Auditing - Appendix H Information Technology and the Auditor

Frauds that get past prevention controls should be discovered by controls.

detection

Which of the following is NOT an administrative level control? Multiple choice question. Program testing after modification Access control software and passwords Rotation of computer duties Security checks on personnel

Access control software and passwords

Which of the following is NOT a processing control? Multiple choice question. Computer prompting Audit trail Data comparisons Control totals Transaction logs

Computer prompting

Which of the following is both an output and a processing control? Multiple choice question. Master file changes Control total reports Run-to-run totals Limit and reasonableness tests

Control total reports

True or false: All passwords should be at least six characters long to make hacking by computer-generated algorithms difficult.

False

True or false: Small entities often fail to separate the functions of programming and operations due to indifference with respect to internal control. True false question.TrueFalse

False

True or false: The process of identifying the points in the flow of transactions where specific types of misstatements could occur is virtually the same in both manual and and IT processing environments. True false question. True False

False

Which type of controls are designed to provide reasonable assurance that data received for processing by the computer department have been properly authorized and accurately entered or converted for processing? Multiple choice question. Input Output Processing Authorization

Input

Which of the following is both an input and a processing control? Multiple choice question. Run-to-run totals Limit and reasonableness tests Data entry and formatting controls Valid character tests

Limit and reasonableness tests

Which of the following are NOT processing controls? Multiple select question. Run-to-run totals Control total reports Missing data tests Master file changes

Missing data tests Master file changes

Which of the following statements is correct? Multiple choice question. When forming the IT testing plan, only entirely automated controls need to be tested. Manual control activities that rely on a system generated report get special consideration when forming the IT audit testing plan. Only purely manual control activities can be ignored in the IT audit testing plan.

Only purely manual control activities can be ignored in the IT audit testing plan.

Which type of controls are concerned with detecting rather than preventing errors? Multiple choice question. Reasonableness Output Input Processing

Output

Which type of controls are similar in nature to input controls? Multiple choice question. Reasonableness Authorization Processing Output

Processing

Which of the following is NOT a program development control? Multiple choice question. All software and programs have appropriate documentation. Programs and software are tested and validated prior to being placed in operations. Processing failures are resolved on a timely basis. Programs and software support the entity's financial reporting requirements.

Processing failures are resolved on a timely basis.

Which of the following is NOT a computer operations control? Multiple choice question. Transactions are processed in accordance with the entity's objectives. Programs and software support the entity's financial reporting requirements. Actions are taken to facilitate backup and recovery of data when needed. Processing failures are resolved on a timely basis.

Programs and software support the entity's financial reporting requirements.

Which of the following is NOT an input control? Multiple choice question. Run-to-run totals Check digits Batch totals Data entry and formatting controls

Run-to-run totals

Which of the following is NOT a typical end-user computing environment control issue that audit teams must consider? Multiple choice question. Lack of program documentation and testing Limited computer knowledge Separation of programming and operations functions Lack of physical security

Separation of programming and operations functions

Which of the following is NOT a technical control? Multiple choice question. Range checks Transaction logging reports Transaction limit amounts Data encryption

Transaction limit amounts

Which of the following is NOT a physical control? Multiple choice question. Preprinted limits on documents Data backup storage Transaction logging reports Controlled access

Transaction logging reports

Which of the following is NOT a data entry control in end-user computing environments? Multiple choice question. Online editing and sight verification Transaction logs Access restriction to input devices Standard screens and computer prompting

Transaction logs

True or false: When a user entity employs a service organization for specialized processing, the user entity's auditors must still evaluate controls related to the service organization's computerized processing for the user entity.

True

Experts have two definitions related to computer chicanery: computer and computer .

abuse, fraud

The use of information technology by a perpetrator to achieve a gain at the expense of a victim is called computer or computer .

abuse, fraud

Individuals employed by the entity and limitations or limits on the nature and scope of activities they perform are the focus of level controls.

administrative

In an IT environment, a chain of evidence and documentation known as a(n) _________ _________ does not exist.

audit trail

Controls applied to specific business activities within an accounting information system to achieve financial reporting objectives are called controls.

automated application

Providing reasonable assurance that processing failures do not affect or delay the processing of other transactions is one objective of _ _controls.

computer operations

Computer operations controls are implemented for files and data used in processing with the major objectives of ensuring files ______. Multiple select question. can be reconstructed from earlier versions of processing information used in automated processing are appropriate are free from input and output errors are appropriately secured and protected from loss

can be reconstructed from earlier versions of processing information used in automated processing are appropriate are appropriately secured and protected from loss

Extra numbers tagged onto the end of basic ID numbers designed to detect coding or keying errors are called

check digits

Rotation of assigned tasks, proper supervision, and required vacations are all important controls when there is inadequate separation of duties.

compensating

"The science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media" is the FBI definition of

computer forensics

Impeaching a president, terrorist tracking and child pornographer prosecution have all been helped by

computer forensics

Having an appropriate disaster recovery plan to ensure files are secured and protected from loss is a major objective of _ _ controls

computer operations

Having an appropriate disaster recovery plan to ensure files are secured and protected from loss is a major objective of _____ _____ controls.

computer operations

Record counts, batch totals, hash totals and run-to-run totals should be calculated during processing operations and summarized in a(n) report.

control totals

Restrictions on access to input devices and standard screens and computer prompting are examples of controls in end-user computing environments.

data entry

In determining whether an audit team can rely on IT controls, auditors must determine the scope of the IT testing plan completed by carefully identifying each of the IT ____________

dependencies or dependency

Audit professionals generally categorize ___________ level controls as either general controls or application controls.

entity

Within a client's IT environment, there are essential, general IT controls that apply to all applications that are called _____ level controls.

entity

When computerized processing is used ______. Multiple choice question. transaction errors are virtually eliminated the auditor needs to be able to test for the occurrence of random errors errors will result in all similar transactions being processed incorrectly

errors will result in all similar transactions being processed incorrectly

The assessment process that needs to be undertaken for IT controls is ______ the assessment process that needs to be taken for manual controls.

essentially the same as

Whether the entity should purchase, develop or modify a system is determined during the analysis stage of the SDLC.

feasibility

A log that records time and use statistics for specific computer applications is an example of a(n) ______ control. Multiple choice question. authorization and approval data entry and formatting limit and reasonableness file and operator

file and operator

A safe and secure computing environment that allows the operating controls to operate effectively is provided by the ______ IT controls.

general

Controls that apply to all applications of an accounting information system are called ______ controls.

general

Totals that allow input errors to be detected prior to submission for processing but are not meaningful for accounting records are called totals.

hash

Controls that provide the opportunity for entity personnel to correct and resubmit data initially rejected as erroneous are called __ controls.

input

Controls that provide the opportunity for entity personnel to correct and resubmit data initially rejected as erroneous are called controls.

input

In an information technology environment, audit teams need to be concerned with ______ errors. Multiple select question. random processing input systematic processing

input systematic processing

Automated application controls are organized under three categories, _ controls, _ controls and _ controls.

input, processing, output

Compensating controls include ______. Multiple select question. investigation of excess computer usage required vacation separation of duties rotation of duties

investigation of excess computer usage required vacation rotation of duties

When scoping the IT audit procedures that need to be completed, auditors need to be concerned with ______ Multiple choice question. the full range of control activities implemented by management key control activities being relied on the mitigate the RMM only those control activities deemed important by the IT auditors

key control activities being relied on the mitigate the RMM

An important program development control is the entity's use of the systems development __ __ process.

life cycle

IT dependencies must be tested for ______. Multiple select question. purely manual control activities that do not rely on a system generated report manual control activities that rely on a system generated report entirely automated controls

manual control activities that rely on a system generated report entirely automated controls

Reasonable assurance that only authorized persons have access to files produced by the system is one concern of controls.

output

The most common form of control related to access is the use of ______.

passwords

Placing computer devices out of the way of casual traffic is an example of a(n) control.

physical

When evaluating tests of controls within an IT environment, auditors need to consider the ______. Multiple select question. possible occurrence of random errors possibility of temporary transactions trails potential for increased management supervision potential for errors and frauds

possibility of temporary transactions trails potential for increased management supervision potential for errors and frauds

Errors and frauds are kept from entering the system by controls.

prevention

Data comparisons and audit trails are examples of controls.

processing

Periodically testing and evaluating the accuracy of programs is the most fundamental control a client can implement.

processing

The objectives of _________ _________ controls parallel are to provide reasonable assurances regarding modifications to existing programs.

program change

Having reasonable assurance that appropriate users participate in the software acquisition process is an objective of _ _ controls.

program development

An important general control is the separation of duties performed by system analysts, ______ and ______ ______

programmers, computer operators

An individual knowledgeable about the nature or transactions and processing should perform an overall review of the output for

reasonableness

Which of the following is NOT a method of testing the operating effectiveness of controls? Multiple choice question. observation reconciliation reperformance inquiry inspection of documents

reconciliation

User entities may outsource specialized data processing to other companies referred to as

service organizations

Emergency change requests and the migration of new programs into operations, ______. Multiple select question. should occur within the SDLC process should be subject to standard approval procedures after they are made require appropriate documentation should be migrated by appropriate individuals

should be subject to standard approval procedures after they are made require appropriate documentation should be migrated by appropriate individuals

Data encryption, reasonableness checks and password software are examples of controls.

technical

The major phases that need to be completed in order to determine whether an audit team can rely on IT controls are ______ Multiple select question. discussing the IT controls with the manager in charge testing the IT controls understanding the IT controls and processes that need to be tested determining the scope of the IT testing plan by identifying each IT dependency

testing the IT controls understanding the IT controls and processes that need to be tested determining the scope of the IT testing plan by identifying each IT dependency

Multiple Choice Question One important difference in assessing control risk in an IT environment is in identifying ______. Multiple choice question. whether the design of control procedures suggest a low control risk the types of misstatements that can occur in significant accounting applications the points in the flow of transactions where misstatements could occur specific control procedures designed to prevent or detect misstatements

the points in the flow of transactions where misstatements could occur

The identification of IT applications and systems typically occurs during the _______ of each financial reporting process.

walkthrough