Question 1

Embedded audit modules or audit hooks are examples of continuous auditing techniques.

Accepted Answer

Embedded audit modules and audit hooks are examples of continuous auditing techniques that enable auditors to obtain real-time data and assess the accuracy and completeness of financial reporting.

Question 2

A career in information technology auditing requires both specialized skills and a broad-based set of technical knowledge.

Accepted Answer

Information technology auditing involves evaluating and analyzing computer systems and networks to ensure that they are secure, efficient, and compliant with legal and regulatory requirements. This requires a specialized set of skills such as knowledge of computer programming, network architecture, and information security. However, IT auditors also need to have a broad understanding of various technologies, software applications, and business processes in order to effectively assess risks and identify areas of improvement.

Question 3

An information systems risk assessment is as concerned with errors and accidents as it is with fraud.

Accepted Answer

An information systems risk assessment evaluates potential threats to an organization's information systems, which encompass both intentional acts of fraud as well as unintentional errors and accidents. It is important for organizations to address all types of risks in order to protect their systems and data.

Question 4

Normal transactions rather than exception transactions are of most interest to auditors.

Accepted Answer

Auditors are particularly interested in exception transactions because they are more likely to contain errors, irregularities, or be indicative of fraudulent activity, thus requiring closer examination.

Question 5

One problem with internal auditing is that it is akin to self-regulation i.e., the auditor cannot be impartial because both the auditor and the subsystem being audited work for the same company).

Accepted Answer

The answer of One problem with internal auditing is that...

Question 6

The greatest advantage of an integrated test facility is that it enables an auditor to examine both manual and computerized steps companies take to process business transactions.

Accepted Answer

The answer of The greatest advantage of an integrated test...

Question 7

The main objective of information technology auditing is to evaluate the IT's role in achieving audit and control objectives.

Accepted Answer

The main objective of information technology auditing is indeed to evaluate the IT's role in achieving audit and control objectives. This includes assessing the reliability and accuracy of information systems, as well as ensuring compliance with laws and regulations related to IT. Ultimately, the goal is to provide assurance that IT is supporting the organization's objectives effectively and efficiently.

Question 8

An ideal program change control process includes required documentation of every request for application program changes as well as the use of a test environment for development and implementation of program changes.

Accepted Answer

A program change control process should include documentation of every request and the use of a testing environment to ensure the changes do not harm the production environment.

Question 9

Certified Information System Auditors must have an accounting degree.

Accepted Answer

While an accounting degree can be helpful for a career as a Certified Information System Auditor, it is not a requirement. Other relevant degrees or experience in the field may also qualify an individual for this certification.

Question 10

An auditing around the computer approach pays little or no attention to the control procedures within an IT environment.

Accepted Answer

An "auditing around the computer" approach focuses on verifying the input data and the output results of computer systems, without examining the internal workings or control procedures of the IT environment.

Question 11

In auditing through the computer, auditors will want to review systems software documentation.

Accepted Answer

Reviewing systems software documentation is an important part of auditing through the computer as it helps auditors understand the functions of a computer system and how it is configured. This includes reviewing operating system manuals, system flowcharts, data dictionary, and other documentation that describe the technical aspects of the system.

Question 12

Both the internal audit and the external audit have the same primary objective i.e., to verify that the financial records of the company have been prepared according to generally accepted accounting principles).

Accepted Answer

The primary objective of an internal audit is to assess the effectiveness of a company's internal controls, risk management, and governance processes, while the primary objective of an external audit is to verify that the financial records of the company have been prepared according to generally accepted accounting principles (GAAP) and to provide an independent opinion on the financial statements.

Question 13

The Electronic Systems Assurance and Control model provides a framework for evaluating controls over email systems.

Accepted Answer

The answer of The Electronic Systems Assurance and Control model...

Question 14

The focus in an audit should be primarily on business risk rather than on internal control.

Accepted Answer

The primary focus of an audit is to assess the risk of material misstatement of the financial statements, which is driven by business risks. Internal control is only one factor that affects the risk of material misstatement.

Question 15

Many of the assurance services auditors offer today involve information technology.

Accepted Answer

With the increasing use of technology in businesses, many assurance services such as IT audits, cybersecurity reviews, and data analytics are being offered by auditors.

Question 16

Computer assisted audit techniques are used primarily when auditing around the computer.

Accepted Answer

Computer assisted audit techniques (CAATs) are used to perform substantive tests of controls, analytical procedures, and substantive tests of transactions directly on data stored in computer systems. Therefore, CAATs are used primarily to audit through the computer and not around the computer.

Question 17

Use of test data is not recommended when evaluating integrated online systems.

Accepted Answer

The answer of Use of test data is not recommended...

Question 18

Public companies are required to adopt the Control Objectives for Information and Related Technology framework under SOX.

Accepted Answer

SOX (Sarbanes-Oxley Act) does not specifically require public companies to adopt the Control Objectives for Information and Related Technology (COBIT) framework; it mandates an internal control framework without specifying COBIT.

Question 19

If control procedures over a company's computerized financial accounting system are particularly strong, auditors will not need to perform any substantive testing.

Accepted Answer

Strong control procedures over a company's computerized financial accounting system can decrease the risk of material misstatements, but auditors still need to perform substantive testing to ensure the accuracy and completeness of the financial statements.

Question 20

When the costs of protecting against a business risk exceed the cost of the risk multiplied by its probability, an auditor will generally recommend against installing the specific control.

Accepted Answer

This is known as the "cost-benefit analysis" approach to risk management, where the cost of implementing a control should not exceed the expected losses from the risk being mitigated.

Quiz 12: Information Technology Auditing