Question 1

Which of the following is a correct statement regarding general controls?
A)Auditors should evaluate the effectiveness of application controls before evaluating general controls.
B)General controls have a pervasive effect on the effectiveness of application controls.
C)Ineffective general controls have no impact on the potential for material misstatements across all system applications.
D)General controls have no impact on audit testing.

Accepted Answer

General controls have a pervasive effect on the effectiveness of application controls. This means that if the general controls are not effective, it can impact the effectiveness of application controls across all system applications. Therefore, auditors should evaluate general controls before evaluating the effectiveness of application controls. Option A is incorrect because it suggests that application controls should be evaluated before general controls. Option C is incorrect because it contradicts the fact that ineffective general controls can have a significant impact on material misstatements. Option D is incorrect because general controls have a direct impact on audit testing.

Question 2

Which of the following statements is correct?
A)Auditors should evaluate application controls before evaluating general controls.
B)Auditors should evaluate application controls and general controls simultaneously.
C)Auditors should evaluate general controls before evaluating application controls.
D)None of these statements is correct.

Accepted Answer

Auditors should evaluate general controls before evaluating application controls as general controls provide a foundation for application controls to operate effectively. General controls are policies and procedures that affect the overall control environment, information technology infrastructure, and the organization's risk management practices. By evaluating general controls first, auditors can assess the overall reliability of the system and identify any weaknesses that could affect the effectiveness of application controls. Therefore, option C is the correct statement.

Question 3

The auditor's objective in determining whether the client's automated controls can correctly handle valid and invalid transactions as they arise is accomplished through the:
A)test data approach.
B)generalized audit software approach.
C)microcomputer-aided auditing approach.
D)generally accepted auditing standards.

Accepted Answer

The auditor's objective of determining whether the client's automated controls can correctly handle valid and invalid transactions as they arise is accomplished through the test data approach. This involves using test data to simulate typical transactions and then evaluating how the system processes those transactions.

Question 4

General controls in smaller companies are usually less effective than in more complex IT environments.

Accepted Answer

General controls are usually less effective in smaller companies because they may have limited resources and personnel to implement and monitor those controls consistently. In contrast, larger and more complex IT environments have more controls, processes, and oversight mechanisms to mitigate risks and ensure compliance.

Question 5

Auditors:
A)link controls and deficiencies in general controls to specific transaction-related audit objectives.
B)can use a control risk matrix to help identify both manual and automated application controls and control deficiencies for each related audit objective.
C)can rely on IT-based application controls for all cycles if general controls are ineffective.
D)can use the IT staff to determine how much reliance they can place on general controls.

Accepted Answer

Auditors use a control risk matrix to identify both manual and automated application controls and control deficiencies for each related audit objective. This helps them assess the effectiveness of controls in place.

Question 6

"Auditing around the computer" is acceptable only if the auditor has access to the client's data in a machine-readable language.

Accepted Answer

Auditing around the computer involves verifying inputs and outputs without examining the processing, so access to machine-readable data is not necessary.

Question 7

Auditors should evaluate which of the following before evaluating application controls because of the potential for pervasive effects?
A)Input controls
B)Control environment
C)Processing controls
D)General controls

Accepted Answer

General controls should be evaluated before application controls as they have a pervasive effect on the entire IT environment. General controls include controls over the IT organization and management, access controls, program development and change controls, and operating system controls. Input controls, processing controls, and control environment are specific to each application and their evaluation would come after the evaluation of general controls.

Question 8

When a client uses desktops and networked servers for the accounting functions, there is a risk of computer viruses.

Accepted Answer

Desktops and networked servers are susceptible to computer viruses if proper measures are not taken to prevent them. Regular antivirus software updates, firewalls, and secure network configurations can help mitigate this risk.

Question 9

Even in a less sophisticated IT environment, automated controls can often be relied on.

Accepted Answer

Automated controls, even in a less sophisticated IT environment, can still provide a level of reliability in managing and securing systems and data. However, the effectiveness of these controls may be limited compared to more advanced, integrated solutions.

Question 10

Auditors usually obtain information about general and application controls through:
A)interviews with IT personnel.
B)examination of systems documentation.
C)reading program change requests.
D)all of the above methods.

Accepted Answer

Auditors typically use a combination of methods to obtain information about controls, including interviews with IT personnel to understand processes, examination of systems documentation to evaluate system design and planned controls, and reading program change requests to assess changes made to the system. Therefore, the best answer is D, all of the above methods.

Question 11

When the client uses a computer but the auditor chooses to use only the non-IT segment of internal control to assess control risk, it is referred to as auditing around the computer.Which one of the following conditions need not be present to audit around the computer?
A)Application controls need to be integrated with general controls.
B)The source documents must be available in a non-machine language.
C)The documents must be filed in a manner that makes it possible to locate them.
D)The output must be listed in sufficient detail to enable the auditor to trace individual transactions.

Accepted Answer

While integrating application controls with general controls can facilitate the audit process, it is not necessary to audit around the computer. However, the other conditions listed (non-machine language source documents, accessible document filing system, and detailed output for transaction tracing) are all essential for auditors who choose to audit around the computer.

Question 12

The approach to auditing where the auditor does not test automated controls to reduce assessed control risk is called:
A)the single-stage audit.
B)the test deck approach.
C)auditing around the computer.
D)generalized audit software (GAS).

Accepted Answer

Auditing around the computer is the approach where the auditor does not test automated controls but instead focuses on testing manual controls and conducting substantive procedures directly on the data. This approach is used when the auditor determines that testing automated controls would not be efficient or effective in reducing assessed control risk. The test deck approach is a method of testing the accuracy and completeness of computerized systems by processing a set of hypothetical transactions or data. Generalized audit software (GAS) is software designed specifically for auditors to perform various audit tasks on electronic data. The single-stage audit is a type of audit approach where the auditor only performs one stage of the audit process, such as only conducting substantive procedures without testing controls.

Question 13

Auditors often use their own software to test the client's IT controls.

Accepted Answer

Auditors often use specialized software to test the effectiveness of a client's IT controls, as it allows for more efficient and accurate testing.

Question 14

Auditors normally link controls and deficiencies in general controls to specific transaction-related audit objectives.

Accepted Answer

The answer of Auditors normally link controls and deficiencies in...

Question 15

It is important for the auditor to understand both the general controls and the application controls a company has implemented.Which of the following statements is true about these controls?
A)Auditors do not link IT controls to audit objectives.
B)After identifying specific IT-based application controls that can be used to reduce control risk, auditors can reduce substantive testing.
C)General controls affect audit objectives in only one cycle.
D)The impact of general controls and application controls on audits does not vary depending on the level of complexity in the IT environment.

Accepted Answer

After identifying specific IT-based application controls, auditors can rely on them to reduce control risk and therefore reduce the need for substantive testing. This not only saves time and resources but also increases the effectiveness and efficiency of the audit.

The other three statements are incorrect. 
A) Auditors do link IT controls to audit objectives, as IT controls are an integral part of the audit process. 
C) General controls can affect multiple cycles, not just one. 
D) The impact of general and application controls can vary depending on the complexity of the IT environment, as more complex IT systems may require more intensive and detailed controls.

Question 16

When the client changes the computer software:
A)no additional testing is needed by the auditor.
B)and application controls are effective, the auditor can easily identify when software changes are made.
C)and general controls are effective, the auditor can easily identify when software changes are made.
D)application and general controls can no longer by relied upon by the auditor.

Accepted Answer

If general controls are effective, the auditor should be able to identify when software changes are made. However, if application controls are also effective, the auditor can not only identify software changes but also assess their impact on the effectiveness of internal control. Therefore, additional testing may be needed by the auditor depending on the effectiveness of general and application controls. Option A is incorrect because changes in software may affect the effectiveness of internal control which may require the auditor to perform additional testing. Option B is incorrect because the effectiveness of application controls does not allow the auditor to assess the impact of software changes on internal control. Option D is incorrect because software changes may affect the effectiveness of internal control, not the reliability of the controls themselves.

Question 17

Companies with non-complex IT environments often rely on desktops and networked servers to perform accounting system functions.Which of the following is not an audit consideration in such an environment?
A)Limited reliance on automated controls
B)Unauthorized access to master files
C)Vulnerability to viruses and other risks
D)Excess reliance on automated controls

Accepted Answer

In a non-complex IT environment with limited reliance on automated controls, excess reliance on automated controls is not a significant audit consideration. Instead, auditors would focus on the other options listed, such as limited reliance on automated controls, unauthorized access to master files, and vulnerability to viruses and other risks.

Question 18

Auditors typically obtain information about general and application controls through all of the following ways except for:
A)interviews with IT personnel.
B)reviews of detailed questionnaires completed by IT staff.
C)examination of system documentation such as flowcharts.
D)filings submitted to the PCAOB or SEC.

Accepted Answer

Filings submitted to the PCAOB or SEC may not necessarily provide information about general and application controls. Auditors typically obtain information about controls through interviews with IT personnel, reviews of detailed questionnaires completed by IT staff, and examination of system documentation such as flowcharts.

Question 19

"Auditing around the computer" is most appropriate when the client has not maintained detailed output or source documents in a form readable by humans.

Accepted Answer

"Auditing around the computer" is used when auditors focus on inputs and outputs without evaluating the processing. It is not suitable when detailed documents are not available, as it requires verifying outputs against inputs.

Question 20

Which of the following is least likely to be used in obtaining an understanding of client general controls?
A)Examination of system documentation
B)Inquiry of key users
C)Walk through of a sales transaction
D)Reviews of questionnaires completed by client IT personnel

Accepted Answer

A walk through of a sales transaction is a specific control test procedure and would not necessarily provide an overall understanding of client general controls. The other options, such as examination of system documentation, inquiry of key users, and reviews of questionnaires completed by client IT personnel, are more commonly used in obtaining an understanding of client general controls.

Quiz 12: The Impact of Information Technology on the Audit Process

Which of the following is a correct statement regarding general controls?

Which of the following statements is correct?

The auditor's objective in determining whether the client's automated controls can correctly handle valid and invalid transactions as they arise is accomplished through the:

General controls in smaller companies are usually less effective than in more complex IT environments.

Auditors:

"Auditing around the computer" is acceptable only if the auditor has access to the client's data in a machine-readable language.

Auditors should evaluate which of the following before evaluating application controls because of the potential for pervasive effects?

When a client uses desktops and networked servers for the accounting functions, there is a risk of computer viruses.

Even in a less sophisticated IT environment, automated controls can often be relied on.

Auditors usually obtain information about general and application controls through:

When the client uses a computer but the auditor chooses to use only the non-IT segment of internal control to assess control risk, it is referred to as auditing around the computer.Which one of the following conditions need not be present to audit around the computer?

The approach to auditing where the auditor does not test automated controls to reduce assessed control risk is called:

Auditors often use their own software to test the client's IT controls.

Auditors normally link controls and deficiencies in general controls to specific transaction-related audit objectives.

It is important for the auditor to understand both the general controls and the application controls a company has implemented.Which of the following statements is true about these controls?

When the client changes the computer software:

Companies with non-complex IT environments often rely on desktops and networked servers to perform accounting system functions.Which of the following is not an audit consideration in such an environment?

Auditors typically obtain information about general and application controls through all of the following ways except for:

"Auditing around the computer" is most appropriate when the client has not maintained detailed output or source documents in a form readable by humans.

Which of the following is least likely to be used in obtaining an understanding of client general controls?