Deck 5: IT in the New World of Corporate Governance Reforms

Question 1

Only publicly traded companies in the United States are subject to rules of financial disclosure.

Answer 1

False

Question 2

Surveys show that most firms have underestimated the costs of SOX compliance.

Answer 2

True

Question 3

SOX requires external auditors to independently attest to the effectiveness of internal financial controls, negating the need for an annual evaluation of internal controls and procedures for financial reporting.

Answer 3

False

Question 4

Prior to 2002, IT has been heavily affected by regulatory matters.

Question 5

Because of SOX's emphasis on control documentation, the technical skills required of IT staff are more important than written skills for complying with SOX requirements.

Question 6

Different regulations affect business units differently, but all regulations have an impact IT.

Question 7

The act designed to protect stockholders, employees, and consumers from inaccurate or misleading financial reports is called the:

A) 2001 Patriot Act
B) 1934 Securities and Exchange Act
C) 002 Sarbanes-Oxley Act
D) 2004 REVISED Securities and Exchange Act

Question 8

Legislators and other regulatory bodies are not very aware of the impact electronic information and systems can have on organizations and the public.

Question 9

New standards for internal controls have significant implications on how IT is managed and IT costs and productivity.

Question 10

It is the job of a company's Internal auditors to determine if its controls are "reasonable."

Question 11

The Security and Exchange Act mandates an annual evaluation of internal controls and procedures for financial reporting.

Question 12

All organizations are increasingly subject to a growing number of legal acts, regulations, and ethical expectations.

Question 13

Compliance with regulations involves huge costs for IT, but the costs are more than just monetary.

Question 14

In the past, most organizations designed their record-keeping systems as they wished with no real regard of regulatory issues.

Question 15

Surveys show that most firms have overestimated the costs of SOX compliance but the majority of those surveyed planned to increase their compliance budgets in the future.

Question 16

Since organizations are more dependent on automated information and processes, their IT infrastructures are also more vulnerable to security threats.

Question 17

Protection of systems and data is the biggest concern for IT but not necessarily other units of a business.

Question 18

Recent legislation makes CEOs and CFOs explicitly responsible for establishing, evaluating, and monitoring the effectiveness of internal controls over financial reporting and disclosure.

Question 19

As regulations become more numerous and complex, organizations are finding that only IT-based controls are effective in ensuring compliance.

Question 20

Compliance with the many new regulations imposed on organizations has led to significant IT costs.

Question 21

In practice, ________ refers to the structure, roles, procedures, and internal and external relationships that ensure that IT is well managed and can provide the necessary information to run the organization.

A) Business continuity planning
B) IT Governance
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Question 22

Which of the following IT elements addresses the work that is done to develop or acquire new applications?

A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) IT strategic planning, competitive advantage, increased costs.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Question 23

________ is the structure of relationships and processes that enable the enterprise to direct and control IT in order to achieve enterprise goals while balancing risk versus return.

A) Business continuity planning
B) IT Governance
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Question 24

________ is/are the front line of business support and often are the first to identify problems and risks with systems, operations, and information.

A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Question 25

________ oversees existing hardware, software, and networks and ensure ongoing operations, as well as those that make needed changes and deal with problems as they occur.

A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Question 26

IT management issues associated with SOX compliance include:

A) increased costs, operational challenges and new opportunities.
B) unforeseen benefits, new opportunities, and operational challenges.
C) competitive advantage, increased costs and new opportunities.
D) increased costs, operational challenges, new opportunities, and unforeseen benefits.

Question 27

U.S. companies have found that they spent more than ________ on IT investments to meet SOX requirements.

A) $1 billion
B) $2 billion
C) $3 billion
D) $5 billion
E) $5.5 billion

Question 28

The Sarbanes-Oxley Act strongly recommends that companies follow a framework for internal controls known as:

A) Committee of Sponsoring Organizations of the Treadway Commission
B) Control Objectives for Information and related Technology
C) Information Technology Control Guidelines
D) National Institute of Standards and Technology

Question 29

Industry-specific legislation issues that IT faces include:

A) software standards.
B) homeland security.
C) access to persons with disabilities.
D) Both B and C
E) Both A and B

Question 30

Transporting sensitive personal information across organizational and national boundaries could:

A) produce inaccurate or invalid information that could mislead auditors.
B) produce inaccurate or invalid information that could tax officials and inspectors.
C) create a sense if distrust among the public.
D) create a sense of distrust among investors.
E) All of the above

Question 31

Which of the following IT elements ensure that all work done in IT is properly completed, meets all control standards, and can be demonstrated to do so with reasonable assurance?

A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) Testing and validation, documentation management, and quality assurance.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Question 32

To reduce risk, organizations need a planned, integrated, and evolving set of practices for dealing with threat called ________.

A) Business continuity planning
B) Disaster recovery
C) Security architecture
D) Physical and virtual access
E) IT strategic planning

Question 33

Some of the benefits of a properly implemented internal control program include:

A) increased costs, operational challenges, new opportunities, and unforeseen benefits.
B) improved overall IT governance and enhanced understanding of IT by senior executives.
C) effective written documentation of controls and segregation of duties.
D) Both A and C.
E) All of the above.

Question 34

Two particularly challenging aspects of SOX and privacy legislation are:

A) the segregation of duties and technical documentation of controls.
B) the segregation of duties and restrictions on who has access to data.
C) the written documentation of controls and restrictions on who has access to data.
D) the written documentation of controls and segregation of duties.
E) the technical documentation of controls and who has access to the data.

Question 35

The single most challenging regulation that IT faces is:

A) capital management.
B) homeland security.
C) access to persons with disabilities.
D) the Sarbanes-Oxley Act.
E) the impact on the environment.

Question 36

SOX requires all of the following EXCEPT:

A) the CEO and CFO to personally certify internal financial controls.
B) internal auditors to personally certify internal financial controls.
C) external auditors to independently attest to the effectiveness of internal financial controls.
D) financial controls designed to achieve control objectives using established criteria.
E) financial control objectives and related controls are appropriately documented.

Question 37

Companies doing business with the European Union are not required to respect strict EU privacy standards since their systems operate in the United States.

Question 38

Which of the following IT elements addresses all data and information produced and/or stored by IT?

A) IT strategic planning, risk assessment, project management.
B) Information architecture, access to data, data administration.
C) IT strategic planning, competitive advantage, increased costs.
D) Risk assessment, new opportunities, IT strategic planning.
E) Competitive advantage, risk assessment, project management.

Question 39

Which of the following areas is one of the most important areas of control?

A) Testing and validation
B) Documentation management
C) Quality assurance
D) Information architecture and data administration

Question 40

________ is essential to ensure that all staff understand their responsibilities in complying with regulations.

A) Operations and infrastructure support
B) Help desks
C) IT governance
D) IT strategic plans
E) Training and awareness

Question 41

List and describe the (3) elements of daily IT operations that ensure ongoing operations. Indicate whether or not any of these areas are impacted by regulatory changes.

Question 42

List and describe the two areas of IT most impacted by SOX legislation.

Question 43

What is a framework? Name and describe the control framework used to comply with SOX requirements.

Question 44

Why are new and increasingly complex privacy controls and security legislation such a challenge for IT?

Question 45

List and describe (3) key IT elements affected by regulation. Which is the most critical? Why?

Question 46

What are the two most challenging aspects of SOX and privacy legislation compliance?

Question 47

Can morale issues develop among IT staff when IT must comply with SOX regulations? Why or why not?

Question 48

When properly implemented, what are some of the benefits of a strong internal control program to an organization?

Question 49

List and describe the basic requirements of the Sarbanes-Oxley Act.

Question 50

List and describe the (3) IT elements that run existing hardware, software, and networks and ensure ongoing operations, as well as those that make needed changes and deal with problems as they occur.