Deck 12: Information Technology Auditing

Question 1

Embedded audit modules or audit hooks are examples of continuous auditing techniques.

Answer 1

True

Question 2

A career in information technology auditing requires both specialized skills and a broad-based set of technical knowledge.

Answer 2

True

Question 3

An information systems risk assessment is as concerned with errors and accidents as it is with fraud.

Answer 3

True

Question 4

Normal transactions rather than exception transactions are of most interest to auditors.

Question 5

One problem with internal auditing is that it is akin to self-regulation i.e., the auditor cannot be impartial because both the auditor and the subsystem being audited work for the same company).

Question 6

The greatest advantage of an integrated test facility is that it enables an auditor to examine both manual and computerized steps companies take to process business transactions.

Question 7

The main objective of information technology auditing is to evaluate the IT's role in achieving audit and control objectives.

Question 8

An ideal program change control process includes required documentation of every request for application program changes as well as the use of a test environment for development and implementation of program changes.

Question 9

Certified Information System Auditors must have an accounting degree.

Question 10

An auditing around the computer approach pays little or no attention to the control procedures within an IT environment.

Question 11

In auditing through the computer, auditors will want to review systems software documentation.

Question 12

Both the internal audit and the external audit have the same primary objective i.e., to verify that the financial records of the company have been prepared according to generally accepted accounting principles).

Question 13

The Electronic Systems Assurance and Control model provides a framework for evaluating controls over email systems.

Question 14

The focus in an audit should be primarily on business risk rather than on internal control.

Question 15

Many of the assurance services auditors offer today involve information technology.

Question 16

Computer assisted audit techniques are used primarily when auditing around the computer.

Question 17

Use of test data is not recommended when evaluating integrated online systems.

Question 18

Public companies are required to adopt the Control Objectives for Information and Related Technology framework under SOX.

Question 19

If control procedures over a company's computerized financial accounting system are particularly strong, auditors will not need to perform any substantive testing.

Question 20

When the costs of protecting against a business risk exceed the cost of the risk multiplied by its probability, an auditor will generally recommend against installing the specific control.

Question 21

Which of the following is not one of the groups of SOX compliance requirements?

A)Requirements to use an IT auditor to evaluate controls
B)Regulations governing executive reporting and conduct
C)Rules about financial statement reporting
D)Audit committee/corporate governance requirements

Question 22

Information Technology IT)governance includes using IT responsibly and efficiently, but not necessarily strategically.

Question 23

The advantages of around-the-computer auditing include:

A)The emphasis which is placed on testing data processing exceptions
B)Use of live data
C)The minimal disturbance of a company's records
D)both b and c

Question 24

Section 404 of SOX requires that the information technology auditor "sign off" that the financial statements are reliable.

Question 25

The three conditions for fraud in the fraud triangle include incentive/pressure, rationalization, and opportunity.

Question 26

One purpose of generalized audit software packages is to enable an auditor to examine the contents of computer files of interest without having to write a computer program himself/herself.

Question 27

A computerized AIS is harder to audit than a manual system for all of the following reasons except:

A)The file information is not human readable
B)The volume of transaction records and master file records is usually much larger in computerized systems than in manual systems
C)An audit trail does not exist in a computerized AIS
D)Computerized systems often use remote real-time data processing, thus complicating the tracing of transaction records to their sources

Question 28

Information technology governance:

A)Is a component of IT auditing
B)Has one objective - to ensure that IT is used strategically to fulfill an organization's mission
C)Is intended to ensure both the strategic use of IT and control over IT resources
D)Is primarily intended to deter IT fraud

Question 29

CAS 240 - The Auditor's Responsibility Relating to Fraud in a Financial Statement Audit guides auditors in being proactive in detecting fraud.

Question 30

The most important skills needed by information technology auditors are people skills.

Question 31

Test of program length is one approach to detecting the existence of a Trojan Horse.

Question 32

The primary purpose of an internal audit is:

A)To verify the accuracy of a firm's financial statements
B)To punish employees for inefficient performance
C)To meet the requirements of the accounting profession
D)To ascertain employee adherence to organizational policies and procedures

Question 33

The best educational background for a Certified Information Systems Auditor is:

A)A degree in information systems or technology
B)A degree which combines the study of accounting with the study of information systems
C)No college degree, but work experience in information systems
D)An accounting degree

Question 34

The CICA members may offer trust services such as WebTrust and SysTrust to evaluate the reliability of information systems.

Question 35

Auditors may use transaction tagging to verify how a system processes certain transactions.

Question 36

Which of the following is not true?

A)An internal audit is never performed by external auditors
B)The primary goals of an internal audit and an external audit are somewhat different
C)Both internal and external audits are similar in their insistence upon objectivity in the performance of the audit evaluation
D)Both the internal audit and the external audit rely heavily upon the audit trail of transactions in an accounting system

Question 37

If an auditor were to audit a payroll application using around-the-computer auditing techniques, the individual would:

A)Use test data
B)Verify that the output from the computerized processing was correct for the input data used to generate it
C)Never use a surprise audit because of the amount of time and work involved
D)Prepare a profile of a computer file and check the processed data with the profile thus obtained

Question 38

Through-the-computer auditing uses all of the following except:

A)Confirmation sampling
B)Test data
C)Tests of program authorization
D)Embedded audit modules

Question 39

Computer assisted audit techniques:

A)Are never used in compliance testing
B)May be used for substantive and compliance testing
C)Are used primarily when auditing around the computer
D)Are good tools for auditors who are lacking in technical computer skills

Question 40

It is relatively easy to prevent hackers from unauthorized access to data and programs.

Question 41

Which of the following is not typically checked by an auditor in a review of a responsibility system of computer program development and maintenance?

A)Documentation of all program changes on proper change-request forms
B)Proper costing of all program change requests
C)A review of each program change request by an internal auditor
D)Matches between program documentation and the production version of a computer program

Question 42

The greatest drawback of an integrated test facility is that:

A)It requires the construction of a high volume of test data
B)It introduces artificial transactions into the transaction stream
C)It produces overkill in the audit function
D)It is not broad enough to cover the entire spectrum of activities involved in the AIS

Question 43

The auditor's role in reviewing the system of computer program development:

A)Does not include checking to see that all program changes are properly documented
B)Does not include a check of librarian functions
C)Does not include checking to see that program change requests are properly costed
D)Includes a cross-check of program changes against in-use programs

Question 44

When an auditor audits with the computer, the auditor:

A)Uses the computer to process transaction data under normal processing conditions
B)Uses the computer as a tool to assist in various other auditing tasks
C)Relies heavily upon test data to evaluate the presence or absence of specific computer controls
D)Must also use an integrated test facility

Question 45

Information Technology governance includes all of the following except:

A)A decentralized approach to IT acquisition
B)Using IT strategically to carry out the objectives of an organization
C)Ensuring effective management of an organization's IT resources
D)Control over IT-related risks

Question 46

All of the following are true concerning embedded audit modules except:

A)They provide for continuous auditing of application processing
B)The auditor does not have to be involved in the development of these programs
C)Once implemented, the system can capture information that is useful to the auditor on an ongoing basis
D)With this approach, the application program incorporates subroutines for audit purposes

Question 47

All of the following are reasons why SOX was enacted, except:

A)Enron's CEO, Jeffrey Skilling, claimed he did not know about the company's financial shenanigans because he was not involved in their accounting
B)Public perception was that auditors were having conflicts of interest with respect to the auditing and consulting services they provided
C)The CICA has long been thought to be ineffective
D)Congress wanted to restore investor confidence in the wake of a rash of corporate scandals

Question 48

An integrated test facility is used to:

A)Test only the computer programs of an AIS
B)Test only the manual operations of an AIS
C)Test both the programs and the manual operations of an AIS in an operational setting
D)Test the computer programs, the manual operations, and the auditing procedures of a company using a computerized AIS

Question 49

Three common techniques auditors use to test computer programs are:

A)Test data, integrated test facilities, and parallel simulation
B)Test data, edit checks, and integrated test facilities
C)Test data, program change control, and parallel simulation
D)Program change control, edit checks, and parallel simulation

Question 50

Which of the following is not a condition for fraud as identified in the fraud triangle?

A)Incentives or pressures
B)Greed
C)Opportunity
D)Rationalization

Question 51

Under which audit technique is the way transactions are processed examined?

A)Exception reporting technique
B)Transaction tagging technique
C)Snapshot technique
D)Parallel simulation technique

Question 52

The four approaches to through-the-computer auditing include all but which of the following:

A)Use of embedded audit modules
B)Testing of outputs to verify processing
C)Computer program testing
D)Validation of computer programs

Question 53

Which of the following statements is not true regarding people skills for IT auditors?

A)People skills are more important than technical skills
B)An example of people skills would be the ability to work as a team
C)In the case of protecting against computer viruses, technical skills matter more than people skills
D)Many internal controls evaluated by auditors concern human behavior

Question 54

All of the following are examples of parameters that might be used to set passwords except:

A)A minimum password length of six digits
B)Restriction of passwords to alphanumeric characters only
C)Required use of words that can be found in a dictionary
D)A requirement for a minimum interval such as one day)before a password may be changed

Question 55

Which of the following services is not prevented by SOX for an auditor to perform for their own client?

A)Internal auditing outsourcing services
B)Expert services related to the audit
C)Actuarial services
D)Implementation of a financial information system

Question 56

The most important advantage of an integrated test facility is that it:

A)Allows auditors to evaluate transactions in an operational setting
B)Can test every exception transaction as opposed to test data which includes only a limited set of such transactions
C)Works best at evaluating input controls
D)Has no disadvantages

Question 57

The term "test data" is associated with:

A)Auditing through-the-computer
B)Auditing around-the-computer
C)Auditing of manual accounting systems
D)Non-auditing procedures performed by a firm's accounting subsystem employees

Question 58

Prewritten computer programs used for audit purposes are called:

A)Sequential access program systems
B)Positive confirmation audit systems
C)Embedded audit modules
D)Generalized audit software packages

Question 59

SQL is:

A)An example of an integrated test facility
B)A generalized audit software program
C)A tool used for continuous auditing
D)A tool used by auditors to retrieve and manipulate data

Question 60

Which of the following audit techniques is likely to require the most technical expertise on the part of an auditor?

A)Test data
B)Integrated test facility
C)Evaluation of program change control
D)Parallel simulation

Question 61

Continuous audit techniques can improve the effectiveness of the audit by:

A)Focusing most of the audit effort near the year-end
B)Alerting auditors to potential problems when the problems occur
C)Protecting the privacy of the auditors
D)Facilitating parallel simulation

Question 62

Which of the following is not a principle of the AICPA's Trust Services?

A)Maintainability
B)Availability
C)Online privacy
D)Processing integrity

Question 63

Controls over access to IT systems are particularly important because:

A)Weak access controls prevent unauthorized use of systems
B)Access controls allow auditors to employ continuous auditing techniques
C)Access controls make test data more effective
D)Weak access controls can allow users to bypass many other controls

Question 64

Risks of using an integrated test facility include:

A)Failure to remove fake transactions from the client's system
B)High costs of building the facility
C)Discovery of many control weaknesses
D)none of the above