Deck 14: Auditing It Controls Part I: Sarbanes-Oxley and It Governance

Question 1

A strong internal control system will reduce the amount of substantive testing that must be performed.

Answer 1

True

Question 2

The same internal control objectives apply to manual and computer-based information systems.

Answer 2

True

Question 3

An IT auditor expresses an opinion on the fairness of the financial statements.

Answer 3

False

Question 4

Audit risk is the probability that the auditor will render an unqualified opinion on financial statements that are materially misstated.

Question 5

External auditors can cooperate with and use evidence gathered by internal audit departments that are organizationally independent and that report to the audit committee of the board of directors.

Question 6

The database administrator should be separated from systems development.

Question 7

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

Question 8

Substantive testing techniques provide information about the accuracy and completeness of an application's processes.

Question 9

Statements on Auditing Standards recommendations must be followed by every member of the profession unless it can be shown why a standard does not apply in a given situation.

Question 10

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Question 11

Application controls apply to a wide range of exposures that threaten the integrity of all programs processed within the computer environment.

Question 12

A disaster recovery plan is a comprehensive statement of all actions to be taken after a disaster.

Question 13

A qualified opinion on management's assessment of internal controls over the financial reporting system necessitates a qualified opinion on the financial statements.

Question 14

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Question 15

External auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization.

Question 16

The most common access point for perpetrating computer fraud is at the data collection stage.

Question 17

Tests of controls determine whether the database contents fairly reflect the organization's transactions.

Question 18

Some systems professionals have unrestricted access to the organization's programs and data.

Question 19

IT auditing is a small part of most external and internal audits.

Question 20

Both the SEC and the PCAOB recommend management to use the COSO framework for assessing internal control adequacy.

Question 21

Transaction cost economics (TCE)theory suggests that firms should outsource specific noncore IT assets.

Question 22

The IT audit focuses on systems where technology plays a material role and thus makes the entire audit process more complex.

Question 23

Which of the following is not an implication of section 302 of the Sarbanes-Oxley Act?

A)Auditors must determine whether changes in internal control have materially affected (or are likely to affect) internal control over financial reporting.
B)Auditors must interview management regarding significant changes in the design or operation of internal control that occurred since the last audit.
C)The board of directors must certify quarterly and annually their organization's internal controls over financial reporting.
D)Management must disclose any material changes in the company's internal controls that have occurred during the most recent fiscal quarter.

Question 24

Supervision in a computerized environment is more complex than in a manual environment for all of the following reasons except

A)rapid turnover of systems professionals complicates management's task of assessing the competence and honesty of prospective employees
B)many systems professionals have direct and unrestricted access to the organization's programs and data
C)rapid changes in technology make staffing the systems environment challenging
D)systems professionals and their supervisors work at the same physical location

Question 25

Which is the most critical segregation of duties in the centralized computer services function?

A)systems development from data processing
B)data operations from data librarian
C)data preparation from data control
D)data control from data librarian

Question 26

Systems development is separated from data processing activities because failure to do so

A)weakens database access security
B)allows programmers access to make unauthorized changes to applications during execution
C)results in inadequate documentation
D)results in master files being inadvertently erased

Question 27

Scavenging is a form of fraud in which the perpetrator uses a computer program to search for key terms in a database and then steal the data.

Question 28

Commodity IT assets are easily acquired in the marketplace and should be outsourced under the core competency theory.

Question 29

The least important item to store off-site in case of an emergency is

A)backups of systems software
B)backups of application software
C)documentation and blank forms
D)results of the latest test of the disaster recovery program

Question 30

A cold site backup approach is also known as

A)an internally provided backup
B)a recovery operations center
C)an empty shell
D)a mutual aid pact

Question 31

Which of the following is not an essential feature of a disaster recovery plan?

A)off-site storage of backups
B)computer services function
C)second site backup
D)critical applications identified

Question 32

Which of the following is not a requirement in management's report on the effectiveness of internal controls over financial reporting?

A)A statement of management's responsibility for establishing and maintaining adequate internal control user satisfaction.
B)A statement that the organization's internal auditors has issued an attestation report on management's assessment of the company's internal controls.
C)A statement identifying the framework used by management to conduct their assessment of internal controls.
D)An explicit written conclusion as to the effectiveness of internal control over financial reporting.

Question 33

For most companies,which of the following is the least critical application for disaster recovery purposes?

A)month-end adjustments
B)accounts receivable
C)accounts payable
D)order entry/billing

Question 34

Adequate backups will protect against all of the following except

A)natural disasters such as fires
B)unauthorized access
C)data corruption caused by program errors
D)system crashes

Question 35

In a computer-based information system,which of the following duties needs to be separated?

A)program coding from program operations
B)program operations from program maintenance
C)program maintenance from program coding
D)All of the above duties should be separated.

Question 36

All of the following are control risks associated with the distributed data processing structure except

A)lack of separation of duties
B)system incompatibilities
C)system interdependency
D)lack of documentation standards

Question 37

The major disadvantage of an empty shell solution as a second site backup is

A)the host site may be unwilling to disrupt its processing needs to process the critical applications of the disaster stricken company
B)intense competition for shell resources during a widespread disaster
C)maintenance of excess hardware capacity
D)the control of the shell site is an administrative drain on the company

Question 38

Which organizational structure is most likely to result in good documentation procedures?

A)separate systems development from systems maintenance
B)separate systems analysis from application programming
C)separate systems development from data processing
D)separate database administrator from data processing

Question 39

An advantage of a recovery operations center is that

A)it is an inexpensive solution
B)the initial recovery period is very quick
C)the company has sole control over the administration of the center
D)none of the above are advantages of the recovery operations center

Question 40

Changing the Hours Worked field in an otherwise legitimate payroll transaction to increase the amount of the paycheck is an example of data collection fraud.

Question 41

All of the following are steps in an IT audit except

A)substantive testing
B)tests of controls
C)post-audit testing
D)audit planning

Question 42

Which statement is not true?

A)Auditors must maintain independence.
B)IT auditors attest to the integrity of the computer system.
C)IT auditing is independent of the general financial audit.
D)IT auditing can be performed by both external and internal auditors.

Question 43

The fundamental difference between internal and external auditing is that

A)internal auditors represent the interests of the organization and external auditors represent outsiders
B)internal auditors perform IT audits and external auditors perform financial statement audits
C)internal auditors focus on financial statement audits and external auditors focus on operational audits and financial statement audits
D)external auditors assist internal auditors but internal auditors cannot assist external auditors

Question 44

The financial statements of an organization reflect a set of management assertions about the financial health of the business.All of the following describe types of assertions except

A)that all of the assets and equities on the balance sheet exist
B)that all employees are properly trained to carry out their assigned duties
C)that all transactions on the income statement actually occurred
D)that all allocated amounts such as depreciation are calculated on a systematic and rational basis

Question 45

When planning the audit,information is gathered by all of the following methods except

A)completing questionnaires
B)interviewing management
C)observing activities
D)confirming accounts receivable

Question 46

Inherent risk

A)exists because all control structures are flawed in some ways.
B)is the likelihood that material misstatements exist in the financial statements of the firm.
C)is associated with the unique characteristics of the business or industry of the client.
D)is the likelihood that the auditor will not find material misstatements.

Question 47

Which of the following is true?

A)In the CBIS environment, auditors gather evidence relating only to the contents of databases, not the reliability of the computer system.
B)Conducting an audit is a systematic and logical process that applies to all forms of information systems.
C)Substantive tests establish whether internal controls are functioning properly.
D)IT auditors prepare the audit report if the system is computerized.

Question 48

All of the following tests of controls will provide evidence about the physical security of the computer center except

A)review of fire marshal records
B)review of the test of the backup power supply
C)verification of the second site backup location
D)observation of procedures surrounding visitor access to the computer center

Question 49

All of the following tests of controls will provide evidence about the adequacy of the disaster recovery plan except

A)inspection of the second site backup
B)analysis of the fire detection system at the primary site
C)review of the critical applications list
D)composition of the disaster recovery team

Question 50

All of the following are recommended features of a fire protection system for a computer center except

A)clearly marked exits
B)an elaborate water sprinkler system
C)manual fire extinguishers in strategic locations
D)automatic and manual alarms in strategic locations

Question 51

Which of the following is true of disaster recovery as a service (DRaaS)?

A)Cloud resources are used to protect an organization from the consequences of disasters and service disruptions.
B)DRaaS is the most secure disaster recovery option available to most businesses.
C)Cloud resources are used as backups in place of all traditional forms of data backup.
D)DRaaS is different than other outsourcing of the IT function because it exposes a client's data more fully than other cloud services.

Question 52

Substantive tests include

A)examining the safety deposit box for stock certificates
B)reviewing systems documentation
C)completing questionnaires
D)observation

Question 53

Which of the following is not a generally accepted auditing standard?

A)The auditor must have adequate technical training and proficiency.
B)The auditor must obtain sufficient, competent evidence.
C)The auditor must have independence of mental attitude.
D)All of the above are generally accepted auditing standard general standards.

Question 54

All of the following are components of audit risk except

A)control risk
B)legal risk
C)detection risk
D)inherent risk

Question 55

Tests of controls include

A)confirming accounts receivable
B)counting inventory
C)completing questionnaires
D)counting cash

Question 56

Some companies separate systems analysis from programming/program maintenance.All of the following are control weaknesses that may occur with this organizational structure except

A)systems documentation is inadequate because of pressures to begin coding a new program before documenting the current program
B)illegal lines of code are hidden among legitimate code and a fraud is covered up for a long period of time
C)a new systems analyst has difficulty in understanding the logic of the program
D)inadequate systems documentation is prepared because this provides a sense of job security to the programmer

Question 57

Control risk is

A)the probability that the auditor will render an unqualified opinion on financial statements that are materially misstated
B)associated with the unique characteristics of the business or industry of the client
C)the likelihood that the control structure is flawed because controls are either absent or inadequate to prevent or detect errors in the accounts
D)the risk that errors not detected or prevented by the control structure will also not be detected by the auditor

Question 58

Which statement is not correct?

A)Auditors gather evidence using tests of controls and substantive tests.
B)The most important element in determining the level of materiality is the mathematical formula.
C)Auditors express an opinion in their audit report.
D)Auditors compare evidence to established criteria.

Question 59

Internal auditors assist external auditors with financial audits to

A)reduce audit fees
B)ensure independence
C)represent the interests of management
D)None of the above. Internal auditors are not permitted to assist external auditors with financial audits.

Question 60

Which concept is not an integral part of an audit?

A)evaluating internal controls
B)preparing financial statements
C)expressing an opinion
D)analyzing financial data

Question 61

Which of the following is not an advantage of distributed data processing?

A)ability to backup computing facilities
B)improved user satisfaction
C)efficient use of resources
D)All of the above are advantages of distributed data processing.

Question 62

What are the objectives of application controls?

Question 63

Describe the components of a disaster recovery plan.

Question 64

Define general controls.

Question 65

The Sarbanes-Oxley Act contains many sections.Which sections are the focus of this chapter?

Question 66

List three pairs of system functions that should be separated in the centralized computer services organization.Describe a risk exposure if the functions are not separated.

Question 67

Which of the following is not true?

A)When management outsources their organization's IT functions, they also outsource responsibility for internal control.
B)Once a client firm has outsourced specific IT assets, its performance becomes linked to the vendor's performance.
C)IT outsourcing may effect incongruence between a firm's IT strategic planning and its business planning functions.
D)The financial justification for IT outsourcing depends upon the vendor achieving economies of scale.

Question 68

The following are examples of commodity assets except

A)network management
B)systems operations
C)systems development
D)server maintenance

Question 69

All of the following are examples of specific assets except

A)application maintenance
B)data warehousing
C)highly skilled employees
D)server maintenance

Question 70

Segregation of duties in the computer-based information system includes

A)separating the programmer from the computer operator
B)preventing management override
C)separating the inventory process from the billing process
D)performing independent verifications by the computer operator

Question 71

Which of the following is true?

A)Core competency theory argues that an organization should outsource specific core assets.
B)Core competency theory argues that an organization should focus exclusively on its core business competencies.
C)Core competency theory argues that an organization should not outsource specific commodity assets.
D)Core competency theory argues that an organization should retain certain specific noncore assets in-house.

Question 72

Both the SEC and the PCAOB have expressed an opinion as to which internal control framework an organization should use to comply with SOX legislation.Explain.

Question 73

For disaster recovery purposes,what criteria are used to identify an application or data as critical?

Question 74

What approach to the design and assessment of controls is recommended by PCAOB Auditing Standard No.5?

Question 75

Discuss the key features of Section 302 of the Sarbanes-Oxley Act.

Question 76

Computer fraud can take many forms,including each of the following except

A)theft or illegal use of computer-readable information
B)theft, misuse, or misappropriation of computer equipment
C)theft, misuse, or misappropriation of assets by altering computer-readable records and files
D)theft, misuse, or misappropriation of printer supplies

Question 77

Describe the two broad groupings of information system controls that are specified by COSO.

Question 78

Which of the following is not true?

A)Large-scale IT outsourcing involves transferring specific assets to a vendor.
B)Specific assets, while valuable to the client, are of little value to the vendor.
C)Once an organization outsources its specific assets, it may not be able to return to its pre-outsource state.
D)Specific assets are of value to vendors because, once acquired, vendors can achieve economies of scale by employing them with other clients.

Question 79

What primary IT functions must be separated in a centralized firm?

Question 80

Operations fraud includes

A)altering program logic to cause the application to process data incorrectly
B)misusing the firm's computer resources
C)destroying or corrupting a program's logic using a computer virus
D)creating illegal programs that can access data files to alter, delete, or insert values