Chapter 17—IT Controls Part III: Systems Development, Program Changes, and Application Controls

An electronic walk-through of the application's internal logic is called a. a salami logic test. b. an integrated test. c. tracing. d. a logic bomb test.

C

25. Which of the following is an example of an input error correction technique? a. immediate correction b. rejection of batch c. creation of error file d. all are examples of input error correction techniques

: D

1. Which statement is not correct? The audit trail in a computerized environment a. consists of records that are stored sequentially in an audit file b. traces transactions from their source to their final disposition c. is a function of the quality and integrity of the application programs d. may take the form of pointers, indexes, and embedded keys

A

19. A computer operator was in a hurry and accidentally used the wrong master file to process a transaction file. As a result, the accounts receivable master file was erased. Which control would prevent this from happening? a. header label check b. expiration date check c. version check d. validity check

A

2. Which control is not associated with new systems development activities? a. reconciling program version numbers b. program testing c. user involvement d. internal audit participation

A

20. Run-to-run control totals can be used for all of the following except a. to ensure that all data input is validated b. to ensure that only transactions of a similar type are being processed c. to ensure the records are in sequence and are not missing d. to ensure that no transaction is omitted

A

27. Which statement is not true? a. An audit objective for systems maintenance is to detect unauthorized access to application databases. b. An audit objective for systems maintenance is to ensure that applications are free from errors. c. An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version numbers. d. An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized access.

A

28. When the auditor reconciles the program version numbers, which audit objective is being tested? a. protect applications from unauthorized changes b. ensure applications are free from error c. protect production libraries from unauthorized access d. ensure incompatible functions have been identified and segregated

A

29. When auditors do not rely on a detailed knowledge of the application's internal logic, they are performing a. black box tests of program controls b. white box tests of program controls c. substantive testing d. intuitive testing

A

31. Which test is not an example of a white box test? a. determining the fair value of inventory b. ensuring that passwords are valid c. verifying that all pay rates are within a specified range d. reconciling control totals

A

32. When analyzing the results of the test data method, the auditor would spend the least amount of time reviewing a. the test transactions b. error reports c. updated master files d. output reports

A

34. All of the following are disadvantages of the test data technique except a. the test data technique requires extensive computer expertise on the part of the auditor b. the auditor cannot be sure that the application being tested is a copy of the current application used by computer services personnel c. the auditor cannot be sure that the application being tested is the same application used throughout the entire year d. preparation of the test data is time-consuming

A

35. All of the following statements are true about the integrated test facility (ITF) except a. production reports are affected by ITF transactions b. ITF databases contain "dummy" records integrated with legitimate records c. ITF permits ongoing application auditing d. ITF does not disrupt operations or require the intervention of computer services personnel

A

The controls in a computerized system are classified as a. input, processing, and output. b. input, processing, output, and storage. c. input, processing, output, and control. d. input, processing, output, storage, and control. e. collecting, sorting, summarizing, and reporting.

A

17. An inventory record indicates that 12 items of a specific product are on hand. A customer purchased two of the items, but when recording the order, the data entry clerk mistakenly entered 20 items sold. Which check could detect this error? a. numeric/alphabetic data checks b. limit check c. range check d. reasonableness check

B

22. Risk exposures associated with creating an output file as an intermediate step in the printing process (spooling) include all of the following actions by a computer criminal except a. gaining access to the output file and changing critical data values b. using a remote printer and incurring operating inefficiencies c. making a copy of the output file and using the copy to produce illegal output reports d. printing an extra hardcopy of the output file

B

4. Which statement is correct? a. compiled programs are very susceptible to unauthorized modification b. the source program library stores application programs in source code form c. modifications are made to programs in machine code language d. the source program library management system increases operating efficiency

B

7. Program testing a. involves individual modules only, not the full system b. requires creation of meaningful test data c. need not be repeated once the system is implemented d. is primarily concerned with usability

B

Computer applications use routines for checking the validity and accuracy of transaction data called a. operating systems. b. edit programs. c. compiler programs. d. integrated test facilities. e. compatibility tests.

B

Which of the following is an example of an input control? a. making sure that output is distributed to the proper people b. monitoring the work of programmers c. collecting accurate statistics of historical transactions while gathering data d. recalculating an amount to ensure its accuracy e. having another person review the design of a business form

B

8. The correct purchase order number, 123456, was incorrectly recorded as shown in the solutions. All of the following are transcription errors except a. 1234567 b. 12345 c. 124356 d. 123454

C

A control designed to validate a transaction at the point of data entry is a. recalculation of a batch total. b. a record count. c. a check digit. d. checkpoints. e. recalculation of hash total

C

10. Which statement is not correct? The goal of batch controls is to ensure that during processing a. transactions are not omitted b. transactions are not added c. transactions are free from clerical errors d. an audit trail is created

C

11. An example of a hash total is a. total payroll checks-$12,315 b. total number of employees-10 c. sum of the social security numbers-12,555,437,251 d. none of the above

C

16. The employee entered "40" in the "hours worked per day" field. Which check would detect this unintentional error? a. numeric/alphabetic data check b. sign check c. limit check d. missing data check

C

18. Which check is not an input control? a. reasonableness check b. validity check. c. spooling check d. missing data check

C

21. Methods used to maintain an audit trail in a computerized environment include all of the following except a. transaction logs b. Transaction Listings. c. data encryption d. log of automatic transactions

C

23. Which statement is not correct? a. only successful transactions are recorded on a transaction log b. unsuccessful transactions are recorded in an error file c. a transaction log is a temporary file d. a hardcopy transaction listing is provided to users

C

24. Input controls include all of the following except a. check digits b. Limit check. c. spooling check d. missing data check

C

26. Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud? Review of the documentation indicates that a. a cost-benefit analysis was conducted b. the detailed design was an appropriate solution to the user's problem c. tests were conducted at the individual module and total system levels prior to implementation d. problems detected during the conversion period were corrected in the maintenance phase

C

33. All of the following are advantages of the test data technique except a. auditors need minimal computer expertise to use this method b. this method causes minimal disruption to the firm's operations c. the test data is easily compiled d. the auditor obtains explicit evidence concerning application functions

C

5. Which control is not a part of the source program library management system? a. using passwords to limit access to application programs b. assigning a test name to all programs undergoing maintenance c. combining access to the development and maintenance test libraries d. assigning version numbers to programs to record program modifications

C

6. Which control ensures that production files cannot be accessed without specific permission? a. Database Management System b. Recovery Operations Function c. Source Program Library Management System d. Computer Services Function

C

An employee in the receiving department keyed in a shipment from a remote terminal and inadvertently omitted the purchase order number. The best systems control to detect this error would be a a. batch total. b. completeness test. c. sequence check. d. reasonableness test. e. compatibility test.

C

How does a direct access file processing system edit individual transactions? a. takes place in a separate computer run b. takes place in online mode as transactions are entered c. takes place during a backup procedure d. is not performed due to time constraints e. is not necessary

C

In a computer system, how are accounting records posted? a. master file is updated to a transaction file b. master file is updated to an index file c. transaction file is updated to a master file d. master file is updated to a year-to-date file e. current balance file is updated to an index file

C

In an automated payroll processing environment, a department manager substituted the time card for a terminated employee with a time card for a fictitious employee. The fictitious employee had the same pay rate and hours worked as the terminated employee. The best control technique to detect this action using employee identification numbers would be a a. batch total. b. record count. c. hash total. d. subsequent check. e. financial total.

C

Which of the following is NOT a common type of white box test of controls? a. completeness tests b. redundancy tests c. inference tests d. authenticity tests

C

13. Which of the following is not an example of a processing control? a. hash total. b. record count. c. batch total. d. check digit

D

14. Which of the following is an example of input control test? a. sequence check b. zero value check c. spooling check d. range check

D

15. Which input control check would detect a payment made to a nonexistent vendor? a. missing data check b. numeric/alphabetic check c. range check d. validity check

D

3. Routine maintenance activities require all of the following controls except a. documentation updates b. testing c. formal authorization d. internal audit approval

D

30. All of the following concepts are associated with the black box approach to auditing computer applications except a. the application need not be removed from service and tested directly b. auditors do not rely on a detailed knowledge of the application's internal logic c. the auditor reconciles previously produced output results with production input transactions d. this approach is used for complex transactions that receive input from many sources

D

36. Which statement is not true? Embedded audit modules a. can be turned on and off by the auditor. b. reduce operating efficiency. c. may lose their viability in an environment where programs are modified frequently. d. identify transactions to be analyzed using white box tests.

D

37. Generalized audit software packages perform all of the following tasks except a. recalculate data fields b. compare files and identify differences c. stratify statistical samples d. analyze results and form opinions

D

9. Which of the following is correct? a. check digits should be used for all data codes b. check digits are always placed at the end of a data code c. check digits do not affect processing efficiency d. check digits are designed to detect transcription and transposition errors

D

SOX legislation calls for sound internal control practices over financial reporting and requires SEC-registered corporations to maintain systems of internal control that meet SOX standards. An integral part of internal control is the appropriate use of preventive controls. Which of the following is not an essential element of preventive control? a. separation of responsibilities for the recording, custodial, and authorization functions b. sound personnel practices c. documentation of policies and procedures d. implementation of state-of-the-art software and hardware e. physical protection of assets

D

Which of the following is NOT a test for identifying application errors? a. reconciling the source code b. reviewing test results c. retesting the program d. testing the authority table

D

12. Which statement is not true? A batch control record a. contains a transaction code b. records the record count c. contains a hash total d. control figures in the record may be adjusted during processing e. All the above are true

E