Deck 11: Auditing Computer-Based Information Systems

Question 1

The ________ audit reviews the general and application controls of an AIS to assess its compliance with internal control policies and procedures and its effectiveness in safeguarding assets.

A)financial
B)information systems
C)management
D)internal control

Answer 1

B

Question 2

An organization that has an antiquated accounting information system has more ________ risk than an organization that has a more advanced system.

A)control
B)detection
C)inherent
D)investing

Answer 2

A

Question 3

The ________ audit is concerned with the economical and efficient use of resources and the accomplishment of established goals and objectives.

A)financial
B)informational
C)information systems
D)operational

Answer 3

D

Question 4

The ________ stage of the auditing process involves (among other things)the auditors observing the operating activities and having discussions with employees.

A)audit planning
B)collection of audit evidence
C)communication of audit results
D)evaluation of audit evidence

Question 5

A system that employs various types of advanced technology has more ________ risk than traditional batch processing.

A)control
B)detection
C)inherent
D)investing

Question 6

The purpose of ________ is to determine why,how,when,and who will perform the audit.

A)audit planning
B)the collection of audit evidence
C)the communication of audit results
D)the evaluation of audit evidence

Question 7

Organizing the audit team and the physical examination of assets are components of which two separate audit stages?

A)Planning; evaluating audit evidence.
B)Planning; collecting audit evidence.
C)Collecting audit evidence; communicating audit results.
D)Communicating audit results; evaluating audit evidence.

Question 8

Control risk is defined as the

A)susceptibility to material risk in the absence of controls.
B)risk that a material misstatement will get through the internal control structure and into the financial statements.
C)risk that auditors and their audit procedures will not detect a material error or misstatement.
D)risk auditors will not be given the appropriate documents and records by management who wants to control audit activities and procedures.

Question 9

Auditors have the ability to change inherent risk.

Question 10

Auditing involves the

A)collection, review, and documentation of audit evidence.
B)planning and verification of economic events.
C)collection of audit evidence and approval of economic events.
D)testing, documentation, and certification of audit evidence.

Question 11

The possibility that a material error will occur even though auditors are following audit procedures and using good judgment is referred to as

A)control risk.
B)detection risk.
C)inherent risk.
D)investigating risk.

Question 12

Auditors have the ability to change control risk.

Question 13

Auditors have the ability to change detection risk.

Question 14

Which type of work listed below is not typical of internal auditors?

A)Operational and management audits.
B)Information system audits.
C)Financial statement audit.
D)Financial audit of accounting records.

Question 15

A(n)________ audit is concerned with the economical and efficient use of resources and the accomplishment of established goals and objectives.

A)operational or management
B)financial
C)information systems
D)internal control

Question 16

The ________ audit examines the reliability and integrity of accounting records.

A)financial
B)informational
C)information systems
D)operational

Question 17

What is not a typical responsibility of an internal auditor?

A)Helping management to improve organizational effectiveness.
B)Assisting in the design and implementation of an AIS.
C)Preparation of the company's financial statements.
D)Implementing and monitoring of internal controls.

Question 18

Verifying the accuracy of certain information,often through communication with third parties,is known as

A)reperformance.
B)confirmation.
C)substantiation.
D)documentation.

Question 19

Consideration of risk factors and materiality is most associated with which audit stage?

A)Collection of audit evidence.
B)Communication of audit results.
C)Audit planning.
D)Evaluation of audit evidence.

Question 20

What is not a typical responsibility of an external auditor?

A)Helping management to improve organizational effectiveness.
B)Assisting in the design and implementation of an AIS.
C)Preparation of the company's financial statements.
D)All of the above.

Question 21

Increasing the effectiveness of auditing software will

A)reduce detection risk.
B)reduce control risk.
C)increase detection risk.
D)increase control risk.

Question 22

Which of the choices below best describes a risk-based audit approach?

A)A four-step approach to internal control evaluation.
B)A three-step approach to internal control evaluation.
C)A four-step approach to financial statement review and recommendations.
D)A three-step approach to financial statement review and recommendations.

Question 23

The first step in a risk-based audit approach is to

A)evaluate the control procedures.
B)determine the threats facing the AIS.
C)identify the control procedures that should be in place.
D)evaluate weaknesses to determine their effect on the audit procedures.

Question 24

Expanding a firm's operations to include a manufacturing facility overseas will

A)reduce inherent risk.
B)reduce control risk.
C)increase inherent risk.
D)increase control risk.

Question 25

The auditor's objective is to seek ________ that no material error exists in the information audited.

A)absolute reliability
B)reasonable objectivity
C)reasonable evidence
D)reasonable assurance

Question 26

Increasing the effectiveness of internal controls would have the greatest effect on

A)reducing inherent risk.
B)reducing control risk.
C)reducing detection risk.
D)reducing audit risk.

Question 27

________ can determine whether the necessary control procedures are in place.

A)A systems review
B)A systems overhaul
C)Tests of controls
D)Both B and C

Question 28

An auditor calculates the current ratio of the company to determine its ability to pay off its current financial obligation.This is an example of

A)review of the documentation.
B)vouching.
C)confirmation.
D)analytical review.

Question 29

An auditor examines all documents related to the acquisition,repair history,and disposal of a firm's delivery van.This is an example of collecting audit evidence by

A)confirmation.
B)reperformance.
C)vouching.
D)analytical review.

Question 30

There is a direct relationship between inherent risk and detection risk.

Question 31

The evidence collection method that considers the relationships and trends among information to detect items that should be investigated further is called

A)review of the documentation.
B)vouching.
C)physical examination.
D)analytical review.

Question 32

The ________ to auditing provides auditors with a clear understanding of possible errors and irregularities and the related risks and exposures.

A)risk-based approach
B)risk-adjusted approach
C)financial audit approach
D)information systems approach

Question 33

When a control deficiency is identified,the auditor should inquire about

A)tests of controls.
B)compensating controls.
C)the feasibility of a systems review.
D)materiality and inherent risk factors.

Question 34

An auditor searching for a shipping document to ensure that the sales number recorded in the sales journal was properly supported.This is an example of

A)review of the documentation.
B)vouching.
C)confirmation.
D)analytical review.

Question 35

The evidence collection method that examines all supporting documents to determine the validity of a transaction is called

A)review of documentation.
B)vouching.
C)physical examination.
D)analytical review.

Question 36

Auditors often use reperformance to test a company's internal control.

Question 37

Assessing the quality of internal controls,the reliability of information,and operating performance are all part of

A)audit planning.
B)collection of audit evidence.
C)communication of audit results.
D)evaluation of audit evidence.

Question 38

An auditor manually calculates accumulated depreciation on a delivery van and compares her calculation with the accounting records.The auditor is performing

A)vouching.
B)confirmation.
C)reperformance.
D)analytical review.

Question 39

There is an inverse relationship between control risk and detection risk.

Question 40

An auditor finds that employee absentee rates are significantly higher on Mondays and Fridays than on other work days.This is an example collecting audit evidence by

A)confirmation.
B)reperformance.
C)vouching.
D)analytical review.

Question 41

Which of the following is not one of the six objectives of an information systems audit?

A)Security provisions exist to protect data from unauthorized access, modification, or destruction.
B)Obtaining evidence to provide reasonable assurance the financial statements are not materially misstated
C)Programs have been developed and acquired in accordance with management's authorization.
D)Program modifications have received management's authorization and approval.

Question 42

Describe how audit evidence can be collected.

Question 43

Which of the following is an information systems audit review procedure?

A)Verify the extent and effectiveness of encryption.
B)Inspect computer sites.
C)Test assignment procedures for user IDs.
D)Observe the preparation of backup files.

Question 44

The information systems audit objective that pertains to having management's authorization and approval is known as

A)overall security.
B)program development.
C)program modifications.
D)processing.

Question 45

What is the purpose of an information systems audit?

A)To determine the inherent risk factors found in the system.
B)To review and evaluate the internal controls that protect the system.
C)To examine the reliability and integrity of accounting records.
D)To examine whether resources have been used in an economical and efficient manner in keeping with organization goals and objectives.

Question 46

Name and describe the different types of audits.

Question 47

You are an internal auditor for Ron Burgandy Suits.The CEO has asked you to perform an audit of the program modifications process.Identify one procedure you might use to test controls surrounding the program modification process.

A)Review logical access control policies.
B)Discuss modification policies with management, users, and systems personnel.
C)Verify logical access controls are in effect for program changes.
D)Separate development, test, and production versions of programs.

Question 48

Describe the concept of materiality and provide an example.

Question 49

The information systems audit objective that pertains to protect computer equipment,programs,communications,and data from unauthorized access,modification,or destruction is known as

A)overall security.
B)program development.
C)program modifications.
D)processing.

Question 50

How is a financial audit different from an information systems audit?

Question 51

How and to whom does an auditor communicate the audit results?

Question 52

The information systems audit objective that pertains to source data being processed into some form of output is known as

A)overall security.
B)program development.
C)program modifications.
D)processing.

Question 53

Which of the following is not one of the types of internal audits?

A)A review of the corporate organizational structure and reporting hierarchies.
B)An examination of procedures for reporting and disposing of hazardous waste.
C)A review of source documents and general ledger accounts to determine integrity of recorded transactions.
D)A comparison of estimates and analysis made before purchase of a major capital asset to actual numbers and results achieved.

Question 54

Explain the differences between each type of audit risk.

Question 55

You are the head of the IT department at Panther Designs,Inc.A systems review reveals that your firm has poor control procedures for preventing inadvertent programming errors.However,you are not concerned because you feel Panther Designs has strong compensating controls.What control likely exists to give you this confidence?

A)The internal audit department processes test data at Panther Designs.
B)Panther Designs pays its employees well, decreasing the likelihood of errors.
C)Panther Designs only hires competent programmers, decreasing the likelihood of errors.
D)All of Panther Design's IT applications are less than 2 years old.

Question 56

Which of the following is not a control procedure for preventing inadvertent programming errors?

A)Review software license agreements.
B)Test new programs, including user acceptance testing.
C)Purchase hardware only from management approved vendors.
D)Require management approval of programming specifications.

Question 57

Describe the risk-based audit approach.

Question 58

Which of the following is not an information systems audit test of controls?

A)Observe computer-site access procedures.
B)Investigate how unauthorized access attempts are handled.
C)Review logical access policies and procedures.
D)Examine the results of disaster recovery plan simulations.

Question 59

What is a test data generator?

A)It is an application that records how well systems personnel have performed on company competency examinations.
B)It is an application that prepares data that can be used for auditing the effectiveness of computer processing.
C)It is an application that records which professional examinations systems personnel have obtained.
D)It is a backup generator application that can be used to generate data if the original storage device fails.

Question 60

Why do all audits follow a sequence of events that can be divided into four stages,and what are the four stages?

Question 61

The ________ procedure for auditing computer process controls uses a hypothetical series of valid and invalid transactions.

A)concurrent audit techniques
B)test data processing
C)integrated test facility
D)dual process

Question 62

Software that interprets a program's source code and generates a flowchart of the program's logic is called

A)automated flowcharting programs.
B)automated decision table programs.
C)mapping programs.
D)tracing program.

Question 63

Auditors have several techniques available to them to test computer-processing controls.An audit technique that immediately alerts auditors of suspicious transactions is known as

A)a SCARF.
B)reperformance.
C)the snapshot technique.
D)an audit hook.

Question 64

________ is one tool used to document source data controls.

A)An input control matrix
B)A flowchart generator program
C)A program algorithm matrix
D)A mapping program

Question 65

Strong ________ controls can partially compensate for inadequate ________ controls.

A)development; processing
B)processing; development
C)operational; internal
D)internal; operational

Question 66

What role should an auditor play in system development?

A)an independent reviewer only
B)a developer of internal controls
C)an advisor and developer of internal control specifications
D)A and B above

Question 67

Marking transactions with a special code,recording them and their master file records before and after processing,and storing the data to later verify that all processing steps were properly executed is an example of

A)integrated test facility.
B)snapshot technique.
C)system control audit review file.
D)audit hooks.

Question 68

Which auditing technique will not assist in determining if unauthorized programming changes have been made?

A)The use of a source code comparison program.
B)The use of the reprocessing technique to compare program output.
C)By interviewing and making inquiries of the programming staff.
D)The use of parallel simulation to compare program output.

Question 69

Software that identifies unexecuted program code is called

A)automated flowcharting programs.
B)automated decision table programs.
C)mapping programs.
D)tracing program.

Question 70

Inserting a dummy entity in a company's system; processing test transactions to update that will not affect actual records is an example of

A)integrated test facility.
B)snapshot technique.
C)system control audit review file.
D)audit hooks.

Question 71

Describe the difference between concurrent audit techniques and embedded audit modules.

Question 72

The auditor uses ________ to continuously monitor the system and collect audit evidence while live data are processed.

A)test data processing
B)parallel simulation
C)concurrent audit techniques
D)analysis of program logic

Question 73

Identify the activity below that the external auditor should not be involved.

A)Examining system access logs.
B)Developing the information system.
C)Examining logical access policies and procedures.
D)Making recommendations to management for improvement of existing internal controls.

Question 74

Using embedded audit modules to continuously monitor transactions,collect data on transactions with special audit significance,and store the data to later identify and investigate questionable transactions is an example of

A)integrated test facility.
B)snapshot technique.
C)system control audit review file.
D)audit hooks.

Question 75

A type of software that auditors can use to analyze program logic and detect unexecuted program code is

A)an audit log.
B)a mapping program.
C)a scanning routine.
D)program tracing.

Question 76

How could auditors determine if unauthorized program changes have been made?

A)By interviewing and making inquiries of the programming staff.
B)By examining the systems design and programming documentation.
C)By using a source code comparison program.
D)By interviewing and making inquiries of recently terminated programming staff.

Question 77

Embedded audit molecules can be used to continually monitor the system and collect audit evidence.

Question 78

Audit routines that notify auditors of questionable transactions,often as they occur is an example of

A)integrated test facility.
B)snapshot technique.
C)system control audit review file.
D)audit hooks.

Question 79

Which statement below is incorrect regarding program modifications?

A)Only material program changes should be thoroughly tested and documented.
B)During the change process, the developmental version of the program must be kept separate from the production version.
C)After the modified program has received final approval, the change is implemented by replacing the developmental version with the production version.
D)When a program change is submitted for approval, a list of all required updates should be compiled and then approved by management and program users.

Question 80

Describe the five commonly used concurrent audit techniques.