Deck 5: Corporate Governance and IT

Question 1

Only floor wardens need to be trained to recognize and respond to various types of disaster warnings,such as those for fires,tornados,gas releases,and so on.

Answer 1

False

Question 2

Acquisition of the COBIT framework,including tools and templates,is relatively expensive,but the tools are considered a good investment.

Answer 2

False

Question 3

IT-related initiatives are generally simple and straightforward.

Answer 3

False

Question 4

One good approach to backing up data in case of a disaster is to have employees take backup copies of vital data home at the end of the work day.

Question 5

Interest in corporate governance has grown due to recent accounting scandals resulting in bankruptcies at companies such as Arthur Andersen,Enron,Global Crossing,Tyco,and Worldcom.

Question 6

Today IT is viewed simply as a support function that is separate and distinct from a business.

Question 7

ITIL and COBIT are competing frameworks.

Question 8

A key to the successful introduction and adoption of more effective internal controls is ensuring that managers understand why they need to care about improved internal controls.

Question 9

COBIT is an internationally accepted standard for IT governance and control practices.

Question 10

The primary people involved in corporate governance only include the board of directors and the CEO.

Question 11

COBIT is a set of decades-old standards that are highly regarded by auditors because they provide specific guidelines and are completely independent of any computer hardware or software platforms.

Question 12

Organizations are in a constant state of change,so the plan must be continually updated to account for changes.

Question 13

The Plan-Do-Check-Act (PDCA)model is a tried and proven method that can be applied to general processes that have been identified for improvement.

Question 14

For all AAA priority business functions,document all the resources needed to recover the business function within the recovery time objective: number of people,phones,files,desks,office space,faxes,computers,software,printers,and so on.

Question 15

Enlightened organizations recognize that IT governance is not the responsibility of IT management but of executive management,including the board of directors.

Question 16

Many organizations combine the use of PDCA and an ITIL governance framework to get excellent results in their process improvement projects.

Question 17

An organization's executives are the only ones responsible for governance.

Question 18

The COBIT process known as "Effective Continuous Service" describes how to create an effective disaster recovery plan.

Question 19

The ITIL or COBIT governance frameworks provide an excellent set of best practices for various IT-related processes.

Question 20

One internal control might be that a company's purchasing department,accounts payable department,and IT systems not allowing the same person to authorize a major purchase and then approve its payment.

Question 21

A ____ plan defines the people and procedures required to ensure timely and orderly resumption of an organization's essential,time-sensitive processes with minimal interruption.

A) business disaster
B) business continuity
C) disaster recovery
D) business recovery

Question 22

It is a good practice to identify "____" who are responsible for evacuating a given floor or work area.

A) floor guards
B) floor monitors
C) floor matrons
D) floor wardens

Question 23

The ____ requires all financial-services institutions to communicate their data privacy policies and honor customer data-gathering preferences.

A) Gramm-Leach-Bliley regulation
B) Basel II regulation
C) Sarbanes-Oxley Act (SOX)
D) Foreign Corrupt Practices Act

Question 24

The ____ is a set of guidelines initially formulated by the UK government in the late 1980s and widely used today throughout Europe and the United States to standardize,integrate,and manage IT service delivery.

A) Capability Model Maturity Integration (CMMI)
B) Control OBjectives for Information and Related Technology (COBIT)
C) Project Management Book of Knowledge (PMBOK)
D) IT Infrastructure Library (ITIL)

Question 25

A(n)____ business function,while significant,can be unavailable for up to a few days without causing severe problems.

A) AAA
B) AA
C) A
D) B

Question 26

A(n)____ business function can be unavailable for several days in times of a major disaster without causing major problems.

A) AAA
B) AA
C) A
D) B

Question 27

____ is the process established by an organization's board of directors,managers,and IT systems to provide reasonable assurance for the effectiveness and efficiency of operations,the reliability of financial reporting,and compliance with applicable laws and regulations.

A) Internal control
B) External control
C) Mitigating control
D) Compensating control

Question 28

A(n)____ business function is extremely critical to the operation of the firm and cannot be unavailable more than a few minutes without causing severe problems.

A) AAA
B) AA
C) A
D) B

Question 29

The ____ ensures that internal controls are in place to govern the creation and documentation of financial statements.

A) Gramm-Leach-Bliley regulation
B) Basel II regulation
C) Sarbanes-Oxley Act (SOX)
D) Foreign Corrupt Practices Act

Question 30

____ is the set of processes,customs,rules,procedures,policies,and traditions that determine how to direct and control management activities.

A) External governance
B) Management governance
C) Corporate governance
D) Department process

Question 31

____ must take leadership for creating an effective partnership between the IT organization and the rest of the organization.

A) Junior executives
B) Senior executives
C) Frontline managers
D) Frontline employees

Question 32

For most organizations,the ____ includes members of the fire department,police department,and other first responder.

A) control group
B) recovery team
C) continuity group
D) emergency response team

Question 33

____ is a set of guidelines whose goal is to align IT resources and processes with business objectives,quality standards,monetary controls,and security needs.

A) Capability Model Maturity Integration (CMMI)
B) Control OBjectives for Information and Related Technology (COBIT)
C) Project Management Book of Knowledge (PMBOK)
D) IT Infrastructure Library (ITIL)

Question 34

The ____ includes employees and nonemployee specialists who assess the situation once it is safe to do so.

A) control group
B) recovery team
C) continuity group
D) emergency response team

Question 35

The ____ is an international set of risk and capital management requirements designed to ensure that banks hold capital reserves commensurate to the risk banks assume through their lending and investment practices.

A) Gramm-Leach-Bliley regulation
B) Basel II regulation
C) Sarbanes-Oxley Act (SOX)
D) Foreign Corrupt Practices Act

Question 36

The ____ provides direction and control during a disaster and operates from a secure emergency operations center equipped with emergency communications gear.

A) control group
B) recovery team
C) continuity group
D) emergency response team

Question 37

____ is a decision-making process that involves investments in IT.

A) IT governance
B) IT management
C) IT processes
D) IT governing

Question 38

The ____ requires employers to use national standards for electronic healthcare transactions with insurers and healthcare providers,and requires that employers ensure the security and privacy of employee health data.

A) Health Insurance Protection and Accountability Act (HIPAA)
B) Health Insurance Portability and Accountability Act (HIPAA)
C) Health Insurance Portability and Accuracy Act (HIPAA)
D) Health Insurance Protection and Accuracy Act (HIPAA)

Question 39

Mitigating IT-related risks means embedding ____ and internal controls in the organization.

A) transparency
B) process
C) integrity
D) accountability

Question 40

The ____ prohibits corrupt payments to foreign officials for the purpose of obtaining or keeping business.

A) Gramm-Leach-Bliley regulation
B) Basel II regulation
C) Sarbanes-Oxley Act (SOX)
D) Foreign Corrupt Practices Act

Question 41

In the ____________________ step of the Plan-Do-Check-Act model,the change decided in the Plan step is implemented,often on a pilot or limited basis to assess the potential impact of the proposed change(s).

Question 42

____________________ includes defining the decision-making process itself,as well as defining who makes the decisions,who is held accountable for results,and how the results of decisions are communicated,measured,and monitored.

Question 43

An organization's executives and board of directors carry out governance through ____________________ that oversee critical areas such as audits,compensation,and acquisitions.

Question 44

Floor ____________________ receive additional training in crowd control,first aid,CPR,operation of defibrillators,and helping handicapped workers evacuate.

Question 45

Identify five issues that corporate governance addresses.

Question 46

Discuss the responsibilities of floor wardens.

Question 47

The business continuity plan needs to be ____________________ to ensure that it is effective and that people can execute it.

Question 48

An effective business continuity plan can be developed only after an organization's unique ___________________ are identified.

Question 49

Internal controls play a key role in preventing and detecting ____________________ and protecting the organization's resources.

Question 50

____________________ procedures define the steps to be taken during a disaster and immediately following it.

Question 51

A(n)____________________ is an unplanned interruption of normal business operations for an unacceptable period of time.

Question 52

___________________ is the effort made by an ordinarily prudent or reasonable party to avoid harm to another party.Failure to make this effort may be considered negligence.

Question 53

Section ____________________ of the Sarbanes-Oxley Act requires a signed statement by the CEO and CFO attesting that the information in any of their firm's SEC filings is accurate,with stiff penalties for false attestation.

Question 54

List the specific features to consider for inclusion in the recovery of a AAA priority business function.

Question 55

The time within which a business function must be recovered before an organization suffers serious damage is called the __________________ objective.

Question 56

What does the team do in the Act step of the Plan-Do-Check-Act model?

Question 57

A(n)___________________ plan is a subset of the business continuity plan,and focuses on keeping components of the IT infrastructure functioning during a disaster or recovering them quickly afterward.

Question 58

Good ____________________ controls and management accountability must be embedded in the organization to avoid IT-related risks.

Question 59

A(n)____________________ business function is critical to the operation of the firm and cannot be unavailable more than a few hours without causing severe problems.

Question 60

Discuss several reasons why Harley-Davidson decided to convert to the COBIT control framework.