Auditing: Chapter 11

60) Which of the following is not an example of an applications control? A) Back-up of data is made to a remote site for data security. B) There are reasonableness tests for the unit selling price of a sale. C) After processing, all sales transactions are reviewed by the sales department. D) There is a preprocessing authorization of the sales transactions.

A) Back-up of data is made to a remote site for data security.

14) The internal control framework used by most U.S. companies is the ________ framework. A) COSO B) FASB C) PCAOB D) SEC

A) COSO

75) ________ is the information technology and internal control processes an organization has in place to protect computers, networks, programs, and data from unauthorized access. A) Cybersecurity B) A firewall C) Encryption D) A processing control

A) Cybersecurity

30) Which of the following is correct with respect to the design and use of business documents? A) Documents should be prenumbered consecutively to facilitate control over missing documents. B) Documents should be designed for a single purpose to avoid confusion in their use. C) Documents should be designed to be understandable only by those who use them. D) The documents should be in paper format.

A) Documents should be prenumbered consecutively to facilitate control over missing documents.

24) Which of the following is most correct regarding the requirements under Section 404 of the Sarbanes-Oxley Act? A) The audits of internal control and the financial statements provide reasonable assurance as to misstatements. B) The audits of internal control and the financial statements provide absolute assurance as to misstatements. C) The audit of financial statements provides absolute assurance of misstatement. D) The audit of internal control provides absolute assurance of misstatement.

A) The audits of internal control and the financial statements provide reasonable assurance as to misstatements.

29) Authorizations can be either general or specific. Which of the following is not an example of a general authorization? A) a sales managerʹs authorization for a sales return B) credit limits for various classes of customers C) a sales price list for merchandise D) automatic reorder points for raw materials inventory

A) a sales managerʹs authorization for a sales return

77) A database management system A) allows clients to create databases that include information that can be shared across multiple applications. B) stores data on different files for different purposes, but always knows where they are and how to retrieve them. C) allows quick retrieval of data, but it needs to update files continually. D) allows quick retrieval of data, but at a cost of inefficient use of file space.

A) allows clients to create databases that include information that can be shared across multiple applications.

1) Which of the following is not one of the three primary objectives of effective internal control? A) assurance of elimination of business risk B) reliability of financial reporting C) efficiency and effectiveness of operations D) compliance with laws and regulations

A) assurance of elimination of business risk

17) When considering internal controls, A) auditors are concerned with the clientʹs internal controls over the safeguarding of assets if they affect the financial statements. B) companies must use the COSO framework to establish internal controls. C) auditors can ignore controls affecting internal management information. D) management is responsible for understanding and testing internal control over financial reporting.

A) auditors are concerned with the clientʹs internal controls over the safeguarding of assets if they affect the financial statements.

46) The ________ is helpful in preventing classification errors if it accurately describes which type of transaction should be in each account. A) chart of accounts B) trial balance C) general ledger D) general journal

A) chart of accounts

3) Internal controls A) consist of policies and procedures designed to provide reasonable assurance that the company achieves its objectives and goals. B) are implemented by and are the responsibility of the auditors. C) only apply to SEC companies. D) guarantee that the company complies with all laws and regulations.

A) consist of policies and procedures designed to provide reasonable assurance that the company achieves its objectives and goals.

71) In an IT system, automated equipment controls or hardware controls are designed to A) detect and control errors arising from the use of equipment. B) monitor and detect errors in source documents. C) arrange data in a logical sequential manner for processing purposes. D) correct errors in the computer programs.

A) detect and control errors arising from the use of equipment.

72) If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll IT application? A) employee numbers B) total hours worked C) total debit amounts and total credit amounts D) gross wages earned

A) employee numbers

58) A control that relates to all parts of the IT system is called a(n) A) general control. B) universal control. C) systems control. D) applications control.

A) general control.

70) A(n) ________ total represents the summary total of codes from all records in a batch that do not represent a meaningful total. A) hash B) output C) financial D) record

A) hash

81) Rather than maintain an internal IT center, many companies outsource their basic IT functions such as payroll to an A) independent computer service center. B) internal control service provider. C) internal auditor. D) external general service provider.

A) independent computer service center.

12) When one material weakness is present at the end of the year, management of a public company must conclude that internal control over financial reporting is A) ineffective. B) inadequate. C) inefficient. D) insufficient.

A) ineffective.

63) Controls which are designed to assure that the information entered into the computer is authorized, complete, and accurate are called A) input controls. B) general controls. C) output controls. D) processing controls.

A) input controls.

41) If a company has an effective internal audit department, A) it can reduce external audit costs by providing direct assistance to the external auditors. B) the internal auditors can express an opinion on the fairness of the financial statements. C) their work cannot be used by the external auditors per PCAOB Standard 5. D) the internal auditors must be CPAs in order for the external auditors to rely on their work.

A) it can reduce external audit costs by providing direct assistance to the external auditors.

7) The PCAOB places responsibility for the reliability of internal controls over the financial reporting process on A) management. B) the companyʹs board of directors. C) the audit committee of the board of directors. D) the CFO and the independent auditors.

A) management.

78) When auditing a client who uses a database management system, the auditor is principally aware of elevated risk due to the fact that A) multiple users can access and update data files. B) the database administrator may lack appropriate accounting knowledge. C) the accounting information is only in one place. D) multiple users could all access the data simultaneously causing a system shutdown.

A) multiple users can access and update data files.

76) The most important output control is A) review of data for reasonableness by someone who knows what the output should look like. B) control totals, which are used to verify that the computerʹs results are correct. C) distribution control, which assures that only authorized personnel receive the reports generated by the system. D) logic tests, which verify that no mistakes were made in processing.

A) review of data for reasonableness by someone who knows what the output should look like.

42) To promote operational efficiency, the internal audit department would ideally report to A) the audit committee. B) line management. C) the PCAOB. D) the Chief Accounting Officer.

A) the audit committee.

69) Which of the following best explains the relationship between general controls and application controls? A) General controls have no impact on application controls. B) Application controls are likely to be effective only when general controls are effective. C) Application controls are effective even if general controls are extremely weak. D) None of the above

B) Application controls are likely to be effective only when general controls are effective.

28) Which of the following statements is most correct with respect to separation of duties? A) Employees who authorize transactions should have recording responsibility for these transactions. B) Employees who authorize transactions should not have custody of related assets. C) A person who has temporary or permanent custody of an asset should account for that asset. D) Employees who open cash receipts should record the amounts in the subsidiary ledgers.

B) Employees who authorize transactions should not have custody of related assets.

83) ________ protect(s) the security of electronic communication when information is transmitted and when it is stored. A) Digital signatures B) Encryption C) A database D) Firewalls

B) Encryption

20) Which of the following is an accurate statement regarding the auditorʹs responsibility for understanding internal control? A) Auditors generally emphasize internal control over account balances rather than classes of transactions. B) Transaction-related audit objectives typically have no impact on the rights and obligations objectives. C) Transaction-related audit objectives typically have a significant impact on the balance-related audit objective of realizable value. D) Auditors and management are both equally concerned about controls that affect the efficiency and effectiveness of company operations.

B) Transaction-related audit objectives typically have no impact on the rights and obligations objectives.

10) Sarbanes-Oxley requires management to issue an internal control report that includes two specific items. Which of the following is one of these two requirements? A) a statement that management, the board of directors, and the external auditors are jointly responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting B) a statement that management is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting C) a statement that management and the board of directors are jointly responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting D) a statement that the external auditors are solely responsible for establishing and maintaining an adequate system of internal control

B) a statement that management is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting

37) It is important for the CPA to consider the competence of the clientsʹ personnel because their competence has a direct impact upon the A) timing of the tests to be performed. B) achievement of the objectives of internal control. C) comparison of recorded accountability with assets. D) cost/benefit relationship of the system of internal control.

B) achievement of the objectives of internal control.

19) The Sarbanes-Oxley Act requires A) the auditor of public companies to design effective internal controls. B) all public companies to issue reports on internal controls. C) the auditor of public companies to withdraw from an engagement if internal controls are weak. D) all public companies to define adequate internal controls.

B) all public companies to issue reports on internal controls.

53) Security controls should require that users enter a(n) ________ before being allowed access to software and other related data files. A) echo check B) authorized password C) parity check D) self-diagnosis test

B) authorized password

21) The primary emphasis by auditors is on controls over A) account balances. B) classes of transactions. C) both A and B, because they are equally important. D) both A and B, because they vary from client to client.

B) classes of transactions.

84) A(n) ________ is a computer resource deployment and procurement model that enables an organization to obtain IT resources and applications from any location via an Internet connection. A) local area network B) cloud computing environment C) application service provider D) firewall

B) cloud computing environment

6) Two key concepts that underlie managementʹs design and implementation of internal control are A) collusion and materiality. B) inherent limitations and reasonable assurance. C) absolute assurance and costs. D) costs and materiality.

B) inherent limitations and reasonable assurance.

23) Reasonable assurance allows for A) moderate likelihood that material misstatements will not be prevented or detected by internal control. B) low likelihood that material misstatements will not be prevented or detected by internal controls. C) high likelihood that material misstatements will not be prevented or detected by internal control. D) no likelihood that material misstatements will not be prevented or detected by internal control.

B) low likelihood that material misstatements will not be prevented or detected by internal controls.

47) Old and new systems operating simultaneously in all locations is a test approach known as A) horizontal testing. B) parallel testing. C) pilot testing. D) integrative testing.

B) parallel testing.

74) Which of the following is not a general control? A) separation of IT duties B) processing controls C) systems development D) hardware controls

B) processing controls

11) When management is evaluating the design of internal control, management evaluates whether the control can do which of the following? A) (Detect material misstatements) (Correct material misstatements) (No) (Yes) B) (Detect material misstatements) (Correct material misstatements) (No) (No) C) (Detect material misstatements) (Correct material misstatements) (Yes) (No) D) (Detect material misstatements) (Correct material misstatements) (Yes) (Yes)

C) (Detect material misstatements) (Correct material misstatements) (Yes) (No)

27) Which of the following factors may increase risks to an organization? A) (Geographic dispersion of company operations) (Presence of new information technologies) (No) (Yes) B) (Geographic dispersion of company operations) (Presence of new information technologies) (No) (No) C) (Geographic dispersion of company operations) (Presence of new information technologies) (Yes) (Yes) D) (Geographic dispersion of company operations) (Presence of new information technologies) (Yes) (No)

C) (Geographic dispersion of company operations) (Presence of new information technologies) (Yes) (Yes)

61) Which of the following is not a general control? A) There are adequate program run instructions for operating the computer. B) Equipment failure causes error messages on monitor. C) Computer performed validation tests of input accuracy. D) There is a separation of duties between programmer and operators.

C) Computer performed validation tests of input accuracy.

80) What tools do companies use to limit access to sensitive company data? A) Encryption techniques/ Digital signatures/ Firewall Yes/ Yes/ No B) Encryption techniques/ Digital signatures/ Firewall Yes/ No/ No C) Encryption techniques/ Digital signatures/ Firewall Yes/ Yes/ Yes D) Encryption techniques/ Digital signatures/ Firewall No/ Yes/ Yes

C) Encryption techniques/ Digital signatures/ Firewall Yes/ Yes/ Yes

35) Which of the following is not an underlying principle related to risk assessment? A) The organization should consider the potential for fraudulent behavior. B) The organization should monitor changes that could impact internal controls. C) The auditors should determine how the companyʹs risks should be managed. D) The organization should have clear objectives in order to be able to identify and assess the risks relating to the objectives.

C) The auditors should determine how the companyʹs risks should be managed.

4) Internal controls are not designed to provide reasonable assurance that A) transactions are executed in accordance with managementʹs authorization. B) the companyʹs resources are used efficiently and effectively. C) all frauds will be detected. D) company personnel comply with applicable rules and regulations.

C) all frauds will be detected.

59) Controls that are designed for each software application and are intended to help a company satisfy the transaction-related audit objectives are A) general controls. B) audit controls. C) application controls. D) user controls.

C) application controls.

34) Which of the following is a risk assessment principle? A) use relevant, quality information to support the functioning of internal controls B) accountability C) consider the potential for fraud D) develop general controls over technology

C) consider the potential for fraud

39) Without an effective ________, the other components of the COSO framework are unlikely to result in effective internal control, regardless of their quality. A) risk assessment policy B) system of control activities C) control environment D) monitoring policy

C) control environment

52) A ________ is responsible for controlling the use of computer programs, transaction files and other computer records and documentation and releases them to the operators only when authorized. A) software engineer B) data control operator C) librarian D) chief computer operator

C) librarian

73) Which of the following is not an application control? A) reasonableness test for unit selling price of sale B) post-processing review of sales transactions by the sales department C) logging in to the companyʹs information systems via a password D) reprocessing authorization of sales transactions

C) logging in to the companyʹs information systems via a password

25) Which of the following activities would be least likely to strengthen a companyʹs internal control? A) carefully selecting and training employees B) separating accounting from other financial operations C) maintaining insurance for fire and theft D) fixing responsibility for the performance of employee duties

C) maintaining insurance for fire and theft

32) Which of the following deals with ongoing or periodic assessment of the quality of internal control by management? A) oversight activities B) verifying activities C) monitoring activities D) management activities

C) monitoring activities

68) An internal control deficiency occurs when computer personnel A) provide physical security over program files. B) participate in computer software acquisition decisions. C) originate changes in customer master files. D) design flowcharts and narratives for computerized systems.

C) originate changes in customer master files

50) General controls include all of the following except A) hardware controls. B) systems development. C) processing controls. D) online security.

C) processing controls.

2) With which of managementʹs assertions with respect to implementing internal controls is the auditor primarily concerned? A) efficiency of operations B) effectiveness of operations C) reliability of financial reporting D) compliance with applicable laws and regulations

C) reliability of financial reporting

5) Who is responsible for establishing a private companyʹs internal control? A) audit committee B) FASB C) senior management D) internal auditors

C) senior management

67) Controls specific to IT include all of the following except for A) pull-down menu lists. B) validation tests of input accuracy. C) separation of duties. D) adequately designed input screens.

C) separation of duties.

22) An auditor should consider two key issues when obtaining an understanding of a clientʹs internal controls. These issues are A) the implementation and operating effectiveness of the controls. B) the effectiveness and efficiency of the controls. C) the design and operating effectiveness of the controls. D) the frequency and effectiveness of the controls.

C) the design and operating effectiveness of the controls

31) Which of the following best describes the purpose of control activities? A) activities that deal with the ongoing assessment of the quality of internal control by management B) the identification and analysis of risks relevant to the preparation of financial statements C) the policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entityʹs objectives D) the actions, policies and procedures that reflect the overall attitudes of management

C) the policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entityʹs objectives

13) The auditors primary purpose in auditing the clientʹs system of internal control over financial reporting is A) to efficiently conduct the Audit of Financial Statements. B) to prevent fraudulent financial statements from being issued to the public. C) to evaluate the effectiveness of the companyʹs internal controls over all relevant assertions in the financial statements. D) to report to management that the internal controls are effective in preventing misstatements from appearing on the financial statements.

C) to evaluate the effectiveness of the companyʹs internal controls over all relevant assertions in the financial statements.

82) When the auditor is obtaining an understanding of the independent computer service centerʹs internal controls, the auditor should A) use different criteria because the service center resides outside the company. B) use the same criteria used to evaluate the clientʹs internal controls but omit tests of transactions. C) use the same criteria used to evaluate the clientʹs internal controls. D) use different criteria for the service center by including substantive tests of balances.

C) use the same criteria used to evaluate the clientʹs internal controls.

49) Which of the following statements related to application controls is correct? A) Application controls relate to various aspects of the IT function including physical security and the processing of transactions in various cycles. B) Application controls relate to various aspects of the IT function including software acquisition and the processing of transactions. C) Application controls relate to all aspects of the IT function. D) Application controls relate to the processing of individual transactions.

D) Application controls relate to the processing of individual transactions

18) Of the following statements about internal controls, which one is least likely to be correct? A) Transactions must be properly authorized before such transactions are processed. B) Because of the cost-benefit relationship, a client may apply controls on a test basis. C) No one person should be responsible for the custodial responsibility and the recording responsibility for an asset. D) Control procedures reasonably ensure that collusion among employees cannot occur.

D) Control procedures reasonably ensure that collusion among employees cannot occur.

8) Which of the following parties provides an assessment of the effectiveness of internal control over financial reporting for public companies? A) Management/ Financial statement auditors No/ Yes B) Management/ Financial statement auditors Yes/ No C) Management/ Financial statement auditors No/ No D) Management/ Financial statement auditors Yes/Yes

D) Management/ Financial statement auditors Yes/Yes

33) Which of the following best describes an entityʹs accounting information and communication system? A) Monitor transactions/ Record and process transactions/ Initiate transactions Yes/ Yes/ Yes B) Monitor transactions/ Record and process transactions/ Initiate transactions Yes/ No/ No C) Monitor transactions/ Record and process transactions/ Initiate transactions No/ No/ No D) Monitor transactions/ Record and process transactions/ Initiate transactions No/ Yes/ Yes

D) Monitor transactions/ Record and process transactions/ Initiate transactions No/ Yes/ Yes

56) When purchasing software or developing in-house software, A) cost should be the only factor. B) the librarian and the IT manager should be the only ones involved in the decision process. C) extensive testing of the software is generally not required. D) a team of both IT and non-IT personnel should be involved in the decision process.

D) a team of both IT and non-IT personnel should be involved in the decision process.

36) Which of the following is not one of the subcomponents of the control environment? A) managementʹs philosophy and operating style B) commitment to competence C) organizational structure D) adequate separation of duties

D) adequate separation of duties

40) Which of the following is an accurate statement regarding control activities? A) The most important type of protective measure for safeguarding assets and records is the us of physical precautions. B) As the level of complexity of IT systems increases, the separation of duties often becomes blurred. C) Segregation of duties would be violated if the same person authorizes the payment of a vendorʹs invoice and also approves the disbursement of funds to pay the bill. D) all of the above

D) all of the above

44) External financial statement auditors must obtain evidence regarding what attributes of an internal audit (IA) department if the external auditors intend to rely on IAʹs work? A) objectivity B) competence C) integrity D) all of the above

D) all of the above

54) Typical controls developed for manual systems which are still important in IT systems include A) competent personnel. B) managementʹs authorization of transactions. C) adequate preparation of input source documents. D) all of the above.

D) all of the above.

38) Proper segregation of functional responsibilities calls for separation of A) authorization, execution, and payment. B) custody, execution, and reporting. C) authorization, payment, and recording. D) authorization, recording, and custody.

D) authorization, recording, and custody.

48) Which of the following is a component of general controls? A) processing controls B) input controls C) output controls D) back-up and contingency planning

D) back-up and contingency planning

9) An act of two or more employees to steal assets and cover their theft by misstating the accounting records would be referred to as A) a control deficiency. B) a significant deficiency. C) a material weakness. D) collusion.

D) collusion.

16) Internal controls can never be regarded as completely effective. Even if company personnel could design an ideal system, its effectiveness depends on the A) proper implementation by management. B) ability of the internal audit staff to maintain it. C) adequacy of the computer system. D) competency and dependability of the people using it.

D) competency and dependability of the people using it.

65) Which of the following tests determines that every field in a record has been completed? A) programming B) sequence C) validation D) completeness

D) completeness

57) Output controls need to be designed for which of the following data integrity objectives? A) preventing errors in separation of duties for IT personnel B) preventing errors before the processing is completed C) detecting errors in the general ledger adjustment process D) detecting errors after the processing is completed

D) detecting errors after the processing is completed

62) Controls which are built in by the manufacturer to detect equipment failure are called A) data integrity controls. B) manufacturerʹs controls. C) input controls. D) hardware controls.

D) hardware controls.

64) When dealing with the administration of the IT function and the segregation of IT duties A) programmers should investigate all security breaches. B) in large organizations, management should assign technology issues to outside consultants. C) the board of directors should not get involved in IT decisions since it is a routine function handled by middle management. D) in complex environments, management may establish IT steering committees.

D) in complex environments, management may establish IT steering committees.

45) To obtain an understanding of an entityʹs control environment, an auditor should concentrate on the substance of managementʹs policies and procedures rather than their form because A) the board of directors may not be aware of managementʹs attitude toward the control environment. B) the policies and procedures may be so weak that no reliance is contemplated by the auditor. C) the auditor may believe that the policies and procedures are inappropriate for that particular entity. D) management may establish appropriate policies and procedures but not act on them.

D) management may establish appropriate policies and procedures but not act on them.

26) Which of the following components of the control environment define the existing lines of responsibility and authority? A) management integrity and ethical values B) human resource policies and practices C) management philosophy and operating style D) organizational structure

D) organizational structure

51) Which of the following describes the process of implementing a new system in one part of the organization, while other locations continue to use the current system? A) parallel testing B) online testing C) control testing D) pilot testing

D) pilot testing

43) Hanlon Corp. maintains a large internal audit staff that reports directly to the accounting department. Audit reports prepared by the internal auditors indicate that the system is functioning as it should and that the accounting records are reliable. An independent auditor will probably A) increase the depth of the study and evaluation of administrative controls. B) avoid duplicating the work performed by the internal audit staff. C) eliminate tests of controls. D) place limited reliance on the work performed by the internal audit staff.

D) place limited reliance on the work performed by the internal audit staff.

55) Which of the following controls prevent and detect errors while transaction data are processed? A) software B) transaction C) application D) processing

D) processing

15) In performing the audit of internal control over financial reporting, the auditor emphasizes internal control over classes of transactions because A) the class of transaction is where most fraud schemes occur. B) account balances are less important to the auditor then the changes in the account balances. C) classes of transactions tests are the most efficient manner to compensate for inherent risk. D) the accuracy of accounting system outputs depends heavily on the accuracy of inputs and processing.

D) the accuracy of accounting system outputs depends heavily on the accuracy of inputs and processing.

66) An example of a physical control is A) a hash total. B) the use of backup generators to prevent data loss during power outages. C) a parallel test. D) the matching of employee fingerprints to a database before access to the system is allowed.

D) the matching of employee fingerprints to a database before access to the system is allowed.

79) Firewalls are used to protect from A) illogical programming commands. B) insufficient documentation of transactions. C) erroneous internal handling of data. D) unauthorized external users.

D) unauthorized external users.