Question 1

Which control is not associated with new systems development activities?
A)reconciling program version numbers
B)program testing
C)user involvement
D)internal audit participation

Accepted Answer

Reconciling program version numbers is more associated with maintenance and version control of already developed systems rather than the development of new systems. Program testing, user involvement, and internal audit participation are all integral parts of the development process for new systems.

Question 2

The programmer's authority table will specify the libraries a programmer may access.

Accepted Answer

The authority table is used to specify the level of access a programmer has to various resources including libraries.

Question 3

Routine maintenance activities require all of the following controls except
A)documentation updates
B)testing
C)formal authorization
D)internal audit approval

Accepted Answer

Internal audit approval is not typically required for routine maintenance activities. However, documentation updates, testing, and formal authorization are all important controls that should be in place for routine maintenance activities.

Question 4

To meet the governance-related expectations of management under SOX,an organization's internal audit department needs to be all of the following except
A)independent
B)objective
C)technically qualified
D)designers of test data

Accepted Answer

Internal audit departments are responsible for providing assurance that governance and control processes are being followed properly. While they may use test data to check whether internal controls are working as intended, they are not typically responsible for designing this data. Therefore, option D is the correct answer. Options A, B, and C are all characteristics that an internal audit department should possess to fulfill its responsibilities under SOX.

Question 5

Which statement is not true?
A)An audit objective for systems maintenance is to detect unauthorized access to application databases.
B)An audit objective for systems maintenance is to ensure that applications are free from errors.
C)An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version numbers.
D)An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized access.

Accepted Answer

An audit objective for systems maintenance is to detect unauthorized access to application databases is a true statement. The other options (B, C, and D) are also true statements.

Question 6

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

Accepted Answer

Comparing results of a parallel simulation to production run is a common method to check the quality of application processes and controls.

Question 7

Program testing
A)involves individual modules only, not the full system
B)requires creation of meaningful test data
C)need not be repeated once the system is implemented
D)is primarily concerned with usability

Accepted Answer

Program testing involves testing the entire system, not just individual modules. It requires the creation of meaningful test data to ensure that the system works correctly. Testing should be repeated even after implementation, as changes or updates to the system can cause new defects to emerge. Usability testing is only one aspect of program testing, which also includes functional, performance, and security testing.

Question 8

All of the following concepts are associated with the black box approach to auditing computer applications except
A)the application need not be removed from service and tested directly
B)auditors do not rely on a detailed knowledge of the application's internal logic
C)the auditor reconciles previously produced output results with production input transactions
D)this approach is used for complex transactions that receive input from many sources

Accepted Answer

The black box approach is commonly used for testing simple or routine transactions that have a limited number of input sources, not complex transactions that receive input from many sources. A, B, and C are all characteristics of the black box approach.

Question 9

When analyzing the results of the test data method,the auditor would spend the least amount of time reviewing
A)the test transactions
B)error reports
C)updated master files
D)output reports

Accepted Answer

The auditor would spend the least amount of time reviewing the test transactions because these are specifically created for the purpose of the audit to test the system's processing capabilities. The focus of the auditor is more on the outcomes and effects of these transactions on the system (such as error reports, updated master files, and output reports) to assess the system's accuracy and reliability.

Question 10

Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud?
A)A cost-benefit analysis was conducted.
B)The detailed design was an appropriate solution to the user's problem.
C)Tests were conducted at the individual module and total system levels prior to implementation.
D)Problems detected during the conversion period were corrected in the maintenance phase.

Accepted Answer

Tests conducted at the individual module and total system levels prior to implementation will provide evidence that the system as originally implemented was free from material errors and free from fraud. A cost-benefit analysis assesses the trade-offs between costs and benefits, but does not necessarily provide evidence of the system's accuracy or freedom from fraud. The detailed design being an appropriate solution to the user's problem does not guarantee the absence of errors or fraud. Finally, problems detected during the conversion period being corrected in the maintenance phase only ensure that errors are corrected, but do not provide evidence that the system was error-free prior to implementation.

Question 11

When the auditor reconciles the program version numbers,which audit objective is being tested?
A)protect applications from unauthorized changes
B)ensure applications are free from error
C)protect production libraries from unauthorized access
D)ensure incompatible functions have been identified and segregated

Accepted Answer

When the auditor reconciles the program version numbers, they are checking if the applications have been changed or updated without proper authorization. This is a test of the audit objective to protect applications from unauthorized changes.

Question 12

Which statement is correct?
A)Compiled programs are very susceptible to unauthorized modification.
B)The source program library stores application programs in source code form.
C)Modifications are made to programs in machine code language.
D)The source program library management system increases operating efficiency.

Accepted Answer

The statement "The source program library stores application programs in source code form" is correct. The source program library is where programs are stored in their original source code form, which can be edited and modified by authorized personnel. Compiled programs are not easily modifiable as they are in machine code form, while modification of programs is also not done in machine code language. The source program library management system does aid in managing the source code, but it is not specified whether it increases operating efficiency.

Question 13

Which of the following statements is not true?
A)All systems should be properly authorized to ensure their economic justification and feasibility.
B)Users need not be actively involved in the systems development process.
C)All program modules must be thoroughly tested before they are implemented.
D)The task of creating meaningful test data is time consuming.

Accepted Answer

Users should be actively involved in the systems development process to ensure their needs and requirements are met. Their feedback can also help to identify issues and areas for improvement.

Question 14

Which control is not a part of the source program library management system?
A)using passwords to limit access to application programs
B)assigning a test name to all programs undergoing maintenance
C)combining access to the development and maintenance of test libraries
D)assigning version numbers to programs to record program modifications

Accepted Answer

Combining access to the development and maintenance of test libraries is not a control that is a part of the source program library management system. The other options - using passwords to limit access, assigning a test name, and assigning version numbers to programs - are all controls that are commonly used in the management of source program libraries.

Question 15

Use of the integrated test facility poses no threat to organizational data files.

Accepted Answer

The integrated test facility method involves inserting and processing test data alongside live data, which, if not carefully managed, could potentially lead to accidental corruption or compromise of organizational data files.

Question 16

Which test is not an example of a white box test?
A)determining the fair value of inventory
B)ensuring that passwords are valid
C)verifying that all pay rates are within a specified range
D)reconciling control totals

Accepted Answer

White box testing involves testing internal structures or workings of an application, as opposed to its functionality (black box testing). Determining the fair value of inventory is not an example of white box testing because it does not involve examining the internal structures or workings of software; it's more related to accounting or financial auditing practices.

Question 17

Which control ensures that production files cannot be accessed without specific permission?
A)database management system
B)recovery operations function
C)source program library management system
D)computer services function

Accepted Answer

The source program library management system controls access to production files by only allowing specific individuals with the appropriate permissions to access and modify them. The database management system, recovery operations function, and computer services function do not necessarily have the same level of control over production files as the source program library management system.

Question 18

Firms with an independent internal audit staff may conduct tests of the system development life cycle on an ongoing basis.

Accepted Answer

Firms with independent internal audit staff may conduct ongoing tests of the system development life cycle to ensure that it is well-designed and effectively implemented. This helps to identify any weaknesses or inefficiencies in the process and allows for corrective actions to be taken in a timely manner.

Question 19

When auditors do not rely on a detailed knowledge of the application's internal logic,they are performing
A)black box tests of program controls
B)white box tests of program controls
C)substantive testing
D)intuitive testing

Accepted Answer

Black box testing of program controls refers to testing the functionality of a program without detailed knowledge of its internal logic. This type of testing focuses on the inputs and outputs of the program and not its internal workings. It is commonly used by auditors to test the effectiveness of program controls.

Question 20

Generalized audit software packages are used to assist the auditor in performing substantive tests.

Accepted Answer

Generalized audit software packages are specifically designed to help auditors in performing substantive tests by automating large volumes of data analysis and identifying exceptions and anomalies that need further investigation.

Quiz 16: Auditing It Controls Part III: Systems Development, program Changes, and Application Auditing

Which control is not associated with new systems development activities?

The programmer's authority table will specify the libraries a programmer may access.

Routine maintenance activities require all of the following controls except

To meet the governance-related expectations of management under SOX,an organization's internal audit department needs to be all of the following except

Which statement is not true?

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

Program testing

All of the following concepts are associated with the black box approach to auditing computer applications except

When analyzing the results of the test data method,the auditor would spend the least amount of time reviewing

Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud?

When the auditor reconciles the program version numbers,which audit objective is being tested?

Which statement is correct?

Which of the following statements is not true?

Which control is not a part of the source program library management system?

Use of the integrated test facility poses no threat to organizational data files.

Which test is not an example of a white box test?

Which control ensures that production files cannot be accessed without specific permission?

Firms with an independent internal audit staff may conduct tests of the system development life cycle on an ongoing basis.

When auditors do not rely on a detailed knowledge of the application's internal logic,they are performing

Generalized audit software packages are used to assist the auditor in performing substantive tests.