Question 1

The completeness of IT-generated sales figures can be tested by comparing the number of items listed on the daily sales report with the number of items billed on the actual invoices. This process uses:
A) control totals.
B) validity tests.
C) process tracing data.
D) check digits.

Accepted Answer

Control totals are used to ensure the completeness and accuracy of data. By comparing the number of items listed on the sales report with the number of items billed on the actual invoices, we are using a control total to check for completeness. Validity tests are used to check if data is valid or not, process tracing data is used to analyze the flow of data within a process, and check digits are used to check for transcription errors in numeric data. None of these options are applicable to the process of comparing daily sales reports with actual invoices to ensure completeness.

Question 2

Which of the following activities would most likely be performed in the IT department?
A) Initiation of changes to master records.
B) Conversion of information to machine-readable form.
C) Correction of transactional errors.
D) Initiation of changes to existing applications.

Accepted Answer

Conversion of information to machine-readable form is a technical task that would typically fall under the responsibilities of the IT department. The other options - initiation of changes to master records, correction of transactional errors, and initiation of changes to existing applications - could potentially be performed by non-IT departments as well.

Question 3

Carmela Department Stores Ltd has a fully integrated IT accounting system and is planning to issue credit cards to credit-worthy customers. To strengthen the internal control by making it difficult for one to create a valid customer account number, the company's independent auditor has suggested the inclusion of a check digit that should be placed:
A) at the beginning of a valid account number, only.
B) in the middle of a valid account number, only.
C) at the end of a valid account number, only.
D) consistently in any position.

Accepted Answer

The answer of Carmela Department Stores Ltd has a fully...

Question 4

Maxi Sales Corp. maintains a large, full-time internal audit staff that reports directly to the chief accountant. Audit reports prepared by the internal auditors indicate that the structure is functioning as it should be and that the accounting records are reliable. The external auditor will probably:
A) eliminate tests of controls.
B) increase the depth of the procedures to obtain an understanding of controls directed towards operating efficiency.
C) avoid duplicating the work performed by the internal audit staff.
D) place limited reliance on the work performed by the internal audit staff.

Accepted Answer

The external auditor should place limited reliance on the work performed by the internal audit staff. While the internal audit staff may have provided assurance on the reliability of accounting records, the external auditor still needs to independently test the effectiveness of internal controls and the accuracy of financial statements. This is because the internal audit staff may not have the same level of independence and objectivity as the external auditor.

Question 5

Internal control procedures within the IT activity may leave no visible evidence indicating that the procedures were performed.In such instances, the auditor should test these controls by:
A) making corroborative inquiries.
B) observing the separation of duties of personnel.
C) reviewing transactions submitted for processing and comparing them to related output.
D) reviewing the run manual.

Accepted Answer

Since there may be no visible evidence of the internal control procedures being performed, the best way to test these controls is to review transactions submitted for processing and comparing them to related output. This will help to ensure that the procedures were performed effectively and accurately. Making corroborative inquiries and observing the separation of duties are useful in some cases, but they may not be sufficient to test internal controls within the IT activity. Reviewing the run manual may provide some information, but it is less effective than reviewing actual transactions and output.

Question 6

A procedural control used in the management of a computer centre to minimise the possibility of data or program file destruction through operator error includes:
A) control figures.
B) cross-adding tests.
C) limit checks.
D) external labels.

Accepted Answer

External labels are a procedural control used to minimize the possibility of data or program file destruction through operator error by ensuring that the correct and intended media (like tapes or disks) are being used for data processing tasks.

Question 7

When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an error report. The error report should most probably be reviewed and followed up by the:
A) IT control group.
B) system analyst.
C) supervisor of computer operations.
D) computer programmer.

Accepted Answer

The IT control group is responsible for ensuring the accuracy and integrity of data processing within an organization. When erroneous data are detected, reviewing and following up on error reports falls within their purview to maintain system reliability and compliance with data management policies.

Question 8

Which of the following is an example of a check digit?
A) An agreement of the total number of employees to the total number of cheques printed by the computer.
B) An algebraically determined number produced by the other digits of the employee number.
C) A logic test that ensures all employee numbers have nine digits.
D) A limit check that an employee's hours do not exceed 50 hours per work week.

Accepted Answer

A check digit is a digit added to a number that validates the authenticity and accuracy of the number. Option B describes the process of creating a check digit by using the other digits in the employee number to produce a unique digit that ensures the accuracy of the number. The other options do not describe a check digit.

Question 9

If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll IT application?
A) Hours worked.
B) Employee's identification number.
C) Number of employees.
D) Gross pay.

Accepted Answer

A hash total is typically used to ensure that all data items have been processed or entered correctly. In a payroll application, the employee's identification number is a unique identifier for each employee and is likely to be used as a key field in many of the system's tables. Therefore, computing a hash total on this data item can help ensure that all employee records have been processed correctly. The other data items listed (hours worked, number of employees, gross pay) are not generally used as key fields in a payroll application and are therefore less suitable for use as a hash total.

Question 10

When an independent auditor decides that the work performed by internal auditors may have a bearing on the nature, timing and extent of contemplated audit procedures, the independent auditor should plan to evaluate the objectivity of the internal auditors. Relative to objectivity, the independent auditor should:
A) consider the organisation level to which internal auditors report the results of their work.
B) review the quality control program in effect for the internal audit staff.
C) examine the quality of the internal audit reports.
D) consider the qualifications of the internal audit staff.

Accepted Answer

The answer of When an independent auditor decides that the...

Question 11

If a control total were to be calculated on each of the following data items, which would best be identified as a hash total for a payroll IT application?
A) Net pay.
B) Department numbers.
C) Hours worked.
D) Total debits and total credits.

Accepted Answer

Department numbers would be the best choice for a hash total in a payroll IT application as it would allow for verification that all departments have been processed and accounted for. Net pay, hours worked, and total debits and credits are not as useful for this purpose.

Question 12

For control purposes, which of the following should be organisationally segregated from the computer operations function?
A) Data conversion.
B) Surveillance of CRT messages.
C) Systems development.
D) Minor maintenance according to a schedule.

Accepted Answer

Systems development should be organisationally segregated from computer operations to ensure proper segregation of duties and reduce the risk of conflicts of interest or fraudulent activities. Data conversion and minor maintenance can be performed by computer operations staff, while surveillance of CRT messages can be outsourced or performed by an independent unit within the organisation.

Question 13

One of the major problems with IT systems is that incompatible functions may be performed by the same individual.One compensating control for this is the use of:
A) a tape library.
B) a check-digit system.
C) computer-generated hash totals.
D) a computer log.

Accepted Answer

A computer log can track and record all actions taken by an individual in the system, making it easier to detect if incompatible functions are being performed by the same person. This provides a compensating control to help prevent errors or intentional wrongdoing. Tape libraries, check-digit systems, and computer-generated hash totals are not directly related to addressing the problem of incompatible functions being performed by the same individual.

Question 14

Totals of amounts in computer-record data fields that are not usually added, but are used only for data-processing control purposes, are called:
A) record totals.
B) hash totals.
C) processing data totals.
D) field totals.

Accepted Answer

Totals of amounts in computer-record data fields that are used only for data-processing control purposes are known as hash totals. They are used for error detection and control in computer systems. Record totals, processing data totals, and field totals refer to different types of totals that are based on the content of data fields and are used for different purposes.

Question 15

In which of the following situations would an auditor most likely use a strategy of reliance on internal control?
A) The systems analyst reviews output and controls the distribution of output from the IT department.
B) The entity has been slow to update its IT system to reflect changes in billing practices.
C) No paper trail is generated, as the entity receives sales orders, bills customers and receives payment based only on information generated from IT.
D) The auditor has been unable to determine whether all changes to a client's IT were properly authorised.

Accepted Answer

In situation C, where the entity relies heavily on IT for its sales orders, billing, and payment processes without generating a paper trail, an auditor would likely use a strategy of reliance on internal control. This is because the effectiveness and efficiency of these processes are highly dependent on the proper functioning and integrity of the internal controls within the IT system.

Question 16

The use of a header label in conjunction with magnetic tape is most likely to prevent errors by the:
A) computer operator.
B) key entry operator.
C) computer programmer.
D) maintenance technician.

Accepted Answer

Header labels on magnetic tapes are used to identify the contents and ensure that the correct tape is being used, which helps prevent errors by the computer operator who handles and loads the tapes.

Question 17

An input control is designed to ensure that:
A) machine processing is accurate.
B) only authorised personnel have access to the computer area.
C) data received for processing are properly authorised and converted to machine-readable form.
D) electronic data processing has been performed as intended for the particular application.

Accepted Answer

An input control is designed to ensure that the data received for processing are properly authorised and converted to machine-readable form. This helps in ensuring data accuracy and completeness in the system. Input controls are used to verify the validity of the data input, thereby maintaining the integrity of the data. The options A, B, and D are incorrect because they do not fully describe the purpose of an input control.

Question 18

To provide for the greatest degree of independence in performing internal auditing functions, an internal auditor most likely should report to the:
A) chief financial officer.
B) corporate controller.
C) audit committee.
D) shareholders.

Accepted Answer

Reporting directly to the audit committee is the best way to maintain independence and objectivity in internal auditing. This allows the auditor to provide unbiased and truthful assessments of the organization's systems and controls without fear of retribution or pressure from management or executives. Reporting to the CFO or corporate controller, who may have a vested interest in presenting a positive image of the organization, could compromise the auditor's independence. Reporting to shareholders is not practical as it would create logistical and communication challenges.

Question 19

After obtaining an understanding of a client's IT control, an auditor may decide not to perform tests of controls within the IT portion of the client's system. Which of the following would not be a valid reason for choosing to omit tests of controls?
A) There appear to be major deficiencies that preclude reliance on the stated procedure.
B) The time and dollar costs of testing controls exceed the savings in substantive testing if the tests show the controls to be operative.
C) The controls appear to be adequate and thus can be relied upon in assessing the level of control risk.
D) The controls duplicate controls existing elsewhere in the system.

Accepted Answer

If controls appear to be adequate, the auditor would typically perform tests of controls to confirm their effectiveness and potentially reduce substantive testing. Therefore, this is not a valid reason to omit tests of controls.

Quiz 8: Understanding and Assessing Internal Control Part Three: Tests of Control and Tests of Details

The completeness of IT-generated sales figures can be tested by comparing the number of items listed on the daily sales report with the number of items billed on the actual invoices. This process uses:

Which of the following activities would most likely be performed in the IT department?

Internal control procedures within the IT activity may leave no visible evidence indicating that the procedures were performed.In such instances, the auditor should test these controls by:

A procedural control used in the management of a computer centre to minimise the possibility of data or program file destruction through operator error includes:

When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an error report. The error report should most probably be reviewed and followed up by the:

Which of the following is an example of a check digit?

If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll IT application?

If a control total were to be calculated on each of the following data items, which would best be identified as a hash total for a payroll IT application?

For control purposes, which of the following should be organisationally segregated from the computer operations function?

One of the major problems with IT systems is that incompatible functions may be performed by the same individual.One compensating control for this is the use of:

Totals of amounts in computer-record data fields that are not usually added, but are used only for data-processing control purposes, are called:

In which of the following situations would an auditor most likely use a strategy of reliance on internal control?

The use of a header label in conjunction with magnetic tape is most likely to prevent errors by the:

An input control is designed to ensure that:

To provide for the greatest degree of independence in performing internal auditing functions, an internal auditor most likely should report to the:

After obtaining an understanding of a client's IT control, an auditor may decide not to perform tests of controls within the IT portion of the client's system. Which of the following would not be a valid reason for choosing to omit tests of controls?