Internal control and the information system
The arrangements that keep operations, accounts and compliance under control: the five COSO components, preventive, detective and corrective controls, segregation of duties, the audit trail, IT general controls and the three lines model.
- 23 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Internal control: what is it?
Show the answer
Arrangements put in place at every level of an organisation to obtain reasonable assurance that its operations, the reliability of its accounts and its compliance with rules are under control.
It gives reasonable assurance, never absolute: a control has a cost, and collusion or a management decision can bypass it.
Which IT general control ensures that "every program change is tested and approved before going live"?
- Change management
- Access management
- Operations management
- The application input control
Show the answer
Change management
The three families of general controls are access (who can act), changes (how the system evolves) and operations (backups, scheduling, incidents). An input control is internal to an application.
The COSO framework has five components: control environment, risk assessment, …, information and communication, and ….
Show the answer
The COSO framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring.
Control activities are the concrete measures (approvals, reconciliations, access rights); monitoring checks over time that the system works. The control environment is the foundation: the example set by management.
Segregation of duties: what is it?
Show the answer
A principle that gives different people the steps of one sensitive operation: committing, recording, paying.
A fraud then requires several people to collude. In an information system it is implemented through rights: one user must not hold incompatible rights.
An accountant created a fake supplier and paid himself 80,000 euros over eighteen months without being noticed. Which fix addresses the cause?
- Cap the amount of payments each accountant can enter per day
- Require the accountant to change his password every month
- Separate supplier creation from payment approval
- Double the backup of the supplier database
Show the answer
Separate supplier creation from payment approval
The fraud was possible because a single person held both rights. A cap slows it down; a changed password and a backup do not prevent it: the authorised person is the one committing fraud.