Deck 10: The impact of information technology on the audit process

Question 1

Which of the following type of risks is mitigated by strong general controls?

A) risk of theft of information and data
B) risk of system crash
C) risk of system obsolescence
D) all of the above

Answer 1

B

Question 2

Systems development, operations and data control, and librarianship are separated in an IT system.

Answer 2

True

Question 3

Control risk is often affected by a complex IT system even if it enhances internal controls.

Answer 3

True

Question 4

IT can significantly impact an organisation's overall control risk.Which of the following risks would NOT be important from an auditing perspective?

A) the potential for material misstatement
B) use of unreliable information because of processing errors produced by the technology
C) the inability to retrieve important information because of IT systems failure
D) none of the above (i.e., they are all important)

Question 5

One disadvantage of IT systems is the potential elimination of the control provided by division of duties of independent persons normally present in manual systems.

Question 6

Internal control is ineffective when computer programmers:

A) request physical security be provided for program files.
B) design documentation for computerised systems.
C) have access to actual programs used to produce accounting information.
D) participate in computer software acquisition decisions.

Question 7

The accumulation of source documents and records that allows the organisation to trace accounting entries back to their initiation is the:

A) audit trail.
B) outsourcing code.
C) initialisation procedure.
D) substantiation record.

Question 8

Controls that relate to a specific use of the IT system, such as the processing of sales or cash receipts, are called application controls.

Question 9

One potential disadvantage of IT systems is the increased risk of destruction of entire data files.

Question 10

General controls are normally evaluated earlier in the audit than application controls.

Question 11

Oversight of the IT function to ensure that all activities are carried out consistently with the IT strategic plan is the responsibility of the:

A) chief information officer.
B) data control group.
C) librarian.
D) computer operators.

Question 12

How is internal control enhanced by information technologies?

A) Computer controls replace manual controls.
B) Higher quality information is available.
C) Computer controls are cheaper.
D) both A and B

Question 13

Why does a well-controlled IT system offer greater potential for reducing misstatements?

A) because computers reduce the human error that is likely to occur in traditional manual environments
B) because computers process information consistently
C) because computers handle tremendous volumes of complex business transactions effectively
D) all of the above

Question 14

One key to a backup and contingency plan is to make sure that all critical copies of software and data files are backed up and stored off-premises.

Question 15

The perceived importance of IT within an organisation is often dictated by the attitude of the audit committee.

Question 16

Processing controls is a category of general controls.

Question 17

The day-to-day operations of the computer are the responsibility of management.

Question 18

Discuss how the integration of IT into accounting systems enhances internal control.

Question 19

An auditor's investigation of a company's IT control procedures has disclosed the following four circumstances.Indicate which circumstance constitutes a weakness in internal control.

A) Only one copy of backup files is stored in an off-premises location.
B) Computer operators are closely supervised by programmers.
C) Programmers do not have the authorisation to operate equipment.
D) Computer operators do not have access to the complete run manual.

Question 20

When integrating IT into accounting systems, which of the following would enhance internal control?

A) computer controls replacing manual ones
B) higher quality information
C) both A and B
D) none of the above

Question 21

If a control total were to be computed on each of the following data items, which would BEST be identified as a hash total for a payroll IT application?

A) department numbers
B) hours worked
C) total debits and total credits
D) net pay

Question 22

Output controls focus on:

A) checking the accuracy of processing.
B) detecting errors after the completion of processing.
C) confirming that data has been processed in the correct order.
D) preventing errors before final reports are completed.

Question 23

Well-controlled organisations segregate key duties within IT.Ideally, this means the following responsibilities should be separated:

A) IT management is separate from systems development.
B) IT management is separate from data control.
C) IT management is separate from operations.
D) all of the above

Question 24

Which one of the following is NOT an application control?

A) processing controls
B) hardware controls
C) output controls
D) input controls

Question 25

What type of analyst coordinates development and changes to IT systems?

A) technical
B) financial
C) systems
D) all of the above

Question 26

Which of the following is NOT a general control?

A) preparation of backup plans
B) restricted access to hardware
C) equipment error causing error messages to appear on the computer monitor
D) post-processing reviews

Question 27

Controls which are built in by the manufacturer to detect equipment failure are called:

A) hardware controls.
B) manufacturer's controls.
C) input controls.
D) fail-safe controls.

Question 28

Which of the following is NOT an example of an application control?

A) There are reasonableness tests reviewing hours worked by employees.
B) There are reasonableness tests for the unit selling price of a sale.
C) After processing, all sales transactions are reviewed by the sales department.
D) An equipment failure causes an error message on the monitor.

Question 29

Which of the following is NOT an application control?

A) post-processing review of sales transactions by the sales department
B) reasonableness test for unit selling price of sale
C) preprocessing authorisation of sales transactions
D) separation of duties between computer programmer and operators

Question 30

Parallel testing involves:

A) processing test data against a copy of the client's application program.
B) operating the old and the new system simultaneously.
C) requiring the user to re-input critical fields to verify accuracy of input.
D) implementing a new system in one part of the organisation while other locations continue to rely on the old system.

Question 31

Which two broad control groupings for IT systems are described by auditing standards?
1)General controls
2)application controls
3)information controls
4)performance controls

A) 2 and 3
B) 3 and 4
C) 1 and 3
D) 1 and 2

Question 32

Which one of the following is NOT usually part of a contingency plan?

A) regular changing of access codes
B) identifying alternative hardware that can be used to process company data
C) backing up critical data files
D) storing copies of critical software off premises

Question 33

Auditors usually evaluate the effectiveness of:

A) sales-cycle controls first.
B) application controls first.
C) general controls before application controls.
D) hardware controls first.

Question 34

In IT systems, if general controls are effective, it increases the auditor's ability to rely on application controls to reduce control risk.

Question 35

Which of the following is a control that relates to all parts of the IT system?

A) a universal control
B) a general control
C) an application control
D) a systems control

Question 36

The objective of understanding internal control and assessing control risk in an IT system is to:

A) aid in determining the audit evidence that should be accumulated.
B) evaluate management's efficiency in designing and using the IT system.
C) gain an understanding of the computer hardware and software.
D) determine if the audit firm must have an IT auditor on the team.

Question 37

Which type of control is designed to assure that the information processed by computer is authorised, complete, and accurate?

A) processing controls
B) output controls
C) input controls
D) general controls

Question 38

Which one of the following is NOT a general control?

A) backup
B) hardware controls
C) segregation of IT duties
D) processing controls

Question 39

IT controls are classified as either general or application controls.

Question 40

Controls which apply to the processing of individual transactions are called:

A) general controls.
B) application controls.
C) systems controls.
D) user controls.

Question 41

Identify the six categories of general controls and give one example of each.

Question 42

Auditing around the computer:

A) considers only the non-IT controls in assessing control risk.
B) uses the client's computer as an audit tool.
C) uses computer programs to perform audit tasks in special circumstances.
D) all of the above

Question 43

Which of the following are key to a successful software purchase decision?

A) key users of the software
B) IT and non-IT personnel
C) internal auditors
D) all of the above

Question 44

Discuss the major factors associated with complex IT systems that increase control risk and the likelihood of material misstatements in the financial statements.

Question 45

Physical control over computer equipment restricts access to:

A) software.
B) hardware.
C) backup data files.
D) all of the above

Question 46

When might an auditor decide NOT to reduce assessed control risk even if internal controls are adequate?

A) The cost of the study and tests of controls will exceed the savings from reduced substantive procedures.
B) A qualified opinion will be issued.
C) The auditor plans to rely on the controls and reduce substantive testing.
D) all of the above

Question 47

After obtaining an understanding of IT internal control, if the auditor feels that control risk cannot be reduced, he or she will

A) expand the substantive testing portion of the audit.
B) issue a disclaimer.
C) issue an adverse opinion.
D) increase the sample size for tests of controls.

Question 48

When the auditor decides to audit around the computer, he or she is not required to test the client's IT controls.

Question 49

Auditing through the computer is justified when general controls are acceptable.

Question 50

Auditing around the computer is acceptable when general controls are strong.

Question 51

When the client uses a computer but the auditor chooses to use only the non-IT segment of internal control to assess control risk, it is referred to as 'auditing around the computer'.Which one of the following conditions need NOT be present in order to audit around the computer?

A) The source documents are available in a readable form and can be traced easily through the accounting system to output.
B) User controls include comparison of computer-produced records with source documents.
C) Computer programs must be available in English.
D) The accounting software can display or print ledger balances and transaction details that allow the auditor to trace individual transactions through the accounting records.

Question 52

Tests of controls are normally performed only if the auditor believes the client's internal control may be effective.

Question 53

Identify the three categories of application controls and give one example of each.

Question 54

Which audit procedure is least useful in gathering evidence on significant computer processes?

A) tracing
B) test data
C) observation
D) generalised audit software

Question 55

Which of the following output controls is most important?

A) review of the data for reasonableness by someone who knows what the output should look like
B) control totals, which are used to verify that the computer's results are correct
C) distribution control, which assures that only authorised personnel receive the reports generated by the system
D) logic tests, which verify that no mistakes were made in processing

Question 56

Discuss the four areas of responsibility under the IT function that should be segregated in large companies.

Question 57

Auditing around the computer is acceptable if the auditor has access to sufficient source documents and a detailed listing of output in a readable form.

Question 58

Which of the following is true if the general control environment is weak?

A) The auditor will need to rely more on application controls and increase testing.
B) This tends to have a pervasive effect on the application control environment.
C) Auditing through the computer is usually the most cost-effective audit approach.
D) all of the above

Question 59

Application controls vary with each application in the IT system.In attempting to review and gain an understanding of the internal control system, the auditor must evaluate the application controls for every:

A) audit area in which the client uses the computer.
B) material audit area.
C) audit area.
D) audit area where the auditor plans to reduce assessed control risk.

Question 60

Which of the following is NOT a general control?

A) hardware controls
B) the plan of organisation and operation of IT activity
C) processing controls
D) procedures for documenting, reviewing, and approving systems and payments

Question 61

Generalised audit software is:

A) used when client's software is not compatible with the auditor's.
B) a method of verifying the client's data recorded in a machine language.
C) often used even when client's data are not computerised.
D) all of the above

Question 62

Using the test data approach, the auditor processes a set of the client's actual transaction data using the auditor's computer programs on the auditor's computer equipment to determine whether the client's computer programs and equipment are processing data correctly.

Question 63

Which of the following is NOT an example of a test data approach?

A) testing authorisation of transactions
B) testing input data to final reports
C) testing online passwords
D) testing data access controls

Question 64

Which of the following tests CANNOT be performed with the auditor's computer program?

A) Analyse exception responses returned with confirmations received from customers.
B) Verify extensions and footings.
C) Re-sequence data and perform analyses.
D) Compare data on separate files.

Question 65

Which one of the following computer-assisted auditing techniques allows fictitious and real transactions to be processed together without client operating personnel being aware of the testing process?

A) Parallel simulation
B) Integrated test facility
C) Generalised audit software programming
D) Test data approach

Question 66

One common use of generalised audit software is to help the auditor identify weaknesses in the client's IT control procedures.

Question 67

Generalised audit software can be used to perform many different kinds of tests.Which of these is NOT one of them?

A) comparing creditor statements with accounts payable files
B) inquiry of management policy on aged debtors
C) random sampling of all other receivables
D) totalling the client's accounts receivable balances

Question 68

Data Corporation has just completely computerised its billing and accounts receivable record-keeping.Your firm has recently acquired IDEA software, and you want to make maximum use of the computer in your audit of Data Corporation.Which of the following audit techniques could NOT be performed using generalised audit software?

A) comparing data on separate files
B) selecting a sample of accounts to be confirmed and printing confirmation requests
C) resolving differences reported by customers on confirmation requests
D) examining records for quality, completeness, consistency, and correctness

Question 69

Discuss what is meant by the term 'auditing through the computer'.

Question 70

Which of the following is a function of an embedded audit module approach?

A) Tests data used to test specific controls.
B) Analyses the client data.
C) Uses software to define the content of data records.
D) Inserts an audit module into the client's application system.

Question 71

An independent auditor uses generalised audit software (GAS).The second step in using GAS, application design, might include which of the following?

A) Develop a logical approach to extract and manipulate data obtained from the client's records.
B) Design the most useful format and contents of the auditor's GAS reports.
C) Identify and describe the client's data files and the information to which access is desired.
D) all of the above

Question 72

Which of the following is NOT a test performed by generalised audit software?

A) review of accounts receivable balances for amounts over the credit limit
B) observing cash receipts processes
C) recalculating employees' net pay calculations
D) preparing general ledger trial balances

Question 73

Program-oriented CAATs are useful primarily for:

A) tests of balances.
B) tests of controls.
C) analytical review tests.
D) any type of audit testing.

Question 74

An auditor who is testing IT controls in a payroll system would most likely use test data that contains conditions such as:

A) deductions not authorised by employees.
B) overtime not approved by supervisors.
C) time tickets with invalid job numbers.
D) payroll cheques with unauthorised signatures.

Question 75

The major disadvantage of generalised audit software is that its complexity limits its use primarily to IT specialists.

Question 76

The audit approach in which the auditor runs his or her own program on a controlled basis in order to verify the client's data recorded in a machine language is:

A) the generalised audit software approach.
B) the test data approach.
C) called 'auditing around the computer'.
D) the microcomputer-aided auditing approach.

Question 77

Program-oriented CAATs:

A) are useful primarily for substantive procedures.
B) allow the auditor to select records for further testing.
C) may be applied regardless of the level of assessed control risk in an application.
D) none of the above

Question 78

Which of the following is a generalised audit software package?

A) ACL
B) MYOB
C) Visual Basic
D) none of the above

Question 79

An advantage of generalised audit software (GAS)is the ability to access and test client data independently.

Question 80

The objective of the computer audit technique known as the 'test data approach' is to determine whether the client's computer programs can correctly process valid and invalid transactions.