Information Technology for Managers 2nd Edition By George Reynolds - Test Bank Instant Download - Complete Test Bank With Answers Sample Questions Are Posted Below Chapter 5: CORPORATE AND IT GOVERNANCE MULTIPLE CHOICE: Interest in corporate governance has grown due to _____ scandals. accounting espionage journalistic plagiarism ANS: …
$19.99
Information Technology for Managers 2nd Edition By George Reynolds – Test Bank
Instant Download – Complete Test Bank With Answers
Sample Questions Are Posted Below
Chapter 5: CORPORATE AND IT GOVERNANCE
MULTIPLE CHOICE:
ANS: A
RATIONALE: Interest in corporate governance has grown due to accounting scandals resulting in bankruptcies, multimillion-dollar fines, and/or jail sentences for senior executives at companies such as Arthur Andersen, Computer Associates, Enron, Global Crossing, Hewlett Packard, J.P. Morgan, Tesco, Tyco, and Worldcom. In addition, board members who are responsible for paying executives have been challenged as a result of several scandals.
ANS: D
RATIONALE: Information technology governance is a framework that ensures that information technology decisions are made while taking into account the goals and objectives of the business. Governance includes defining the decision-making process itself, as well as defining who makes the decisions; who is held accountable for results; and how the results of decisions are communicated, measured, and monitored.
ANS: A
RATIONALE: An organization’s executives and board of directors are responsible for governance. They carry out this duty through committees that oversee critical areas such as audits, compensation, and acquisitions.
ANS: D
RATIONALE: An organization’s executives and board of directors are responsible for governance. They carry out this duty through committees that oversee critical areas such as audits, compensation, and acquisitions. Enlightened organizations recognize that information technology (IT) governance is not the responsibility of IT management but of executive management, including the board of directors.
ANS: A
RATIONALE: The two primary goals of effective information technology (IT) governance are ensuring that an organization achieves good value from its investments in IT and mitigating IT-related risks. Achieving good value from IT investments requires a close alignment between business objectives and IT initiatives. Mitigating IT-related risks means embedding accountability and internal controls in the organization.
ANS: C
RATIONALE: Information technology governance is similar to financial portfolio management, in which a manager weighs the rate of return and balances it against the risks associated with each investment. The manager then makes choices to achieve a good rate of return at an acceptable level of risk.
ANS: D
RATIONALE: Mitigating information technology (IT)-related risks means embedding accountability and internal controls in the organization. Value and risk are the two main goals of IT governance.
ANS: B
RATIONALE: Only information technology projects that are consistent with the business strategy and that support business goals and objectives should be considered for staffing and funding. Such projects will deliver the organization’s strategic goals, whether they are increased revenues, decreased costs, improved customer service, increased market share, or decreased time to market.
ANS: A
RATIONALE: For information technology projects to be aligned with business goals and properly staffed, funded, and executed, the projects must deliver expected business results on time and within budget. This process involves applying good project management principles to ensure that work is done efficiently and that results can be achieved with a high degree of predictability.
ANS: C
RATIONALE: The intention of the Bank Secrecy Act is to detect and prevent money laundering by requiring financial institutions to report certain transactions to government agencies. It also withholds from clients that such reports were filed about them.
ANS: D
RATIONALE: Basel II Accord creates international standards that strengthen global capital and liquidity rules with the goal of promoting a more resilient banking sector. Its goal is to promote a more resilient banking sector.
ANS: B
RATIONALE: California Senate Bill 1386 act protects against identity theft by imposing disclosure requirements for businesses and government agencies that experience security breaches that might put the personal information of California residents at risk. This is the first of many state laws aimed at protecting consumers from identity theft.
ANS: C
RATIONALE: The intent of the Foreign Corrupt Practices Act is to prevent certain classes of persons and entities from making payments to foreign government officials. This is done in an attempt to obtain or retain business.
ANS: A
RATIONALE: Foreign Account Tax Compliance Act identifies U.S. taxpayers who hold financial assets in non-U.S. financial institutions and offshore accounts. This is done so that the taxpayers cannot avoid their U.S. tax obligations.
ANS: B
RATIONALE: Federal Information Security Management Act strengthens computer and network security within the U.S. federal government and affiliated parties (such as government contractors). This is done by mandating yearly audits.
ANS: B
RATIONALE: The European Union Data Protection Directive protects the privacy of European Union citizens’ personal information. It protects by placing limitations on sending such data outside of the European Union to areas that are deemed to have less than adequate standards for data security.
ANS: A
RATIONALE: The Personal Information Protection and Electronic Documents Act (Canada) governs the collection, use, and disclosure of personally identifiable information in the course of commercial transactions. It is created in response to European Union data protection directives
ANS: C
RATIONALE: The intent of the Gramm-Leach-Bliley Act is to protect the privacy and security of individually identifiable financial information collected and processed by financial institutions.
ANS: B
RATIONALE: Internal control is the process established by an organization’s board of directors, managers, and information technology systems to provide reasonable assurance for the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with applicable laws and regulations. A fundamental concept of good internal controls is the careful separation of duties associated with a key process so that the duties must be performed by more than one person.
ANS: A
RATIONALE: A fundamental concept of good internal controls is the careful separation of duties associated with a key process so that the duties must be performed by more than one person. Separation of duties is essential for any process that involves the handling of financial transactions so that fraud requires the collusion of two or more parties.
ANS: D
RATIONALE: Internal control is the process established by an organization’s board of directors, managers, and information technology systems to provide reasonable assurance for the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with applicable laws and regulations. It plays a key role in preventing and detecting fraud and protecting an organization’s resources.
ANS: B
RATIONALE: Information technology (IT) value delivery and risk management are the goals of effective IT governance. Strategic alignment and IT resource management are the methods for achieving these goals.
ANS: A
RATIONALE: Information technology (IT) value delivery and risk management are the goals of effective IT governance. Strategic alignment and IT resource management are the methods for achieving these goals.
ANS: A
RATIONALE: Successful managers seek opportunities to deliver the potential benefits promised by IT. Thus, successful managers need a process that can help them achieve high value from their investments in information technology (IT), manage associated risks, and deliver IT-related solutions that comply with increasing regulatory compliance demands. IT governance is just such a process.
ANS: D
RATIONALE: Information technology (IT) related initiatives are seldom simple and straightforward. They are influenced by many factors: the vision, mission, and values of the organization; community and organizational ethics and values; a myriad of laws, regulations, and policies; industry guidelines and practices; changing business needs; and the values of the IT stakeholders and company owners.
ANS: B
RATIONALE: The Committee of Sponsoring Organizations (COSO) 2013 framework provides guidance on enterprise risk management, internal control, and fraud deterrence. It is designed to improve organizational performance and governance and reduce the extent of fraud in organizations.
ANS: B
RATIONALE: Control Objectives for Information and Related Technology (COBIT) is a set of guidelines whose goal is to align information technology resources and processes with business objectives, quality standards, monetary controls, and security needs. It provides a framework for information technology management and governance consisting of process descriptions, control objectives, management guidelines, and models to assess maturity and capability for each process.
ANS: C
RATIONALE: Control Objectives for Information and Related Technology (COBIT) provides a framework for information technology management and governance consisting of process descriptions, control objectives, management guidelines, and models to assess maturity and capability for each process. It is a set of guidelines whose goal is to align information technology resources and processes with business objectives, quality standards, monetary controls, and security needs.
ANS: B
RATIONALE: International standards organization (ISO) framework provides best practice recommendations on information security management. It is developed for use by those responsible for initiating, implementing, or maintaining information security management systems.
ANS: A
RATIONALE: Information Technology Infrastructure Library (ITIL) provides a proven and practical framework for planning and delivering IT services based on a synthesis of the best ideas from international practitioners. It also provides best practices and criteria for effective IT services such as help desk, network security, and IT operations.
ANS: D
RATIONALE: Information Technology Infrastructure Library (ITIL) provides best practices and criteria for effective IT services such as help desk, network security, and IT operations. ITIL advocates that IT services be aligned with the objectives of the business and support the core business processes.
ANS: A
RATIONALE: Control Objectives for Information and Related Technology (COBIT) provides guidelines for 37 processes that span a wide range of information technology (IT)-related activities. COBIT is a useful tool to improve the quality and measurability of IT governance or to implement a control system for improved regulatory compliance.
ANS: C
RATIONALE: Service strategy involves understanding who the information technology (IT) customers are, the service offerings required to meet their needs. It also analyzes IT capabilities and resources required to develop and successfully execute these offerings.
ANS: B
RATIONALE: Service transition involves following the design to build, test, and move into production the services that will meet customer expectations. It is the phase next to the service design phase.
ANS: A
RATIONALE: Service design ensures that the new and/or changed services are designed effectively to meet customer expectations. The designed service is then built, tested, and moved in the service transition phase.
ANS: A
RATIONALE: Service design ensures that the new and/or changed services are designed effectively to meet customer expectations. The designed service is then built, tested, and moved in the service transition phase.
ANS: D
RATIONALE: Service operation delivers information technology services on an ongoing basis while monitoring the overall quality of the service. The delivered services are the built in the service transition phase.
ANS: B
RATIONALE: Continual process improvement provides a means for an information technology organization to measure and improve the service levels, the technology. It also improves the efficiency and effectiveness of processes used in the overall management of services.
ANS: C
RATIONALE: The Plan step requires the improvement team to identify its target improvement area, analyze how things work currently, and identify opportunities for improvement. This step is followed by a Do step that implements the change decided in the Plan step.
ANS: A
RATIONALE: In the Do step, the change decided in the Plan step is implemented, often on a pilot or limited basis to assess the potential impact of the proposed change(s). This step is followed by a Check step that measures the results of change.
ANS: A
RATIONALE: Choosing a specific information technology process to improve, setting goals for the chosen processes, benchmarking the current process using the Control Objectives for Information and Related Technology (COBIT) framework, analyzing the current process, identifying gaps between actual and ideal processes, and developing improvement ideas using best practices from COBIT are activities done in the Plan step of the Plan-Do-Check-Act model. The Plan step requires the improvement team to identify its target improvement area, analyze how things work currently, and identify opportunities for improvement.
ANS: B
RATIONALE: In the Check step, the results of a change are measured. This step is followed by an Act step, where an improvement team considers whether it is worth continuing the process with the recently implemented change.
ANS: D
RATIONALE: In the Act step, the improvement team considers whether it is worth continuing a process with a recently implemented change. If the change is too complicated for people to follow or if it led to insignificant improvements, then the change may be aborted. At this point the team would go back to the Do step and start over. Thus, the completion of one cycle of improvement flows into the beginning of the next cycle.
ANS: C
RATIONALE: A business continuity plan defines the people and procedures required to ensure timely and orderly resumption of an organization’s essential, time-sensitive processes with minimal interruption. Having a business continuity plan in place before the business interruption occurs is critical.
ANS: A
RATIONALE: The International Standards Organizational standard ISO 22301:2012 (“Societal Security–Business Continuity Management Systems–Requirements”) specifies requirements to plan, establish, implement, operate, monitor, review, maintain, and continually improve a documented management system to prepare for, respond to, and recover from disruptive events when they arise. The standard is applicable to organizations in all industries, profit and nonprofit, and of all sizes.
ANS: B
RATIONALE: Due diligence is the effort made by an ordinarily prudent or reasonable party to avoid harm to another party. Failure to make this effort may be considered negligence.
ANS: C
RATIONALE: Being able to show a written, tested business continuity plan is considered part of due diligence. Indeed, many laws and regulations specify requirements for business continuity planning. The requirements vary by country and by industry.
ANS: D
RATIONALE: The scope of a full business continuity plan addresses the health and safety of all workers. It minimizes financial loss, including damages to facilities, critical data, records, finished products, and raw materials; minimizes the interruption to critical business processes; and provides for effective communications to customers, business partners, and shareholders.
ANS: A
RATIONALE: Every company has key electronic records and hard copy data that are essential to manage and control the cash flow and other tangible assets of the organization. These records include customer data, contracts, current order information, accounts payable data, accounts receivable data, inventory records, and payroll information. Companies must identify vital records and data and then determine where and how they are being stored and backed up.
ANS: D
RATIONALE: The recommended and widely implemented approach for data backup is to use online databases to update the data; as online databases are updated, companies can have these changes mirrored on a backup database hundreds of miles away. This approach is expensive, but it provides rapid access to current data in the event of a disaster.
ANS: B
RATIONALE: An inexpensive yet safe approach to backup vital data is to copy online databases every night to high-volume, inexpensive magnetic storage devices and ship them off-site to a data storage facility in another state. This low-cost solution minimizes the potential for losing more than one day of data.
ANS: C
RATIONALE: The time within which a business function must be recovered before an organization suffers serious damage is called the recovery time objective. Based on this data, each business function can be placed in the appropriate category.
ANS: B
RATIONALE: The “AA” business function is critical to the operation of a firm and cannot be unavailable for more than a few hours without causing severe problems. Accounts receivable and accounts payable can be examples of this business function.
ANS: A
RATIONALE: Payroll business function, while significant, can be unavailable for up to a few days without causing severe problems. Thus, it belongs to the “A” priority business function.
ANS: D
RATIONALE: Employee recruiting is a business function that can be unavailable for several days in times of a major disaster without causing major problems. Thus it belongs to the “B” priority business function.
ANS: C
RATIONALE: The “AAA” business function is extremely critical to the operation of a firm and cannot be unavailable for more than a few minutes without causing severe problems. Order processing is an example of this business function.
ANS: A
RATIONALE: Disaster recovery as a service (DRaaS) is the replication and hosting of physical or virtual servers and other necessary hardware and software by a third-party service provider to deliver information technology services in the event of a disaster. Many small-to-midsized organizations implement a DRaaS strategy to avoid the costs and effort associated with building and maintaining their own off-site disaster recovery (DR) environment.
ANS: B
RATIONALE: Emergency procedures define the steps to be taken during a disaster and immediately following it. A little planning and practice of such procedures can minimize loss of life and injuries as well as reduce the impact on a business and its operations.
ANS: C
RATIONALE: The control group provides direction and control during a disaster and operates from a secure emergency operations center equipped with emergency communications gear. The group gathers and analyzes data needed to make decisions and direct the work of the emergency response team and business recovery team.
ANS: D
RATIONALE: The control group provides direction and control during a disaster and operates from a secure emergency operations center equipped with emergency communications gear. The group gathers and analyzes data needed to make decisions and direct the work of the emergency response team and business recovery team.
ANS: A
RATIONALE: For most organizations, the emergency response team includes members of the fire department, police department, and other first responders. Some large organizations have their own emergency firefighting department. Their role is to help save lives and contain the impact of the disaster.
ANS: a
RATIONALE: The emergency response team in most organizations includes members of the fire department, police department, and other first responders. The members of this team should be carefully selected based on their areas of expertise, experience, and ability to function well under extreme pressure.
ANS: C
RATIONALE: The business recovery group includes employees and nonemployee specialists who assess the situation once it is safe to do so. They assess the extent of the damage and decide if or when it may be safe to reenter the affected work area.
ANS: B
RATIONALE: The business recovery group includes employees and nonemployee specialists who assess the situation once it is safe to do so. They assess the extent of the damage and decide if or when it may be safe to reenter the affected work area. They recommend whether the disaster recovery plan needs to be put into effect, depending on the impact of the disaster or incident.
ANS: D
RATIONALE: It is a good practice to identify “floor wardens” who are responsible for evacuating a given floor or work area. These floor wardens receive additional training in crowd control, first aid, CPR, operation of defibrillators, and helping handicapped workers evacuate.
TRUE/FALSE:
ANS: False
RATIONALE: Interest in corporate governance has grown due to accounting scandals resulting in bankruptcies, multimillion-dollar fines, and/or jail sentences.
ANS: True
RATIONALE: Only information technology projects that are consistent with the business strategy and that support business goals and objectives should be considered for staffing and funding. Such projects will deliver an organization’s strategic goals, whether they are increased revenues, decreased costs, improved customer service, increased market share, or decreased time to market.
ANS: False
RATIONALE: The objective of the Foreign Account Tax Compliance Act is to identify U.S. taxpayers who hold financial assets in non-U.S. financial institutions and offshore accounts so that they cannot avoid their U.S. tax obligations.
ANS: False
RATIONALE: The USA PATRIOT Act is designed to combat the financing of terrorism through money laundering and other financial crimes.
ANS: False
RATIONALE: Performance measurement is the means by which management tracks how well its information technology governance efforts are succeeding.
ANS: False
RATIONALE: Information technology (IT)-related initiatives are seldom simple and straightforward. They are influenced by many factors: the vision, mission, and values of the organization; community and organizational ethics and values; a myriad of laws, regulations, and policies; industry guidelines and practices; changing business needs; and the values of the IT stakeholders and company owners.
ANS: True
RATIONALE: The IT Infrastructure Library (ITIL) is a set of guidelines initially formulated by the U.K. government in the late 1980s and widely used today to standardize, integrate, and manage IT service delivery. ITIL provides a proven and practical framework to plan and deliver IT operational services based on a synthesis of the best ideas from international practitioners.
ANS: False
RATIONALE: Having a business continuity plan in place before a business interruption occurs is critical; otherwise, an organization may not be able to respond quickly enough to prevent service interruption.
ANS: False
RATIONALE: The International Standards Organizational standard ISO 22301:2012 (“Societal Security–Business Continuity Management Systems–Requirements”) specifies requirements to plan, establish, implement, operate, monitor, review, maintain, and continually improve a documented management system to prepare for, respond to, and recover from disruptive events when they arise. The standard is applicable to organizations in all industries, profit and nonprofit, and of all sizes.
ANS: True
RATIONALE: The disaster recovery plan must be tested to ensure that it is effective and that people can execute it. Many companies practice the disaster recovery plan for at least one AAA priority system once per year.
ESSAY:
ANS: Control Objectives for Information and Related Technology (COBIT) is a set of guidelines whose goal is to align information technology (IT) resources and processes with business objectives, quality standards, monetary controls, and security needs. These guidelines are issued by the IT Governance Institute. They provide metrics, best practices, and critical success factors for COBIT-defined IT-related processes. COBIT 5.0 proposes five principles that guide governance of IT:
ANS: A business continuity plan defines the people and procedures required to ensure timely and orderly resumption of an organization’s essential, time-sensitive processes with minimal interruption. Having a business continuity plan in place before a business interruption occurs is critical; otherwise, the organization may not be able to respond quickly enough to prevent service interruption.
ANS: A disaster recovery plan is a component of the organization’s business continuity plan that defines the process to recover an organization’s business information system assets including hardware, software, data, networks, and facilities in the event of a disaster. The disaster recovery plan focuses on technology recovery and identifies the people or the teams responsible for taking action in the event of a disaster, what exactly these people will do when a disaster strikes, and the information system resources required to support critical business processes.
The process involved in developing a disaster recovery plan includes:
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
Original price was: $30.00.$20.00Current price is: $20.00.
