Font size
WorksheetsENTPLAN 105
Total questions: 105
Worksheet time: 53mins
An IT environment requires the use of supercomputers in processing financial information to exist.
TRUE
FALSE
The IT environment still exists even if it is being outsourced by the organization from a third-party vendor.
TRUE
FALSE
The CPU cannot operate without the support of a solid-state memory known as random access memory (RAM).
TRUE
FALSE
E-commerce allows the conduct of electronic business transactions over the public internet as compared to an electronic data interchange (EDI) that is a non-internet based private network.
TRUE
FALSE
Application software are programs designed for specific purposes and may work independently without the operating system.
TRUE
FALSE
One of the disadvantages of a database system is the lack of data synchronization which leads to multiple versions of the same file.
TRUE
FALSE
Cloud accounting software offers greater flexibility to its users as financial information is hosted offline which is accessible through an internet browser.
TRUE
FALSE
Under a complex IT environment, transactions are initiated and produced in an electronic format which results to physical visibility of transaction trails.
TRUE
FALSE
Through Online or Real-time (OLRT) processing, a large volume of data collected over time is now processed at the same time.
TRUE
FALSE
Due to the high level of complexity of IT environments of large organizations, reliance on complex IT controls is not adopted.
TRUE
FALSE
For good internal control, programmers should not be given access to complete program documentation for the programs they work on.
TRUE
FALSE
Distributive data processing eliminates the need for data security.
TRUE
FALSE
Most advanced computer systems do not have audit trails.
TRUE
FALSE
Auditors usually begin their consideration of IT systems with tests of application controls.
TRUE
FALSE
Generalized audit software may be used for substantive tests or for tests of controls.
TRUE
FALSE
Auditing around the computer is a more appropriate approach to audit simple IT environments.
TRUE
FALSE
When evaluating IT controls, it is suggested to evaluate application controls first as these are vital to complete and accurate financial reporting.
TRUE
FALSE
Monitoring the IT environment may executed either through predetermined performance measures or through separate evaluations.
TRUE
FALSE
Data encryption secures information through an algorithm known as a cipher which converts data into characters unreadable by humans, called ciphertext.
TRUE
FALSE
System software controls are IT application controls over the effective selection, acquisition, implementation, and maintenance of system software.
TRUE
FALSE
Due to the rapid changes in the IT environment of entities, the overall objective and scope of the auditor also changed to address these advancements.
TRUE
FALSE
The understanding required over a company's information system is confined to the aspects of such system relating to information disclosed in the financial statements which are found within the general and subsidiary ledgers.
TRUE
FALSE
When the work of an IT specialist is required for purposes of the audit, the auditor shall assess the adequacy of such work and whether the specialist is competent, capable, and objective.
TRUE
FALSE
Under the black-box approach, the internal structures or workings of the system are ignored.
TRUE
FALSE
CAATs are widely used as they provide detailed analysis of system configurations and workings while saving time and cost.
TRUE
FALSE
Test data utilizes the client system to process both valid and invalid transactions that allows the auditor to check if controls are functioning effectively.
TRUE
FALSE
Parallel simulation uses the client system to process data prepared by the auditor for comparison to the auditor's expected outcome.
TRUE
FALSE
System control audit review file (SCARF) are audit software modules in a host application system that allows for continuous monitoring and data collection stored in a special audit file called SCARF master files.
TRUE
FALSE
Generalized audit software may be used to execute tests of controls over IT and manual controls but not for substantive testing.
TRUE
FALSE
Expertise in the specific features and functions of computerized audit tools is required to effectively perform auditing with the computer.
TRUE
FALSE
An IT environment least likely affects
The procedures followed by the auditor in obtaining a sufficient understanding of the accounting and internal control systems.
The consideration of inherent risk and control risk through which the auditor arrives at the risk assessment.
The auditor's design and performance of tests of control and substantive procedures appropriate to meet the audit objective.
The overall objective and scope of an audit.
An IT environment
Consists of the policies and procedures that the entity implements and the IT infrastructure (hardware, operating systems, etc.) and application software that it uses to support business operations and achieve business strategies.
Exists when a computer of any type or size is involved in the processing by the entity of financial information of significance to the audit, whether that computer is operated by the entity or by a third party.
Is the electronic transmission of documents between organizations in a machine-readable form.
A communications network that serves users within a confined geographical area.
Which of the following statements is not correct?
The overall objective and scope of an audit do not change in an IT environment
When computers or IT are introduced, the basic concept of evidence accumulation remains the same
Most IT rely extensively on the same type of procedures for control that are used in manual processing system
The specific methods appropriate for implementing the basic auditing concepts do not change, as systems become more complex
Which of the following characteristics distinguishes computer processing from manual processing?
Computer processing virtually eliminates the occurrence of computational error normally associated with manual processing.
Errors or fraud in computer processing will be detected soon after their occurrences.
The potential of systematic error is ordinarily greater in manual processing than in computerized processing.
Most computer systems are designed so that transaction trails useful for audit purposes do not exist.
The development of CIS will generally result in design and procedural characteristics that are different from those found in manual systems. These different design and procedural aspects of CIS include, except:
Consistency of performance.
Programmed control procedures.
Vulnerability of data and program storage media
Multiple transaction update of multiple computer files or databases.
RIAN, Inc. recently switched from a manual accounting system to a computerized accounting system. The system supports online, real-time processing in a networked environment and six employees have been granted access to various parts of the system in order to perform their jobs. Relative to the manual system, ABC can expect to see:
That functions that had previously been spread across employees have been combined.
An increase in the incidence of clerical errors.
A decrease in the incidence of systemic errors.
A decrease in the need for access controls to the accounting records.
A manufacturing company that wanted to be able to place material orders more efficiently most likely would utilize which of the following?
Electronic check presentment
Automated clearinghouse
Electronic data interchange
Electronic funds transfer
Audit objectives in the Electronic Data Interchange (EDI) environment include all of the following except
A complete audit trail of EDI transactions is maintained
All EDI transactions are authorized
Backup procedures are in place and functioning properly
Unauthorized trading partners cannot gain access to database records
What controls are designed to ensure that an organization's computer-based control environment is stable and well managed?
General controls
Detective controls
Application controls
Preventive controls
General controls relate to all computer activities and application controls relate to specific tasks. General controls include
Controls designed to assure that all data submitted for processing has been properly authorized
Controls designed to assure the accuracy of the processing results
Controls for documenting and approving software and changes to software
Controls that relate to the correction and resubmission of data that were initially incorrect
The primary objective of security software is to
Control access to information system resources.
Restrict access to prevent installation of unauthorized utility software.
Detect the presence of viruses.
Monitor the separation of duties within applications.
Preventing someone with sufficient technical skill from circumventing security procedures and making changes to production programs is best accomplished by
Reviewing report of jobs completed
Comparing production programs with independently controlled copies
Running test data periodically
Providing suitable segregation of duties
Which of the following is not a purpose of an auditor's attempt to understand internal control when a client processes accounting information by computer?
Determine the extent to which the computer is used in significant accounting applications.
Understand the flow of transactions in the system.
Comprehend the basic structure of accounting control.
Identify the controls that can be relied on when designing substantive tests of details.
Which of the following is likely to be of least importance to an auditor when assessing control risk in a company that processes data by computer?
The segregation of duties within the computer department.
The control over source documents.
The documentation maintained for accounting applications.
The cost-benefit ratio of data processing operations.
RIEL Corporation has numerous customers. A customer file is kept on disk. Each customer file contains the name, address, credit limit, and account balance. The auditor wishes to test this file to determine whether credit limits are being exceeded. The best procedure for the auditor to follow would be to
Develop test data that would cause some account balances to exceed the credit limit and determine if the system properly detects such situations.
Develop a program to compare credit limits with account balances and print out the details of any account with a balance exceeding its credit limit.
Request a printout of all account balances so they can be manually checked against the credit limits.
Request a printout of a sample of account balances so they can be individually checked against the credit limits.
in considering a client's internal control structure in a computer environment, the auditor will encounter general controls and application controls. Which of the following is an application control? A. Organization charts. C. Systems flowcharts. B. Hash total. D. Control over program changes.
Organization charts.
Hash total.
Systems flowcharts
Control over program changes.
MS Windows, Ubuntu and Mac OS are examples of A. Application software. C. Database management systems. B. Generalized audit software. D. Operating software.
Application software.
Generalized audit software.
Database management systems.
Operating software.
When software or files can be accessed from on-line servers, users should be required to enter A. A parity check. C. A self-diagnosis test. B. A personal identification code. D. An echo check.
A parity check.
A personal identification code.
A self-diagnosis test.
An echo check.
A control feature requires the computer to send signals to the printer to activate the print mechanism for each character. The print mechanism, just prior to printing, sends a signal back to the computer verifying that the proper print position has been activated. This type of hardware control is referred to as a/an
Echo check.
Validity check.
Signal check.
Check digit.
Which of the following is a software component of a computer system?
The operating system.
The storage unit.
The display monitor.
The optical scanner.
An example of an access control is a:
Check digit.
Password
Test facility.
Read only memory.
End-user computing is most likely to occur on which of the following types of computers?
Mainframe
Macrocomputers.
Personal computers
Personal reference assistants
If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll computer application?
Net pay
Department numbers
Hours worked
Total debits and total credit
Online computer system uses workstation or terminals that are located either locally or at remote sites. There are two types of workstations: general purpose terminals and special purpose terminals. General purpose terminals include the following, except A. Basic keyboard and monitor C. Point of sale devices B. Intelligent terminal D. Personal computers
Basic keyboard and monitor
Intelligent terminal
Point of sale devices
Personal computers
The grandfather-father-son approach to providing protection for important computer files is a concept that is most often found in
On-line, real-time systems
Punched-card systems
Magnetic tape systems
Magnetic drum systems
What type of computer system is characterized by data that are assembled from more than one location and records that are updated immediately?
Microcomputer system
Minicomputer system
Batch processing system
On-line-real-time system
A collection of data that is shared and used by a number of different users for different purposes.
Database
Information file
Master file
Transaction file
It is a communication system that enables computer users to share computer equipment, application software, data and voice and video transmissions.
Network
File server
Host
Client
Which of the following is least likely a characteristic of Wide Area Network (WAN)?
Created to connect two or more geographically separated LANs.
Typically involves one or more long-distance providers, such as a telephone company to provide the connections.
WAN connections tend to be faster than LAN.
Usually more expensive than LAN.
Gateway is
A hardware and software solution that enables communications between two dissimilar networking systems or protocols.
A device that forwards frames based on destination addresses.
A device that connects and passes packets between two network segments that use the same communication protocol.
A device that regenerates and retransmits the signal on a network.
An auditor would least likely use computer software to
Prepare spreadsheets
Access client data files
Assess computer control risk
Construct parallel simulations
Which of the following would an auditor would most likely use in obtaining an understanding of internal control?
Program listings
Record counts
Record layouts
System flowcharts
Which of the following is not a major reason for maintaining an audit trail for a computer system?
Deterrent to fraud
Monitoring purposes
Analytical procedures
Query answering
When obtaining an understanding of the significance and complexity of the IT environment, the auditor may use automated tools and techniques. Examples of procedures that may be performed include (choose the exception): A. Perform risk assessment procedures on large volumes of data including for analysis, recalculations, reperformance or reconciliations. Perform analytical procedures. C. Observe or inspect, in particular assets, for example through the use of remote observation tools. D. Design of further audit procedures.
Perform risk assessment procedures on large volumes of data including for analysis, recalculations, reperformance or reconciliations.
Perform analytical procedures.
Observe or inspect, in particular assets, for example through the use of remote observation tools.
Design of further audit procedures.
Evaluate the following clients as the approach you will take in understanding (or testing) the system: I. Airline company; system is always online II. Law firm; processing is by batch A. white box; white box C. brown box; white box B. black box; black box D. white box; black box
white box; white box
black box; black box
brown box; white box
white box; black box
If the inherent risk due to information technology is high, which approach must an auditor undertake
Auditing around the computer
Auditing through the computer
Auditing with the computer
Auditing by the computer
The primary objective of procedures performed to obtain an understanding of internal control is to provide an auditor with
Evidential matter to use in reducing detection risk.
Knowledge necessary to plan the audit.
A basis from which to modify tests of controls.
Information necessary to prepare flowcharts.
Auditing by testing the input and output of a computer system-i.e., auditing "around" the computer-instead of the computer software itself will
Not detect program errors that do not appear in the output sampled.
Detect all program errors, regardless of the nature of the output.
Provide the auditor with the same type of evidence.
Not provide the auditor with confidence in the results of the auditing procedures.
Which of the following statements most likely represents a disadvantage for an entity that maintains computer data files rather than manual files?
It's usually more difficult to detect transposition errors.
Transactions are usually authorized before they are executed and recorded.
It's usually easier for unauthorized persons to access and alter the files.
Random error is more common when similar transactions are processed in different ways.
Which of the following statements best describes a weakness often associated with computers? A. Computer equipment is more subject to systems error than manual processing is subject to human error. B. Computer equipment processes and records similar transactions in a similar manner. C. Control activities for detecting invalid and unusual transactions are less effective than manual control activities. D. Functions that would normally be separated in a manual system are combined in a computer system.
Computer equipment is more subject to systems error than manual processing is subject to human error.
Computer equipment processes and records similar transactions in a similar manner.
Control activities for detecting invalid and unusual transactions are less effective than manual control activities.
Functions that would normally be separated in a manual system are combined in a computer system.
Which of the following procedures would an entity most likely include in its disaster recovery plan?
Convert all data from external formats to an internal company format.
Maintain a program to prevent illegal activity.
Develop an auxiliary power supply to provide uninterrupted electricity.
Store duplicate copies of files in a location away from the computer center.
Which of the following is a password security problem?
Users are assigned passwords when accounts are created, but do not change them.
Users have accounts on several systems with different passwords.
Users copy their passwords on note paper, which is kept in their wallets.
Users select passwords that are not listed in any online dictionary.
Which of the following personnel is responsible for the proper functioning of the security features built into the operating system?
The systems programmer.
The application programmer.
The computer operator.
The telecommunications specialist.
Which of the following computer related employees should not be allowed access to program listings of application programs?
The systems analyst.
The programmer.
The operator.
The librarian.
15. Which of the following would the auditors consider to be a weakness in an IT system?
Operators have access to terminals.
Programmers are allowed access to the file library.
Reprocessing of exceptions detected by the computer is handled by a data control group.
More than one employee is present when the computer facility is in use.
The advent of personal computers has resulted in a(n):
Decentralization of data processing activities.
Increased concern over the accuracy of computerized processing.
Decrease in the number of local area networks.
Increase for general computer control activities.
Assume that an auditor estimated that 10,000 checks were issued during the accounting period. If an application control that performs a limit check for each check request is to be subjected to the auditor's test-data approach, the sample should include:
Approximately 1,000 test items.
A number of test items determined by the auditor to be sufficient under the circumstances.
A number of test items determined by the auditor's reference to the appropriate sampling tables.
One transaction.
3. Accounting functions that are normally considered incompatible in a manual system are often combined by computer software. This necessitates an application control that prevents unapproved
Access to the computer library.
Revisions to existing software.
Usage of software.
Testing of modified software.
An auditor's consideration of a company's computer control activities has disclosed the following four circumstances. Indicate which circumstance constitutes a significant deficiency in internal control.
Computer operators do not have access to the complete software support documentation.
Computer operators are closely supervised by programmers.
Programmers are not authorized to operate computers.
Only one generation of backup files is stored in an off-premises
In a computer system, hardware controls are designed to A. Arrange data in a logical sequence for processing. B. Correct errors in software. C. Monitor and detect errors in source documents. D. Detect and control errors arising from use of equipment.
Arrange data in a logical sequence for processing.
Correct errors in software.
Monitor and detect errors in source documents.
Detect and control errors arising from use of equipment.
Which of the following is an example of general computer control? A. Input validation checks. C. Operations manual. B. Control total. D. Generalized audit software.
Input validation checks.
Control total.
Operations manual.
Generalized audit software.
Which of the following would be least likely to be considered a desirable attribute of a database management system?
Data redundancy.
Quick response to users' request for information.
Control of users' identification numbers and passwords.
Logging of terminal activity.
General controls over IT systems are typically tested using:
Generalized audit software.
Observation, inspection, and inquiry.
Program analysis techniques.
Test data.
Which of the following is not a distinctive characteristic of advanced IT systems?
Data communication.
Integrated database.
Batch processing of transactions.
Distributive data processing.
The best method of achieving internal control over advanced IT systems is through the use of:
Batch controls.
Controls written into the computer system.
Equipment controls.
Documentation controls.
In a client/server environment, the "client" is most likely to be the:
Supplier of the computer system.
Computers of various users.
Computer that contains the networks software and provides services to a server.
Database administrator.
Auditing through the computer is most likely to be used when:
Input transactions are batched and system logic is straightforward.
Processing primarily consists of sorting the input data and updating the master file sequentially.
Processing is primarily on line and updating is real-time.
Outputs are in hard copy form.
Which of the following computer system risks would be increased by the installation of a database system?
Programming errors.
Data entry errors.
Improper data access.
Loss of power.
Auditing by testing the input and output of a computer system instead of the computer program itself will:
Not detect program errors which do not show up in the output sampled.
Detect all program errors, regardless of the nature of the output.
Provide the auditors with the same type of evidence.
Not provide the auditors with the confidence in the results of the auditing procedures.
Which of the following is true of generalized audit software?
They can be used only in auditing on-line computer systems.
They can be used on any computer without modification.
They each have their own characteristics, which the auditor must carefully consider before using in a given audit situation.
They enable the auditor to perform all manual compliance test procedures less expensively.
1. Evaluate the following statements related to parallel simulation:
I. Parallel simulation is less costly to perform compared to test data approach
II. Parallel simulation uses the client's system with fictitious transactions
True, False
False, True
True, True
False, False
Which of the following is not an example of a computer-assisted audit technique?
Integrated test data.
Audit modules.
Disk operating systems.
Audit hooks.
What encryption method is used when RSA and DES are used together? A. Data envelope C. Data packet B. Digital envelope D. Digital packet
Data envelope
Digital envelope
Data packet
Digital packet
Which of the following methods of testing application controls utilizes software prepared by the auditors and applied to the client's data?
Parallel simulation.
Integrated test facility.
Test data.
Exception report tests.
The test-data method is used by auditors to test the A. Accuracy of input data. B. Validity of the output. C. Procedures contained within the program. D. Normalcy of distribution of test data.
Accuracy of input data.
Validity of the output.
Procedures contained within the program.
Normalcy of distribution of test data.
Which is true about test data approach?
The test deck must include all possible scenarios, regardless of materiality
The test deck must include scenarios of particular audit concern
Base case system evaluation is not particularly useful when subsequent application changes are made
No invalid date must be included in the test deck as this might the client's data integrity
An auditor most likely would introduce test data into a computerized payroll system to test controls related to the A. Existence of unclaimed payroll checks held by supervisors. B. Early cashing of payroll checks by employees. C. Discovery of invalid employee I.D. numbers. D. Proper approval of overtime by supervisors.
Existence of unclaimed payroll checks held by supervisors.
Early cashing of payroll checks by employees.
Discovery of invalid employee I.D. numbers.
Proper approval of overtime by supervisors.
Evaluate the following statements related to integrated test facility (ITF): I. IT audit modules can discriminate between ITF and production transactions Il. In IT dummy master files integrated with legitimate records A. True, False C. True, True B. False, True D. False, False
True, False
False, True
True, True
False, False
The test-data method is used by auditors to test the
Accuracy of input data.
Validity of the output.
Procedures contained within the program.
Normalcy of distribution of test data.
Parallel simulation programs used by the auditors for testing programs:
Must simulate all functions of the production computer-application system.
Cannot be developed with the aid of generalized audit software.
Can use live data or test data.
Is generally restricted to data base environments.
Which of the following testing techniques is more commonly used by internal auditors than by independent auditors?
Integrated test facilities.
Test data.
Controlled programs.
Tagging and tracing transactions.
Which of the following testing techniques minimizes the possibility that the auditors will contaminate a client's financial records?
Test data.
Integrated test facilities.
Integrated test facilities.
Tagging and tracing transactions.
An auditor who wishes to capture an entity's data as transactions are processed and continuously test the entity's computerized information system most likely would use which of the following techniques?
Snapshot application.
Embedded audit module.
Integrated data check.
Test data generator.
A log, usually created by an embedded audit module, used to collect information for subsequent review and analysis.
Audit hooks
Extended records
Systems control audit review files
Transaction tagging
This technique in essence "takes a picture" of the status of program execution, intermediate results, or transaction data at specified processing points in the program processing. This technique helps an auditor to analyze the processing logic of specific programs
Audit hooks
Snapshot
Systems control audit review files
Transaction tagging
