Home / Summaries / AIS [Hall] / fraud-computer-information

Ethics, fraud, and internal control

24 important questions on Ethics, fraud, and internal control

What is ethical responsibility?

Business organizations have conflicting responsibilities to their stakeholders (employees, shareholders, customers, the public). Seeking a balance between the different consequences for every stakeholder is the managers’ ethical responsibility.

Which principles give guidance to ethical responsibility?

Proportionality: The benefit from a decision must outweigh the risks. Furthermore, there must be no alternative decision that provides the same or greater benefit with less risk.
Justice: The benefits of the decision should be distributed fairly to those who share the risk. Those who do not benefit should not carry the burden of risk.
Minimize risk: Even if judged by the principles, the decision should be implemented so as to minimize all of the risks and avoid any unnecessary risks.

What is computer ethics?

It is the analysis of the nature and social impact of computer technology and the corresponding formulation and justification of policies for the ethical use of such technology. You can define three levels of computer ethics: pop, para and theoretical.

What is pop, para and theoretical computer ethics?

Pop computer ethics is simply the exposure to stories and reports found in the popular media regarding the good or bad ramifications of computer technology.
Para computer ethics involves taking a real interest in computer ethics and acquiring some level of skill and knowledge in the field. Students should achieve this level of understanding.
The third level, theoretical computer ethics, is of interest to multi-disciplinary researchers who apply the theories of philosophy, sociology, and psychology to computer science with the goal of bringing some new understanding to the field.

What is section 406 of SOX?

Section 406 pertains the ethical issues. Section 406 requires public companies to adapt a code of ethics.

How can a public company disclose its code of ethics and which issues should it address?

A public company may disclose its code of ethics in several ways: 1) included as an exhibit to its annual report, 2) as a posting on its website, or 3) by agreeing to provide copies of the code on request. The code of ethics should address the following ethical issues:
Conflicts of interest.
Full and fair disclosures.
Legal compliance.
Internal reporting of code violations.
Accountability.

Why is it difficult to quantify the actual costs of fraud?

1) not all fraud is detected
2) of that detected, not all is reported,
3) in many fraud cases, incomplete information is gathered,
4) information is not properly distributed to management or law enforcement authorities, and
5) too often business organizations decide to take no civil or criminal action against the perpetrator(s) of fraud.

What are fraud statements?

Fraud statements are associated with management fraud. To meet the definition under this class of fraud scheme the statement itself must bring direct or indirect financial benefit to the perpetrator. In other words, the statement is not simply a vehicle for obscuring or covering a fraudulent act. Some underlying problems of the occurrence of fraud statements in recent years (i.e. the case of Enron, WorldCom) are:
1) Lack of auditor independence.
2) Lack of director independence.
3) Questionable executive compensation schemes.
4) Inappropriate accounting practices.

How does SOX address the problems of fraud?

SOX addresses the problems by establishing a framework to modernize and reform the oversight and regulation of public company auditing. Its principal reforms pertain to;
1) the creation of an accounting oversight board
2) auditor independence
3) corporate governance and responsibility
4) disclosure requirements
5) penalties for fraud and other violations.

What is transaction fraud?

Transaction fraud involves deleting, altering, or adding false transactions to divert assets to the perpetrator. This technique may be used to ship inventories to the perpetrator in response to a fraudulent sales transaction or to disburse cash in a payment of a false liability. A common type of transaction fraud involves the distribution of fraudulent paychecks to nonexistent employees.

What are computer fraud schemes?

Computer fraud includes:
The theft, misuse, or misappropriation of assets by altering computer-readable records and files.
The theft, misuse, or misappropriation of assets by altering the logic of computer software.
The theft or illegal use of computer-readable information.
The theft, corruption, illegal copying, or intentional destruction of computer
software.
The theft, misuse or misappropriation of computer hardware.

Which four stages are there in the computer model?

data collection, data processing, database management, and information generation

Which three examples of transaction frauds from remote locations are there?

Masquerading, piggybacking and hacking are examples of such fraud techniques.

What is program fraud?

Program fraud includes the following techniques:
- creating illegal programs that can access data files to alter, delete or insert values into accounting records
- destroying or corrupting a program’s logic using a computer virus

What is operations fraud?

It is the misuse or theft of the firm’s computer resources. This can often
involve using the computer to conduct personal business.

What is database management fraud?

Database management fraud includes altering, deleting, corrupting, destroying, or stealing an organization’s data. Because access to database files is an essential element of this fraud, it is usually associated with transaction or program fraud. The most common technique is to access the database from a remote site and browse the files for useful information that can be copied and sold to competitors.

What characteristics has useful information?

Regardless of physical form, useful information has the following characteristics:
Relevance: the contents of a report or document must serve a purpose.
Timelines: the age of information is critical factor in determining its usefulness.
Accuracy: information must be free from material errors.
Completeness: no piece of information essential to a decision or task should be
missing.
Summarization: information should be aggregated in accordance with a user’s needs.

What is exposure and what could the firm be exposed to?

The absence or weakness of a control is called exposure. A weakness in internal control may expose the firm to one or more of the following types of risks:
Destruction of assets (both physical assets and information).
Theft of assets.
Corruption of information or the information system.
Disruption of the information system.

What are preventive controls?

Preventive controls are passive techniques designed to reduce the frequency of occurrence of undesirable events. Preventive controls force compliance with prescribed or desired actions and thus screen out aberrant events.

What are detective controls?

Detective controls are devices, techniques, and procedures designed to identify and expose undesirable events that elude preventive controls. Detective controls reveal specific types of errors by comparing actual occurrences to pre-established standards.

What are corrective controls?

Corrective controls are actions taken to reverse the effects of errors detected in the previous step. There is an important distinction between detective controls and corrective controls. Detective controls identify anomalies and draw attention to them; corrective controls actually fix the problem.

What is stated in SAS no. 78?

The current authoritative document for specifying internal control objectives and techniques is “Statement on Auditing Standards (SAS) No. 78”, which is based on the COSO framework.

What is SOX section 302?

Section 302 requires that corporate management certify their organization’s internal controls on a quarterly and annual basis.

What are the control activities?

Control activities are the policies and procedures used to ensure that appropriate actions are taken to deal with the organization’s identified risks. Control activities can be grouped into two distinct categories.

The question on the page originate from the summary of the following study material:

AIS [Hall]

View summary

A unique study and practice tool
Never study anything twice again
Get the grades you hope for
100% sure, 100% understanding

Remember faster, study better. Scientifically proven.