Week 10 Flashcards
(23 cards)
What are the two main categories of fraud?
Misappropriation of assets (theft) and fraudulent financial reporting (“cooking the books”).
What three elements must exist for fraud (Fraud Triangle)?
Pressure (financial/emotional need), Opportunity (weak controls), Rationalization (justifying unethical behavior).
Example of misappropriation in Malaysia?
MH370 case - bank officer stole RM110,643 from passengers’ accounts.
Example of fraudulent financial reporting?
M K Land Holdings - overstated land disposal gains as revenue (RM80.77m tax penalty).
Define computer fraud classification types:
Input fraud, Processor fraud, Computer instruction fraud, Data fraud, Output fraud.
Most common cybercrime in Malaysia (2015)?
Fraud - #1 for 5 consecutive years per CyberSecurity Malaysia.
What is a botnet?
46.2M Malaysian mobile records stolen (2017).
Distinguish virus vs. worm:
Virus requires human action to replicate; worm self-replicates independently.
Ransomware example in Malaysia?
WannaCry attack (2017) - encrypted files demanding Bitcoin ransom.
Four social engineering techniques:
Phishing (fake emails), Pretexting (fabricated scenarios), Shoulder surfing, Dumpster diving.
How to spot phishing?
Check sender address, urgency tactics, attachment requests (e.g., fake Citibank email).
Three functions of internal controls:
Preventive (deter), Detective (identify), Corrective (recover).
Why segregate accounting duties?
Prevent single-person fraud:
Custody (handle assets) ≠ Recording (bookkeeping) ≠ Authorization.
Key components of COSO framework:
Control environment, Risk assessment, Control activities, Information/communication, Monitoring.
Four risk response strategies:
Reduce (implement controls), Accept (tolerate risk), Share (insurance), Avoid (stop activity).
COBIT5 vs. COSO-ERM:
COBIT5 focuses on IT governance; COSO-ERM expands to enterprise risk management.
Inherent vs. Residual risk:
Inherent = pre-control risk; Residual = post-control risk.
Auditor’s fraud detection duties (ISA):
Assess control risks, understand fraud schemes, document findings, use tech-focused approaches.
Three ways to deter fraud:
Culture of integrity, strong internal controls, fraud detection software.
How to minimize social engineering?
ever share passwords, verify unknown requests, restrict tailgating into secure areas
Salami technique example:
Round-down fraud - stealing fractions of cents from transactions.
ARP spoofing vs. IP spoofing:
ARP spoofing attacks LANs; IP spoofing hides DoS attack sources.
Purpose of change management controls?
Ensure system updates don’t create vulnerabilities or disrupt operations.
