Match the following terms with their definitions.

The product of inherent risk and control risk.
Specific to a subsystem or an application to ensure the validity, completeness, and accuracy of the transactions.
Important in determining whether to implement an internal control.
Find problems when they arise.
A set of concepts and practices for IT service management.
A process, affected by the entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within the risk appetite, to provide reasonable assurance regarding the achievement of objectives.
This series contains a range of individual standards and documents specifically reserved by ISO for information security.
Composed of the AAA, AICPA, FEI, IIA and IMA; studies the causal factors that lead to fraudulent financial reporting and develops recommendations for public companies, independent auditors, the SEC and other regulators, and educational institutions to improve the quality of financial reporting through internal controls and corporate governance.
A response to business scandals such as Enron, WorldCom, and Tyco International. Requires public companies registered with the SEC and their auditors to annually assess and report on the design and effectiveness of internal control over financial reporting.
An internationally accepted set of best IT security and control practices for IT management released by the IT Governance Institute.
The process of identifying and analyzing risks systematically to determine the firm's risk response and control activities.
A set of processes and policies in managing an organization with sound ethics to safeguard the interests of its stakeholders.
Established by SOX to provide independent oversight of public accounting firms.
Provide output to authorized people and ensure the output is used properly.
Pertain to enterprise-wide issues such as controls over accessing the network, developing and maintaining applications, and documenting changes of programs.
Involve processes that provide assurance for information and help to mitigate risks associated with the use of technology.
Enterprise-level controls over IT.
Mainly manual but could involve the physical use of computing technology.
A formal expectation on what is considered to be ethical within an organization to promote ethical behavior.
The risk related to the nature of the business activity itself.
Deter problems before they arise.
Fix problems that have been identified, such as using backup files to recover corrupted data.
Ensure that data and transactions are processed accurately.
Ensure the authorization, entry, and verification of data entering the system.
Activities specific to a subsystem's or an application's input, processing, and output.
The threat that errors or irregularities in the underlying transactions will not be prevented, detected, and corrected by the internal control system.

Cost/benefit

analysis

residual risk

IT controls

detective controls

risk assessment

code of ethics

physical controls

control objectives for information and related technology

IT general controls

corporate governance

input controls

corrective controls

enterprise risk management

Sarbanes-Oxley Act of 2002

inherent risk

Information Technology Infrastructure Library

IT application controls

application controls

processing controls

preventive controls

control risk

output controls

general controls

Public Company Accounting Oversight Board

Committee of Sponsoring Organizations

International Organization for Standardization 27000 Series