Deck 17: IT Controls Part III: Systems Development, Program Changes, and Application Controls

Question 1

Tracing is a method used to verify the logical operations executed by a computer application.

Answer 1

True

Question 2

The presence of a SPLMS effectively guarantees program integrity.

Answer 2

False

Question 3

One of the auditor's objectives relating to systems development is to authorize development projects.

Answer 3

False

Question 4

To verify the module's internal logic, the programmer compares the actual results obtained from the test with the predetermined results.

Question 5

Meaningful test data is relatively easy to create.

Question 6

The base case system evaluation is a variation of the test data method.

Question 7

The technical design activities translate a set of detailed technical specifications for a system into user specifications.

Question 8

The longest period in the SDLC is the maintenance phase.

Question 9

The user test and acceptance procedure is the last point at which the user can determine the system's acceptability prior to it going into service.

Question 10

Maintenance access to systems increases the risk that logic will be corrupted either by the accident or intent to defraud.

Question 11

A salami fraud affects a large number of victims, but the harm to each appears to be very small.

Question 12

All program modules must be thoroughly tested before they are implemented.

Question 13

Users need to be activity involved in the systems development process.

Question 14

When using the test data method, the presence of multiple error messages indicates a flaw in the preparation of test transactions.

Question 15

The black box approach to testing computer applications allows the auditor to explicitly review program logic.

Question 16

Source program library controls should prevent and detect unauthorized access to application programs.

Question 17

The black box approach to testing computer program controls is also known as auditing around the computer.

Question 18

Programs in their compiled state are very susceptible to the threat of unauthorized modification.

Question 19

To support future audit needs, test data prepared during systems implementation should be preserved.

Question 20

All systems should be informally approved to ensure economic justification and feasibility.

Question 21

Generalized audit software packages are used to assist the auditor in performing substantive tests.

Question 22

Which control ensures that production files cannot be accessed without specific permission?

A) Database Management System
B) Recovery Operations Function
C) Source Program Library Management System
D) Computer Services Function

Question 23

Which test is not an example of a white box test?

A) determining the fair value of inventory
B) ensuring that passwords are valid
C) verifying that all pay rates are within a specified range
D) reconciling control totals

Question 24

When analyzing the results of the test data method, the auditor would spend the least amount of time reviewing

A) the test transactions
B) error reports
C) updated master files
D) output reports

Question 25

Firms with an independent internal audit staff may conduct tests of the system development life cycle on an ongoing basis.

Question 26

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

Question 27

Routine maintenance activities require all of the following controls except

A) documentation updates
B) testing
C) formal authorization
D) internal audit approval

Question 28

Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud? Review of the documentation indicates that

A) a cost-benefit analysis was conducted
B) the detailed design was an appropriate solution to the user's problem
C) tests were conducted at the individual module and total system levels prior to implementation
D) problems detected during the conversion period were corrected in the maintenance phase

Question 29

Which statement is correct?

A) compiled programs are very susceptible to unauthorized modification
B) the source program library stores application programs in source code form
C) modifications are made to programs in machine code language
D) the source program library management system increases operating efficiency

Question 30

The programmer's authority table will specify the libraries a programmer may access.

Question 31

All of the following concepts are associated with the black box approach to auditing computer applications except

A) the application need not be removed from service and tested directly
B) auditors do not rely on a detailed knowledge of the application's internal logic
C) the auditor reconciles previously produced output results with production input transactions
D) this approach is used for complex transactions that receive input from many sources

Question 32

Which of the following statements is NOT true?

A) All systems should be properly authorized to ensure their economic justification and feasibility.
B) Users need not be actively involved in the systems development process.
C) All program modules must be thoroughly tested before they are implemented.
D) The task of creating meaningful test data is time-consuming.

Question 33

When auditors do not rely on a detailed knowledge of the application's internal logic, they are performing

A) black box tests of program controls
B) white box tests of program controls
C) substantive testing
D) intuitive testing

Question 34

To meet the governance-related expectations of management under SOX, an organization's internal audit department needs to be

A) independent
B) objective
C) technically qualified
D) All of the above are true.

Question 35

Which control is not a part of the source program library management system?

A) using passwords to limit access to application programs
B) assigning a test name to all programs undergoing maintenance
C) combining access to the development and maintenance test libraries
D) assigning version numbers to programs to record program modifications

Question 36

Use of the integrated test facility poses no threat to organizational data files.

Question 37

When the auditor reconciles the program version numbers, which audit objective is being tested?

A) protect applications from unauthorized changes
B) ensure applications are free from error
C) protect production libraries from unauthorized access
D) ensure incompatible functions have been identified and segregated

Question 38

Which control is not associated with new systems development activities?

A) reconciling program version numbers
B) program testing
C) user involvement
D) internal audit participation

Question 39

Program testing

A) involves individual modules only, not the full system
B) requires creation of meaningful test data
C) need not be repeated once the system is implemented
D) is primarily concerned with usability

Question 40

Which statement is not true?

A) An audit objective for systems maintenance is to detect unauthorized access to application databases.
B) An audit objective for systems maintenance is to ensure that applications are free from errors.
C) An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version numbers.
D) An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized access.

Question 41

New system development activity controls must focus on the authorization, development, and implementation of new systems and its maintenance. Discuss at least five control activities that are found in an effective system development life cycle.

Question 42

Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

Question 43

Which statement is not true? Embedded audit modules

A) can be turned on and off by the auditor.
B) reduce operating efficiency.
C) may lose their viability in an environment where programs are modified frequently.
D) identify transactions to be analyzed using white box tests.

Question 44

Generalized audit software packages perform all of the following tasks except

A) recalculate data fields
B) compare files and identify differences
C) stratify statistical samples
D) analyze results and form opinions

Question 45

What is GAS? Identify two examples of GAS products.

Question 46

All of the following statements are true about the integrated test facility (ITF) except

A) production reports are affected by ITF transactions
B) ITF databases contain "dummy" records integrated with legitimate records
C) ITF permits ongoing application auditing
D) ITF does not disrupt operations or require the intervention of computer services personnel

Question 47

What are program version numbers and how are the used?

Question 48

What is ITF?

Question 49

Auditors do not rely on detailed knowledge of the application's internal logic when they use the __________________________ approach to auditing computer applications.

Question 50

What is an embedded audit module?

Question 51

What are the audit's objectives relating to systems development?

Question 52

Describe two methods used to control the source program library.

Question 53

Contrast the source program library (SPL) management system to the database management system (DBMS).

Question 54

What are CAATS? Identify five of them.

Question 55

All of the following are disadvantages of the test data technique except

A) the test data technique requires extensive computer expertise on the part of the auditor
B) the auditor cannot be sure that the application being tested is a copy of the current application used by computer services personnel
C) the auditor cannot be sure that the application being tested is the same application used throughout the entire year
D) preparation of the test data is time-consuming

Question 56

All of the following are advantages of the test data technique except

A) auditors need minimal computer expertise to use this method
B) this method causes minimal disruption to the firm's operations
C) the test data is easily compiled
D) the auditor obtains explicit evidence concerning application functions

Question 57

Describe parallel simulation.

Question 58

A __________________________ fraud affects a large number of victims but the harm to each appears to be very small.

Question 59

What is meant by auditing around the computer versus auditing through the computer? Why is this so important?

Question 60

Identify six controllable activities that distinguish an effective systems development process.

Question 61

Discuss the three types of controls auditors can perform to determine that programs are free from material errors.

Question 62

Describe and contrast the test data method with the integrated test facility.

Question 63

Describe two tests of controls the auditor can use confirm that authorization procedures for program changes.

Question 64

Outline the six controllable activities that relate to new systems development

Question 65

Contrast embedded audit modules with generalized audit software.

Question 66

What is the purpose of the auditor's review of SDLC documentation?

Question 67

Discuss the six general categories of tests of IT controls.