Question 1

Which one of the following is NOT a general control?
A) Processing controls
B) Segregation of IT duties
C) Hardware controls
D) Backup

Accepted Answer

Processing controls are a type of general control, along with segregation of IT duties, hardware controls, and backup.

Question 2

Auditors usually evaluate the effectiveness of:
A) applications controls first.
B) sales- cycle controls first.
C) general controls before applications controls.
D) hardware controls first.

Accepted Answer

General controls are the foundation for all information systems controls and must be evaluated first to ensure that the application controls are operating effectively. Hardware controls are also important, but they are part of the general controls. Sales-cycle controls and applications controls are evaluated after the general controls have been assessed.

Question 3

The auditor can perform many different kinds of tests and other functions with the auditor's computer program. Which of the following tests or functions CANNOT be performed?
A) Verify extensions and footings.
B) Analyse exception responses returned with confirmations received from customers.
C) Compare data on separate files.
D) Re- sequence data and perform analyses.

Accepted Answer

Analyzing exception responses from confirmations requires human judgment and understanding of context, which cannot be fully automated by a computer program.

Question 4

Internal control is ineffective when computer programmers:
A) design documentation for computerised systems.
B) request physical security be provided for program files.
C) have access to actual programs used to produce accounting information.
D) participate in computer software acquisition decisions.

Accepted Answer

When computer programmers have access to actual programs used to produce accounting information, they can potentially manipulate the programs to produce incorrect or fraudulent information without detection. This is a violation of the principle of segregation of duties, which is a key component of effective internal control. Designing documentation for computerized systems, requesting physical security for program files, and participating in computer software acquisition decisions do not necessarily lead to ineffective internal control on their own.

Question 5

Which of the following is NOT a general control?
A) Post processing reviews
B) Preparation of backup plans
C) Access to hardware is restricted
D) Equipment error causes error messages to appear on the computer monitor

Accepted Answer

The answer of Which of the following is NOT a...

Question 6

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?
A) Totalling the client's accounts receivable balances
B) Random sampling of all other receivables
C) Inquiry of management policy on aged debtors
D) Comparing creditor statements with accounts payable files

Accepted Answer

Generalised audit software can perform a wide range of tests including totaling account balances, random sampling, and comparing different files. However, inquiring about management policy is not a test that can be performed using generalised audit software. Such an inquiry would require the auditor to directly communicate with management.

Question 7

Auditing around the computer:
A) uses computer programs to perform audit tasks in special circumstances.
B) uses the client's computer as an audit tool.
C) only considers the non- IT controls in assessing control risk.
D) all of the above

Accepted Answer

Auditing around the computer involves assessing control risk by focusing on non-IT controls and examining inputs and outputs without evaluating the internal processing of the computer system.

Question 8

Strong general controls mitigate which type of risks?
A) Risk of system obsolescence
B) Risk of system crash
C) Risk of theft of information and data
D) All of the above

Accepted Answer

The answer of Strong general controls mitigate which type of...

Question 9

The objective of understanding internal control and assessing control risk in an IT system is:
A) to gain an understanding of the computer hardware and software.
B) to evaluate management's efficiency in designing and using the IT system.
C) to determine if the audit firm must have an IT auditor on the team.
D) to aid in determining the audit evidence that should be accumulated.

Accepted Answer

The objective of understanding internal control and assessing control risk in an IT system is to aid in determining the audit evidence that should be accumulated. This is because understanding the IT system and its internal controls helps the auditor identify areas of higher or lower risk, which in turn helps them determine the nature, timing, and extent of audit procedures that should be performed. While the other options may be related to the objective, they are not the primary purpose of assessing control risk in an IT system.

Question 10

When the client uses a computer but the auditor chooses to use only the non- IT segment of internal control to assess control risk, it is referred to as auditing around the computer. Which one of the following conditions need NOT be present in order to audit around the computer?
A) Computer programs must be available in English.
B) User controls include comparison of computer- produced records with source documents.
C) The accounting software can display or print ledger balances and transaction details that allow the auditor to trace individual transactions through the accounting records.
D) The source documents are available in a readable form and can be traced easily through the accounting system to output.

Accepted Answer

The availability of computer programs in English is not a necessary condition for auditing around the computer. However, the other options (B, C, and D) are all necessary conditions for auditing around the computer as they relate to the ability of the auditor to assess control risk without relying on IT controls.

Question 11

Should the auditor feel, after obtaining an understanding of IT internal control, that control risk cannot be reduced, he or she will:
A) issue an adverse opinion.
B) increase the sample size for tests of controls.
C) issue a disclaimer.
D) expand the substantive testing portion of the audit.

Accepted Answer

If control risk cannot be reduced, the auditor will expand substantive testing to gather sufficient evidence to support the audit opinion.

Question 12

An auditor's investigation of a company's IT control procedures has disclosed the following four circumstances. Indicate which circumstance constitutes a weakness in internal control.
A) Only one copy of backup files is stored in an off- premises location.
B) Computer operators are closely supervised by programmers.
C) Programmers do not have the authorisation to operate equipment.
D) Computer operators do not have access to the complete run manual.

Accepted Answer

Having computer operators closely supervised by programmers can lead to a conflict of interest and reduce the effectiveness of segregation of duties. Programmers should not have direct control over computer operations to prevent unauthorized changes to programs or data.

Question 13

Development and changes to IT systems are generally coordinated by a _ analyst.
A) financial
B) technical
C) systems
D) all of the above

Accepted Answer

Systems analysts are responsible for coordinating the development and changes to IT systems. While financial and technical analysts may be involved in certain aspects of the process, systems analysts are generally the ones responsible for ensuring that all components are working together smoothly and meeting the organization's needs.

Question 14

A key to successful software purchase decisions involves:
A) IT and non- IT personnel.
B) internal auditors.
C) key users of the software.
D) all of the above

Accepted Answer

Successful software purchase decisions involve input and collaboration from IT and non-IT personnel, internal auditors, and key users of the software. This ensures that the software meets the needs of the organization and is compatible with existing systems and processes.

Question 15

A site is allowed to retain the Webtrust seal if the auditor monitors compliance at least every:
A) 120 days.
B) 60 days.
C) 30 days.
D) 90 days.

Accepted Answer

According to the Webtrust criteria, the auditor must monitor compliance at least every 90 days for a site to retain the Webtrust seal.

Question 16

IT can significantly impact on an organisation's overall control risk. Which of the following risks would NOT be important from an auditing perspective?
A) Use of unreliable information because of processing errors produced by the technology
B) The inability to retrieve important information because of IT systems failure
C) The potential for material misstatement
D) None of the above, i.e., they are all important.

Accepted Answer

All the listed risks are important from an auditing perspective as they can affect the accuracy and reliability of financial information.

Question 17

Well- controlled organisations segregate key duties within IT. Ideally, this means the following responsibilities should be separated:
A) IT management separate from operations.
B) IT management separate from data control.
C) IT management separate from systems development.
D) All of the above

Accepted Answer

All of the above options should be implemented to ensure proper segregation of duties within IT. Separating IT management from operations helps to prevent conflicts of interest and ensures unbiased decision-making. Separating IT management from data control helps to prevent unauthorized access to sensitive information. Separating IT management from systems development helps to ensure independent oversight of system development and implementation.

Question 18

Parallel testing involves:
A) requiring the user to re- input critical fields to verify accuracy of input.
B) operating the old and the new system simultaneously.
C) implementing a new system in one part of the organisation while other locations continue to rely on the old system.
D) processing test data against a copy of the client's application program.

Accepted Answer

Parallel testing involves operating the old and new system simultaneously to compare their results and ensure the accuracy of the new system before completely replacing the old system. This allows for a smooth transition from the old system to the new one without disrupting business operations. Option A is referring to data entry validation and not parallel testing. Option C involves implementing a new system in some locations but not in others and not operating them simultaneously. Option D is referring to testing using a copy of the client's application program and not parallel testing.

Question 19

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?
A) Review of accounts receivable balances for amounts over the credit limit
B) Observing cash receipts processes
C) Recalculating employees' net pay calculations
D) Preparing general ledger trial balances

Accepted Answer

Generalised audit software is designed to perform tests that involve data analysis and manipulation, such as recalculating net pay calculations and reviewing accounts receivable balances. However, it cannot observe physical processes like cash receipts. Preparing general ledger trial balances can also be performed using generalised audit software.

Question 20

When auditing a computerised system, an auditor may use the test data approach as an audit tool. This technique:
A) involves introducing simulated transactions into the client's actual application program(s).
B) should not involve the actual application programs the client uses throughout the year, since use of the actual programs would contaminate the client's accounting data.
C) is more applicable to independent audits than internal audits.
D) is a commonly used audit technique for auditing around the computer.

Accepted Answer

The test data approach involves introducing simulated transactions into the client's actual application program(s). This allows the auditor to test the effectiveness and accuracy of the system. Option B is incorrect as the actual application programs are used to test the system. Option C is incorrect as the test data approach can be used in both independent and internal audits. Option D is incorrect as the test data approach is used for auditing through the computer, not around it.

Quiz 10: The Impact of Information Technology on the Audit Process

Which one of the following is NOT a general control?

Auditors usually evaluate the effectiveness of:

The auditor can perform many different kinds of tests and other functions with the auditor's computer program. Which of the following tests or functions CANNOT be performed?

Internal control is ineffective when computer programmers:

Which of the following is NOT a general control?

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?

Auditing around the computer:

Strong general controls mitigate which type of risks?

The objective of understanding internal control and assessing control risk in an IT system is:

When the client uses a computer but the auditor chooses to use only the non- IT segment of internal control to assess control risk, it is referred to as auditing around the computer. Which one of the following conditions need NOT be present in order to audit around the computer?

Should the auditor feel, after obtaining an understanding of IT internal control, that control risk cannot be reduced, he or she will:

An auditor's investigation of a company's IT control procedures has disclosed the following four circumstances. Indicate which circumstance constitutes a weakness in internal control.

Development and changes to IT systems are generally coordinated by a _ analyst.

A key to successful software purchase decisions involves:

A site is allowed to retain the Webtrust seal if the auditor monitors compliance at least every:

IT can significantly impact on an organisation's overall control risk. Which of the following risks would NOT be important from an auditing perspective?

Well- controlled organisations segregate key duties within IT. Ideally, this means the following responsibilities should be separated:

Parallel testing involves:

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?

When auditing a computerised system, an auditor may use the test data approach as an audit tool. This technique: