Deck 17: IT Controls Part III: Systems Development, Program Changes, Application Controls

Question 1

Which of the following is NOT a common type of through-the-computer tests of controls?

A) Inference tests
B) Redundancy tests
C) Completeness tests
D) Validity tests
E) All of the above are through-the-computer tests

Answer 1

Through-the-computer test of controls:
In auditing through the computer techniques the auditor thoroughly studies the audit history to know about the inside functioning of the application. Access Test, Completeness test, Validity test, Redundancy test, Accuracy test and Audit trail test are the valid tests of through the computer technique.
Inference test is not a test of audit through the computer method. Hence, the correct option is (a).
Explanation of incorrect options:
• The Redundancy Test checks whether the program executes the records only once or not. Hence, option 'b' is incorrect.
• The Completeness Test is used to check the omitted data in a document or file. Hence, option 'c' is incorrect.
• The Validity Test is used to check the output of any calculation is coming correct or not. Hence, option'd' is incorrect.

Question 2

Tracing is a technique that:
a. reviews interest calculations to identify a salami fraud.
b. allows test data to be merged with production
data and traces the effects in the database.
c. performs an electronic walk through of computed logic.
d. none of the above

Answer 2

Tracing:
Tracing is a technique that is primarily used to accomplish electronic walk- through of the application's internal logic. Tracing includes the tests are as follows:-
• The System under evaluation must submit to a special accumulation to trigger the trace selection.
• Particular transactions are created as test data out of a lot of transaction.
• The test data transactions are mark out through all phases of the system, and the result is recorded.
Hence, the correct option is (c).
Explanation for incorrect solutions:
• Rounding error/Salami tests are the tests that validate the perfection of rounding procedures to check the salami fraud. Hence option 'a' is incorrect.
• The integrated test facility (ITF) approach is a programmed method that allows the auditor to check System's logic and controls during its normal task. Hence, option 'b' is incorrect.
• As one the given options is true, the option'd' is incorrect.

Question 3

Which of the following statements about the ITF technique for testing is NOT correct?

A) Applications may be tested directly without being removed from service.
B) ITF supports continuous monitoring of controls.
C) ITF has the potential to corrupt corporate databases.
D) During normal operations, test transactions are merged into the input stream of regular (production) transactions.
E) All of the above are correct statements.

Answer 3

Integrated Test Facility
• To avoid the Test Data problem Integrated Test Facility (ITF) technique is used. Here the auditor does not depend on the System experts of the organization.
• It creates its own test module and tests it. It provides to verify the working functionality of the System.
• It upsurges the productivity and consistency of the System. Here the System testing is done while it is running or without being detached from its work. It uninterruptedly observes the System and the controls.
• During its normal working the input transactions combined into input stream of production transaction and executed against bogus files of database.
• The demerit of the ITF technique is that it is capable of mortifying company database.
Hence, the correct option is
Consider the following options:
• ITF produces its own test module and checks it. It allows the auditor to test while it is in service or working condition. As the statement in option 'a' is true, hence this option is incorrect.
• It increases the efficiency and steadiness of the System. Here the System testing is done while it is running or without being removed from its work. It successively observes the System and the controls. As the statement in option 'b' is true, hence this option is incorrect.
• The shortcoming of the ITF method is, it is capable of degrading company database. As the statement in option 'c' is true, hence this option is incorrect.
• During its usual working the input transactions combined into input stream of production transaction and executed against fake files of database. As the statement in option 'd' is true, hence this option is incorrect.

Question 4

What is an embedded audit module?

Question 5

COMPUTER FRAUD AND CONTROLS
For many organizations, the security threat from external penetration is significant; however, many fraud threats are internal. These include (1) data input alteration, (2) program alteration, (3) file alteration, (4) data theft, and (5) sabotage.
Required
Explain how each of these five types of frauds is committed. Also, identify a method of protection against each without using the same protection method for more than one type of fraud. Use the following format.

Question 6

RISK IDENTIFICATION AND PLAN OF ACTION
The internal auditors of Brown Electrical Company report to the controller. Because of changes made in the past year to several of the transaction processing programs, the internal auditors created a new test data set. The external auditors requested that the old data set also be run. The internal auditors, embarrassed, explained that they overwrote the original test data set.
Required
Outline any potential risks, and determine the courses of action the external auditor should take.

Question 7

COMPUTER-ASSISTED AUDIT TOOLS AND TECHNIQUES (CAATTS) Required
a. Explain the advantages of using GAS to assist with IT audits, and give five examples of how it may be used.
b. Describe the audit purpose facilitated and the procedural steps to be followed when using the following CAATTs.
1. ITF
2. EAM
3. parallel simulation

Question 8

Explain what GAS is and why it is so popular with larger public accounting firms. Discuss the independence issue related to GAS.

Question 9

Explain how program testing is conducted, and explain the importance of test data.

Question 10

Give one example of an error that a check digit control detects.

Question 11

Why should programs undergoing maintenance be renamed?

Question 12

Name the general categories of IT application control tests that auditors design.

Question 13

What are user test and acceptance procedures?

Question 14

Discuss the problem associated with creating test data and how it can be alleviated.

Question 15

Explain how an embedded audit module works.

Question 16

What is the purpose of a range check?

Question 17

Which of the following is NOT an SDLC controllable activity?

A) User specification
B) Systems authorization
C) User test and acceptance procedures
D) External audit participation
E) All are SDLC controls

Question 18

Which of the following is NOT a test for identifying application control errors?

A) Access tests
B) User acceptance tests
C) Field tests
D) Range tests
E) All of the above

Question 19

AUDIT OF SYSTEMS DEVELOPMENT
The Balcar Company's external auditors are developing an audit plan to review the company's systems development procedures. Their audit objectives are to ensure that
1. the system was judged necessary and justified at various checkpoints throughout the SDLC.
2. systems development activities are applied consistently and in accordance with management's policies to all systems development projects.
3. the system as originally implemented was free from material errors and fraud.
4. system documentation is sufficiently accurate and complete to facilitate audit and maintenance activities.
The following six controllable activities have been identified as sources of audit evidence for meeting these objectives: systems authorization, user specification, technical design, internal audit participation, program testing, and user testing and acceptance.
Required
a. Explain the importance of each of the six activities in promoting effective control.
b. Outline the tests of controls that the auditor would perform in meeting audit objectives.

Question 20

What is a reasonableness test?

Question 21

AUDIT PLAN
The CPA firm of True, Blue, and Smith (TBS) has taken on a new audit client. The TBS partner in charge of the audit has concerns in the following areas: system access and security; systems development and program changes; and organization of the IT function.
Required
Outline an audit plan that specifies audit objective and procedures needed to test controls in the areas of concern.

Question 22

SYSTEMS DEVELOPMENT AND PROGRAM CHANGES
Winston Financial Services (WFS), located in Parsippany, NJ provides financial advice to small and mid-sized businesses. Its primary operations are in portfolio management and financial services for clients in the health care industry. Each client has general business and financial information stored on servers in the main office in Parsippany. Client investment information is stored on a separate server in their Tulsa Oklahoma data center. This includes the total value of the portfolio, type of investments made, the income structure of each client, and associated tax liabilities.
WFS had purchase specialized asset management software called VIEW, which allows the company to run analytics on client portfolios and to run simulations of market trends. The customization and implementation of VIEW was performed by a team of IT professionals from the consulting firm of Cutting Edge Solutions (CES).
The contract with CES required them to train a WFS employee to maintain VIEW after the implementation. For this purpose, WFS selected a programmer from their systems maintenance group who was subsequently trained in VIEW's proprietary language and all of its functionality and controls.
Two years after the implementation of VIEW,WFS management is now considering investing in a significant custom upgrade to the system. Furthermore, since their contract with CES has expired, they have decided to assign the upgrade task to their in-house maintenance programmer who had been trained in VIEW by CES. Once the project is completed, the programmer will be redeployed to the maintenance group. This is viewed by the WFS management team to be the most feasible and economic approach.
Required
a. Discuss the risks associated with systems development approach.
b. What controls weaknesses are apparent in this approach?

Question 23

What is a program version number?

Question 24

Why are user specification activities important?

Question 25

Why are program change procedures important to auditors?

Question 26

Compare and contrast the following techniques based on costs and benefits:
• test data method
• base case system evaluation
• tracing
• integrated test facility
• parallel simulation

Question 27

What are rounding error routines, and why are they used?

Question 28

Why is reliance on the client IT staff to provide a copy of the production application a potential risk?

Question 29

PAYROLL APPLICATION CONTROL
Using this supplemental information, analyze the flowchart in the diagram for Problem 12. • The personnel department determines the wage rate of all employees. To start the process, the personnel department sends the payroll coordinator, George Jones, an authorization form to add an employee to the payroll. After Jones enters this information into the system, the computer automatically determines the overtime and shift differential rates for the individual, updating the payroll master files.
• Employees use a time clock to record the hours worked. Every Monday morning, George Jones collects the previous week's timecards and begins the computerized processing of payroll information to produce paychecks the following Friday. Jones then reviews the timecards to ensure that the hours worked are correctly totaled; the system determines overtime and/or any shift differential.
• Jones performs all other processes displayed on the flowchart. The system automatically assigns a sequential number to each payroll check produced. The check stocks are stored in a box next to the computer printer to provide immediate access. After the checks are printed, an automatic check signing machine signs them with an authorized signature plate that Jones keeps locked in a safe.

After the check processing is completed, Jones distributes the checks to the employees, leaving the checks for the second- and third-shift employees with the appropriate shift supervisor. Jones then notifies the data processing department that he is finished with his weekly processing, and data processing makes a backup of the payroll master for storage in the computer room.
Required Identify and describe:
a. areas in the payroll processing system in which the internal controls are inadequate.
b. two areas in the payroll system in which the system controls are satisfactory.

Question 30

Which of the following statements is NOT correct?

A) Executing a production application requires that the source code be compiled and linked to a load module.
B) As a practical matter, programs in their compiledstate are secure and free from the threat of unauthorized modification.
C) Application logic changes may be made directly to the load module.
D) Once the application is compiled, the source code is not needed to run the application.
E) All of the above are correct statements.

Question 31

Which of the following statements about the GAS techniques for substantive testing is NOT correct?

A) GAS captures data during processing without removing the application from service.
B) GAS languages are easy to use and require little IT background.
C) GAS techniques are limited to use with flat files and relational database tables.
D) Complex file structures need to be flattened before they can be read by GAS.
E) All of the above are correct statements.

Question 32

What tests may be conducted for identifying unauthorized program changes?

Question 33

AUDIT PLAN
The auditors for Golden Gate Company have a gut feeling that liabilities may be unrecorded. Their initial suspicions stem from a radical decline in accrued liabilities from last year. Golden Gate's records are all computerized.
Required
Devise a plan to search the data files to perform a substantive test for identifying unrecorded liabilities.

Question 34

AUDIT OBJECTIVES AND PROCEDURES
You are conducting substantive tests on the accounts receivable file to verify its accuracy. The file is large, and you decide to sample test the records in it. Because of the complexity of the database structure, you cannot access it directly. The client's systems programmer writes a special application that produces a flat file, which he provides for testing purposes.
Required
Discuss any concerns you would have as an auditor and any actions you would take.

Question 35

What risks, if any, are associated with reliance on client IT personnel to provide the auditor with flat files from complex data structures?

Question 36

What is the role of the internal auditor in systems development?

Question 37

What is the importance of the SPL?

Question 38

ANNOUNCING A NEW INFORMATION SYSTEM
The AJAX Company is considering implementing a new accounting system, which will automate sales processing, cash receipts, accounts payable, and cash disbursement procedures. Roger Moore, AJAX's CIO sent an announcement letter to the AJAX community. In the letter Moore said: "I have contracted with Spartan Consulting Group to do the needs analysis, system selection, and design work. The programming and implementation will be performed in-house using existing IT department staff. The development process will be unobtrusive to user departments because Spartan knows what needs to be done. They will work independently, in the background, and will not disrupt departmental and internal audit work flow with time-consuming interviews, surveys, and questionnaires. This promises to be an efficient process that will produce a system appreciated by all users."
Required
Draft a memo from George Jones, Director of Internal Audits in response to Moore's letter.

Question 39

How does the salami fraud get its name, and how does it work?

Question 40

The systems development life cycle is a methodology. Why are auditors responsible for evaluating the controls in this process?

Question 41

What tests may be conducted for identifying application errors?

Question 42

Discuss how a controlled SPL environment can help to deter unauthorized changes to programs. Can the use of maintenance commands mitigate these controls?

Question 43

Which of the following statements is NOT correct?

A) EAMs have the potential to corrupt corporate databases.
B) EAMs support continuous monitoring of controls.
C) EAMs capture transactions during processing without removing the application from service.
D) EAMs decrease operational performance.
E) All of the above are correct statements.

Question 44

Which of the following is NOT an SDLC control issue during an audit?

A) User and computer services management properly authorized the project.
B) A preliminary feasibility study showed that the project had merit.
C) A cost-benefit analysis was conducted using reasonably accurate values.
D) The detailed design was an appropriate and accurate solution to the user's problem.
E) All of the above are specific points for review.

Question 45

PROBLEMS VS SYMPTOMS
Being able to distinguish between a symptom and a problem is an important analysis skill. Classify each of the following as a problem or a symptom. If it is a symptom, give two examples of a possible underlying problem. If it is a problem, give two examples of a possible symptom that may be detected.
a. declining profits
b. defective production process
c. low-quality raw materials
d. shortfall in cash balance
e. declining market share
f. shortage of employees in the accounts payable department
g. shortage of raw material due to a drought in the Midwest
h. inadequately trained workers
i. decreasing customer satisfaction

Question 46

Which of the following statements about test data techniques for testing application controls are NOT correct?

A) Applications may be tested directly without being removed from service.
B) The test provides only a static picture of application integrity.
C) Implementing the test is costly and labor intensive.
D) The test provides explicit evidence of application functions.
E) All of the above are correct statements.

Question 47

RISK IDENTIFICATION AND PLAN OF ACTION
Two years ago, an external auditing firm supervised the programming of embedded audit modules for Pre-vits Office Equipment Company. During the audit process this year, the external auditors requested that a transaction log of all transactions be copied to the audit file. The external auditors noticed large gaps in dates and times for transactions being copied to the audit file. When they inquired about this, they were informed that increased processing of transactions had been burdening the Mainframe system and that operators frequently had to turn off the EAM to allow the processing of important transactions in a timely fashion. In addition, much maintenance had been performed during the past year on the application programs.
Required
Outline any potential exposures, and determine the courses of action the external auditors should use to proceed.

Question 48

RISK IDENTIFICATION AND PLAN OF ACTION
As the manager of the external audit team, you realize that the embedded audit module writes material invoices only to the audit file for the accounts receivable confirmation process. You are immediately concerned that the accounts receivable account may be substantially overstated this year and for the prior years in which this EAM was used.
Required
Explain why you are concerned because all "material" invoices are candidates for confirmation by the customer. Outline a plan for determining if the accounts receivable are overstated.

Question 49

What does auditing around the computer mean versus auditing through the computer? Why is this so important?

Question 50

DESIGN TESTS OF APPLICATION CONTROLS
Required
Describe the test data (transaction files and master files) the auditor would create, and the tests that an auditor would perform, to evaluate the accuracy of inventory receipts in the receiving department. Assume the following:
• The receiving clerk records receipts from a terminal in the receiving department.
• Inventory is automatically updated by an integrated system.
• The auditor has a current copy of the application and documentation.
Use the examples of tests of IT controls in this chapter as a basis for your responses.

Question 51

What is the purpose of program testing in the SDLC?

Question 52

What functions does the SPLMS control?

Question 53

SPL RISKS AND CONTROLS
Orben Manufacturing Company has an in-house IT department that incurs a high volume of new development and program maintenance projects. To efficiently manage the workload, the director of IT has combined the systems development and maintenance functions into a single department. This allows the programmers of new applications to also maintain those applications. The immediate effect has been an increase in the work flow by reducing the startup time needed by programmers to become familiar with the systems being modified. It also reduces the time spent on system documentation. Since the designer and the maintenance programmer are the same person, highly detailed and standardized documentation is not needed. To achieve cross training, programmers also maintain applications programmed by other IT personnel. This has resulted in an "open" library policy that allows programmers to access any program stored in the SPL. Programmers download the application undergoing maintenance to their personal computers, perform the necessary maintenance, and then restore the application to the SPL under its original name.
Required
a. Comment on the trade-off between efficiency and control as it pertains in this situation.
b. Discuss the risk potential related to Orben Manufacturing's program change procedures.
c. Discuss the controls that would reduce the risks described in (b) above.

Question 54

List the six systems development controls the chapter addresses. List the two systems maintenance controls.

Question 55

Discuss the black box approach, and explain how it is different from through-the-computer approaches to testing application controls.

Question 56

What factors do you think might cause an auditing team to spend more time than average on tests to identify application errors? For unauthorized program changes?

Question 57

What are the through-the-computer techniques?

Question 58

What types of output would be considered extremely sensitive in a university setting? Give three examples, and explain why the information would be considered sensitive. Discuss who should and should not have access to each type of information.