Exam 5: Business Analysis and Information Technology

Question 1

The main reason to establish internal controls in an organization is to:

A) Encourage compliance with policies and procedures.
B) Safeguard the resources of the organization.
C) Ensure the accuracy, reliability, and timeliness of information.
D) Provide reasonable assurance on the achievement of objectives.

Answer 1

Provide reasonable assurance on the achievement of objectives.

Question 2

An organization uses a database management system (DBMS) as a repository for data. The DBMS, in turn, supports a number of end-user developed applications which were created using fourth-generation programming languages. Some of the applications update the database. Which of the following is the most important control related to the integrity of the data in the database?

A) End users have their read-only applications approved by the information systems department before accessing the database.
B) Concurrency update controls are in place.
C) End-user applications are developed on personal computers before being implemented on the mainframe.
D) A hierarchical database model is adopted so that multiple users can be served at the same time.

Answer 2

Concurrency update controls are in place.

Question 3

The decision to implement enhanced failure detection and back-up systems to improve data integrity is an example of which risk response?

A) Risk acceptance.
B) Risk sharing.
C) Risk avoidance.
D) Risk reduction.

Answer 3

Risk reduction.

Question 4

For an engineering department with a total quality management program, important elements of quality management include all of the following except:

A) Basing performance evaluations on the number of projects completed.
B) Comparing results with those of other engineering departments.
C) Creating a quality council within the engineering department.
D) Conducting post-project surveys on performance.

Question 5

One change control function that is required in client/server environments, but is not required in mainframe environments, is to ensure that:

A) Program versions are synchronized across the network.
B) Emergency move procedures are documented and followed.
C) Appropriate users are involved in program change testing.
D) Movement from the test library to the production library is controlled.

Question 6

A key advantage of developing a computer application by using the prototyping approach is that it:

A) Does not require testing for user acceptance.
B) Allows applications to be portable across multiple system platforms.
C) Is less expensive since it is self-documenting.
D) Better involves users in the design process.

Question 7

The economic order quantity for inventory is higher for an organization that has:

A) Lower annual unit sales.
B) Higher fixed inventory ordering costs.
C) Higher annual carrying costs as a percentage of inventory value.
D) A higher purchase price per unit of inventory.

Question 8

A capital investment project will have a higher net present value, everything else being equal, if it has:

A) A higher initial investment level.
B) A higher discount rate.
C) Cash inflows that are larger in the later years of the life of the project.
D) Cash inflows that are larger in the earlier years of the life of the project.

Question 9

Preferred stock is less risky for investors than is common stock because:

A) Common stock pays dividends as a stated percentage of face value.
B) Common stock has priority over preferred stock with regard to earnings and assets.
C) Preferred dividends are usually cumulative.
D) Preferred stock with no conversion feature has a higher dividend yield than does convertible preferred stock.

Question 10

Which of the following statements pertaining to a market skimming pricing strategy is not true?

A) The strategy is favored when unit costs fall with the increase in units produced.
B) The strategy is favored when buyers are relatively insensitive to price increases.
C) The strategy is favored when there is insufficient market capacity and competitors cannot increase market capacity.
D) The strategy is favored when high price is perceived as high quality.

Question 11

Which of the following budgets must be prepared first?

A) Cash budget.
B) Production budget.
C) Sales budget.
D) Selling and administrative expenses budget.

Question 12

Which of the following steps should an internal auditor take during an audit of an organization's business continuity plans? 1. Evaluate the business continuity plans for adequacy and currency. 2. Prepare a business impact analysis regarding the loss of critical business. 3. Identify key personnel who will be required to implement the plans. 4. Identify and prioritize the resources required to support critical business processes.

A) 1 only
B) 2 and 4 only
C) 1, 3, and 4 only
D) 1, 2, 3, and 4

Question 13

During a review of a web-based application used by customers to check the status of their bank accounts, it would be most important for the internal auditor to ensure that:

A) Access to read application logs is restricted to authorized users.
B) Account balance information is encrypted in the database.
C) The web server used to host the application is located in a physically secure area.
D) Sensitive data, such as account numbers, are submitted using encrypted communications.

Question 14

Which of the following is a disadvantage of selecting a commercial software package rather than developing an application internally?

A) Lack of flexibility.
B) Incompatibility with client/server technology.
C) Employee resistance to change.
D) Inadequate technical support.

Question 15

The activity that involves a trial run of a product in a typical segment of the market before proceeding to a national launch is referred to as:

A) Test marketing
B) Experimentation
C) Segmentation
D) Positioning

Question 16

During the last year, an organization had an opening inventory of $300,000, purchases of $980,000, sales of $1,850,000, and a gross margin of 40 percent. What is the closing inventory if the periodic inventory system is used?

A) $170,000
B) $280,000
C) $300,000
D) $540,000

Question 17

Which of the following is a type of network in which an organization permits specific users (such as existing customers) to have access to its internal network through the Internet by building a virtual private network?

A) Intranet.
B) Extranet.
C) Digital subscriber line.
D) Broadband.

Question 18

Refer to the exhibit. The figure below shows the network diagram for the activities of a large project.

What is the shortest number of days in which the project can be completed?

A) 21 days.
B) 22 days.
C) 27 days.
D) 51 days.

Question 19

A brand manager in a consumer food products organization suspected that several days of the point-of-sale data on the spreadsheet from one grocery chain were missing. The best approach for detecting missing rows in spreadsheet data would be to:

A) Sort on product identification code and identify missing product identification codes.
B) Review store identification code and identify missing product identification codes.
C) Compare product identification codes for consecutive periods.
D) Compare product identification codes by store for consecutive periods.

Question 20

Which of the following best describes the concept of relevant cost?

A) A future cost that is the same among alternatives.
B) A future cost that differs among alternatives.
C) A past cost that is the same among alternatives.
D) A past cost that differs among alternatives.

Question 21

An organization produces two products, X and Y. The materials used for the production of both products are limited to 500 kilograms (kg) per month. All other resources are unlimited and their costs are fixed. Individual product details are as follows: Product X Product Y Selling price per unit $10 $13 Materials per unit (at $1/kg) 2 kg 6 kg Monthly demand 100 units 120 units In order to maximize profit, how much of product Y should the organization produce each month?

A) 50 units.
B) 60 units.
C) 100 units.
D) 120 units.

Question 22

Which of the following conflict resolution methods should be applied when the intention of the parties is to solve the problem by clarifying differences and attaining everyone's objectives?

A) Accommodating.
B) Compromising.
C) Collaborating.
D) Competing.

Question 23

Which mindset promotes the most comprehensive risk management strategy?

A) Increase shareholder value.
B) Maximize market share.
C) Improve operational efficiency.
D) Mitigate losses.

Question 24

Which of the following is a characteristic of an emerging industry?

A) Established strategy of players.
B) Low number of new firms.
C) High unit costs.
D) Technical expertise.

Question 25

Which of the following standards would be most useful in evaluating the performance of a customer-service group?

A) The average time per customer inquiry should be kept to a minimum.
B) Customer complaints should be processed promptly.
C) Employees should maintain a positive attitude when dealing with customers.
D) All customer inquiries should be answered within seven days of receipt.

Question 26

Multinational organizations generally spend more time and effort to identify and evaluate:

A) Internal strengths and weaknesses.
B) Break-even points.
C) External trends and events.
D) Internal risk factors.

Question 27

A small furniture-manufacturing firm with 100 employees is located in a two-story building and does not plan to expand. The furniture manufactured is not special-ordered or custom-made. The most likely structure for this organization would be:

A) Functional departmentalization.
B) Product departmentalization.
C) Matrix organization.
D) Divisional organization.

Question 28

Listening effectiveness is best increased by:

A) Resisting both internal and external distractions.
B) Waiting to review key concepts until the speaker has finished talking.
C) Tuning out messages that do not seem to fit the meeting purpose.
D) Factoring in biases in order to evaluate the information being given.

Question 29

Which of the following is useful for forecasting the required level of inventory? 1. Statistical modeling. 2. Information about seasonal variations in demand. 3. Knowledge of the behavior of different business cycles. 4. Pricing models linked to seasonal demand.

A) 1 and 2 only
B) 2 and 3 only
C) 1, 2, and 3 only
D) 1, 2, 3, and 4

Question 30

Which of the following statements accurately describes the responsibility of the internal audit activity (IAA) regarding IT governance?
1. The IAA does not have any responsibility because IT governance is the responsibility of the board and senior management of the organization.
2. The IAA must assess whether the IT governance of the organization supports the organization's strategies and objectives.
3. The IAA may assess whether the IT governance of the organization supports the organization's strategies and objectives.
4. The IAA may accept requests from management to perform advisory services regarding how the IT governance of the organization supports the organization's strategies and objectives.

A) 1 only
B) 4 only
C) 2 and 4
D) 3 and 4

Question 31

An organization had three large centralized divisions: one that received customer orders for service work; one that scheduled the service work at customer locations; and one that answered customer calls about service problems. These three divisions were restructured into seven regional groups, each of which performed all three functions. One advantage of this restructuring would be:

A) Better internal controls.
B) Greater economies of scale.
C) Improved work flow.
D) Increased specialization.

Question 32

Which audit approach should be employed to test the accuracy of information housed in a database on an un-networked computer?

A) Submit batches of test transactions through the current system and verify with expected results.
B) Use a test program to simulate the normal data entering process.
C) Select a sample of records from the database and ensure it matches supporting documentation.
D) Evaluate compliance with the organization's change management process.

Question 33

According to the International Professional Practices Framework, internal auditors who are assessing the adequacy of organizational risk management processes should not:

A) Recognize that organizations use different techniques for managing risk.
B) Seek assurance that the key objectives of the risk management processes are being met.
C) Determine and accept the level of risk for the organization.
D) Treat the evaluation of risk management processes differently from the risk analysis used to plan audit engagements.

Question 34

According to IIA guidance, which of the following corporate social responsibility (CSR) activities is appropriate for the internal audit activity to perform?

A) Determine the optimal amount of resources for the organization to invest in CSR.
B) Align CSR program objectives with the organization's strategic plan.
C) Integrate CSR activities into the organization's decision-making process.
D) Determine whether the organization has an appropriate policy governing its CSR activities.

Question 35

International marketing activities often begin with:

A) Standardization.
B) Global marketing.
C) Limited exporting.
D) Domestic marketing.

Question 36

When writing a business memorandum, the writer should choose a writing style that achieves all of the following except:

A) Draws positive attention to the writing style.
B) Treats all receivers with respect.
C) Suits the method of presentation and delivery.
D) Develops ideas without overstatement.

Question 37

Which of the following is the best reason for considering the acquisition of a nondomestic organization?

A) Relatively fast market entry.
B) Improved cash flow of the acquiring organization.
C) Increased diversity of corporate culture.
D) Opportunity to influence local government policy.

Question 38

A global business organization is selecting managers to post to various international (expatriate) assignments. In the screening process, which of the following traits would be required to make a manager a successful expatriate? 1. Superior technical competence. 2. Willingness to attempt to communicate in a foreign language. 3. Ability to empathize with other people.

A) 1 and 2 only
B) 1 and 3 only
C) 2 and 3 only
D) 1, 2, and 3

Question 39

An organization engages in questionable financial reporting practices due to pressure to meet unrealistic performance targets. Which internal control component is most negatively affected?

A) Monitoring.
B) Control activities.
C) Risk assessment.
D) Control environment.

Question 40

In mergers and acquisitions, which of the following is an example of a horizontal combination?

A) Dairy manufacturing company taking over a large dairy farm.
B) A movie producer acquires movie theaters.
C) A petroleum processing company acquires an agro-processing firm.
D) A baker taking over a competitor.

Question 41

Which of the following is the most likely reason an organization may decide to undertake a stock split?

A) To keep stock price constant.
B) To keep shareholders' equity constant.
C) To increase shareholders' equity.
D) To enhance the stock liquidity.

Question 42

A chief audit executive (CAE) was asked to participate in the selection of an external auditor. Which of the following would not be a typical responsibility for the CAE?

A) Evaluate the proposed external auditor fee.
B) Recommend criteria to be used in the selection process.
C) Develop appropriate performance metrics.
D) Monitor the work of the external auditors.

Question 43

Which of the following application-based controls is an example of a programmed edit check?

A) Reasonableness check.
B) Transaction log.
C) Input error correction.
D) Authorization for access.

Question 44

Which of the following is a limiting factor for capacity expansion?

A) Government pressure on organizations to increase or maintain employment.
B) Production orientation of management.
C) Lack of credible market leader in the industry.
D) Company diversification.

Question 45

An organization needs to borrow a large amount of cash to fund its expansion plan. Which of the following annual interest rates is least expensive?

A) 7 percent simple interest with a 10 percent compensating balance.
B) 7 percent simple interest paid at the end of each year.
C) 7 percent discount interest.
D) 7 percent compounding interest.

Question 46

Which of the following is the most appropriate test to assess the privacy risks associated with an organization's workstations?

A) Penetration test.
B) Social engineering test.
C) Vulnerability test.
D) Physical control test.

Question 47

An organization decided to install a motion detection system in its warehouse to protect against after-hours theft. According to the COSO enterprise risk management framework, which of the following best describes this risk management strategy?

A) Avoidance.
B) Reduction.
C) Elimination.
D) Sharing.

Question 48

Which of the following is always true regarding the use of encryption algorithms based on public key infrastructure (PKI)?

A) PKI uses an independent administrator to manage the public key.
B) The public key is authenticated against reliable third-party identification.
C) PKI's public accessibility allows it to be used readily for e-commerce.
D) The private key uniquely authenticates each party to a transaction.

Question 49

Which of the following is true regarding the COSO enterprise risk management framework?

A) The framework categorizes an organization's objectives to distinct, non overlapping objectives.
B) Control environment is one of the framework's eight components.
C) The framework facilitates effective risk management, even if objectives have not been established.
D) The framework integrates with, but is not dependent upon, the corresponding internal control framework.

Question 50

An internal auditor performed a review of IT outsourcing and found that the service provider was failing to meet the terms of the service level agreement. Which of the following approaches is most appropriate to address this concern?

A) The organization should review the skill requirements and ensure that the service provider is maintaining sufficient expertise and retaining skilled resources.
B) The organization should proactively monitor the performance of the service provider, escalate concerns, and use penalty clauses in the contract where necessary.
C) The organization should ensure that there is a clear management communication strategy and path for evaluating and reporting on all outsourced services concerns.
D) The organization should work with the service provider to review the current agreement and expectations relating to objectives, processes, and overall performance.

Question 51

Which of the following descriptions of the internal control system are indicators that risks are managed effectively? 1. Existing controls promote compliance with applicable laws and regulations. 2. The control environment is designed to address all identified risks to the organization. 3. Key controls for significant risks to the organization remain consistent over time. 4. Monitoring systems are in place to alert management to unexpected events.

A) 1 and 3.
B) 1 and 4.
C) 2 and 3.
D) 2 and 4.

Question 52

Which of the following best describes an objective for an audit of an environmental management system?

A) To assess whether an annual control review is necessary.
B) To determine conformance with requirements and agreements.
C) To evaluate executive management oversight.
D) To promote environmental awareness.

Question 53

Which of the following techniques would be least effective in resolving the conflict created by an internal audit client's perception of the audit report as a personal attack on his management performance?

A) The auditor should focus on the audit client as a person and understand him, rather than just concentrating on the problem.
B) The auditor should make recommendations based on objective criteria, rather than based on a subjective assessment.
C) The auditor should explore alternative solutions to address the audit problem, so the audit client has options.
D) The auditor should take a flexible position on the recommendations and focus on resolving the issue by addressing the interests of the people concerned.

Question 54

Which of the following are appropriate functions for an IT steering committee? 1. Assess the technical adequacy of standards for systems design and programming. 2. Continually monitor of the adequacy and accuracy of software and hardware in use. 3. Assess the effects of new technology on the organization's IT operations. 4. Provide broad oversight of implementation, training, and operation of new systems.

A) 1, 2, and 3
B) 1, 2, and 4
C) 1, 3, and 4
D) 2, 3, and 4

Question 55

The audit committee of a global corporation has mandated a change in the organization's business ethics policy. Which of the following approaches describes the best way to accomplish the policy's diffusion worldwide?

A) Deploy the policy in the corporate headquarters' language, so everyone gets an unfiltered version simultaneously.
B) Introduce the policy region by region, using any lessons learned to change the subsequent version of the policy for the next area.
C) Consult with legal and operational management in each affected country to ensure the final version can be implemented globally, following audit committee approval.
D) Send the board-approved version of the policy to each country's senior leadership, and empower them to tailor the policy to the local language and culture.

Question 56

The economic order quantity can be calculated using the following formula: Which of the following describes how the optimal order size will change if the annual demand increases by 36 percent?

A) Decrease by about 17 percent.
B) Decrease by about 7 percent.
C) Increase by about 7 percent.
D) Increase by about 17 percent.

Question 57

Organizations use matrix management to accomplish which of the following?

A) To improve the chain of command.
B) To strengthen corporate headquarters.
C) To focus better on a single market.
D) To increase lateral communication.

Question 58

Which of the following is the primary benefit of including end users in the system development process?

A) Improved integrity of programs and processing.
B) Enhanced ongoing maintenance of the system.
C) Greater accuracy of the testing phase.
D) Reduced need for unexpected software changes.

Question 59

Which of the following describes the result if an organization records merchandise as a purchase, but fails to include it in the closing inventory count?

A) The cost of goods sold for the period will be understated.
B) The cost of goods sold for the period will be overstated.
C) The net income for the period will be understated.
D) There will be no effect on the cost of goods sold or the net income for the period.

Question 60

Which of the following statements accurately describes one of the characteristics that distinguishes a multinational company from a domestic company?

A) A multinational company has stockholders in other countries.
B) A multinational company exports its products to other countries.
C) A multinational company operates outside of its country of origin.
D) A multinational company uses raw materials and components from more than one country.

Question 61

Which of the following strategies would most likely prevent an organization from adjusting to evolving industry market conditions?

A) Specializing in proven manufacturing techniques that have made the organization profitable in the past.
B) Substituting its own production technology with advanced techniques used by its competitors.
C) Forgoing profits over a period of time to gain market share from its competitors.
D) Using the same branding to sell its products through new sales channels to target new markets.

Question 62

Which of the following statements about COBIT is not true?

A) COBIT helps management understand and manage the risks associated with information technology (IT) processes.
B) Management needs to determine the cost-benefit ratio of adopting COBIT control objectives.
C) COBIT control objectives are specific to various IT platforms and help determine minimum controls.
D) COBIT provides management with the capability to conduct self-assessments against industry best practices.

Question 63

An internal auditor has been asked to conduct an investigation involving allegations of independent contractor fraud. Which of the following controls would be least effective in detecting any potential fraudulent activity?

A) Exception report identifying payment anomalies.
B) Documented policy and procedures.
C) Periodic account reconciliation of contractor charges.
D) Monthly management review of all contractor activity.

Question 64

According to Porter, which of the following is associated with fragmented industries?

A) Weak entrance barriers.
B) Significant scale economies.
C) Steep experience curve.
D) Strong negotiation power with suppliers.

Question 65

Which of the following should an organization consider when developing strategic objectives for its business processes? 1. Contribution to the success of the organization. 2. Reliability of operational information. 3. Behaviors and actions expected of employees. 4. How inputs combine with outputs to generate activities.

A) 1 and 2 only
B) 1 and 3 only
C) 2 and 4 only
D) 3 and 4 only

Question 66

What are the objectives of governance as defined by the Standards?

A) Inform, direct, manage, and monitor.
B) Identify, assess, manage, and control.
C) Organize, assign, authorize, and implement.
D) Add value, improve, assure, and conform.

Question 67

Where complex problems need to be addressed, which of the following communication networks would be most appropriate?

A) Chain.
B) All-channel.
C) Circle.
D) Wheel.

Question 68

Which of the following statements is false regarding the internal audit approach when a set of standards other than The IIA's Standards is applicable to a specific engagement?

A) The internal auditor may cite the use of other standards during audit communications.
B) If the other standards are government-issued, the internal auditor should apply them in conjunction with The IIA's Standards.
C) If there are inconsistencies between the other standards and The IIA's Standards, the internal auditor must use the more restrictive standards.
D) If there are inconsistencies between the other standards and The IIA's Standards, the internal auditor must use the less restrictive standards.

Question 69

An organization facing rapid growth decides to employ a third party service provider to manage its customer relationship management function. Which of the following is true regarding the supporting application software used by that provider compared to an in-house developed system? 1. Updating documentation is always a priority. 2. System availability is usually more reliable. 3. Data security risks are lower. 4. Overall system costs are lower.

A) 1 and 2 only
B) 1 and 3 only
C) 2 and 4 only
D) 3 and 4 only

Question 70

In an organization where enterprise risk management practices are mature, which of the following is a core internal audit role?

A) Giving assurance that risks are evaluated correctly.
B) Developing the risk management strategy for the board's approval.
C) Facilitating the identification and evaluation of risks.
D) Coaching management in responding to risk.

Question 71

Which of the following statements about market signaling is correct? 1. The organization releases information about a new product generation. 2. The organization limits a challenger's access to the best source of raw materials or labor. 3. The organization announces that it is fighting a new process technology. 4. The organization makes exclusive arrangements with the channels.

A) 1 and 3 only
B) 1 and 4 only
C) 2 and 3 only
D) 2 and 4 only

Question 72

Which of the following is an example of a risk avoidance response?

A) Buying an insurance policy to protect against loss events.
B) Hedging against natural gas price fluctuations.
C) Selling a non-strategic business unit.
D) Outsourcing a high risk process to a third party.

Question 73

Which of the following phases of a business cycle are marked by an underuse of resources? 1. The trough. 2. The peak. 3. The recovery. 4. The recession.

A) 1 and 3 only
B) 1 and 4 only
C) 2 and 3 only
D) 2 and 4 only

Question 74

Providing knowledge, motivating organizational members, controlling and coordinating individual efforts, and expressing feelings and emotions are all functions of:

A) Motivation.
B) Performance.
C) Organizational structure.
D) Communication.

Question 75

Within an enterprise, IT governance relates to the: 1. Alignment between the enterprise's IT long term plan and the organization's objectives. 2. Organizational structures of the company that are designed to ensure that IT supports the organization's strategies and objectives. 3. Operational plans established to support the IT strategies and objectives. 4. Role of the company's leadership in ensuring IT supports the organization's strategies and objectives.

A) 1 and 2 only
B) 3 and 4 only
C) 1, 2, and 4 only
D) 2, 3, and 4 only

Question 76

An organization accumulated the following data for the prior fiscal year: Value of Percentage of Quarter Output Produced Cost X 1 $4,750,000 2.9 2 $4,700,000 3.0 3 $4,350,000 3.2 4 $4,000,000 3.5 Based on this data, which of the following describes the value of Cost X in relation to the value of Output Produced?

A) Cost X is a variable cost.
B) Cost X is a fixed cost.
C) Cost X is a semi-fixed cost.
D) Cost X and the value of Output Produced are unrelated.

Question 77

In order to provide useful information for an organization's risk management decisions, which of the following factors is least important to assess?

A) The underlying causes of the risk.
B) The impact of the risk on the organization's objectives.
C) The risk levels of current and future events.
D) The potential for eliminating risk factors.

Question 78

In which type of business environment are price cutting strategies and franchising strategies most appropriate?

A) Embryonic, focused.
B) Fragmented, decline.
C) Mature, fragmented.
D) Competitive, embryonic.

Question 79

An organization's balance sheet indicates that the total asset amount and the total capital stock amount remained unchanged from one year to the next, and no dividends were declared or paid. However, the organization reported a loss of $200,000. Which of the following describes the most likely year-over-year change to the organization's total liabilities and total stockholder equity?

A) The total liabilities and total stockholder equity both increased.
B) The total liabilities and total stockholder equity both decreased.
C) The total liabilities decreased, and the total stockholder equity increased.
D) The total liabilities increased, and the total stockholder equity decreased.

Question 80

An internal auditor is trying to assess control risk and the effectiveness of an organization's internal controls. Which of the following audit procedures would not provide assurance to the auditor on this matter?

A) Interviewing the organization's employees.
B) Observing the organization's operations.
C) Reading the board's minutes.
D) Inspecting manuals and documents.