Question 1

Monitoring control activities to determine if they are adequate and effective can be done on an ongoing basis, as a separate project, or as a combination of both. Briefly compare monitoring on an ongoing basis versus monitoring as a separate project.

Accepted Answer

The answer of Monitoring control activities to determine if they...

Question 2

Computer crimes are always reported and easily investigated.

Accepted Answer

While computer crimes are typically reported, they can be difficult to investigate due to factors such as the anonymity of online activity and the ability to easily hide or delete digital evidence.

Question 3

Duties that should be segregated are authorization of transaction and other events, custody of assets, and modification or creation of related data and program files.

Accepted Answer

Segregation of duties is an important internal control measure to prevent fraud or errors. The three duties that should be segregated are authorization, custody, and record-keeping. By segregating these duties, it minimizes the risk of any one person having complete control over a transaction or asset, which helps prevent or detect errors or fraud.

Question 4

A current trend with respect to the placement of controls is a movement away from controls programmed into computer software toward controls in human operating procedures.

Accepted Answer

The current trend is towards integrating more controls into computer software to automate processes and reduce human error, rather than relying on human-operated procedures.

Question 5

SAS 94 allows auditing around the computer in complex IT environments.

Accepted Answer

SAS 94 acknowledges the integration of IT in financial reporting and requires auditors to understand the automated and manual procedures an entity uses, making auditing solely around the computer insufficient in complex IT environments.

Question 6

General controls relate to the flow of data in and among individual applications, such as customer billing and cash receipts.

Accepted Answer

General controls relate to the overall security and control environment of an organization, such as access controls and backup procedures. The controls that relate to the flow of data in and among individual applications are called application controls.

Question 7

In the process of identifying control activities, you must first identify risks.

Accepted Answer

This statement is true. In order to design effective control activities, risks must first be identified and assessed. This helps to determine which risks require mitigation through control activities.

Question 8

Identify and briefly describe the classification scheme for control activities.

Accepted Answer

The answer of Identify and briefly describe the classification scheme...

Question 9

According to SAS 94, control activities can be classified into performance reviews, physical controls, segregation of duties, and authorizations.

Accepted Answer

The answer of According to SAS 94, control activities can...

Question 10

The monitoring of internal control can be conducted on an ongoing basis, as a separate project, or as a combination of both.

Accepted Answer

The statement is true. Internal control monitoring can be done continuously or as a separate project or a combination of both.

Question 11

List and describe the two basic types of encryption.

Accepted Answer

The answer of List and describe the two basic types...

Question 12

A trend is a movement away from programming controls into computer software and toward placing controls in human operating procedures.

Accepted Answer

A trend in technology and business processes is actually towards integrating more controls into computer software to automate and enhance security, efficiency, and accuracy, rather than relying on human-operated procedures which are more prone to error.

Question 13

Performance measures should be quantitative as opposed to qualitative.

Accepted Answer

Performance measures should be based on measurable data and numbers, which are quantitative in nature. Qualitative data is subjective and difficult to measure consistently.

Question 14

Computer forensics involves putting together the facts and computer evidence necessary to prosecute computer criminals.

Accepted Answer

Computer forensic investigations are conducted to gather digital evidence in order to identify and prosecute individuals involved in cybercrimes. The evidence collected is used to build a case against the accused in a court of law.

Question 15

Identify the general control activities that are desirable for information processing systems.

Accepted Answer

The answer of Identify the general control activities that are...

Question 16

A disaster recovery plan is an application control.

Accepted Answer

A disaster recovery plan is a process of ensuring that critical business functions can continue in the event of a disaster, such as a natural disaster, cyber attack or power outage. It is not an application control, which is a specific security measure designed to prevent unauthorized access, alteration or destruction of software applications.

Question 17

Physical controls protect assets from theft and destruction.

Accepted Answer

Physical controls such as locks, access controls, and security systems can deter theft and protect assets from destruction.

Question 18

Hiring trustworthy employees is the best way to minimize the opportunity for fraudulent activity,

Accepted Answer

Hiring trustworthy employees reduces the risk of fraudulent activity within a company because they are less likely to engage in illegal actions. This is why background checks, reference checks and interviews are important components in assessing an employee's character and suitability for a particular role.

Question 19

Disaster recovery plans should be practiced regularly so that everyone knows what they are supposed to do in the event of a disaster.

Accepted Answer

Disaster recovery plans are only effective if all the employees and stakeholders are well-aware of their roles and responsibilities in the event of a disaster. To ensure that the plan works smoothly, it should be practiced and tested regularly, preferably annually, and updated as necessary. Regular testing and training will help employees understand their responsibilities, gain the confidence to handle emergencies, and identify areas of weakness in the recovery plan that need improvement. Therefore, disaster recovery plans should be practiced regularly to ensure smooth and efficient recovery operations.

Question 20

Control activities include a variety of operational procedures, may be physical in nature, and include techniques that ensure the security of computer programs, files, and networks.

Accepted Answer

Control activities are a set of procedures and techniques designed to ensure the security and effectiveness of an organization's operations. These activities may be physical or systemic and are meant to prevent or detect errors, fraud, or other undesirable events. One aspect of control activities is the implementation of security measures to protect computer programs, files, and networks from unauthorized access or damage.

Quiz 7: Control Activities