Question 1

The goal of RBA to auditing is to apply audit efforts to areas in proportion to their likelihood to
A) reduce exposures in areas of high risk.
B) reduce the exposure and occurrences of fraud.
C) significantly impact the auditor's overall audit conclusions.
D) All of the above are goals of RBA.

Accepted Answer

The goal of Risk-Based Auditing (RBA) is to focus audit efforts on areas that are most likely to significantly impact the auditor's overall audit conclusions, ensuring that resources are allocated efficiently to address the most critical risks.

Question 2

Why are most audits now performed by auditing through and with the computer?

Accepted Answer

The answer of Why are most audits now performed by...

Question 3

________ is for IS audit,control,assurance and/or security professionals.
A) CISA
B) CISM
C) CGEIT
D) COBIT

Accepted Answer

CISA (Certified Information Systems Auditor) is specifically designed for individuals involved in IS audit, control, assurance, and/or security, reflecting their expertise in assessing systems and ensuring their reliability and security.

Question 4

The Public Company Accounting Oversight Board (PCAOB)has encouraged a risk-based approach to test the effectiveness of ________ as they relate to financial audits.
A) internal controls
B) security processes
C) financial misstatements
D) fraud exposure

Accepted Answer

The PCAOB has encouraged a risk-based approach to test the effectiveness of internal controls as they relate to financial audits. This approach helps auditors identify the areas of highest risk for financial misstatements and focus their testing efforts accordingly. Security processes and fraud exposure may also be tested as part of this approach, but they are not the primary focus.

Question 5

COBIT has four domains that include
A) plan and organize, acquire and implement, deliver and support, and monitor and evaluate.
B) analysis, design, implement, and feedback.
C) plan, build, implement, and evaluate.
D) analysis, build, train, and implement.

Accepted Answer

COBIT has four domains namely, plan and organize, acquire and implement, deliver and support, and monitor and evaluate. These domains provide a framework for the governance and management of enterprise information technology. Choice B, C, and D are not the correct domains for COBIT.

Question 6

An audit that examines the controls governing the systems process and which directly affect the reliability of the application programs created is called a(n)
A) general information system audit.
B) information system applications audit.
C) application systems development audit.
D) information system computer service center audit.

Accepted Answer

An application systems development audit focuses on the controls and processes involved in the development of application programs, ensuring their reliability and effectiveness.

Question 7

An IT governance framework such as ________ can be a critical element in ensuring proper control and governance over information and the systems that create,store,manipulate,and retrieve that information.
A) CISA
B) SOA
C) COBIT
D) RBA

Accepted Answer

COBIT (Control Objectives for Information and Related Technology) is specifically designed to provide a comprehensive IT governance framework, covering all aspects of IT processes, from planning and implementation to monitoring and evaluation. It provides a set of best practices and guidelines for ensuring that information systems are aligned with organizational goals, adequately controlled, and properly audited. CISA (Certified Information Systems Auditor) is a certification for professionals involved in IT auditing, while SOA (Service Oriented Architecture) and RBA (Risk-Based Audit) are concepts related to IT architecture and audit methodology, respectively, but not specific IT governance frameworks.

Question 8

Listed below are five examples of auditing situations and five information systems auditing techniques.
Required: First,match the letter of the information system auditing technique which best identifies the example.Then,in the space below each item,write a brief explanation of how the technique works in the situation.
A.Parallel simulation
B.Test data approach
C.Mapping
D.PC software
E.Extended records
________ 1.An auditor performs an inexpensive test of a cash disbursements program without modifying the client's program.
________ 2.Audit team members communicate with each other in separate locations during an audit by exchanging Word and Excel files electronically.
________ 3.An auditor inputs test sales order data to find out whether a sales order program executes the program statements needed to produce a shipping notice document.
________ 4.An internal auditor modifies a newly designed accounts receivable program to randomly select sales transactions and save each transaction's complete processing audit trail.
________ 5.During substantive testing,an auditor tests a client's loan interest accrual program by submitting the client's data to a program running on a computer at the auditor's office.

Accepted Answer

The answer of Listed below are five examples of auditing...

Question 9

________ provides assurances relating to the effectiveness of an organization's enterprise risk management processes.
A) RBA
B) OMB
C) REA
D) UML

Accepted Answer

RBA (Risk-Based Audit) provides assurances relating to the effectiveness of an organization's enterprise risk management processes. OMB (Office of Management and Budget) is a government agency that oversees the administration of the federal budget and REA (Real Estate Agent) is a professional who helps people buy and sell properties. UML (Unified Modeling Language) is a visual language used in software engineering to design software systems. None of these options relate to assurance of enterprise risk management processes.

Question 10

IT governance has the objective of enhancing and ensuring the efficient application of IT resources
A) to ensure success in the development of systems and processes.
B) as a critical success factor.
C) to gain a competitive advantage.
D) as a major component to IT security.

Accepted Answer

The objective of IT governance is primarily to ensure that IT resources are used efficiently and effectively to support the organization's goals and objectives. This makes IT governance a critical success factor for businesses that rely heavily on technology to compete and succeed in the market. While IT security is undoubtedly a major concern for all organizations, it is not the primary objective of IT governance. Similarly, while gaining a competitive advantage may be a desirable outcome of effective IT governance, it is not the primary objective in and of itself. Finally, while IT governance may help to ensure the success of systems and processes developed by the organization, this is not its primary objective either.

Question 11

Presented below is a list of terms relating to accounting information systems,followed by definitions of those terms.
Required: Match the letter next to each definition with the appropriate term.Each answer will be used only once.
________ 1.Mapping
________ 2.Compliance testing
________ 3.Extended records
________ 4.Substantive testing
________ 5.Interim audit
________ 6.Snapshot
________ 7.Parallel simulation
________ 8.Audit software
________ 9.Desk checking
.Tracing
A.Modification of programs to collect and store additional data of audit interest
B.Computer programs that permit the computer to be used as an auditing tool
C.Special software that is used to monitor the executing of a program
D.The first stage of a financial statement audit which has the objective of establishing the degree to which the internal control system can be relied upon
E.Provides a detailed audit trail of the instructions executed during a program's operation
F.Modification of programs to output data of audit interest
G.Direct verification of balances contained in financial statements
H.The auditor manually processes test or real data through the logic of a computer program
I.Testing to confirm the existence,assess the effectiveness,and check the continuity of operation of internal controls
J.The processing of real data through audit programs,with the simulated output and the regular output compared for control purposes

Accepted Answer

The answer of Presented below is a list of terms...

Question 12

Which of the following controls would not be examined in the audit of a computer service center?
A) Environmental controls
B) Physical security controls
C) Management controls
D) Process application controls

Accepted Answer

Process application controls are primarily related to software applications used in business processes, and would not be relevant to the audit of a computer service center, which primarily provides technical support and maintenance services. Environmental controls, physical security controls, and management controls are all relevant to the audit of a computer service center.

Question 13

Below are listed four procedures typically performed during an audit of accounts payable:
Audit procedures:
a.Test the mathematical accuracy of the accounts payable subsidiary ledger.
b.Select samples of vouchers to examine in detail.
c.Determine whether cash discounts were properly applied.
d.Stratify accounts by value.
Required: Briefly state a generalized audit software technique that could be used to perform each procedure,assuming that the accounts payable application is computerized.

Accepted Answer

The answer of Below are listed four procedures typically performed...

Question 14

________ is the most recent certification programs and for individuals interested in Governance of Enterprise IT.
A) CISA
B) CISM
C) CGEIT
D) COBIT

Accepted Answer

CGEIT (Certified in the Governance of Enterprise IT) is the most recent certification program for individuals interested in the governance of enterprise IT. It focuses on five domains: Framework for the Governance of Enterprise IT, Strategic Management, Benefits Realization, Risk Optimization, and Resource Optimization. CISA (Certified Information Systems Auditor) and CISM (Certified Information Security Manager) are older certification programs focused on IT audit and security, while COBIT (Control Objectives for Information and Related Technology) is a framework for IT governance and management but not a certification program.

Question 15

Risks associated with implementing new technologies include
A) IT strategies not aligned with business strategies.
B) control framework for IT does not exist.
C) IT performance is not measured and evaluated.
D) All of the above are risks associated with new technologies.

Accepted Answer

All of the choices presented are risks associated with implementing new technologies. IT strategies must be aligned with business strategies to ensure that the new technology is meeting business needs. A control framework for IT is important to ensure that the technology is being used appropriately and securely. IT performance should be measured and evaluated to ensure that the new technology is achieving the desired outcomes. All of these risks should be addressed to minimize the potential negative impact of implementing new technologies.

Question 16

________ models are used to evaluate an organization's relative level of achievement of IT governance and shows what has to be done to improve.
A) RBA
B) Maturity
C) Visibility
D) Navigation

Accepted Answer

Maturity models are commonly used to evaluate an organization's relative level of achievement of IT governance. These models provide a framework for assessing an organization's processes, policies, and procedures related to IT governance and can help identify areas of weakness and improvement. Common IT governance maturity models include COBIT and ITIL.

Question 17

Explain why external auditors perform compliance testing when a main objective of a financial statement audit is to express an opinion regarding the fairness of the monetary balances in a company's financial statements.

Accepted Answer

The answer of Explain why external auditors perform compliance testing...

Question 18

In the program change control phase of an application systems development audit,an element that may represent a major loss exposure in terms of fraud and access to sensitive data is
A) program development.
B) program auditing.
C) program testing and quality control.
D) program maintenance.

Accepted Answer

Program maintenance represents a major loss exposure in terms of fraud and access to sensitive data because it involves making changes to existing software, which could be exploited to introduce unauthorized changes or access sensitive information without detection.

Question 19

Presented below is a list of terms relating to accounting information systems,followed by definitions of those terms.
Required: Match the letter next to each definition with the appropriate term.Each answer will be used only once.
________ 1.Audit program
________ 2.System control audit review file
________ 3.Auditing around-the-computer
________ 4.In-line code
________ 5.Financial statement audit
________ 6.Control flowcharting
________ 7.Test data
________ 8.Embedded audit routines
________ 9.Sample audit review file
.PC software
A.The second stage of a financial statement audit which uses substantive testing for direct verification of financial statement figures
B.Software that allows the auditor to use PCs to perform audit tasks
C.Information systems auditing approach in which the processing portion of a computer system is ignored
D.A detailed list of the procedures to be applied on a particular audit
E.Analytic documentation or other graphic techniques used to describe the controls in a system
F.The use of in-line code to randomly select transactions for audit analysis
G.Auditor-prepared input containing both valid and invalid data
H.Special auditing routines included in regular computer programs so that transaction data can be subjected to audit analysis
I.An application program performs an embedded audit routine such as data collection at the same time as it processes data for normal use
J.Auditor-determined programmed edit tests for audit transaction analysis are included in a program as it is initially developed

Accepted Answer

The answer of Presented below is a list of terms...

Question 20

________ is for individuals who manage,design,oversee,and assess an enterprise's information security program.
A) CISA
B) CISM
C) CGEIT
D) COBIT

Accepted Answer

CISM (Certified Information Security Manager) is specifically designed for individuals who manage, design, oversee, and assess an enterprise's information security program. It covers topics such as security governance, risk management, and incident management. The other certifications listed (CISA, CGEIT, COBIT) are also related to information security but are not as focused on managing and overseeing security programs.

Quiz 14: Auditing Information Technology

The goal of RBA to auditing is to apply audit efforts to areas in proportion to their likelihood to

Why are most audits now performed by auditing through and with the computer?

________ is for IS audit,control,assurance and/or security professionals.

The Public Company Accounting Oversight Board (PCAOB) has encouraged a risk-based approach to test the effectiveness of ________ as they relate to financial audits.

COBIT has four domains that include

An audit that examines the controls governing the systems process and which directly affect the reliability of the application programs created is called a(n)

An IT governance framework such as ________ can be a critical element in ensuring proper control and governance over information and the systems that create,store,manipulate,and retrieve that information.

________ provides assurances relating to the effectiveness of an organization's enterprise risk management processes.

IT governance has the objective of enhancing and ensuring the efficient application of IT resources

Which of the following controls would not be examined in the audit of a computer service center?

________ is the most recent certification programs and for individuals interested in Governance of Enterprise IT.

Risks associated with implementing new technologies include

________ models are used to evaluate an organization's relative level of achievement of IT governance and shows what has to be done to improve.

Explain why external auditors perform compliance testing when a main objective of a financial statement audit is to express an opinion regarding the fairness of the monetary balances in a company's financial statements.

In the program change control phase of an application systems development audit,an element that may represent a major loss exposure in terms of fraud and access to sensitive data is

________ is for individuals who manage,design,oversee,and assess an enterprise's information security program.