Question 1

The completeness of computer generated sales figures can be tested by comparing the number of items listed on the daily sales report with the number of items billed on the actual invoices. This process uses:
A) Self-checking numbers.
B) Control totals.
C) Validity tests.
D) Process tracing data.

Accepted Answer

This process uses control totals, which is a method of ensuring the completeness and accuracy of computer generated data by comparing the total of a particular data field in the computer system with the same field in a separate source, such as invoices. Self-checking numbers, validity tests, and process tracing data are other methods of ensuring data accuracy but are not specifically applicable to this process.

Question 2

An auditor may decide not to perform tests of controls related to the control activities within the computer portion of the client's internal control. Which of the following would not be a valid reason for choosing to omit such test?
A) The controls duplicate operative controls existing elsewhere.
B) There appear to be major weaknesses that would preclude reliance on the stated procedure.
C) The time and dollar costs of testing exceed the time and dollar savings in substantive testing if the tests show the controls to be operative.
D) The controls appear adequate.

Accepted Answer

The auditor may decide not to perform tests of controls if they duplicate other controls, if there are major weaknesses, or if the cost of testing exceeds the benefits. However, if the controls appear adequate, this is not a valid reason to omit testing; it's actually a reason to consider testing to rely on those controls.

Question 3

The capability for computers to communicate with physically remote terminals is an important feature in the design of modern business information systems. Which of the following risks associated with the use of telecommunications systems is minimized through the use of a password control system?
A) Unauthorized access to system program and data files.
B) Unauthorized physical availability of remote terminals.
C) Physical destruction of system program and data files.
D) Physical destruction of remote terminals.

Accepted Answer

The use of a password control system minimizes the risk of unauthorized access to system program and data files through telecommunications systems.

Question 4

A control feature in a computer system requires the central processing unit (CPU) to send signals to the printer to activate the print mechanism for each character. The print mechanism, just prior to printing, sends a signal back to the CPU verifying that the proper print position has been activated. This type of data transmission is referred to as:
A) Echo control.
B) Validity control.
C) Signal control.
D) Check digit control.

Accepted Answer

This type of data transmission, where a signal is sent and then a response signal is sent back, is commonly referred to as echo control.

Question 5

Passwords for microcomputer software programs are designed to prevent:
A) Inaccurate processing of data.
B) Unauthorized access to the computer.
C) Incomplete updating of data files.
D) Unauthorized use of the software.

Accepted Answer

The answer of Passwords for microcomputer software programs are designed...

Question 6

State whether each of the following statements is correct or incorrect.
A. Specialists with specialized skills in IT processing are seldom used on audits since each audit team member is expected to have the necessary skills.
B. The nature of the IT-based system may affect the specific procedures employed by the auditors in testing the controls.
C. Computer assisted audit techniques, while helpful for tests of controls, are seldom helpful for substantive procedures.
D. Parallel simulation involves the use of audit software to process functions essentially equivalent to those of the client's program and to determine whether auditor and client results are equivalent.

Accepted Answer

The answer of State whether each of the following statements...

Question 7

Which of the following constitutes a weakness in the internal control of a computer system?
A) One generation of backup files is stored in an off-premises location.
B) Machine operators distribute error messages to the control group.
C) Machine operators do not have access to the complete systems manual.
D) Machine operators are supervised by the programmer.

Accepted Answer

Machine operators being supervised by the programmer is a weakness because it can lead to a conflict of interest and reduce the effectiveness of checks and balances within the system.

Question 8

When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an exception report. The exception report should most probably be reviewed and followed up on by the:
A) Supervisor of computer operations.
B) Systems analyst.
C) Data control group.
D) Computer programmer.

Accepted Answer

The data control group is responsible for monitoring and ensuring the accuracy and integrity of data processed by computer systems. Therefore, they are the best choice to review and follow up on the exception report to determine the cause of the erroneous data and take appropriate corrective action. The supervisor of computer operations may oversee the day-to-day operations of the computer systems, but may not have the expertise to analyze and troubleshoot the data issues. The systems analyst and computer programmer may have specific responsibilities in designing and developing the computer programs, but may not be directly responsible for data control and monitoring.

Question 9

A company's labor distribution report requires extensive corrections each month because of labor hours charged to inactive jobs. Which of the following data processing input controls appears to be missing?
A) Completeness test.
B) Validity test.
C) Limit test.
D) Control total.

Accepted Answer

The missing input control is a validity test, which checks that the labor hours charged to a job are actually valid and active jobs. This would prevent labor hours from being mistakenly charged to inactive jobs, resulting in inaccurate labor distribution reports. A completeness test checks that all expected data is present, a limit test checks that data falls within predetermined limits, and a control total checks that the sum of data in a set matches a predetermined total. While these controls are useful, they wouldn't address the specific issue of incorrect labor hours being charged to inactive jobs.

Question 10

Auditing by testing the input and output of a computer system instead of the computer program itself will:
A) Not detect program errors which do not show up in the output sampled.
B) Detect all program errors, regardless of the nature of the output.
C) Provide the auditors with the same type of evidence.
D) Not provide the auditors with the confidence in the results of the auditing procedures.

Accepted Answer

Auditing by testing the input and output of a computer system may not detect program errors that do not show up in the sampled output. This is because errors may occur in the program's processing even if the output still appears to be correct. Therefore, the best choice is A.

Question 11

In their consideration of a client's IT controls, the auditors will encounter general controls and application controls. Which of the following is an application control?
A) The operations manual.
B) Hash total.
C) Systems documentation.
D) Control over program changes.

Accepted Answer

Hash total is an example of an application control, as it ensures the completeness and accuracy of data input and processing within specific application systems. A is a general control, as it outlines overall operational procedures, while C and D are also general controls that deal with IT governance and program management.

Question 12

In the weekly computer run to prepare payroll checks, a check was printed for an employee who had been terminated the previous week. Which of the following controls, if properly utilized, would have been most effective in preventing the error or ensuing its prompt detection?
A) A control total for hours worked, prepared from time cards collected by the timekeeping department.
B) Requiring the treasurer's office to account for the numbers of the prenumbered checks issued to the computer department for the processing of the payroll.
C) Use of a check digit for employee numbers.
D) Use of a header label for the payroll input sheet.

Accepted Answer

The answer of In the weekly computer run to prepare...

Question 13

The purpose of using generalized computer programs is to test and analyze a client's computer:
A) Systems.
B) Equipment.
C) Records.
D) Processing logic.

Accepted Answer

The answer of The purpose of using generalized computer programs...

Question 14

Which of the following is likely to be of least importance to an auditor in considering the internal control in a company with computer processing?
A) The segregation of duties within the computer center.
B) The control over source documents.
C) The documentation maintained for accounting applications.
D) The cost/benefit of data processing operations.

Accepted Answer

While cost/benefit considerations are important for management decisions regarding data processing operations, they are not a significant factor in determining the effectiveness of internal controls. The segregation of duties, control over source documents, and documentation are all important internal control considerations for auditors when evaluating the reliability of computer processing systems.

Question 15

Which of the following computer system risks would be increased by the installation of a database system?
A) Programming errors.
B) Data entry errors.
C) Improper data access.
D) Loss of power.

Accepted Answer

The installation of a database system can increase the risk of improper data access due to potential vulnerabilities in database security and access controls.

Question 16

Parallel simulation programs used by the auditors for testing programs:
A) Must simulate all functions of the production computer-application system.
B) Cannot be developed with the aid of generalized audit software.
C) Can use live data or test data.
D) Is generally restricted to data base environments.

Accepted Answer

Parallel simulation programs used by auditors can use either live data or test data. Option A is incorrect because the simulation programs do not need to simulate all functions of the production computer-application system, only the critical functions relevant to the audit. Option B is incorrect because generalized audit software is not used in developing the simulation program. Option D is incorrect because parallel simulation programs are not restricted to data base environments, they can be used in any type of environment.

Question 17

Smith Corporation has numerous customers. Customer files are kept on disk storage. Each account in the customer file contains name, address, credit limit, and account balance. The auditor wishes to test these files to determine whether credit limits are being exceeded. The best procedure for the auditor to follow would be to:
A) Develop test data that would cause some account balance to exceed the credit limit and determine if the system properly detects such situations.
B) Develop a program to compare credit limits with account balances and print out the details of any account with a balance exceeding its credit limit.
C) Require a printout of all account balances so they can be manually checked against the credit limits.
D) Request a printout of a sample of account balances so they can be individually checked against the credit limits.

Accepted Answer

Developing a program to compare credit limits with account balances and printing out the details of any account with a balance exceeding its credit limit would be the best procedure to test whether credit limits are being exceeded. This method is automated and would efficiently identify any violations, reducing the risk of errors associated with manual checking.

Question 18

If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll computer application?
A) Net pay.
B) Department numbers.
C) Hours worked.
D) Total debits and total credits.

Accepted Answer

Department numbers are the best choice for a hash total in a payroll computer application because they are a non-financial data item that is easily countable and typically represents a small set of values. This makes it easy to detect any errors or anomalies in the data. Net pay and total debits and credits are financial data items that are unlikely to have a consistent value across different pay periods, making them unsuitable for use as a hash total. Hours worked may also vary widely across employees and pay periods, and may not be a reliable indication of errors in the data.

Question 19

Consider the following computer applications:
(1) At a catalog sales firm, as phone orders are entered into their computer, both inventory and credit are immediately checked.
(2) A manufacturer's computer sends the coming week's production schedule and parts orders to a supplier's computer.
Which statement below is true for these applications?
A) Both applications are examples of EDI.
B) Both applications are examples of online real-time processing.
C) The first application is an example of EDI and the second is an example of online real-time.
D) The first application is an example of online real-time and the second is an example of EDI.

Accepted Answer

The first application is an example of online real-time processing because inventory and credit are checked immediately as orders are entered. The second application is an example of EDI because it involves exchanging production schedule and order information between two computer systems. Therefore, the correct answer is D, where the first application is an example of online real-time and the second is an example of EDI.

Question 20

Internal control is ineffective when computer department personnel:
A) Participate in computer software acquisition decisions.
B) Design documentation for computerized systems.
C) Originate changes in master files.
D) Provide physical security for program files.

Accepted Answer

Origination of changes in master files by computer department personnel can lead to unauthorized or improper changes, compromising the integrity of the data and the effectiveness of internal controls.

Quiz 8: Consideration of Internal Control in an Information Technology Environment

The completeness of computer generated sales figures can be tested by comparing the number of items listed on the daily sales report with the number of items billed on the actual invoices. This process uses:

An auditor may decide not to perform tests of controls related to the control activities within the computer portion of the client's internal control. Which of the following would not be a valid reason for choosing to omit such test?

The capability for computers to communicate with physically remote terminals is an important feature in the design of modern business information systems. Which of the following risks associated with the use of telecommunications systems is minimized through the use of a password control system?

Passwords for microcomputer software programs are designed to prevent:

Which of the following constitutes a weakness in the internal control of a computer system?

When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an exception report. The exception report should most probably be reviewed and followed up on by the:

A company's labor distribution report requires extensive corrections each month because of labor hours charged to inactive jobs. Which of the following data processing input controls appears to be missing?

Auditing by testing the input and output of a computer system instead of the computer program itself will:

In their consideration of a client's IT controls, the auditors will encounter general controls and application controls. Which of the following is an application control?

In the weekly computer run to prepare payroll checks, a check was printed for an employee who had been terminated the previous week. Which of the following controls, if properly utilized, would have been most effective in preventing the error or ensuing its prompt detection?

The purpose of using generalized computer programs is to test and analyze a client's computer:

Which of the following is likely to be of least importance to an auditor in considering the internal control in a company with computer processing?

Which of the following computer system risks would be increased by the installation of a database system?

Parallel simulation programs used by the auditors for testing programs:

If a control total were to be computed on each of the following data items, which would best be identified as a hash total for a payroll computer application?

Internal control is ineffective when computer department personnel: