Chapter5

CHAPTER 5
QUESTIONS
1. What are the five components of the COSO IC-IF Model?
 Control Environment
 Risk Assessment
 Monitoring Activities
 Information and Communication
 Control Activities
2. Describe each of the components of the COSO IC-IF Model.
Control Environment
Exercise integrity and ethical values. Make a commitment to competence. Use the board of
directors and audit committee. Facilitate management’s philosophy and operating style. Create
organizational structure. Issue assignment of authority and responsibility .Utilize human
resources policies and procedures.
Risk Assessment
Create companywide objectives. Incorporate process-level objectives. Perform risk

identification and analysis. Manage change.
Control Activities
Follow policies and procedures. Improve security (application and network). Conduct
application change management. Plan business continuity/backups. Perform outsourcing.
Information and Communication
Measure quality of information. Measure effectiveness of communication.
Monitoring Activities
Perform ongoing monitoring. Conduct separate evaluations. Report deficiencies.
3. Explain the benefits of the COBIT Model in the IT and the general business context.
COBIT stands for Control Objectives for Information and Related Technology. It is a framework
created by the ISACA (Information Systems Audit and Control Association) for IT governance
and management. It was designed to be a supportive tool for managers—and allows bridging
the crucial gap between technical issues, business risks, and control requirements. COBIT is a
thoroughly recognized guideline that can be applied to any organization in any industry.
Overall, COBIT ensures quality, control, and reliability of information systems in an
organization, which is also the most important aspect of every modern business. Today, COBIT
is used globally by all IT business process managers to equip them with a model to deliver value
to the organization, and practice better risk management practices associated with the IT
processes. The COBIT control model guarantees the integrity of the information system.
4. Describe the implications of Principle 11 of the COSO 2013 IC-IF Framework.
The 1992 COSO IC-IF and 2004 ERM Frameworks did not directly address IT considerations. That
changed with the 2013 COSO Framework, which refers directly to IT General Computer Controls
(GCCs) in Principle 11. This principle states that the organization selects and develops general
control activities over technology to support the achievement of objectives. In this way, IT’s
pivotal role as essential for long-term success is manifested and recognized. Furthermore, it
recognizes that there is an inherent dependency and linkage among IT GCCs, processes, and
automated control activities.
5. Explain the relevance of IT GCCs for business auditors.
The objective of our general computer controls (GCCs) audits is to determine whether
computer controls effectively support the confidentiality, integrity, and availability of
information systems. Information systems are important for the delivery of essential services to
the public.
6. List five ISO standards and explain their relevance to internal auditors.
ISO 9000 - Quality Management
Quality is critical to remaining competitive in any industry. The ISO 9000 family is the quality
management standard, and comprises of some of ISO’s best-known standards. QISO quality
standards guide companies and equip them with the necessary tools to continuously improve
quality and ensure that customer demands are always met. ISO 9001:2015 is the only standard
in the category that you can be certified to, and lays down the criteria for a quality
management system.
ISO 14000 – Environmental Management
This is a family of standards that provides the necessary tools and guidelines for companies to
manage their environmental responsibilities. ISO 14001 and all other standards in this category
lay emphasis on environmental systems. These standards use tools such as audits,
communications, life-cycle analysis and environmental challenges. This standard can be used by
any organisation regardless of the industry.
ISO 31000: 2018 - Risk Management

Today’s business world is riddled with uncertainty. Risks facing companies have a direct impact
on the economic performance, reputation, as well as safety and environmental outcomes. ISO
31000 cannot be used for certification purposes, but it provides a framework for managing
risks. It offers guidance to organisations for internal and external audit programs, and enables
organisations to achieve objectives in an uncertain environment by facilitating the identification
of opportunities and threats.
ISO 50001: 2018 - Energy Management
ISO 50001: 2018 provides guidance for companies in implementing an Energy Management
System (EnMS) that aims at improving efficiency in the use of energy. This aims to reduce an
organisation’s energy footprint by minimising greenhouse gas emissions. ISO 50001 is not
obligatory, and many organisations implement it solely to comply with stakeholder
expectations.
ISO 26000: 2010 - Social Responsibility
Though organisations cannot be certified to ISO 26000, the standard provides guidance on how
organisations can embrace social responsibility. It clarifies what social responsibility entails for
organisations to lay a framework for effective action.
7. Explain how ISO 9000—Quality Management and related standards can help internal
auditors improve business practices and strengthen the Three Lines of Defense framework.
Quality is critical to remaining competitive in any industry. The ISO 9000 family is the quality
management standard, and comprises of some of ISO’s best-known standards. ISO quality
standards guide companies and equip them with the necessary tools to continuously improve
quality and ensure that customer demands are always met. ISO 9001:2015 is the only standard
in the category that you can be certified to, and lays down the criteria for a quality
management system. There are over one million organisations in over 170 countries that are
certified to ISO 9001.
8. Explain how ISO 31000—Risk Management and related standards can help internal Today’s
business world is riddled with uncertainty. Risks facing companies have a direct impact on the
economic performance, reputation, as well as safety and environmental outcomes.
ISO 31000 cannot be used for certification purposes, but it provides a framework for managing
risks. It offers guidance to organisations for internal and external audit programs, and enables
organisations to achieve objectives in an uncertain environment by facilitating the identification
of opportunities and threats. Organisations are able to benchmark with internationally
recognised practices for effective management and corporate governance auditors improve
business practices and better identify and assess organizational risks.
9. What is ITIL and how can it help improve the practice of integrated auditing?
ITIL, an acronym for Information Technology Infrastructure Library, is an extensively accepted
approach to IT service management (ITSM), which focuses on aligning IT services with business
needs. It directs the professionals and the organisations in using IT as a tool that facilitates
business growth and transformation.
ITIL enhances efficiency of services for the trading partners. The processes provided by ITIL help
the service providers work with their clients and suppliers which enables them to make wise
decisions on cost optimisation, investment opportunities, risk management, and various other
priorities.
10. What are the five maturity levels in the CMMI Model?
 Initial
 Managed
 Defined
 Quantitatively Managed; and
 Optimizing.

Chapter5

Uploaded by

Copyright:

Available Formats

Chapter5

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter5

Uploaded by

Copyright:

Available Formats

CHAPTER 5

1. What are the five components of the COSO IC-IF Model?

2. Describe each of the components of the COSO IC-IF Model.

Create companywide objectives. Incorporate process-level objectives. Perform risk

Information and Communication

Measure quality of information. Measure effectiveness of communication.

Perform ongoing monitoring. Conduct separate evaluations. Report deficiencies.

4. Describe the implications of Principle 11 of the COSO 2013 IC-IF Framework.

ISO 14000 – Environmental Management

ISO 31000: 2018 - Risk Management

ISO 50001: 2018 - Energy Management

ISO 26000: 2010 - Social Responsibility

You might also like