8Controlling Chapter Information Systems: Introduction to Pervasive Controls
TRUE/FALSE
1. IT governance leads to better organizational performance such as profitability.
ANS: T
2. As an IT resource, information includes data in all their forms that are input, processed and output by
information systems.
ANS: T
3. As an IT resource, applications are automated systems and manual procedures that process information.
ANS: T
4. The system of controls used in this text consists of the control environment, pervasive control plans,
IT general controls, and business process (and application) control plans.
ANS: T
5. As used in the text, the information systems organization (function) is synonymous with the accounting function.
ANS: F
6. The function composed of people, procedures, and equipment that is typically called the information
systems department, IS department, or the IT department is the information systems organization.
ANS: T
7. The IS function with the responsibility of guiding the IT organization in establishing and meeting user
information requirements is the IT steering committee.
ANS: T
8. The IS function with the principal responsibilities of insuring the security of all information systems
function resources is data control.
ANS: F
9. The IS function of quality assurance conducts reviews to ensure the attainment of IT customer requirements.
ANS: T
10. The chief information officer (CIO) prioritizes and selects IT projects and resources.
ANS: F
11. Within the data center, the data control group is responsible for routing all work into and out of the
data center, correcting errors, and monitoring error correction.
ANS: T
12. The IS function of systems development provides efficient and effective operation of the computer
equipment by performing tasks such as mounting tapes and disks, loading printer paper, and responding to computer messages.
ANS: F
13. Within the data center, the data librarian function grants access to programs, data, and documentation
to authorized personnel only.
ANS: T
14. Combining the functions of authorizing and executing events is a violation of the organizational control plan known as segregation of duties.
ANS: T
15. Segregation of duties consists of separating the four functions of authorizing events, executing events,
recording events, and safeguarding the resources resulting from consummating the events.
ANS: T
16. Embezzlement is a fraud committed by two or more individuals or departments.
ANS: F
17. A small organization that does not have enough personnel to adequately segregate duties must rely on
alternative controls, commonly called resource controls.
ANS: F
18. The functions of the security officer commonly include assigning passwords and working with human
resources to ensure proper interview practices are conducted during the hiring process.
ANS: T
19. Individual departments coordinate the organizational and IT strategic planning processes and reviews
and approves the strategic IT plan.
ANS: F
20. The policy of requiring an employee to alternate jobs periodically is known as forced vacations.
ANS: F
21. Forced vacations is a policy of requiring an employee to take leave from the job and substituting another employee in his or her place.
ANS: T
22. A fidelity bond indemnifies a company in case it suffers losses from defalcations committed by its employees.
ANS: T
23. According to COSO, most organizations are adequately monitoring operations.
ANS: F
24. Data encryption is a process that codes data to make it readable to human eye.
ANS: F
25. Systems documentation provides an overall description of the application, including the system's purpose; an overview of system procedures; and sample source documents, outputs, and reports.
ANS: T
26. Program documentation provides a description of an application computer program and usually includes the program's purpose, program flowcharts, and source code listings.
ANS: T
27. The user manual gives detailed instructions to computer operators and to data control about a particular application.
ANS: F
28. The operations run manual describes user procedures for an application and assists the user in preparing inputs and using outputs.
ANS: F
29. Training materials help users learn their jobs and perform consistently in those jobs.
ANS: T
30. Program change controls provide assurance that all modifications to programs are authorized and that
the changes are completed, tested, and properly implemented.
ANS: T
31. Business continuity planning is the process that identifies events that may threaten an organization and
provide a framework whereby the organization will continue to operate or resume operations with a
minimum of disruption.
ANS: T
32. Continuity is the process of using backup measures to restore lost data and resume operations.
ANS: F
33. With continuous data protection (CDP) all data changes are data stamped and saved to secondary systems as the changes are happening.
ANS: T
34. The disaster backup and recovery technique known as electronic vaulting is a service whereby data
changes are automatically transmitted over the Internet on a continuous basis to an off-site server
maintained by a third party.
ANS: T
35. The disaster recovery strategy known as a cold site is a fully equipped data center that is made available to client companies for a monthly subscriber fee.
ANS: F
36. A facility usually comprised of air-conditioned space with a raised floor, telephone connections, and
computer ports, into which a subscriber can move equipment, is called a hot site.
ANS: F
37. In a logic bomb attack, a Web site is overwhelmed by an intentional onslaught of thousands of simultaneous messages, making it impossible for the attacked site to engage in its normal activities.
ANS: F
38. Biometric identification systems identify authorized personnel through some unique physical trait such
as fingers, hands, voice, eyes, face, or writing dynamics.
ANS: T
39. Antivirus is a technique to protect one network from another "untrusted" network.
ANS: F
40. The most common biometric devices perform retinal eye scans.
ANS: F
41.
Access control software ensures that only authorized users gain access to a system through a
process
of identification and authentication.
ANS: T
42. Threat monitoring is a technique to protect one network from another untrusted network.
ANS: F
43. Application controls restrict access to data, programs, and documentation.
ANS: F
44. An intrusion-detection systems (IDS) logs and monitors who is on or trying to access the network.
ANS: T
45. Intrusion-prevention systems (IPS) actively block unauthorized traffic using rules specified by the organization.
ANS: T
46. Periodic cleaning, testing, and adjusting of computer equipment is referred to as preventative maintenance.
ANS: T
47. Computer hacking and cracking is the intentional, unauthorized access to an organization's computer
system, accomplished by bypassing the system's access security controls.
ANS: T
MULTIPLE CHOICE
1. The use of IT resources for enterprise systems and e-business
a. magnifies the importance of protecting the resources both within and outside of the organization from risks
b. magnifies the importance of protecting the resources both within but not outside the of the
organization from risks
c. makes it easier to provide internal control risk when IT resources are interlinked
d. none of the above
ANS: A
2. Top 10 management concerns about ITs capability to support an organizations vision and strategy include all except the following:
a. IT and business alignment
b. security and privacy
c. the Internet
d. retaining IT professionals
ANS: C
3. Top 10 security and privacy concerns reported by managers from 63 countries include all the following except:
a. disaster recovery/business continuity
b. the Internet
c. data backup
d. overall information security strategy
ANS: B
4. Pervasive control plans:
a. are unrelated to applications control plans
b. are a subset of applications control plans
c. influence the effectiveness of applications control plans
d. increase the efficiency of applications control plans
ANS: C
5. COBIT was developed to:
a. provide guidance to managers, users, and auditors on the best practices for the management of information technology
b. identify specific control plans that should be implemented to reduce the occurrence of
fraud
c. specify the components of an information system that should be installed in an e-commerce environment
d. suggest the type of information that should be made available for management decision
making
ANS: A
6. The department or function that develops and operates an organizations information systems is often
called the:
a. information systems organization
b. computer operations department
c. Controllers office
d. computer technology branch
ANS: A
7. In an information systems organization structure, the three functions that might logically report directly to the CIO would be:
a. systems development, technical services, and data center
b. systems development, database administration, and data center
c. systems development, technical services, and data librarian
d. applications programming, technical services, and data center
ANS: A
8. Data in all their forms that are input, processed, and output by information system are called this IT resource:
a. Information
b. Applications
c. Infrastructure
d. People
ANS: A
9. Automated systems and manual procedures that process information are called this IT resource:
a. Information
b. Applications
c. Infrastructure
d. People
ANS: B
10. Which of the following IT resources includes hardware, operating systems, DBMSs, and networking?
a. Information
b. Applications
c. Infrastructure
d. People
ANS: C
11. ____ can consist of many computers and related equipment connected together via a network.
a. PCs
b. Servers
c. LAN
d. Firewall
ANS: C
12. In an information systems organization, which of the following reporting relationships makes the least
sense?
a. the data center manager reports to the CIO.
b. the systems development manager reports to the data center manager.
c. database administration reports to the technical services manager.
d. the data librarian reports to the data center manager.
ANS: B
13. In an information systems organization, all of the following functions might logically report to the data
center manager except:
a. data control
b. computer operations
c. data librarian
d. quality assurance
ANS: D
14. Managing functional units such as networks, CAD/CAM and systems programming typically is a major duty of:
a. data center manager
b. systems development
c. technical services manager
d. database administrator
ANS: C
15. From the standpoint of achieving the operations system control goal of security of resources, which of
the following segregation of duties possibilities is least important?
a. between systems programming and computer operations
b. between data control and data preparation personnel
c. between systems development and computer operators
d. between technical services and data center
ANS: B
16. A key control concern is that certain people within an organization have easy access to applications
programs and data files. The people are:
a. data librarians
b. systems programmers
c. systems development
d. data center managers
ANS: B
17. Which of the following has the major duties of prioritizing and selecting IT projects and resources
a. steering committee
c. CIO
d. systems development manager
ANS: A
18. Which of the following has the responsibility to ensure the security of all IT resources?
a. steering committee
b. security officer
c. CIO
d. systems development manager
ANS: B
19. Which of the following has the responsibility of efficient and effective operation of IT?
a. steering committee
b. security officer
c. CIO
d. systems development manager
ANS: C
20. In an information systems organizational structure, the function of ____ is the central point from
which to control data and is a central point of vulnerability.
a. data control
b. data entry
c. data librarian
d. database administration
ANS: D
21. The control concern that there will be a high risk of data conversion errors relates primarily to which
of the following information systems functions?
a. data control
b. data entry
c. data librarian
d. database administration
ANS: B
22. The controlled access to data, programs, and documentation is a principal responsibility of which of
the following functions?
a. data control
b. data preparation (data entry)
c. data librarian
d. computer operator
ANS: C
23. Which of the following is not one of COBITs four broad IT control process domains?
a. plan and organize
b. acquire and implement
c. repair and replace
d. monitor and evaluate
ANS: C
24. Which of the following is not a strategic planning process?
a. IT-related requirements to comply with industry, regulatory, legal, and contractual obligations, including privacy, transborder data flows, e-business, and insurance contracts.
b. Acquisition and development schedules for hardware, software, and application systems
and for personnel and financial requirements.
c. Systems development life cycle adoption to ensure that comprehensive documentation is
developed for each application.
d. An inventory of current IT capabilities.
ANS: C
25. Which one of the following personnel is not involved in safeguarding resources resulting from consummating events?
a. security officer
b. technical service manager
c. database administrator
d. Chief Information Officer
ANS: D
26. The segregation of duties control plan consists of separating all of the following event-processing
functions except:
a. planning events
b. authorizing events
c. executing events
d. recording events
ANS: A
27. A warehouse clerk manually completing an order document and forwarding it to purchasing for approval is an example of:
a. authorizing events
b. executing events
c. recording events
d. safeguarding resources
ANS: B
28. The data entry clerk types data from an order form into an on-line computer through a pre-formatted
screen. This is an example of:
a. authorizing events
b. executing events
c. recording events
d. safeguarding resources
ANS: B
29. Approving a customer credit purchase would be an example of which basic events processing function?
a. authorizing events
b. executing events
c. recording events
d. safeguarding resources
ANS: A
30. An employee of a warehouse is responsible for taking a computer-generated shipping list, pulling the
items from the warehouse shelves and placing them in a bin which is transferred to shipping when the
list is completely filled. This is an example of:
a. authorizing events
b. executing events
c. recording events
d. safeguarding resources
ANS: B
31. An outside auditing firm annually supervises a physical count of the items in a retail store's shelf inventory. This is an example of:
a. authorizing events
b. executing events
c. recording events
d. safeguarding resources
ANS: D
32. A warehouse supervisor prepares a sales order listing items to be shipped to a customer and then signs
it authorizing the removal of the items from the warehouse. The supervisor is performing which functions?
a. authorizing events and safeguarding of resources
b. executing and recording events
c. authorizing and executing events
d. authorizing and recording events
ANS: C
33. A clerk receives checks and customer receipts in the mail. He endorses the checks, fills out the deposit
slip, and posts the checks to the cash receipts events data. The clerk is exercising which functions?
a. recording and executing events
b. authorizing and executing events
c. recording and authorizing events
d. safeguarding of resources and authorizing events
ANS: A
34. When segregation of duties cannot be effectively implemented because the organization is too small,
we may rely on a more intensive implementation of other control plans such as personnel control
plans. This is called:
a. collusion controls
b. compensatory controls
c. authorizing controls
d. inventory controls
ANS: B
35. A method of separating systems development and operations is to prevent programmers from
a. performing technical services
b. performing database administration
c. handling accounting operations
d. operating the computer
ANS: D
36. Which of the following control plans is not a retention control plan?
a. creative and challenging work opportunities
b. occasional performance evaluations
c. competitive reward structure
d. viable career paths
ANS: B
37. Personnel development control plans consist of each of the following except:
a. checking employment references
b. providing sufficient and timely training
c. supporting employee educational interests and pursuits
d. performing scheduled evaluations
ANS: A
38. The primary reasons for performing regular employee performance reviews include all of the following except:
a. determine whether an employee is satisfying the requirements indicated by a job description
b. assess an employee's strengths and weaknesses
c. assist management in determining salary adjustments, promotions, or terminations
d. develop a strategy for filling necessary positions
ANS: D
39. A policy that requires employees to alternate jobs periodically is called:
a. segregation of duties
b. forced vacations
c. rotation of duties
d. personnel planning
ANS: C
40. A control plan that is designed to detect a fraud by having one employee periodically do the job of another employee is called :
a. segregation of duties
b. forced vacations
c. periodic audits
d. management control
ANS: B
41. A mechanism by which a company is reimbursed for any loss that occurs when an employee commits
fraud is called a:
a. segregation of duties
b. fidelity bond
c. personnel planning control
d. termination control plan
ANS: B
42. Which of the following personnel security control plans is corrective in nature as opposed to being a
preventive or detective control plan?
a. rotation of duties
b. fidelity bonding
c. forced vacations
d. performing scheduled evaluations
ANS: B
43. Personnel termination control plans might include all of the following except:
a. require immediate separation
b. identify the employee's reasons for leaving
c. establish a policy of forced vacations
d. collect the employee's keys, badges, etc.
ANS: C
44. Instructions for computer setup, required data, restart procedures, and error messages are typically
contained in a(n):
a. systems development standards manual
b. program documentation manual
c. operations run manual
d. application documentation manual
ANS: C
45. Application documentation that describes the application and contains instructions for preparing inputs
and using outputs is a(n):
a. operations run manual
b. user manual
c. program documentation
d. systems documentation
ANS: B
46. Alternative names for contingency planning include all of the following except:
a. disaster recovery planning
b. business interruption planning
c. business disaster planning
d. business continuity planning
ANS: C
47. A data replication strategy where all data changes are data stamped and saved to secondary systems as
the changes are happening is called:
a. mirror site
b. electronic vaulting
c. continuous data protection (CDP)
d. dumping
ANS: C
48. All of the following are components of a backup and recovery strategy except:
a. echo checking
b. mirror site
c. electronic vaulting
d. hot site
ANS: A
49. Which of the following statements related to denial of service attacks is false?
a. Insurance is available to offset the losses suffered by denial of service attacks.
b. A denial of service attack is designed to overwhelm a web site, making it incapable of performing normal functions.
c. Web sites can employ filters to sense multiple messages from a single site.
d. The most effective attacks originate from a small cluster of computers in a remote geo-
graphic region.
ANS: D
50. In an on-line computer system, restricting user access to programs and data files includes all of the following except:
a. user identification
b. user authentication
c. determining user access rights
d. wearing identification badges
ANS: D
51. Sending out an e-mail pretending to be a legitimate business asking for information about a persons
account is called:
a. dumpster diving
b. phishing
c. smoozing
d. shoulder surfing
ANS: B
52. Which of the following controls restrict access to programs, data, and documentation?
a. library controls
b. password controls
c. authentication controls
d. program change controls
ANS: A
53. This logs and monitors who is on or trying to access an organizations network.
a. biometrics
b. electronic vaulting
c. intrusion detection systems (IDS)
d. Firewall
ANS: C
54. Protecting resources against environmental hazards might include all of the following control plans except:
a. fire alarms and smoke detectors
b. waterproof ceilings
c. voltage regulators
d. rotation of duties
ANS: D
55. Searching through rubbish for system information such as passwords is called:
a. scavenging
b. phishing
c. Smoozing
d. shoulder surfing
ANS: C
COMPLETION
1. ______________________________ is a process that ensures that the enterprisess IT sustains and extends the organizations strategies and objectives.
ANS: IT governance
2. Data in all their forms that are input, processed, and output by information systems is the IT resource
____________________.
ANS: information
3. IT resource that are automated systems and manual procedures that process information
_________________________.
ANS: applications
4.
______________________________ are particularly important because they relate to a multitude of
control goals and processes.
ANS:
Pervasive controls
5. ________________ in an internal control system means assessment by management to determine
whether the control plans in place continuing are to function appropriately over time.
ANS: Monitoring
6. The function composed of people, procedures, and equipment that is typically called the information
systems department, IS department, or IT department is the
_____________________________________________.
ANS: information systems organization
7. The ______________________coordinates the organizational and IT strategic planning
processes and reviews and approves the strategic IT plan.
ANS: IT steering committee
8. The ______________________ is charged with safeguarding the IT organization.
ANS: security officer
9. Management should establish a _______________________ plan and implement related
activities, including reviews, audits, and inspections, to ensure the attainment of IT
customer requirements.
ANS: quality assurance
10. The ______________________________ group is responsible for routing all work in to and out of the
data center, correcting errors, and monitoring all error correction.
ANS: data control
11. The information systems function ______________________________ provides efficient and effective operation of the computer equipment by performing tasks such as mounting tapes, disks, and other
media and monitoring equipment operation.
ANS: computer operations
12. The ______________________________ maintains custody of and controls access to programs,
files, and documentation.
ANS: data librarian
13. Combining the functions of authorizing and executing events is a violation of the organizational control plan known as ______________________________.
ANS: segregation of duties
14. Segregation of duties consists of separating the four functions of authorizing events,
____________________ events, ____________________ events, and safeguarding the resources resulting from consummating the events.
ANS: executing, recording
15. ____________________ is any fraud committed by two or more individuals or departments.
ANS: Collusion
16. A small organization that does not have enough personnel to adequately segregate duties must rely on
alternative controls, commonly called ___________________________________.
ANS: compensatory controls
17. The functions of the ______________________________ commonly include assigning passwords and
making sure the IT organization is secure from physical threats.
ANS: security officer
18. The ___________________________________ coordinates the organizational and IT strategic planning processes and reviews and approves the strategic IT plan.
ANS: IT steering committee
19. The policy of requiring an employee to alternate jobs periodically is known as
______________________________.
ANS: rotation of duties
20. ______________________________ is a policy of requiring an employee to take leave from the job
and substituting another employee in his or her place.
ANS: Forced vacations
21. A(n) ______________________________ indemnifies a company in case it suffers losses from defalcations committed by its employees.
ANS: fidelity bond
22. The ______________________________ covers the progression of information systems through the
systems development process, from birth, through implementation, to ongoing use and modification.
ANS: system development life cycle (SDLC)
23. Computer software that is used to facilitate the execution of a given business process is called
___________________________________.
ANS: application software
24. The ____________________ documentation provides an overall description of the application, including the system's purpose; an overview of system procedures; and sample source documents, outputs,
and reports.
ANS: systems
25. ____________________ documentation provides a description of an application computer program
and usually includes the program's purpose, program flowcharts, and source code listings.
ANS: Program
26. The ______________________________ gives detailed instructions to computer operators and to data
control about a particular application.
ANS: operations run manual
27. The _________________________ describes user procedures for an application and assists the user in
preparing inputs and using outputs.
ANS: user manual
28. ______________________________ are documents that helps users learn their jobs and perform consistently in those jobs.
ANS: Training materials
29. __________________________ controls restrict access to data, programs and documentation.
ANS: Library
30. The terms ____________________ planning, disaster recovery planning, business interruption planning, and business continuity planning have all been used to describe the backup and recovery control
plans designed to ensure that an organization can recover from a major calamity.
ANS: contingency
31. ___________________________________ is a service whereby data changes are automatically transmitted over the Internet on a continuous basis to an off-site server maintained by a third party.
ANS: Electronic vaulting
32. With the data replication strategy known as ________________________________________ all data
changes are data stamped and saved to secondary systems as the changes are happening.
ANS: continuous data protection (CDP)
33. The disaster recovery strategy known as a(n) ____________________ is a fully equipped data center
that is made available on a standby basis to client companies for a monthly subscriber's fee.
ANS: hot site
34. A facility usually comprised of air-conditioned space with a raised floor, telephone connections, and
computer ports, into which a subscriber can move equipment, is called a(n) ____________________.
ANS: cold site
35. In a ___________________________________ a web site is overwhelmed by an intentional onslaught
of thousands of simultaneous messages, making it impossible for the attacked site to engage in its normal activities.
ANS: denial of service attack
36. ____________________ identification systems identify authorized personnel through some unique
physical trait such as fingers, hands, voice, eyes, face, and writing dynamics.
ANS: Biometric
37. A(n) ____________________ is a technique to protect one network from another "untrusted" network.
ANS: firewall
38. The most common biometric devices read ____________________.
ANS: fingerprints
39. In an online environment, ________________________ ensures that only authorized users gain access
to a system through a process of identification (e.g., a unique account number for each user) and authentication.
ANS: access control software
40. In an online computer environment, the accumulation of access activity and its review by the security
officer is also called ______________________________.
ANS: threat monitoring
41. Periodic cleaning, testing, and adjusting of computer equipment is referred to as
______________________________.
ANS: preventive maintenance
42. ______________________________ is the intentional unauthorized access of an organization's computer system, accomplished by bypassing the system's access security controls.
ANS: Computer hacking and/or cracking
43. Copies of important stored data, programs, and documentation made periodically are called
____________________.
ANS: backups
44. The process whereby lost data is restored and operations are continued is called
____________________.
ANS: recovery
45. The site that maintains copies of a primary computing sites programs and data is a
____________________ site.
ANS: mirror
46. A _____________________________________________ uses many computers, called zombies, that
unwittingly cooperate in a denial-of-service attack by sending messages to the target Web site.
ANS: distributed denial-of-service attack
47. The ___________________________________logs and monitors who is on or is trying to access the
network.
ANS: intrusion-detection system (IDS)
48. The ___________________________________ actively blocks unauthorized traffic using rules specified by an organization.
ANS: intrusion-prevention system (IPS)
49. Watching a user type in passwords or user IDs or listening as they give account information over the
phone is called ___________________________________.
ANS: shoulder surfing
50.
___________________________________ is when a hacker calls and requests a password based on
some pretext.
ANS: Smoozing
PROBLEMS
1. Below is an alphabetical list of ten functional titles for the information systems organization structure
shown in Chapter 8. The second list contains descriptions (some partial) of the duties and responsibilities of ten of the functions.
Required:
On the blank line to the left of each numbered description, place the capital letter of the functional title
that best matches the duties and responsibilities described. Do not use a letter more than once.
Functional Title
A.
B.
C.
Quality assurance
Data control
Data librarian
F.
G.
H.
Systems programming
Technical services manager
CIO
D.
E.
Data entry
Systems development manager
I.
J.
Steering committee
Security officer
Answers
DUTIES AND RESPONSIBILITIES
_____
1.
Deliver cost-effective, bug-free applications.
_____
2.
Route all work into and out of the data center, correct errors, monitor all error
correction.
_____
3.
Plan IT acquisition and development.
_____
4.
Conduct reviews to determine adherence to IT standards and procedures and
achievement of IT objectives.
_____
5.
Issue programs, data, and documentation to authorized users.
_____
6.
Manage functional units such as networks, CAD/CAM and systems programming.
_____
7.
Modify and adapt systems software including operating systems and various
utility routines.
_____
8.
Prepare input for computer processing.
_____
9.
Physical security and logical security.
_____
10.
Prioritize and select IT projects and resources.
ANS:
Duties and
Responsibilities
Answer
1
E
2
B
3
H
4
A
5
C
6
G
7
F
8
D
9
J
10
I
2. The four events-processing functions that constitute the segregation of duties control plan are:
A. Authorizing events
B. Executing events
C. Recording events
D. Safeguarding resources
Required:
Below is a list of ten events-processing activities, five relating to the cycle of activities involved in
processing a sales event and seven relating to the cycle for a purchase event. Classify each of the
twelve activities into one of the four functional categories listed above by placing the letter A, B, C, or
D on the answer line to the left of each number. You should use only one letter for each of the answers.
EVENT-PROCESSING ACTIVITIES
Answers
(For a sales event)
_____
1.
The order entry department instructs the shipping department to ship goods to
a customer by sending an approved document to the shipping department.
_____
2.
The shipping department keeps inventory items in a locked storeroom.
_____
3.
The billing department prepares and mails a bill to the customer.
_____
4.
The invoice in item 3 is added to the customer balance in the accounts receivable master data.
_____
5.
The general ledger bookkeeper enters a sales event in a data file.
(For a purchase event)
_____
6.
The purchasing department is requested to order goods.
7.
The purchasing department receives a signed request document from the inventory control department.
_____
8.
The purchasing department manager reviews and signs all order documents in
excess of $100.
_____
9.
The goods are received from the vendor.
_____
_____
10.
The receiving department completes the receiving report.
_____
11.
The goods received in item 8 are placed into the locked inventory storeroom.
_____
12.
A payable is recognized by updating the accounts payable master data.
ANS:
Event-Processing
Activity
Answer
1
A
2
D
3
B
4
C
5
C
6
B
7
A
8
A
9
B
10
C
11
D
12
C
3. Listed below are several pervasive control plans discussed in Chapter 8. On the blank line to the left of
each control plan, insert a "P" (preventive), "D" (detective), or "C" (corrective) to best classify that
control. If you think that more than one code could apply to a particular plan, insert all appropriate
codes
CODE
CONTROL PLAN
_____
1.
Service level agreements
_____
2.
Program change controls
_____
3.
Fire and water alarms
_____
4.
Adequate fire and water insurance
_____
5.
Install batteries for temporary loss in power
_____
6.
Continuous-data protection (CDP)
_____
7.
Intrusion-detection system (IDS)
_____
8.
IT steering committee
_____
9.
Security officer
_____
10.
Operations run manuals
_____
11.
Rotation of duties and forced vacations
_____
12.
Fidelity bonding
_____
13.
Personnel performance evaluations
_____
14.
Personnel termination procedures
_____
15.
Segregation of duties
_____
16.
Strategic IT plan
_____
17.
Disaster recovery planning
_____
18.
Restrict entry to the computer facility through the use of security guards,
locks, badges, and identification cards
_____
19.
Personnel management (supervision)
_____
20.
Library controls
ANS:
CODE
CONTROL PLAN
__P & C__
1.
Service level agreements
__P__
2.
Program change controls
__P__
3.
Fire and water alarms
__C__
4.
Adequate fire and water insurance
__C__
5.
Install batteries for temporary loss in power
__C__
6.
Continuous-data protection (CDP)
__D__
7.
Intrusion-detection system (IDS)
__P__
8.
IT steering committee
__P & D__
9.
Security officer
__P__
10.
Operations run manuals
P&D
11.
Rotation of duties and forced vacations
__C__
12.
Fidelity bonding
P&D
13.
Personnel performance evaluations
__P__
14.
Personnel termination procedures
P&D
15.
Segregation of duties
__P__
16.
Strategic IT plan
__C__
17.
Disaster recovery planning
__P__
18.
Restrict entry to the computer facility through the use of security guards,
locks, badges, and identification cards
P&D
19.
Personnel management (supervision)
P&D
20.
Library controls
4. The first list below contains 10 control plans discussed in Chapter 8. The second list describes 10 system failures that have control implications.
Required:
On the answer line to the left of each system failure, insert the capital letter from the first list of the
best control plan to prevent the system failure from occurring. If you can't find a control that will
prevent the failure, then choose a detective or a corrective plan. A letter should be used only once.
A.
B.
Control Plans
Personnel development control plans
Operations run manuals
C.
Disaster recovery plans
D.
Program change controls
E.
Librarian controls
F.
Segregation of systems development and programming from computer operations
G.
Retention control plans
H.
Restriction of physical access to computer resources
I.
Segregation of recording events from safeguarding resources
J.
Biometric identification system
Answers
SYSTEM FAILURES
_____
1.
The controller at Infotech, Inc., has just completed an analysis of personnel
costs and believes that the cost associated with training new personnel is too
high. She attributes this high cost to the increasing rate at which employees are
being hired to replace defections to Infotech's competitors.
_____
2.
Paul the programmer has modified the accounts receivable statement program
so that the receivables from his cousin Peter will be eliminated from the accounts receivable master file upon printing of the monthly statements. Paul
made these changes to the program while he was operating the computer on a
Saturday morning.
_____
3.
When the hurricane hit the coast, Soggy Records Company lost the use of its
flooded computer room. In such cases, plans called for using an alternate computer center 100 miles inland. However, Soggy was unable to operate in the alternate facility because the company's programs and files were lost in the
flooded computer facility.
_____
4.
All the files were lost at the Stoughton Company when a visitor sat down at a
computer terminal, signed on using one of the passwords posted on the computer terminals, and erased some of the data files.
_____
5.
Sally is the inventory control/warehouse clerk at Techtron Inc. She has been
stealing secret computer components from the warehouse, selling them to foreign agents, and covering up her thefts by altering the inventory records.
_____
6.
At Maralee Company, there seems to be a lack of progression from lower to
middle management. Edward, the director of personnel, believes that the people
being hired have great potential, but they are just not realizing their potential.
_____
7.
Roger, the night-shift computer operator, has had occasion several times in the
last month to call his supervisor to receive assistance--over the telephone--to
correct a problem that he was having in operating the computer.
_____
8.
Mary had become quite unhappy with her job at Funk, Inc. She knew that she
was going to quit soon and decided to destroy some computer files. Using her
own username and password, she found several disk packs on a table outside
the computer room and proceeded to "erase" the data with a powerful magnet.
After Mary's departure, Funk spent several months reconstructing the data that
had been on the lost files.
_____
9.
One of the inventory control programs at Excess Company has been ordering
more inventory than is required, causing an overstock condition on many items.
During an investigation of the problem, it was discovered that the inventory ordering program had recently been changed. The changes were approved, but the
new program was never tested.
_____
10.
Sydney, the computer operator, did not want to go to work one day because he
wanted to go sailing. He gave his ID card to his cousin Vinny who went to work
for him. Even though he was a computer operator, Vinny did not know how to
operate this computer. He made mistakes and destroyed some data.
ANS:
System
Failure
Number
Answer
1
G
2
F
3
C
4
H
5
I
6
A
7
B
8
E
9
D
10
J
5. The first list below contains 10 control plans discussed in Chapter 8. The second list describes 10 system failures that have control implications.
Required:
On the answer line to the left of each system failure, insert the capital letter from the first list of the
best control plan to prevent the system failure from occurring. (If you can't find a control that will
prevent the failure, then choose a detective or corrective control plan). A letter should be used only
once.
A.
B.
Control Plans
Selection and hiring control plans
Documentation control plans
C.
Personnel termination procedures
D.
Forced vacations
E.
Biometric identification system
F.
Fire-protection control plans
G.
IT steering committee
H.
Off-site storage of back up computer files
I.
Program change controls
J.
Continuous-data protection (CDP)
Answers
SYSTEM FAILURES
_____
1. Peter the programmer asked for a substantial increase in salary and benefits.
When turned down, he submitted his two week notice. During those two
weeks he infected the program he was working on with a damaging computer
virus.
_____
2. Cary enters cash receipts into the computer at Kiting Inc. For the past year
she has been pocketing customer payments. To keep herself from being discovered, she enters credit memos into the computer, which records them as
reductions in the customers' accounts receivable records--as if the payment
had been made.
_____
3. Procedures for the approval of orders have been put in place at Overstock
Company. Clyde, the new purchasing agent, was given a briefing on these
procedures when he was hired and has been applying those procedures as best
as he can remember them. Consequently, Clyde sometimes orders more inventory than is required.
_____
4. The new sales reporting system includes a computer printout that was supposed to report daily sales to the V.P. of marketing. The report was never
tested and contains erroneous sales figures and is not presented in the format
required by the V.P.
_____
5. There was a flood and all of the computers and all their data were destroyed.
_____
6. Freida was just hired as a computer operator at Vertigo Inc. Just a few days
after being hired, she discovered that she would not be allowed to spend some
of her time writing computer programs. This was contrary to what she was
told initially, and she is now quite unhappy with her circumstances.
_____
7. After careful screening and selection of employees, an organization issues its
employees name badges with magnetic strips that stores the employees' personal information. Employees in the IT function can scan the badges to gain
entry into various rooms within the IT center. Recently management discovered that employees are sharing their badges to enable them to gain access
to every room in the facility.
_____
8. A fire at the Mitre Corporation caused the release of a poisonous gas which
contaminated the entire building. While the computer files were not destroyed
during the fire, they were contaminated and cannot be removed from the
building and personnel cannot enter the building. It took several months to recreate the computer files.
_____
9. Sandisfield, Inc. has many IT projects under consideration for development.
The CFO has some political connections with the CIO and so financial applications are given a green light for development while projects for marketing
and logistics are put on hold.
______
10.
Jet Red Airlines, a new, low-cost start-up airline, has decided to operate its
own Web site and reservation system that is running on servers located at the
headquarters. One day, the server room was flooded, the reservation system
was not available for many hours, and many reservations were lost.
ANS:
System
Failure
Number
Answer
1
C
2
D
3
B
4
I
5
H
6
A
7
E
8
F
9
G
10
J