Beruflich Dokumente
Kultur Dokumente
TRUE/FALSE 1. Fraud is the possibility that an event or action will cause an organization to fail to meet its objectives (or goals). ANS: F 2. Management is legally responsible for establishing and maintaining an adequate system of internal control ANS: T 3. The exposure of unacceptable accounting is often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision. ANS: F 4. A major reason management must exercise control over an organizations business processes is to provide reasonable assurance that the company is in compliance with applicable legal and regulatory obligations. ANS: T 5. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is erroneous record keeping. ANS: T 6. The inability of an organization to remain abreast of the demands of the marketplace is lack of competitive advantage. ANS: T 7. Business interruption can be caused by power failures. ANS: T 8. Excessive costs may include incurring unnecessary expenses in operating the business. ANS: T 9. Fraud and embezzlement is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors. ANS: T
129
130
Chapter 7
10. Under the Sarbanes Oxley Act of 2002, the section on Auditor Independence establishes an independent board to oversee public company audits. ANS: F 11. Under the Sarbanes Oxley Act of 2002, the section on Corporate Responsibility requires a companys CEO and CO to certify quarterly and annual reports. ANS: T 12. Under the Sarbanes Oxley Act of 2002, the section on Enhanced Financial Disclosures requires each annual report filed with the SEC to include an internal control report. ANS: T 13. Under the Sarbanes Oxley Act of 2002, the section on Corporate Tax Returns Section 1001, conveys a sense of the Senate that the corporate federal income tax returns be signed by the treasurer. ANS: F 14. Risk is the possibility that an event or action will cause an organization to fail to meet its objectives or goals. ANS: T 15. A fraud is a deliberate act or untruth intended to obtain unfair or unlawful gain. ANS: T 16. The Sarbanes Oxley Act of 2002 establishes legal responsibility for management to prevent fraud and other irregularities. ANS: T 17. The recording of events contrary to established accounting practices often caused by the incomplete or inaccurate processing of an event is known as erroneous record keeping. ANS: T 18. Erroneous management decisions differ from fraud in that they are a willful disregard of GAAP. ANS: F 19. Fraud and embezzlement is the exposure that is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors. ANS: T 20. According to the Ernst and Young Fraud survey, the number one fraud worry on the minds of executives is computer crime. ANS: F
21. A computer crime techniques called worm involves the systematic theft of very small amounts from a number of bank or other financial accounts. ANS: F 22. A computer abuse technique called a trap door (or back door) involves a programmer's inserting special code or passwords in a computer program that will allow the programmer to bypass the security features of the program. ANS: T 23. A logic bomb is a computer abuse technique in which unauthorized code is inserted in a program, which, when activated, causes a disaster such as shutting down a system or destroying data. ANS: T 24. A salami is program code that can attach itself to other programs (i.e., "infect" those programs), that can reproduce itself, and that operates to alter the programs or to destroy data. ANS: F 25. Risk assessment is the entity's identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed. ANS: T 26. The control environment sets the tone of the organization, influencing the control consciousness of its people. ANS: T 27. External directives are the policies and procedures that help ensure that management directives are carried out. ANS: F 28. Establishing a viable internal control system is the responsibility of management. ANS: T 29. Monitoring is a process that assesses the quality of internal control performance over time. ANS: T 30. The external environment is a system of integrated elements--people, structures, processes, and procedures--acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals. ANS: F
132
Chapter 7
31. The control environment refers to an organization's general awareness of and commitment to the importance of control throughout the organization. ANS: T 32. The control goal called efficiency of operations strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended. ANS: F 33. Ensuring the security of resources is the control goal that seeks to provide protection against loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources. ANS: T 34. The control goal of ensuring input materiality strives to prevent fictitious items from entering an information system. ANS: F 35. An invalid item is an object or event that is not authorized, never occurred, or is otherwise not genuine. ANS: T 36. The control goal of input accuracy is concerned with the correctness of the transaction data that are entered into a system. ANS: T 37. Business process control plans relate to those controls particular to a specific process or subsystem, such as billing or cash receipts, or to a particular technology used to process data. ANS: T 38. A sale to a customer is entered into the system properly, but the event does not accurately update the customer's outstanding balance. This type of processing error would be classified as a user error. ANS: F 39. A batch of business events is accurately entered into a business event data, but the computer operator fails to use the data to update master data. This type of processing error would be classified as an operational error. ANS: T 40. A corrective control plan is designed to discover problems that have occurred. ANS: F
134
ANS: B
Chapter 7
7. This exposure is often caused by managers using misleading information or failing to acquire necessary information relative to a particular decision: a. Erroneous record keeping b. Unacceptable accounting c. Erroneous management decisions d. Fraud and embezzlement ANS: C 8. This exposure is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors: a. Erroneous record keeping b. Unacceptable accounting c. Erroneous management decisions d. Fraud and embezzlement ANS: D 9. Various penalties that may be brought by judicial or regulatory authorities is (are): a. Statutory sanctions b. Excessive costs c. Loss or destruction of resources d. Competitive disadvantage ANS: A 10. The inability of an organization to remain abreast of the demands of the marketplace is (are): a. Statutory sanctions b. Excessive costs c. Loss or destruction of resources d. Competitive disadvantage ANS: D 11. The section of Sarbanes Oxley that establishes an independent board to oversee public company audits is: a. Title I Public Company Accounting Oversight Board b. Title II Auditor Independence c. Title III Corporate Responsibility d. Title IV Enhanced Financial Disclosures ANS: A 12. The section of Sarbanes Oxley that prohibits a CPA firm that audits a public company from engaging in certain non-audit services is: a. Title I Public Company Accounting Oversight Board b. Title II Auditor Independence c. Title III Corporate Responsibility d. Title IV Enhanced Financial Disclosures ANS: B
13. The section of Sarbanes Oxley that requires a companys CEO and CFO to certify quarterly and annual reports is : a. Title I Public Company Accounting Oversight Board b. Title II Auditor Independence c. Title III Corporate Responsibility d. Title IV Enhanced Financial Disclosures ANS: C 14. The section of Sarbanes Oxley that requires each annual report filed with the SEC to include an internal control report is: a. Title I Public Company Accounting Oversight Board b. Title II Auditor Independence c. Title III Corporate Responsibility d. Title IV Enhanced Financial Disclosures ANS: D 15. The section of Sarbanes Oxley that requires financial analysts to properly disclose any investments they might hold with the companies they recommend: a. Title V Analysis of Conflicts of Interests b. Title VIII Corporate Criminal Fraud Accountability c. Title IX White Collar Crime Enhancements d. Title XI Corporate Fraud and Accountability ANS: A 16. The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is: a. Title V Analysis of Conflicts of Interests b. Title VIII Corporate Criminal Fraud Accountability c. Title IX White Collar Crime Enhancements d. Title XI Corporate Fraud and Accountability ANS: B 17. The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5,000,000 and up to 20 years imprisonment if they certify false or misleading financial statements with the SEC is: a. Title V Analysis of Conflicts of Interests b. Title VIII Corporate Criminal Fraud Accountability c. Title IX White Collar Crime Enhancements d. Title XI Corporate Fraud and Accountability ANS: C 18. The section of Sarbanes Oxley that provides for fines and imprisonment of up to 20 years to individuals who corruptly alter, destroy, mutilate, or conceal documents with the intent to impair the documents integrity or availability for use in an official proceeding, or to otherwise obstruct, influence or impede any official proceeding is: a. Title V Analysis of Conflicts of Interests
136
Chapter 7
b. Title VIII Corporate Criminal Fraud Accountability c. Title IX White Collar Crime Enhancements d. Title XI Corporate Fraud and Accountability ANS: D 19. According to the Ernst and Young Fraud survey, the number one fraud worry on the minds of executives is: a. Personal financial pressure b. Computer crime c. Asset misappropriation d. Internal control ANS: C 20. A computer abuse technique called a __________ involves inserting unauthorized code in a program, which, when activated, causes a disaster, such as shutting the system down or destroying files. a. salami b. trap door c. logic bomb d. Trojan horse ANS: C 21. A computer abuse technique called a __________ involves a program that replicates itself on disks, in memory, or across networks. a. worm b. trap door c. logic bomb d. Trojan horse ANS: A 22. A computer abuse technique called a __________ involves program that can attach itself to other programs thereby infecting those programs. a. worm b. virus c. logic bomb d. Trojan horse ANS: B 23. In its 1999 report, the COSO Report on Fraudulent Financial Reporting that studied over 200 cases of fraudulent financial reporting from 1987 to 1997: a. The companies looked at were all large companies b. Some of the companies were at or near loss positions c. The CEOs were not involved in most cases d. Companies tended to understate assets and understate revenues ANS: B
24. Which of the following statements regarding internal controls systems is false? a. Effective internal control systems provide absolute assurance against the occurrence of material frauds and embezzlements. b. Internal control systems depend largely on the competency and honesty of people. c. Because internal control systems have a cost, management should evaluate the cost/benefit of each control plan. d. The development of an internal control system is the responsibility of management. ANS: A 25. Elements of a control environment might include the following except: a. organization values and norms b. management philosophy and operating style c. means of communications d. reward systems ANS: C 26. ____________ sets the tone of the organization, influencing the control consciousness of its people. a. Control environment b. Risk assessment c. Control activities d. Monitoring ANS: A 27. ____________ are the policies and procedures that help ensure that management directives are carried out. a. Control environment b. Risk assessment c. Control activities d. Monitoring ANS: C 28. ____________ is a process that assesses the quality of internal control performance over time. a. Control environment b. Risk assessment c. Control activities d. Monitoring ANS: D 29. A measure of success in meeting a set of established goals is called system: a. effectiveness b. monitoring c. efficiency d. control goals ANS: A
138
Chapter 7
30. As a result of an inadequate design, a production process yields an abnormally high amount of raw material scrapped. Which control goal is being violated? a. ensure effectiveness of operations b. ensure efficient employment of resources c. ensure security of resources d. ensure input accuracy ANS: B 31. Establishing a viable internal control system is primarily the responsibility of: a. The external auditors b. Management c. The programmers d. Government authorities ANS: B 32. The information system control goal which relates to preventing fictitious events from being recorded is termed: a. ensure input validity b. ensure input accuracy c. ensure input completeness d. ensure effectiveness of operations ANS: A 33. A business event which is not properly authorized is an example of: a. an invalid item b. an inaccurate item c. an incomplete item d. an unusual item ANS: A 34. Achieving which control goal requires that all valid objects or events are captured and entered into a system's database? a. input validity b. update accuracy c. input completeness d. update completeness ANS: C 35. Failing to record a customer's order for the purchase of inventory violates the information system control goal of: a. ensure input accuracy b. ensure input completeness c. ensure input validity d. ensure input accuracy and input validity ANS: B
140
Chapter 7
42. Information processing procedures and policies that assist in accomplishing control goals are known collectively as: a. control plans b. control systems c. control objectives d. control outcomes ANS: A 43. ______________________ relate to those controls particular to a specific process or subsystem, such as billing or cash receipts, or to a particular technology used to process data: a. Control procedures b. Information processing procedures c. Business process control plans d. Operations system control plans ANS: C 44. Control plans that relate to a multitude of goals and applications are called: a. business process control plans b. internal control systems c. pervasive control plans d. management control systems ANS: C 45. A control plan requires that a manager sign his/her approval of timecards for employees in that department. This control plan is an example of: a. a systems control b. the control environment c. a pervasive control plan d. a business process control plan ANS: D 46. Controls that stop problems from occurring are called: a. preventive controls b. detective controls c. corrective controls d. programmed controls ANS: A 47. A control that involves reprocessing transactions that are rejected during initial processing is an example of: a. preventive controls b. detective controls c. corrective controls d. programmed controls ANS: C
142
Chapter 7
8. _______________ is the exposure is often caused by direct misappropriation of funds or by deliberate communication of misinformation to management or investors. ANS: Fraud and embezzlement 9. Various penalties that may be brought by judicial or regulatory authorities is (are) ANS: statutory sanctions 10. The inability of an organization to remain abreast of the demands of the marketplace is (are) _________________. ANS: competitive disadvantage 11. The section of Sarbanes Oxley that establishes an independent board to oversee public company audits is _________________. ANS: Public Company Accounting Oversight Board or Title I 12. The section of Sarbanes Oxley that prohibits a CPA firm that audits a public company from engaging in certain non-audit services is _______________________. ANS: Auditor Independence or Title II 13. The section of Sarbanes Oxley that requires a companys CEO and CFO to certify quarterly and annual reports is ___________________. ANS: Corporate Responsibility or Title III 14. The section of Sarbanes Oxley that requires each annual report filed with the SEC to include an internal control report is _____________________. ANS: Enhanced Financial Disclosures or Title IV 15. The section of Sarbanes Oxley that requires financial analysts to properly disclose in research reports any conflicts of interest they might hold with the companies they recommend is ___________________. ANS: Analysis of Conflicts of Interests or Title V 16. The section of Sarbanes Oxley that makes it a felony to knowingly destroy, alter, or create records and or documents with the intent to impede, obstruct, or influence an ongoing or contemplated federal investigation and offers legal protection to whistle blowers is _____________________. ANS: Corporate and Criminal Fraud Accountability or Title VIII 17. The section of Sarbanes Oxley that sets forth criminal penalties applicable to CEOs and CFOs of up to $5,000,000 and up to 20 years imprisonment if they certify false or misleading financial statements with the SEC is ____________________. ANS: White Collar Crime Enhancements or Title IX
144
Chapter 7
28. Establishing a viable internal control system is the responsibility of _________________. ANS: management 29. ____________________ is a process that assesses the quality of internal control performance over time. ANS: Monitoring 30. ____________________ is a system of integrated elements--people, structures, processes, and procedures--acting together to provide reasonable assurance that an organization achieves both its operations system and its information system goals. ANS: Internal control 31. The ____________________ refers to an organization's general awareness of and commitment to the importance of control throughout the organization. ANS: control environment 32. The control goal called ____________________ strives to assure that a given operations system is fulfilling the purpose(s) for which it was intended. ANS: ensure effectiveness of operations 33. The control goal that seeks to provide protection against loss, destruction, disclosure, copying, sale, or other misuse of an organization's resources is called ____________________. ANS: ensure security of resources 34. The control goal of ensure input ____________________ strives to prevent fictitious items from entering an information system. ANS: validity 35. A(n) ____________________ item is an object or event that is not authorized, never occurred, or is otherwise not genuine. ANS: invalid 36. The control goal that is concerned with the correctness of the transaction data that are entered into a system is called ensure ____________________. ANS: input accuracy 37. A missing data field on a source document or computer screen is an example of an error that could undermine the achievement of the control goal of ensure ____________________. ANS: input accuracy
146
PROBLEM
Chapter 7
1. Below is an alphabetical list of nine common business exposures presented in Chapter 7. The second list contains eight possible causes of exposures (there could be others). Required: On the blank line to the left of each numbered item, place the capital letter of the exposure that best matches that cause. Do not use a letter more than once. You should have one letter unused. Business Exposures A. B. C. D. E. F. G. H. I. Business interruption Competitive disadvantage Erroneous management decisions Erroneous record keeping Excessive costs Fraud and embezzlement Loss or destruction of assets Statutory sanctions Unacceptable accounting POSSIBLE EXPOSURE CAUSES Answers _____ 1. _____ 2. _____ 3. _____ 4. _____ 5. _____ 6. _____ 7. _____ 8. Information that is inappropriate for the decision being made Improper interpretation or disregard of FASB standards Incomplete or inaccurate processing of a business event Deliberate misinforming of management or investors A natural calamity such as a fire Lack of proper safeguards over an organization's information resources An information system that has not kept pace with changes in customer needs Improper interpretation or disregard of SEC regulations
Answer C I D F A G B H
2. Below is a list of control goals followed by a list of short scenarios describing system failures (i.e., control goals not met) and/or instances of successful control plans (i.e., plans that helped to achieve control goals). Required: On the blank line to the left of each numbered scenario, place the capital letter of the control goal that best matches the situation described. HINT: Some letters may be used more than once. Conversely, some letters may not apply at all. A. B. C. D. E. F. G. H. Control Goals Ensure effectiveness of operations. Ensure efficient employment of resources. Ensure security of resources. Ensure input validity. Ensure input accuracy. Ensure input completeness. Ensure update accuracy. Ensure update completeness. SCENARIOS Answers _____ 1. _____ 2. A batch of documents sent by the mail room to the accounts receivable department were lost in the intercompany mail and never recorded. A mail room clerk fabricated a phony document for a friend to make it look like the friend had paid his account receivable balance. The phony document got recorded. An accounts receivable clerk made a copy of the company's accounts receivable master data and sold this customer information to a competing company. Customer checks received in the mail room are batched and sent to the cashier several times a day so that they can be deposited as fast as possible.
_____ 3. _____ 4.
148
Chapter 7
_____ 5.
A flaw in the processing logic of a computer program resulted in cash received from customers being added to their accounts receivable balances rather than subtracted. In a manual bookkeeping system, an accounts receivable clerk failed to post an entire page of transactions from the cash receipts journal to the accounts receivable subsidiary ledger. In a manual bookkeeping system, cash receipts recorded correctly in the cash receipts journal on December 31st were inadvertently posted to customer accounts under a date of January 1st. In keying remittance advices into his computer terminal, an accounts receivable clerk entered a receipt of $200 as $2,000.
_____ 6.
_____ 7.
Answer F D C A
Scenario Number 5 6 7 8
Answer G H G E
3. Figure TB-7.1 depicts the "general" control model shown in Chapter 7 but with all labels removed. Required: Complete Figure TB-7.1 by inserting the following labels where they belong in the model: Process Labels Evaluate process Observe actual state of process Establish desired state of process Recommend changes to process Document actual state of process Data Flow Labels Recommendations Objectives Documentation Observations Evaluation
ANS: For solution, see Figure 7.1 in Chapter 7 of the text. 4. Listed below are 13 specific fraud examples taken from some well-known fraud cases: MiniScribe, ZZZZ Best Carpet Cleaning, Lesley Fay, and Equity Funding. Required: For each fraud example, enter a letter corresponding to which information control goal was initially violated--Validity, Completeness, or Accuracy. Some examples might involve more than one violation. NOTE: When we say initially, we mean what control goal failure led to this example, not what is the present condition. For example, master data might contain information that is inaccurate, but it might have been an inaccurate input that initially caused the data to be inaccurate. Fraud Examples: Control Goal Initially Violated 1. 2. 3. 4. 5.
Scenario MiniScribe: Sales were inflated by shipping disk drives that were not ordered by customers. MiniScribe: Sales of goods were recorded prior to the passing of title. MiniScribe: Some sales returns were never recorded. MiniScribe: Defective disk drives were included in inventory. MiniScribe: Auditors' workpapers were altered to inflate inventory values.
150
Chapter 7
6. 7. 8. 9. 10. 11. 12. 13. ZZZZ Best Carpet Cleaning: Phony receivable/sales documents were created to overstate sales. ZZZZ Best Carpet Cleaning: Payments were recorded to fictitious vendors. Lesley Fay Cos.: Inventory was overstated, thereby understating cost of goods sold. Lesley Fay: Markdown allowances to retailers were understated or omitted. Lesley Fay: Suppliers' invoices were not recorded. Lesley Fay: Revenues and profits were inflated by recording sales entries for several days after a quarter had ended. Equity Funding: 63,000 bogus insurance policies were created and recorded. Other: A bank teller stole $1.5 million by pocketing customer deposits. He covered his theft by accessing an unsecured computer terminal and transferring funds from dormant bank accounts into the accounts of customers from whom he had received deposits.
ANS: Scenario 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. Control Goal Initially Violated V A or V C V V or A V V V or A A or C C A or V V V
5. The CFO of Exeter Corporation is very uncomfortable with its current risk exposure relate to the possibility of business disruptions. Specifically, Exeter is heavily involved with e-Business and its internal information systems are tightly interlinked with its key customers systems. The CFO has estimated that every hour of system downtime will cost the company about $5,000 in sales. The CFO and CIO have further estimated that if the system were to fail, the average downtime would be about 2 hours per incident. The have anticipated (assume with 100% annual probability) that Exeter will likely experience 10 downtime incidents in a given year due to internal computer system problems, and another 10 incidents per year due to external problems; specifically system failures with the Internet service provider (ISP). Currently, Exeter pays an annualized cost of $25,000 for redundant computer and communication systems, and another $25,000 for Internet service provider (ISP) support just to keep total expected number of incidents to 20 per year.
a. Public Company Accounting Oversight Board b. Auditor Independence c. Corporate Responsibility d. Enhanced Financial Disclosures e. Analysts Conflicts of Interest f. Studies and Reports g. Corporate and Criminal Fraud Accountability
152
Chapter 7