Question 1

Which of the following is not a step in the process of program development?
A) Analysis and design.
B) Construction.
C) Testing and quality assurance.
D) Batch processing.

Accepted Answer

Batch processing is not a step in the process of program development. It is a method of processing large amounts of data at once. The other steps, such as analysis and design, construction, testing and quality assurance, are all integral parts of the program development process.

Question 2

When a client company's systems rely heavily on IT, auditors will be concerned with the possibility that:
A) unauthorized program changes could result in a system that uniformly processes data in an unauthorized manner.
B) embedded controls are likely to be circumvented.
C) risk of material misstatement is likely to increase as the complexity of the client's IT system increases.
D) specialized IT knowledge on the audit engagement team is not necessary unless the client company engages in electronic commerce.

Accepted Answer

When a client company's systems rely heavily on IT, auditors will be concerned with the possibility that unauthorized program changes could result in a system that uniformly processes data in an unauthorized manner. This can lead to material misstatement and fraud. Therefore, auditors need to assess the risk of unauthorized program changes and check whether the system is protected against such changes.

Question 3

Why is it necessary for an auditor to perform audit work after the "as of" date to which the opinion on ICFR applies?
A) Whistleblower information may become available after the end of the year.
B) Audit documentation is only prepared after the end of the year.
C) End-of-period financial reporting occurs after the end of the year.
D) IT systems may be changed after the end of the year.

Accepted Answer

End-of-period financial reporting occurs after the end of the year, and auditors need to ensure that controls over financial reporting are effective up to the date of the auditor's report.

Question 4

Event identification in the ERM Framework is primarily concerned with identifying:
A) opportunities and threats that impact the company's events and relationships.
B) the relevant economic and political sources of risk.
C) qualitative and quantitative techniques for assessing risk.
D) the acceptable level of residual risk.

Accepted Answer

Event identification in the ERM Framework is primarily concerned with identifying opportunities and threats that impact the company's events and relationships. This includes identifying events that could affect the organization's objectives, opportunities that could be pursued to improve those objectives, and potential threats that could prevent the organization from achieving its goals.

Question 5

Each of the following is a control used to combat denial of service attacks except:
A) firewalls.
B) patches.
C) electronic vaulting.
D) cookie detection.

Accepted Answer

Firewalls, patches, and cookie detection can all be used as controls to combat denial of service attacks. Electronic vaulting, however, is a backup and recovery process, typically used to protect against data loss in the event of a disaster, but not specifically designed to combat denial of service attacks.

Question 6

Auditors should make inquiries about whether there is knowledge of fraud in the company. Such inquiries should be made of:
A) management.
B) the audit committee.
C) internal auditors.
D) All of the above.

Accepted Answer

Auditors should make inquiries about knowledge of fraud in the company to all of the above parties, including management, the audit committee, and internal auditors. This helps auditors to identify any potential fraud risks and evaluate the company's controls and procedures for detecting and preventing fraud.

Question 7

Which of the following best describes an auditor's responsibility regarding whistleblower information?
A) The auditor must evaluate the effectiveness of the audit committee's processes for receiving and evaluating whistleblower information.
B) The auditor must establish a procedure for receiving tips and handling complaints from client personnel.
C) The auditor must complete a checklist identifying key points in the company's procedures for investigating whistleblower accusations.
D) The auditor must require the company to prepare a Form 8-K to report any whistleblower accusations to the SEC.

Accepted Answer

An auditor is responsible for evaluating the effectiveness of the audit committee's processes for receiving and evaluating whistleblower information. This includes assessing the adequacy of the company's procedures for receiving and investigating allegations of fraud or illegal acts. The auditor is not responsible for establishing a procedure for receiving tips and handling complaints or requiring the company to prepare a Form 8-K. The auditor may use a checklist to identify key points in the company's procedures, but this is not the main responsibility.

Question 8

Application controls are part of the effectiveness of ITGC in that they are the controls that:
A) are specific to a single process or activity within the system but depend upon the validity of the ITGC environment.
B) occur at the entity-level to link the operation of automated and manual controls.
C) occur at the transaction-level to integrate the financial reporting aspects of a given activity.
D) are intended to enhance the access control limitations provided by passwords.

Accepted Answer

Application controls are specific to a single process or activity within the system, but their effectiveness depends upon the validity of the ITGC environment in which they operate. This means that application controls cannot be effective if the ITGC environment is weak or ineffective. Therefore, application controls are part of the overall effectiveness of ITGC. Choices B, C, and D are not accurate descriptions of application controls.

Question 9

Which of the following is not an important consideration for the auditor's assessment of audit committee effectiveness?
A) Independence of audit committee members from management.
B) The audit committee's oversight of external financial reporting and ICFR.
C) The audit committee's approval of the external auditors' approach to the audit.
D) The audit committee's responsiveness to issues raised by the external auditors.

Accepted Answer

The audit committee's approval of the external auditors' approach to the audit is not typically considered a direct measure of audit committee effectiveness. The primary responsibilities of an audit committee include oversight of the financial reporting process, internal controls, and the audit process, but not the approval of the specific audit approach, which is determined by the external auditors based on their professional judgment and audit standards.

Question 10

Recurring financial activities that are reflected in the accounting records in the normal course of business are referred to as:
A) recurring events.
B) routine transactions.
C) common assertions.
D) entity-level controls.

Accepted Answer

Routine transactions are the recurring financial activities reflected in the accounting records during the normal course of business, such as sales, purchases, and payroll.

Question 11

Why will an auditor more extensively test controls for the completeness assertion on liability accounts than on asset accounts?
A) The risk of unrecorded liabilities is greater than the risk of unrecorded assets.
B) The completeness assertion is not applicable to asset accounts.
C) The liabilities account balances presented in the financial statements tend to be more complete than the asset accounts.
D) The most likely type of misstatement for liabilities is overstatements.

Accepted Answer

Liabilities represent obligations that the entity owes to outside parties, such as suppliers, lenders, and employees. The risk of unrecorded liabilities is greater than the risk of unrecorded assets because companies have more control over the timing and amount of assets than liabilities. Therefore, auditors need to test more extensively the completeness assertion on liability accounts to ensure that all liabilities have been properly recorded. Additionally, the most likely type of misstatement for liabilities is understatements, which further justifies the need for extensive testing.

Question 12

Social engineering is the term used to describe:
A) policies defining employee's acceptable uses of the company's email system.
B) the behavior of someone who plans to circumvent controls by manipulating employees.
C) policies that address warning signals regarding the risk of circumvention of controls.
D) the network of computer assets and sensitive employee data.

Accepted Answer

Social engineering refers to the manipulation of individuals or groups in order to obtain sensitive information or gain unauthorized access to a system or network. It involves exploiting human weaknesses, such as trust, greed, or fear, to bypass security controls. This can be done through various methods, such as phishing, pretexting, baiting, or tailgating. Social engineering is a common tactic used by cybercriminals to infiltrate organizations and steal valuable data.

Question 13

Which of the following is an example of a transaction-level ITGC?
A) Supervisory review and approval of supporting documents.
B) A corporate code of conduct.
C) Second-layer passwords that limit users to specifically approved individuals.
D) Programmed recalculations for checking accuracy of data files.

Accepted Answer

Second-layer passwords that limit users to specifically approved individuals are an example of a transaction-level Information Technology General Control (ITGC). This control ensures that only authorized personnel can access and perform transactions within the system, thereby safeguarding the integrity and confidentiality of data.

Question 14

Which of the following is an example of an entity-level ITGC?
A) A corporate code of conduct.
B) Programmed recalculations for checking accuracy of data files.
C) User-identification and passwords requirements for system access.
D) Supervisory review and approval of supporting documents.

Accepted Answer

The answer of Which of the following is an example...

Question 15

Which of the following statements regarding Enterprise Risk Management (ERM) is not true?
A) ERM is broader than COSO's internal control framework.
B) ERM provides a logical and orderly way for management to identify, analyze, and manage all of the company's risks.
C) ERM focuses on objectives in the categories of planning, assessment, analysis, and compliance.
D) A good ERM system provides confidence that the company's actions taken to achieve business objectives will fit within acceptable parameters of risk.

Accepted Answer

ERM focuses on objectives in the categories of planning, assessment, response, and monitoring, not compliance.

Question 16

Following are procedures used by auditors to understand likely sources of misstatements: 
I. Identify controls that management has implemented to address potential misstatements.
II. Identify points within the process at which misstatements could arise.
III. Understand the flow of transactions.
The proper sequence of these steps is:

A) I, II, III.
B) III, II, I.
C) I, III, II.
D) III, I, II.

Accepted Answer

The proper sequence is to first understand the flow of transactions (III), then identify points where misstatements could arise (II), and finally identify controls that management has implemented to address potential misstatements (I).

Question 17

Each of the following represents a risk of relying on computerized information systems except:
A) unauthorized access.
B) inappropriate manual intervention.
C) reduction in circumvention of controls.
D) potential loss of data.

Accepted Answer

Reduction in circumvention of controls is actually a benefit of relying on computerized information systems as it helps prevent unauthorized access and inappropriate manual intervention. The other choices (A, B, and D) all represent risks associated with relying on computerized information systems.

Question 18

Segregation of duties within the IT world is most concerned with separating the functions of:
A) hiring systems personnel and acquiring/modifying hardware and software.
B) monitoring IT processes and overseeing third party service providers.
C) operating IT systems and IT development.
D) managing IT continuity programs and IT security.

Accepted Answer

Segregation of duties within the IT world is most concerned with separating the functions of operating IT systems and IT development. This separation helps to prevent any one individual from having too much control or power over a particular system or process. By separating these roles, there is less chance of errors or fraud occurring, as well as better control and oversight over the IT environment.

Question 19

Contingency controls are primarily concerned with:
A) batch processing.
B) recovery.
C) capacity planning.
D) end user computing.

Accepted Answer

Contingency controls are put in place to ensure that if a system or process fails, there are plans for recovery and continuation of normal operations. Therefore, contingency controls are primarily concerned with recovery.

Question 20

Backup controls for data files and hardware are examples of which classification of ITGC?
A) Security controls.
B) Information controls.
C) Continuity controls.
D) Application controls.

Accepted Answer

Backup controls for data files and hardware are part of continuity controls, which include measures that ensure the availability and integrity of the organization's information systems and data in the event of a disruption or disaster. This includes activities such as data backups, disaster recovery planning, and business continuity planning.

Quiz 7: Internal Control, Understanding the Clients Internal Control Over Financial Reporting and Auditing Design Effectiveness

Which of the following is not a step in the process of program development?

When a client company's systems rely heavily on IT, auditors will be concerned with the possibility that:

Why is it necessary for an auditor to perform audit work after the "as of" date to which the opinion on ICFR applies?

Event identification in the ERM Framework is primarily concerned with identifying:

Each of the following is a control used to combat denial of service attacks except:

Auditors should make inquiries about whether there is knowledge of fraud in the company. Such inquiries should be made of:

Which of the following best describes an auditor's responsibility regarding whistleblower information?

Application controls are part of the effectiveness of ITGC in that they are the controls that:

Which of the following is not an important consideration for the auditor's assessment of audit committee effectiveness?

Recurring financial activities that are reflected in the accounting records in the normal course of business are referred to as:

Why will an auditor more extensively test controls for the completeness assertion on liability accounts than on asset accounts?

Social engineering is the term used to describe:

Which of the following is an example of a transaction-level ITGC?

Which of the following is an example of an entity-level ITGC?

Which of the following statements regarding Enterprise Risk Management (ERM) is not true?

Each of the following represents a risk of relying on computerized information systems except:

Segregation of duties within the IT world is most concerned with separating the functions of:

Contingency controls are primarily concerned with:

Backup controls for data files and hardware are examples of which classification of ITGC?