III IC-71 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Audit trail

A chronological record of system activity that lets an auditor reconstruct, review, and examine the sequence of events behind a transaction from source document to financial statement.

General IT controls

Controls over the IT environment that apply across applications, covering access management, change management, IT operations, and backup; they underpin reliance on automated application controls.

Application controls

Controls specific to a business process within an application, classified as input, processing, and output controls, such as edit checks, reconciliation totals, and exception reports.

Segregation of duties

A control principle requiring that authorization, custody of assets, and recording or reconciliation of a transaction are not all performed by the same individual.

COSO internal control components

Control environment, risk assessment, control activities, information and communication, and monitoring activities; the 2013 framework maps seventeen principles across these five components.

Three lines model

IIA structure in which operational management owns risk, risk and compliance functions provide challenge and expertise, and internal audit gives independent assurance to the governing body.

IT governance definition

The system by which IT is directed and controlled, covering strategic alignment, value delivery, resource management, risk management, and performance measurement, distinct from day-to-day IT management.

Control objective versus procedure

The objective states what must be achieved, such as recording each valid transaction once; the procedure states how it is achieved, such as a three-way match before payment.

Audit risk model

Audit risk equals inherent risk times control risk times detection risk; detection risk is controlled by the auditor through the nature, timing, and extent of substantive procedures.

Generalized audit software

Auditor-controlled programs used to extract and analyze entire populations, supporting recalculation, stratification, duplicate and gap detection, and exception reporting without relying on client-written code.

Parallel simulation

An audit technique in which the auditor writes an independent program replicating the client's processing logic and compares outputs on the same input data.

Integrated test facility

An audit technique using dummy entities in a live system so test transactions pass through production processing; dummy entries must later be reversed to avoid misstating reported figures.

Test data method

An audit technique processing auditor-designed valid and invalid transactions through the client's program to confirm that edit and validation controls operate as documented.

Change management control sequence

Request, risk assessment, authorization, development in a segregated environment, testing including user acceptance, approval, migration to production, and post-implementation review; emergency changes need retroactive approval.

Evidence reliability hierarchy

Auditor's direct observation ranks highest, followed by externally generated documents, internally generated documents under strong controls, and lastly oral representations from management.

Recovery time objective

The maximum acceptable elapsed time to restore a process or system after disruption; it must not exceed the maximum tolerable downtime of the business process.

Recovery point objective

The maximum acceptable data loss expressed in time, determining backup or replication frequency; near-zero RPO requires continuous replication or mirroring.

COBIT 2019 structure

An IT governance framework separating governance and management objectives and defining components: processes, organizational structures, information, culture and behavior, people and skills, and services.

SOC 1 versus SOC 2

SOC 1 reports on controls relevant to user entities' financial reporting; SOC 2 reports on controls against trust services criteria such as security, availability, and confidentiality.

Risk treatment options

Avoid, reduce, transfer, or accept; residual risk remaining after controls must be formally accepted by an accountable business owner.

CIA triad

Confidentiality, integrity, and availability: the three core information security objectives, supported by authentication and non-repudiation properties.

Symmetric versus asymmetric encryption

Symmetric algorithms such as AES are fast for bulk data but need secure key distribution; asymmetric algorithms such as RSA solve key exchange and enable digital signatures but are slower.

Digital signature mechanics

The sender hashes the message and encrypts the hash with a private key; the recipient decrypts with the public key and recomputes the hash, giving integrity, authentication, and non-repudiation but not confidentiality.

Hashing versus encryption

Hashing is a one-way function providing integrity checks only; encryption is reversible with a key and provides confidentiality. Hashing alone cannot protect data secrecy.

RBAC versus MAC

Role-based access control grants permissions by job role; mandatory access control enforces system-defined labels, as in Bell-LaPadula no-read-up and no-write-down rules.

IDS versus IPS

An intrusion detection system monitors and alerts on suspicious traffic; an intrusion prevention system sits inline and can block or drop the traffic it detects.

Incremental versus differential backup

Incremental copies changes since the last backup of any type, needing the full set plus every increment to restore; differential copies changes since the last full backup, needing only full plus latest differential.

Hot versus cold site

A hot site is fully equipped and mirrored for near-zero recovery time at highest cost; a cold site provides only space and power, taking days to weeks to become operational.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned; evidence must be preserved before eradication to keep it forensically admissible.

Control deficiency communication

Deficiencies are reported in writing to those charged with governance; significant deficiencies are communicated to management on a timely basis with their potential effect described.

Scenario answer structure

Identify the risk or weakness, cite the applicable principle or standard, state the specific control or procedure, then state the evidence obtained; each distinct technical point earns marks.

Audit procedure phrasing

Each procedure should be written as an action the auditor performs and the evidence it produces, not as a restatement of the client's own control activity.