Deck 20: Auditing and Information Technology

Question 1

In end-user computing environments,the processing control procedures would ordinarily not include

A)Transaction logs.
B)Control totals.
C)Comparing input to output.
D)Online editing and sight verification.

Answer 1

D

Question 2

The effectiveness of general controls is an important consideration for audit teams when assessing control risk on an audit.Which management assertions are primarily affected by general controls?

A)Completeness and Accuracy.
B)Occurrence and Rights and Obligations.
C)Accuracy and Occurrence.
D)Completeness and Occurrence.

Answer 2

C

Question 3

To obtain evidence that controls over access to computer programs are properly functioning,audit teams most likely would

A)Create checkpoints at periodic intervals after data processing to test for unauthorized use of the system.
B)Examine the transaction log to discover whether any transactions were lost or entered twice due to a system malfunction.
C)Enter invalid identification numbers or passwords to ascertain whether the system rejects them.
D)Vouch a random sample of processed transactions to assure proper authorization.

Answer 3

C

Question 4

Which of the following is an example of a computer operations control?

A)Control totals.
B)Balancing input to output.
C)File backup and retention.
D)Transaction logs.

Question 5

Which of the following is a general control that would most likely assist an organization whose systems analyst resigned during the development of a major project?

A)Grandfather-father-son file retention.
B)Input and output validation routines.
C)Systems documentation.
D)Check digit verification.

Question 6

Which of the following controls most likely would ensure that an organization can reconstruct its financial records?

A)Hardware controls are built into the computer by the computer manufacturer.
B)Backup files are stored in a location separate from original copies.
C)Personnel who are independent of data input perform parallel simulations.
D)System flowcharts provide accurate descriptions of computer operations.

Question 7

Computer operations controls are typically implemented for files and data used in processing.The major objectives of these controls include each of the following except for

A)Ensure that appropriate files are used in computerized processing.
B)Ensure restricted access to the computing environment.
C)Ensure that files are appropriately secured and protected from loss.
D)Ensure that files can be reconstructed from earlier versions of information used in processing.

Question 8

Which of the following is not an appropriate statement with regard to computer control activities?

A)The duties of application programming,computer operation,and control of data files should be separated.
B)Computer operators should maintain control of all software programs.
C)Specific passwords should be required to access online files.
D)Computer programmers should be periodically rotated across different applications.

Question 9

Which of the following organizational positions would evaluate the existing system and design new computerized processing systems and documentation?

A)Programmer.
B)Systems analyst.
C)Computer operator.
D)Data conversion operator.

Question 10

Audit teams would least likely use computer-assisted audit techniques to

A)Access client data files.
B)Prepare spreadsheets.
C)Assess control risk related to computerized processing systems.
D)Construct and perform parallel simulations.

Question 11

When a real-time computerized processing system is in use,the computer controls can be strengthened by

A)Providing for the separation of duties between data input and error listing operations.
B)Using a systems development life cycle for authorization,user involvement,and testing of program modifications.
C)Preparing batch totals to provide assurance that file updates are made for the entire group of transactions.
D)Performing a validity check of an identification number before a user can obtain access to the computer files.

Question 12

Audit teams would most likely introduce test data into a computerized payroll system to test internal controls related to the

A)Existence of unclaimed payroll checks held by supervisors.
B)Early cashing of payroll checks by employees.
C)Discovery of invalid employee identification numbers.
D)Proper approval of overtime by supervisors.

Question 13

Which of the following would most likely be a weakness in the internal control of a client that utilizes portable computing devices rather than a larger computer system?

A)Employee collusion possibilities are increased because portable computing devices from one vendor can process the programs of a system from different vendors.
B)Computer operators may be able to remove hardware and software components and modify them at an off-site location.
C)Programming errors result in all similar transactions being processed incorrectly because those transactions are processed under the same conditions.
D)Certain transactions may be automatically initiated by the computerized processing system and management's authorization of these transactions may be implicit in its acceptance of the system design.

Question 14

Tests of controls in an advanced computerized processing system

A)Can be performed using only actual transactions because testing simulated transactions does not provide relevant evidence.
B)Can be performed using actual transactions or simulated transactions.
C)Is impractical because many procedures within the computerized processing system leave no visible evidence of having been performed.
D)Is inadvisable because it may distort the evidence in real-time systems.

Question 15

Which of the following control procedures most likely could prevent computer personnel from modifying programs to bypass computer controls?

A)Periodic management review of computer utilization reports and systems documentation.
B)Separation of duties for computer programming and computer operations.
C)Participation of user department personnel in designing and approving new systems.
D)Physical security of computer facilities in limiting access to computer equipment.

Question 16

Each of the following automated application controls are designed to ensure that the input of individual transactions and data is accurate except for

A)Check digits.
B)Valid sign tests.
C)Sequence tests.
D)Limit and reasonableness tests.

Question 17

Which of the following statements best describes the impact on an audit when a client uses computerized processing of transactions?

A)The objective of the audit examination focuses on detection of fraud and theft through the computer.
B)The type of substantive procedures performed by the audit team change because of the use of computerized processing.
C)The effectiveness of computer controls implemented by the client over its computerized processing may need to be evaluated by audit teams.
D)Different independence standards are introduced for audit teams when clients utilize computerized processing.

Question 18

When programs or files can be accessed from terminals,users should be required to enter a(n)

A)Parity check.
B)Personal identification code.
C)Self diagnosis test.
D)Echo check.

Question 19

The purpose of test data is to determine whether

A)The audit team's test data are consistent with the client's normal transactions.
B)Controls operate as described in responses to internal control questionnaire items and program flowcharts.
C)Every possible error is prevented or detected by the client's computer controls.
D)All possible combinations of valid data are correctly processed.

Question 20

When audit teams test a computerized processing system,which of the following is true of the test data approach?

A)Several transactions of each type must be tested.
B)Test data are processed by the client's computer programs under the audit team's control.
C)Test data must consist of all possible valid and invalid combinations.
D)The computer program used to process test data is different from the program used throughout the year by the client.

Question 21

Which of the following input controls would be least likely to identify the failure of an employee to input a transaction for which documentary evidence has been prepared?

A)Batch totals.
B)Hash totals.
C)Missing data tests.
D)Sequence tests.

Question 22

Which of the following is not true with respect to the test data approach for evaluating computer controls?

A)The test data are created for a separate entity and are run simultaneously with the client's actual data.
B)Only one of each type of error transaction needs to be included in the test data.
C)The manual results of processing the test data are compared to the results of processing these data through the client's computerized processing system.
D)Audit teams consider potential errors and conditions of interest in generating the test data.

Question 23

Which of the following computer controls would provide the best evidence that unauthorized users are not accessing specific computer programs and files?

A)Using passwords requiring access to those programs and files.
B)Periodically reviewing and confirming access rights for the organization's users.
C)Monitoring actual user activity through a program log and comparing that activity to authorized levels.
D)Ensuring that access to programs and files is removed for recently-terminated employees.

Question 24

Which of the following categories of general controls includes retention and recovery techniques for data and related programs?

A)Access to programs and data.
B)Computer operations.
C)Data file controls.
D)Program change controls.

Question 25

Computer controls that are pervasive and apply to all applications of a computerized processing system are referred to as

A)Computer controls.
B)Environment controls.
C)Automated application controls.
D)General controls.

Question 26

Which of the following input controls would not be effective in identifying the erroneous input of numeric fields in a transaction?

A)Batch totals.
B)Hash totals.
C)Check digits.
D)Record counts.

Question 27

Why is it important that the organization establish systems development and documentation standards?

A)These standards enable the organization to understand the programming logic underlying recently-developed programs.
B)These standards ensure that the program controls and documentation included in recently-developed programs is adequate.
C)The absence of these standards would constitute a material weakness in internal control.
D)These standards ensure the appropriate separation of duties of computer personnel.

Question 28

As part of assessing the risk of material misstatement,the audit team must assess the control risk in the computerized processing system.Initially,the audit team must identify the overall processing scope of the system(s),which would include each of the following considerations except

A)The types of transactions that are processed through the system.
B)The specific control procedures that have been implemented by the client to prevent or detect misstatements that could occur based on the audit team's analysis.
C)The programs and files that are accessed by the system in processing transactions.
D)The type of output that is created as a result of processing transactions through the system.

Question 29

Which of the following is not a control included as part of the systems development life cycle?

A)Ensuring that all software acquisition and program development efforts are consistent with the organization's needs and objectives.
B)Testing and validating new programs and developing proper implementation plans.
C)Requiring that all programming efforts take place under the control of the requesting user department.
D)Ensuring that data are converted completely and accurately for use in the new systems.

Question 30

Which of the following is a category of general controls?

A)Detective controls.
B)Input controls.
C)Processing controls.
D)Program change controls.

Question 31

Which of the following is not an example of a general control?

A)The organization's use of the systems development life cycle when implementing or modifying computerized processing systems.
B)The organization's use of check digits to ensure accurate input of transaction data.
C)Periodic and preventative maintenance performed on the computer and related equipment.
D)The existence of appropriate separation of duties within the computer department.