Power up P3

An IS auditor is assigned to audit a software development project which is more than 80 percent complete,

but has already overrun time by 10 percent and costs by 25 percent. Which of the following actions should

the IS auditor take?

• Report that the organization does not have effective project management

• Recommend the project manager be changed

• Review the IT governance structure

• Review the conduct of the project and the business case

Answer explanation

Before making any recommendations, an IS auditor needs to understand the project and the factors that have contributed to making the project over budget and over schedule. The organization may have effective project management practices and sound IT governance and still be behind schedule or over

budget. There is no indication that the project manager should be changed without looking into the reasons for the overrun.

Which of the following is the PRIMARY safeguard for securing software and data within an information

processing facility?

• Security awareness

• Reading the security policy

• Security committee

• Logical access controls

Answer explanation

To retain a competitive advantage and meet basic business requirements, organizations must ensure that the integrity of the information stored on their computer systems preserve the confidentiality of sensitive

data and ensure the continued availability of their information systems. To meet these goals, logical access controls must be in place. Awareness (choice A) itself does not protect against unauthorized access or

disclosure of information. Knowledge of an information systems security policy (choice B), which should be known by the organization's employees, would help to protect information, but would not prevent the unauthorized access of information. A security committee (choice C) is key to the protection of information

assets, but would address security issues within a broader perspective

Which of the following should an IS auditor review to understand project progress in terms of time, budget

and deliverables for early detection of possible overruns and for projecting estimates at completion

(EACs)?

• Function point analysis

• Earned value analysis

• Cost budget

• Program Evaluation and Review Technique

Answer explanation

Earned value analysis (EVA) is an industry standard method for measuring a project's progress at any

given point in time, forecasting its completion date and final cost, and analyzing variances in the schedule

and budget as the project proceeds. It compares the planned amount of work with what has actually been

completed, to determine if the cost, schedule and work accomplished are progressing in accordance with

the plan. EVA works most effectively if a well-formed work breakdown structure exists. Function point

analysis (FPA) is an indirect measure of software size and complexity and, therefore, does not address the

elements of time and budget. Cost budgets do not address time. PERT aids in time and deliverables

management, but lacks projections for estimates at completion (EACs) and overall financial management

A legacy payroll application is migrated to a new application. Which of the following stakeholders should be

PRIMARILY responsible for reviewing and signing-off on the accuracy and completeness of the data before

going live?

• IS auditor

• Database administrator

• Project manager

• Data owner

Answer explanation

During the data conversion stage of a project, the data owner is primarily responsible for reviewing and

signing-off that the data are migrated completely, accurately and are valid. An IS auditor is not responsible for reviewing and signing-off on the accuracy of the converted datA. However, an IS auditor should ensure that there is a review and sign-off by the data owner during the data conversion stage of the project. A database administrator's primary responsibility is to maintain the integrity of the database and make the database available to users. A database administrator is not responsible for reviewing migrated datA. A project manager provides day-to-day management and leadership of the project, but is not responsible for the accuracy and integrity of the data

Which of the following situations would increase the likelihood of fraud?

• Application programmers are implementing changes to production programs

• Application programmers are implementing changes to test programs

• Operations support staff are implementing changes to batch schedules

• Database administrators are implementing changes to data structures

Answer explanation

Production programs are used for processing an enterprise's datA. It is imperative that controls on changes

to production programs are stringent. Lack of control in this area could result in application programs being modified to manipulate the data.Application programmers are required to implement changes to test programs. These are used only in development and do not directly impact the live processing of data. The implementation of changes to batch schedules by operations support staff will affect the scheduling of the batches only

The purpose of a checksum on an amount field in an electronic data interchange (EDI) communication of financial transactions is to ensure:

• integrity.

• authenticity

• authorization

• nonrepudiation

Answer explanation

A checksum calculated on an amount field and included in the EDI communication can be used to identify unauthorized modifications. Authenticity and authorization cannot be established by a checksum alone and need other controls. Nonrepudiation can beensured by using digital signatures

To reduce the possibility of losing data during processing, the FIRST point at which control totals should be implemented is:

• in transit to the computer

• between related computer runs

• during data preparation

• during the return of the data to the user department

Electromagnetic emissions from a terminal represent an exposure because they:

• affect noise pollution

• disrupt processor functions

• produce dangerous levels of electric current

• can be detected and displayed

Answer explanation

Emissions can be detected by sophisticated equipment and displayed, thus giving unauthorized persons access to data. They should not cause disruption of CPUs or effect noise pollution.

Which of the following is the GREATEST risk when implementing a data warehouse?

• A. increased response time on the production systems

• B. Access controls that are not adequate to prevent data modification

• C. Data duplication

• D. Data that is not updated or current

Answer explanation

Here's why the other options are significant risks but not the most critical:

• A. Increased response time on production systems: This can be a concern, but data warehouses are typically designed to minimize impact on operational systems. Careful optimization and resource allocation can mitigate this risk.

• C. Data duplication: Data duplication can occur, but data cleansing techniques and proper data modeling can help minimize redundancy.

• D. Data that is not updated or current: Data warehousing processes should include procedures for regular data refreshes to ensure data timeliness. While delays can occur, inadequate access controls pose a more serious threat.

Which of the following is the GREATEST risk to the effectiveness of application system controls?

• Removal of manual processing steps

• inadequate procedure manuals

• Collusion between employees

• Unresolved regulatory compliance issues

Answer explanation

Here's why collusion is especially risky:

• Difficulty in detection: Collusion often involves deceitful actions that might be difficult to uncover through traditional control procedures.

• Potential for significant damage: Collusion can lead to major financial losses, reputational damage, or even legal repercussions for the organization.