IT controls : Sarbanes-Oxley and IT governance
15 important questions on IT controls : Sarbanes-Oxley and IT governance
What is section 404 of SOX?
Compliance with sect. 404, management needs to provide the external auditors with documented test results, performed by internal auditor/SOX specialist, of functioning controls as supporting evidence for assertions in its report on control effectiveness.
Which two information system controls groups are identified by COSO?
general control/general computer controls/information technology controls: It applies to all system, supporting application controls and have an affect on transaction integrity. e.g. database security
Which duties should be segregated within the centralized firm?
2. Database administrator (DBA) has to be segregated from other IT functions.
3. DBA & SD
4. Separating New System Development from Maintenance
- Higher grades + faster learning
- Never study anything twice
- 100% sure, 100% understanding
For my 1st exam I got a C. Then, I started looking for ways to learn better and I came across Study Smart. Since then I have scored a A+, A, A- and another A. I highly recommend it to everyone who wants to hear it. I am so happy with it!!
I was struggling to finish all my first-year subjects for 3 years. Then I discovered Study Smart, which helped me to finish all of them within 3 months.
Because of StudySmart, things are going well in many ways. Before, I always had study stress and no time for anything. Now I feel calm and confident (because of the program). I used to score a B, now I usually score an A or A+.
Hey Chris, I really want to thank you very much for developing the platform, I usually got around C for my exams, now I scored an A+, an A and a A- !!
Since using Study Smart, my average has increased significantly. I even completed a statistics course with a A+ while I'm bad at statistics. I took on extra courses this year, because of Study Smart. Thanks so much!
Ever since I started studying with StudySmart I passed all my exams !!! No more re-sits!! At first, I was happy with a pass and now I only get good grades. Many thanks!
I aced all the courses I studied with Study Smart. For law, I first scored a D, and now an A! I’m 100% sure that I’ll pass all the courses I study with Study Smart.
I always thought I studied well. My grades were fine. I could never have imagined that applying these study skills would have such a huge and direct impact on my grades, my speed and the pleasure I have in learning.
For the first time, I finally feel totally confident about the way I learn. I have the perfect overview and make great progress in terms of speed and the grades I get. Thanks, Chris!
I immediately started to enjoy learning again, and my grades soared. All of a sudden, everything went better. I highly recommend Study Smart to all students..
Being able to create my materials online made the process of studying so much smoother and quicker. I no longer have to spend a huge amount of my time on creating my summaries.
At first, my notes were a mess. Now I use Study Smart to take my notes in a perfectly structured way. It helps me to save a lot of time and do other things I enjoy.
Students that study with Study Smart get better grades. The system applies all the learning methods in such a way that both well-performing students and students who struggle perform much better.
Hi Chris, I would like to thank you very much. Last year I scored C on a course, and this year I got an A+ thanks to your method! Thank you very much!
The largest effect is that my child is more enthusiastic about school! Every parent wants their children to be happy at school, Study Smart made it happen.
In high school, I failed several exams, and that has really changed now. I actually needed this tool very much back then. Since I started studying with StudySmart, I haven't had any D's. My average score is now an A and those are results I would have never had in the past
With my old method, I passed only 3 out of 8 courses. Since I started taking my notes digitally in Study Smart, I have passed all my courses on the first try. For me, StudySmart takes away the stress of wondering if I will pass or not.
Thanks to StudySmart, I passed all my exams, and with better grades than before! On top of that, I have mastered a very good study method now, which I am confident will help me earn my degree.
Why should systems development and maintenance by separated?
Why should DBA be separated from other IT functions?
Why should DBA and SD be separated?
Why should new systems development be separated from maintenance.
When a system is poorly documented, it is difficult to interpret, test and debug. Maintenance group requires adequate documentation to perform their maintenance duties.
What are the IT control implications that management and accountants should recognize on DDP?
Redundancy: autonomous SD activities throughout the firm can result in the creation of redundant applications and database.
Consolidating Incompatible Activities, operationally infeasible for segregation of duty
Difficulty in Acquiring Qualified Professionals
Lack of Standards
What kind of advice and expertise does the corporate IT function provide to the various distributed IT functions?
User Services. Provides help in installation, troubleshooting hardware & software problems.
Standard-setting body. Establish & distribute to user areas appropriate standards for systems development, programming and documentation that will be compliant with SOX requirements.
Personnel review. The corporate group is better equipped than users to evaluate the technical credentials of prospective systems professionals.
What are the audit procedures that relate to organizational structure?
Review relevant documentations: organizational chart, mission statement, job description for key functions to determine if individuals-groups perform incompatible function.
Review system documentation and maintenance records for a sample of applications. Verify that maintenance programmers are not the original design programmers.
Through observation, determine that the segregation policy is being followed. Review operations room access logs to determine if programmers enter the facility for reasons other than system failures.
Review user rights and privileges to ensure these are consistent with their job description.
What are the audit objectives related to computer center security?
(2) insurance coverage on equipment is adequate to compensate the organization for the destruction-damage to its computer center. Auditors should annually review the insurance coverage, verify all new acquisitions are listed and obsolete equipments & software have been deleted.
(3) operator documentation is adequate to deal with routine operations as well as system failures.
What is an empty shell or cold site plan?
What is a recovery operations center or hot site?
What is an internally provided backup/ own remote mirrored data center?
What is a disaster recovery team?
control concerns do not apply in this setting. Business continuity is the primary consideration.
The question on the page originate from the summary of the following study material:
- A unique study and practice tool
- Never study anything twice again
- Get the grades you hope for
- 100% sure, 100% understanding
