order to support a conclusion about the internal control system’s ability to manage or mitigate meaningful risks.
Define “self-review.”
Person responsible for a control but NOT that person’s peer or supervisor assesses control effectiveness. The least objective type of “self-assessment.”
Define “timely information.”
Information is produced and used in a time frame that makes it possible to prevent or detect control deficiencies before they become material.
Define “accuracy.”
The degree to which information can reasonably be expected to be free from error and/or to communicate results that reflect reality.
Define “reliable information.”
Information must be accurate, verifiable, and from an objective source.
Define “suitable information.”
Must be relevant (i.e., fits for its intended purpose), reliable (i.e., accurate, verifiable, and from an objective source), timely (i.e., produced and used in an appropriate time frame).
Define “objective or objectivity.”
The measure of the extent of factors that might influence a person to report inaccurate or incomplete information about risks or controls.
Define “key risk indicators.”
Forward-looking metrics that identify critical potential problems, thus enabling an organization t take timely action, if necessary.
Define “competence” in relation to a control evaluation.
Competence refers to the evaluator’s knowledge of the controls and related processes, including how controls should operate and what constitutes a control deficiency.
Define “relevant information.”
Information is meaningful to assessing a risk, control, or control competent.
