Power up P2

The BEST method of proving the accuracy of a system tax calculation is by:

• A. detailed visual review and analysis of the source code of the calculation programs

• B. recreating program logic using generalized audit software to calculate monthly totals.

• C. preparing simulated transactions for processing and comparing the results to predetermined results.

• D. automatic flowcharting and analysis of the source code of the calculation programs.

Answer explanation

Simulating transactions allows the auditor to:

• Test various tax scenarios with known outcomes.

• Identify potential errors in the calculation process.

  • Verify the system handles different tax situations correctly.

This method provides a more practical and efficient way to assess the accuracy of the tax calculation system.

Which of the following online auditing techniques is most effective for the early detection of errors or irregularities?

• A. Embedded audit module

• B. Integrated test facility

• C. Snapshots

• D. Audit hooks

Answer explanation

The audit hook technique involves embedding code in application systems for the examination of selected

transactions. This helps an IS auditor to act before an error or an irregularity gets out of hand. An

embedded audit module involves embedding specially-written software in the organization's host

application system so that application systems are monitored on a selective basis. An integrated test facility

is used when it is not practical to use test data, and snapshots are used when an audittrail is required.

When assessing the design of network monitoring controls, an IS auditor should FIRST review network:

• A. topology diagrams.

• B. bandwidth usage.

• C. traffic analysis reports.

• D. bottleneck locations.

Answer explanation

The first step in assessing network monitoring controls should be the review of the adequacy of network

documentation, specifically topology diagrams. If this information is not up to date, then monitoring

processes and the ability to diagnose problems will not be effective.

The rate of change in technology increases the importance of:

• outsourcing the IS function.

• implementing and enforcing good processes

• hiring personnel willing to make a career within the organization

• meeting user requirements

Answer explanation

Change requires that good change management processes be implemented and enforced. Outsourcing the IS function is not directly related to the rate of technological change. Personnel in a typical IS department are highly qualified and educated; usually they do not feel their jobs are at risk and are prepared to switch jobs frequently. Although meeting user requirements is important, it is not directly related to the rate of technological change in the IS environment

While conducting an audit, an IS auditor detects the presence of a virus. What should be the IS auditor's next step?

• A. Observe the response mechanism.

• B. Clear the virus from the network.

• C. Inform appropriate personnel immediately.

• D. Ensure deletion of the virus.

Answer explanation

The first thing an IS auditor should do after detecting the virus is to alert the organization to its presence,

then wait for their response. Choice A should be taken after choice C. This will enable an IS auditor to

examine the actual workability and effectiveness of the response system. An IS auditor should not make changes to the system being audited, and ensuring the deletion of the virus is a management

responsibility.

When performing a computer forensic investigation, in regard to the evidence gathered, an IS auditor should be MOST concerned with:

• A. analysis.

• B. evaluation.

• C. preservation.

• D. disclosure.

Answer explanation

Preservation and documentation of evidence for review by law enforcement and judicial authorities are of primary concern when conducting an investigation. Failure to properly preserve the evidence could jeopardize the acceptance of the evidence in legal proceedings. Analysis, evaluation and disclosure are important but not of primary concern in a forensic investigation.

An IS auditor interviewing a payroll clerk finds that the answers do not support job descriptions and documented procedures. Under these circumstances, the IS auditor should:

• A. conclude that the controls are inadequate.

• B. expand the scope to include substantive testing.

• C. place greater reliance on previous audits.

• D. suspend the audit.

Answer explanation

If the answers provided to an IS auditor's questions are not confirmed by documented procedures or job descriptions, the IS auditor should expand the scope of testing the controls and include additional substantive tests. There is no evidence that whatever controls might exist are either inadequate or

adequate. Placing greater reliance on previous audits or suspending the audit are inappropriate actions as

they provide no current knowledge of the adequacy of the existing controls.

An IS auditor issues an audit report pointing out the lack of firewall protection features at the perimeter

network gateway and recommends a vendor product to address this vulnerability. The IS auditor has failed

to exercise:

• A. professional independence

• B. organizational independence.

• C. technical competence.

• D. professional competence.

A poor choice of passwords and transmission over unprotected communications lines are examples of:

• vulnerabilities.

• threats

• probabilities

• impacts

Answer explanation

Vulnerabilities represent characteristics of information resources that may be exploited by a threat. Threats are circumstances or events with the potential to cause harm to information resources. Probabilities represent the likelihood of the occurrence of a threat, while impacts represent the outcome or result of a threat exploiting a vulnerability

A benefit of open system architecture is that it:

• facilitates interoperability

• facilitates the integration of proprietary components

• will be a basis for volume discounts from equipment vendors

• allows for the achievement of more economies of scale for equipment

Answer explanation

Open systems are those for which suppliers provide components whose interfaces are defined by public

standards, thus facilitating interoperability between systems made by different vendors. In contrast, closed

system components are built to proprietary standards so that other suppliers' systems cannot or will not

interface with existing systems