Question 1

Which of the following is an enhancement to internal control resulting from integrating IT into accounting systems?
A) Computer controls replace manual ones
B) Higher quality information
C) Both A and B
D) Neither A nor B

Accepted Answer

Integrating IT into accounting systems allows for computer controls to replace manual ones, which enhances internal control. This also results in higher quality information as data can be entered and processed more accurately and efficiently. Therefore, both options A and B are correct.

Question 2

Auditing standards describe which two broad control groupings for IT systems? 1. General controls
2) Application controls
3) Information controls
4) Performance controls
A) 2 and 3
B) 1 and 3
C) 1 and 2
D) 3 and 4

Accepted Answer

Auditing standards describe two broad control groupings for IT systems: general controls and application controls. Information controls and performance controls are not included in these broad groupings.

Question 3

Which of the following is NOT an example of a test data approach?
A) Testing online passwords
B) Testing input data to final reports
C) Testing authorisation of transactions
D) Testing data access controls

Accepted Answer

C

Question 4

A database management system:
A) allows quick retrieval of data, but it needs to update files continually.
B) reduces data redundancy.
C) allows quick retrieval of data but at a cost of inefficient use of file space.
D) stores data on different files for different purposes, but always knows where they are and how to retrieve them.

Accepted Answer

A database management system reduces data redundancy by organizing data into tables and removing duplicate entries. It also allows for efficient retrieval and updating of data.

Question 5

A control which relates to all parts of the IT system is called:
A) a systems control.
B) an applications control.
C) a universal control.
D) a general control.

Accepted Answer

A control which relates to all parts of the IT system is called a general control. General controls are typically established at the organizational level and are designed to ensure the overall effectiveness and reliability of the IT environment. Examples of general controls include policies and procedures, access controls, and system development and change controls.

Question 6

Which one of the following computer- assisted auditing techniques allows fictitious and real transactions to be processed together without client operating personnel being aware of the testing process?
A) Test data approach
B) Generalised audit software programming
C) Integrated test facility
D) Parallel simulation

Accepted Answer

The Integrated Test Facility (ITF) technique allows the auditor to simulate processing of fictitious transactions together with real transactions in the client's live system without the knowledge of the client's operating personnel. This enables the auditor to identify any processing errors or control weaknesses in the system. The Test Data approach and Parallel Simulation are also techniques that involve processing fictitious transactions, but they are typically conducted in a separate test environment rather than the live system. Generalized Audit Software Programming refers to the use of software to perform audit procedures and is not specific to processing fictitious transactions.

Question 7

The auditor may decide NOT to reduce assessed control risk even if internal controls are adequate. This approach is followed if:
A) the cost of the study and tests of controls will exceed the savings from reduced substantive procedures.
B) the auditor plans to rely on the controls and reduce substantive testing.
C) a qualified opinion will be issued.
D) All of the above are true.

Accepted Answer

The cost of testing controls should always be considered in relation to the potential savings from reducing substantive procedures. If the cost of testing controls exceeds the potential savings, it may be more cost-effective to perform substantive testing without reducing assessed control risk. However, if internal controls are deemed effective and the cost of testing is reasonable, the auditor should plan to rely on the controls and reduce substantive testing. A qualified opinion would not be relevant to this decision.

Question 8

Which one of the following is NOT usually part of a contingency plan?
A) Storing copies of critical software off premises
B) Identifying alternative hardware that can be used to process company data
C) Regular changing of access codes
D) Backing up critical data files

Accepted Answer

Regularly changing access codes is a security measure rather than a contingency plan. Contingency plans usually focus on preventing or minimizing the impact of potential disruptions such as natural disasters, cyberattacks, power outages, etc. Storing critical software off premises, identifying alternative hardware, and backing up data files are all examples of contingency planning.

Question 9

The accumulation of source documents and records that allows the organisation to trace accounting entries back to their initiation is the:
A) substantiation record.
B) initialisation procedure.
C) outsourcing code.
D) audit trail.

Accepted Answer

The accumulation of source documents and records that allows the organisation to trace accounting entries back to their initiation is called the audit trail. It is essential for ensuring the accuracy and reliability of financial information and for detecting errors or fraud.

Question 10

The function of an embedded audit module approach:
A) tests data used to test specific controls.
B) analyses the client data.
C) inserts an audit module into the client's application system.
D) uses software to define the content of data records.

Accepted Answer

An embedded audit module approach involves inserting an audit module into the client's application system, allowing for continuous monitoring and control testing. It does not involve analyzing client data or defining the content of data records.

Question 11

A computer service centre processes, for an auditor's client, financial data that has a material effect on that client's financial statements. The independent auditor need NOT consider a review of the service centre controls if:
A) he or she is satisfied that a special report on internal controls issued by the service centre's independent auditor can be relied on to the extent desired.
B) the service centre is a partially owned subsidiary of the client company, whose financial statements are examined by another audit firm.
C) the service centre processes data exclusively for the audit client and its subsidiaries.
D) the service centre controls have already been reviewed by the internal audit team of the client.

Accepted Answer

The independent auditor does not need to consider a review of the service centre controls if they can rely on a special report on internal controls issued by the service centre's independent auditor to the extent desired. This means that if the independent auditor is satisfied with the report, they do not need to perform their own review of the service centre's controls. Options B, C, and D are not relevant to this situation.

Question 12

Many clients have their data processed at an independent computer service centre (IT outsourcing). The difficulty the independent auditor faces when a computer service centre is used is:
A) in trying to abide by the joint Code of Professional Conduct to maintain the security and confidentiality of the client's data.
B) in determining the adequacy of the service centre's internal controls.
C) finding compatible programs that will analyse the service centre's programs.
D) gaining the permission of the service centre to review its work.

Accepted Answer

The independent auditor may face difficulty in determining the adequacy of the service centre's internal controls. This is because the service centre may have different internal controls or may not disclose them to the auditor. Other options listed may also pose challenges, but determining the adequacy of internal controls is a core concern in auditing IT outsourcing services.

Question 13

Controls which are designed to assure that the information processed by the computer is authorised, complete and accurate are called:
A) processing controls.
B) general controls.
C) output controls.
D) input controls.

Accepted Answer

Input controls are designed to ensure that the information entered into the computer is authorised, complete, and accurate. Examples of input controls include data validation checks, limit checks, and field combination controls. Processing controls are designed to ensure the proper processing of information, output controls are designed to ensure the proper output of information, and general controls are designed to ensure the overall security and integrity of the system.

Question 14

Which one of the following statements is incorrect about network environments?
A) Decentralised servers often increase control risk.
B) Many environments lack standardised procedures.
C) Responsibility for purchasing equipment usually resides with a centralised IT function.
D) Network- related software often lacks the security features typically available in traditionally centralised systems.

Accepted Answer

In many organizations, the responsibility for purchasing equipment is often decentralized, allowing individual departments or units to make their own purchasing decisions, rather than being controlled by a central IT function.

Question 15

To obtain evidence that all external users in an e- commerce system are authorised, a 'firewall' channels all network connections through a:
A) separate computer service bureau.
B) control gateway.
C) single telephone line.
D) single computer monitor.

Accepted Answer

A control gateway allows for the monitoring and control of network traffic, ensuring that only authorized users are able to access the e-commerce system. A separate computer service bureau or single telephone line would not provide the necessary security measures to ensure authorization. A single computer monitor would not be able to channel network connections.

Question 16

Which of the following is a generalised audit software package?
A) MYOB
B) ACL
C) Visual Basic
D) None of the above

Accepted Answer

ACL (Audit Command Language) is a generalised audit software package used for data analysis and management. MYOB is a software used for accounting and financial management, and Visual Basic is a programming language used for developing software applications. Therefore, options A and C are not generalised audit software packages.

Question 17

A well- controlled IT system offers greater potential for reducing misstatements because:
A) computers reduce the human error that is likely to occur in traditional manual environments.
B) computers process information consistently.
C) computers handle tremendous volumes of complex business transactions effectively.
D) all of the above

Accepted Answer

All of the above statements are true. Computers reduce the human error that is likely to occur in traditional manual environments, process information consistently, and handle tremendous volumes of complex business transactions effectively. A well-controlled IT system can thus significantly reduce misstatements in financial reporting.

Question 18

The audit procedure which is least useful in gathering evidence on significant computer processes is:
A) test data.
B) generalised audit software.
C) tracing.
D) observation.

Accepted Answer

Observation is the audit procedure which is least useful in gathering evidence on significant computer processes as it involves merely watching the computer system in operation and cannot give a complete picture of the system's strengths and weaknesses. Other procedures like test data, generalized audit software, and tracing are more effective in providing evidence on significant computer processes.

Question 19

Application controls vary with each application in the IT system. In attempting to review and gain an understanding of the internal control system, the auditor must evaluate the application controls for:
A) every audit area.
B) every material audit area.
C) every audit area in which the client uses the computer.
D) every audit area where the auditor plans to reduce assessed control risk.

Accepted Answer

The auditor evaluates application controls in areas where they plan to reduce assessed control risk, as these controls directly impact the reliability of data and financial reporting in those areas.

Question 20

Generalised audit software:
A) is a method of verifying the client's data which is recorded in a machine language.
B) is used when client's software is not compatible with the auditor's.
C) is often used even when client's data are not computerised.
D) can be used for all three of the above.

Accepted Answer

The answer of Generalised audit software:
A) is a method of...

Quiz 10: The Impact of Information Technology on the Audit Process

Which of the following is an enhancement to internal control resulting from integrating IT into accounting systems?

Auditing standards describe which two broad control groupings for IT systems? 1. General controls 2) Application controls 3) Information controls 4) Performance controls

Which of the following is NOT an example of a test data approach?

A database management system:

A control which relates to all parts of the IT system is called:

Which one of the following computer- assisted auditing techniques allows fictitious and real transactions to be processed together without client operating personnel being aware of the testing process?

The auditor may decide NOT to reduce assessed control risk even if internal controls are adequate. This approach is followed if:

Which one of the following is NOT usually part of a contingency plan?

The accumulation of source documents and records that allows the organisation to trace accounting entries back to their initiation is the:

The function of an embedded audit module approach:

A computer service centre processes, for an auditor's client, financial data that has a material effect on that client's financial statements. The independent auditor need NOT consider a review of the service centre controls if:

Many clients have their data processed at an independent computer service centre (IT outsourcing) . The difficulty the independent auditor faces when a computer service centre is used is:

Controls which are designed to assure that the information processed by the computer is authorised, complete and accurate are called:

Which one of the following statements is incorrect about network environments?

To obtain evidence that all external users in an e- commerce system are authorised, a 'firewall' channels all network connections through a:

Which of the following is a generalised audit software package?

A well- controlled IT system offers greater potential for reducing misstatements because:

The audit procedure which is least useful in gathering evidence on significant computer processes is:

Application controls vary with each application in the IT system. In attempting to review and gain an understanding of the internal control system, the auditor must evaluate the application controls for:

Generalised audit software: