Module 41 Flashcards
(52 cards)
1
Q
INFORMATON SYSTEM
IN A BUSINESS
A
- An information system processes data and transactions to provide users with the information they need to plan, control, and operate an organization
2
Q
IT SYSTEMS
A
- Transaction Processing - Involve the daily processing of transaction (airplane reso)
- Mgmt Reporting - Designed to help with decision making
3
Q
MANAGEMENT REPORTING
SYSTEMS
A
- Mgmt Info - Provide info on planning, organizing and controlling
- Decision Support - computer based system that resolve nonstructured issues
- Expert Systems - Apply reasoning methods to data, like human experts
- Executive Info - designed to support executive work
4
Q
SYSTEM DESIGN AND PROCESS
A
- The systems design life cycle includes the following steps:
- Planning Phase
- Analysis Phase
- Design Phase
- Development Phase
- Testing Phase
- Implementation Phases
- Maintenance Phase
5
Q
PLANNING PHASE
A
- Majors steps include
- Define the system to be developed
- Determine the project scope
- Develop a project plan
6
Q
ANALYSIS PHASE
A
- Phase involves users, specialists, and designers to understand the requirements of proposed system
- Needs assesment is done to determine requirements
- Analysis of existing system
- Gap analysis to determine the differences
- Finally priorities will be given to the gaps and documented
7
Q
DESIGN PHASE
A
- Build the technical blueprint
8
Q
DEVELOPMENT PHASE
A
- The platform on which the system is to operate is created and the programs and databases are developed
9
Q
TESTING PHASE
A
- Verify the system works, tests include:
- Units Testing - pieces of code
- System Testing - integrate code
- Integration Testing - test seperate systems can work together
- User Acceptance Testing - does the system allow users to do the job
10
Q
IMPLEMENTATION PHASE
A
- Putting the system in operation by the users, methods include:
- Parallel - both systems at once (old&new)
- Plunge - jump into new, ditch old
- Pilot - small amt of users use before all
- Phase - install in series (A/P then A/R)
11
Q
COMPUTER TYPES
A
- In order of size and power
- Supercomputers
- Mainframe Comuters
- Minicomputers
- Microcomputers - (PC)
- Personal Digital Assistants - (PDA)
12
Q
CENTRAL PROCESSING UNIT (CPU)
A
- Central Processing Unit (CPU) main function is to fetch data decode instructions, and carry out instructions
- Arithmetic/Logic Unit - performs math ops and logic comparisions
- Primary Memory - Active data being processed (RAM & ROM)
- Control Unit - Interprets program instructions, then input/output
13
Q
STORAGE DEVICES
A
- Magnetic Tape
- Magnetic Disks
- RAID - redundant array of indepen disks
- Compact Disks
- Zip Disks
- Optical Disks - uses laser tech
- USB - Universal service bus
14
Q
INPUT DEVICES
A
- Key To Tape - data entered on tapes
- Online Entry
- visual display terminal
- mouse, joystick
- touch sensitive screen
- Turnaround Docs. - remittance bills
- Automated Source Data Inputs
- magnetic tape reader
- magnetic ink reader
- scanner
- ATM
- POS recorders
- voice recognition
- E Commerce - one co. to another
15
Q
OUTPUT DEVICES
A
- Monitors - visual display output
- Printers - produce paper output
- Plotters - produce paper output in graphs
- Computer output to microfilm
16
Q
SOFTWARE
A
- Systems Software
- Operating System (windows)
- Utility Programs - back-up file
- Communication soft - controls transmissions btwn comps
- Application Software
- Low-end - all in one package (quickbooks)
- High-end - in modules (AP, GL)
- ERP - ent. resource plan - (SAP)
17
Q
SOFTWARE TERMS
A
- Source Program - program in language translated in machine language (JAVA, C++)
- Compilier - Produces object program from source
- Object Program - converted source program for CPU
18
Q
METHODS OF PROCESSING
A
- Batch - transactions in groups (month-end)
- Online Real Time - processed in the order they occur
- Centralized - process occurs in one location
- Decentralized - process and data done on computers at multiple locations
- Distributed - transaction from sinle database processed at various sites (payroll in NY, and CT)
19
Q
DATA ORGANIZATION
A
- Bit - binary digit (0 or 1)
- Byte - group of adjecent bits (usually 8)
- Feild - group of related characters
- Record - order of fields (social)
- Array - aggregate of data objects w/ attributes such as name then social then birth date
20
Q
DATABASE STRUCTURES
A
- Heirachical - data of one level owns data from other
- Networked - Data element w/ many owners
- Relational - logical structure of related sheets
- Object Oriented - structered in classes
- Onject Relational
- Distributed - single database spread accross multiple comps in differ locations
21
Q
DATABASE CONTROLS
A
- User Dept. - strict controls over who can read/change
- Access Controls - limit to authorized portions
- Restrict Priveleges - limit operations as well
- Logical Views - authorized views of portions of data
22
Q
DATABASE SYSTEM
+ AND -
A
- Advantages
- data independence
- min redundancy (store 1)
- data sharing
- reduce maintenence
- adjust to corp needs
- Disadvantage
- need specialized peeps
- installation costly
- conversion from old costly
- back/recovery procedures needed
23
Q
NETWORKS BY GEO
A
- Local Area Network - LAN - private owned in a single building
- Metro Area Network - MAN - larger LAN, maybe a group of offices
- Wide Area Network - WAN - span a country
24
Q
NETWORKS BY OWNERSHIP
A
- Private - strict set of users
- Public - owned by 3rd party, leased to users using public switched networks
- Cloud - resources via a digital netowrk, managed by cloud server
25
**NETWORKS BY INTERNET USE**
1. Internet - collection of networks from indep computers
2. Intranet - A local network, usually limited to an org.
3. Extranet - Similiar to Inta but may include supplier access
26
**INTERNET TERMINOLOGY**
1. Firewall - security algorithms that dont allow outsiders to tap in
2. Router - interface connects two networks
3. Bridge - divides LAN into two segments
4. Switch - channels incoming data from multiple ports to desired destination
5. Gateway - combination of hardware and software linking networks
6. Proxy Server - server that saves and serves copies of webpages
7. TCP/IP - communication language of internet
27
**LOCAL AREA NETWORKS (LAN)**
- Privately owned networks in a single building
- Control Implications
1. general controls are weak
2. reliance on end usuers who may not be control conscious
3. inadequate resources for problem solving
4. segregation of duties must exist for logging and access control
5. good menegment controls needed such as pw and codes
6. LAN software may have light security features for large environments
28
**MICROCOMPUTERS**
- Must consider the following when dealing with microcomputers
1. Security - security over comp and data
2. Verification of Processing - review to make sure no personal projects being done
3. Personell - centralized authorization to purchase hardward must be established, copyright issues exist
29
**END USER COMPUTING**
**(EUC)**
- The end user is responsible for the development and executiong of computer applications
- Risks Include:
1. application not adequately tested
2. more personell need to understand control concepts
3. Mgmt doesn't often review
4. applications may not be updated for current needs
30
**END USER COMPUTING**
**CONTROL ISSUES**
- EUC Control Implications
1. Require adequate testing
2. Require adequate documentation
3. Require access controls
4. Control access to appropriate users
5. Control use of incorrect versions
6. Require to backup of files
7. Provide application controls
8. Support programmed or user reconciliations to provide assurance
31
**ELECTRONIC COMMERCE**
- Electronic commerce involves individuals engaging in electronic transactions with computers (either public or private). Risk include:
1. Security
2. Availability
3. Processing Integrity
4. Online Privacy
5. Confidentiality
32
**ELECTRONIC FUNDS TRANSFER (EFT)**
- EFT is making cash transfers between two people instead of checks
- Risks of unathorized accessa nd fraudulant tranfers the following controls are needed:
1. Physical access to network
2. Electronic ID for all EFT terminals
3. Passwords
4. Encrypt data thats being transferred
33
**ELECTRONIC DATA INTERCHANGE (EDI)**
- Electronic exchange of business transactions. Web based E commerce is replacing EDI.
- Risks inlcude:
1. Reduced float (A/R processed fast)
2. No paper trail (no bills, just transactions)
34
**ELECTRONIC DATA INTERCHANGE METHODS**
- EDI methods of communicating include:
1. Point-to-Point - direct computer to computer link
2. Value-Added Network - independently operated network that manages transaction btwn partners
3. Public Network - internet based
4. Proprietary Network - corp. developed on own, such as banking
35
**ELECTRONIC DATA INTERCHANGE BENEFITS**
1. Quick access to info
2. Cost efficiency
3. Reduced paperwork
4. Accuracy
5. Better communication/cust service
6. Necessary to remain competitive
36
**ELECTRONIC DATA INTERCHANGE EXPOSURES**
1. Total dependence on computer
2. Loss of confidentiality
3. Increase chance of fraud
4. Controlled only by few peeps
5. Reliance on 3rd parties (VAN)
6. Data processing/communication errors
7. Legal liability due to errors
8. Loss of audit trails
9. Reliance on trading partners system
37
**TELECOMMUNICATIONS**
- Electronic transfer of info by radio, wire, fiber optic, coaxial cable, laser etc. Controls needed:
1. System Integrity
2. Data Entry
3. Central computer security
4. Dial-in security
5. Transmission accuracy
6. Physical security of facilities
7. Encryption during transmissions
38
**COBIT**
- Control Objectives for Information and Related Technology
- A framework developed by the Information System Audit and Control Association (ISACA)
- Its a systematic way of intergrated IR with business strategy and risk
39
**COBIT INFORMATION CRITERIA**
- To satisfy biz objectives infoneeds to conform to the follwoing criteria:
1. Effectiveness - relavant, timely
2. Efficiency - develop w/ optimal resources
3. Confidential
4. Integrity - accurate
5. Availability - access when needed
6. Comliance - comply w/ laws
7. Reliability - should be available for mgmt
40
**COBIT RESOURCES**
- Employing the following resources to acheive business objectives:
1. Applications - systems process info
2. Information - the data
3. Infrastructure - the tech (comp, hardware)
4. People - personell needed to plan, etc
41
**COBIT PROCESS MODEL**
- IT activities in a process model:
1. Plan and Organize
2. Aquire and Implement
3. Delivery and Support
4. Monitor and Evaluate
42
**EFFECT OF IT ON IC**
- Principles of a reliable system presented by the AICPA Trust Services:
1. Security
2. Availability
3. Processing Intergrity
4. Online Privacy
5. Confidentiality
- When a principle is not met risks exist
43
**IT CONTROL ENVIRONMENT**
- Of teh seven factors of the control environment, Organization Structure is modified for IT
- Segregation of duties is essential for the functions surrounding programming, data entry, operations, and library
44
**IT RISK ASSESSMENT**
- Changes in computerized information systems and in operations may increase the risk of improper financial reporting
45
**IT INFO. AND**
**COMMUNICATION**
- The acct. system is effected based on size of computers used
- Small - controls w/ software well known, and analysis of exception reports are important
- Big - controls w/ software are unknown to auditor, excerpt reports anlaysis is important
46
**IT MONITORING**
- Proper monitoring requires adequate computer skills
- Improper access can be monitored through system logs
- IT can facilitate monitoring through consistent evaluations of data, and sample collectiong for auditors
47
**IT CONTROL ACTIVITIES**
- Consists of three categories:
1. General
2. Application
* Programmed
* Manual
3. User
- Manual application follow-up is only as effective as the programmed results and the user follow-up
48
**IT GENERAL CONTROL ACTIVITES**
- Four types of general controls:
1. Developing new programs/systems
2. Changing new programs/systems
3. Controlling access to programs/data
4. Controlling computer ops
49
**IT PROGRAMMED**
**CONTROL ACTIVITES**
- Applies to a specific application rather than a bunch
- Controls operate to ensure proper input and data processing
- The input step converts human readable data into computer readable data
- Ensureing integrity of the data in teh computer for processing is essential
50
**IT PROGRAMMED**
**CONTROL EXAMPLES**
1. Preprinted Form
2. Check Digit - xtra digit added
3. Control/Batch Total - total of feild/row
4. Hash Total - nonsense total
5. Record Count - count of items listed
6. Limit Test - scores cant be \>99
7. Menu Driven Input - response prompt
8. Feild Check - only #'s, not words
9. Validty Check - dropdown to select amts
10. Missing Data Check
11. Feild Size Check - only certian # of charact
12. Logic Check - error is selection not valid
13. Redundant Check - uses two identifiers
14. Close Loop - data entry personell check
51
**IT MANUAL CONTROL ACTIVITIES**
- These controls involve emplyee follow-up on items listed on computer exception reports.
- Effectiveness depends on effectiveness of programmed control activities and and manual follow-up
52
**IT USER CONTROL**
**ACTIVITIES**
- Manual controls refered to as output controls
- Ofter performed by users/controlled groups
1. Check computer output against source documents
2. Review computer processing logs
3. Maintain proper procedures and communications specifying authorized recipients of output
