Question 1

The database administrator should be separated from systems development.

Accepted Answer

Separation of duties is an important principle in database administration, and having the database administrator separated from systems development reduces the risk of conflicts of interest and ensures the security and integrity of the database. Systems development and database administration require different skill sets and areas of focus, so it's best to have separate roles for these functions.

Question 2

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

Accepted Answer

Corporate management, including the CEO and CFO, are required to certify their organization's internal controls over financial reporting annually, not monthly, as per the Sarbanes-Oxley Act of 2002.

Question 3

Some systems professionals have unrestricted access to the organization's programs and data.

Accepted Answer

Some systems professionals, such as network administrators and IT security personnel, may have unrestricted access to an organization's programs and data to perform their job functions. However, this access should be closely monitored and controlled to prevent misuse or unauthorized access.

Question 4

An IT auditor expresses an opinion on the fairness of the financial statements.

Accepted Answer

An IT auditor focuses on the evaluation of the organization's IT controls and systems. While they may provide insight or recommendations related to the financial systems, they do not provide an opinion on the financial statements. This is the role of a financial auditor.

Question 5

External auditors can cooperate with and use evidence gathered by internal audit departments that are organizationally independent and that report to the Audit Committee of the Board of Directors.

Accepted Answer

External auditors can work with and rely on the work of internal audit departments as long as they are independent and report to the Audit Committee of the Board of Directors. This cooperation can help the external auditor gain a better understanding of the company's internal controls and reduce duplication of efforts. However, the external auditor is ultimately responsible for the audit opinion and must assess the quality and reliability of the internal audit work.

Question 6

IT auditing is a small part of most external and internal audits.

Accepted Answer

IT auditing has become an important area of focus in recent times, and it is now a significant part of most external and internal audits.

Question 7

The same internal control objectives apply to manual and computer-based information systems.

Accepted Answer

Internal control objectives, such as safeguarding assets, ensuring accuracy and completeness of information, and promoting operational efficiency, should apply to all information systems regardless of whether they are manual or computer-based.

Question 8

Substantive testing techniques provide information about the accuracy and completeness of an application's processes.

Accepted Answer

The answer of Substantive testing techniques provide information about the...

Question 9

Application controls apply to a wide range of exposures that threaten the integrity of all programs processed within the computer environment.

Accepted Answer

The answer of Application controls apply to a wide range...

Question 10

A disaster recovery plan is a comprehensive statement of all actions to be taken after a disaster.

Accepted Answer

A disaster recovery plan outlines the steps to be taken before, during, and after a disaster to ensure business continuity and minimize damage. It includes procedures for assessment, response, recovery, and restoration of operations, along with roles and responsibilities of key personnel and contact lists for emergency services and vendors.

Question 11

Both the SEC and the PCAOB require management to use the COSO framework for assessing internal control adequacy.

Accepted Answer

The answer of Both the SEC and the PCAOB require...

Question 12

Audit risk is the probability that the auditor will render an unqualified opinion on financial statements that are materially misstated.

Accepted Answer

This is the definition of audit risk, which is a fundamental concept in auditing.

Question 13

External auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization.

Accepted Answer

External auditing is conducted by an independent body outside of the organization to provide an objective assessment of financial statements and compliance with applicable laws and regulations.

Question 14

Assurance services is an emerging field that goes beyond the auditor's traditional attestation function.

Accepted Answer

Assurance services encompass a range of activities aimed at providing confidence to stakeholders beyond just formal attestation of financial statements. These services may include evaluating and improving governance processes, risk management systems, and other areas of organizational performance.

Question 15

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Accepted Answer

The answer of To fulfill the segregation of duties control...

Question 16

A strong internal control system will reduce the amount of substantive testing that must be performed.

Accepted Answer

A strong internal control system provides assurance that transactions are being recorded accurately and completely. This means that auditors can rely on the internal controls to prevent or detect material misstatements, which reduces the need for substantive testing. However, even with a strong internal control system, some level of substantive testing is still necessary to provide reasonable assurance that the financial statements are free from material misstatement.

Question 17

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Accepted Answer

While the SEC recommends the use of a recognized framework like COBIT, it does not require it. The PCAOB, on the other hand, requires management to use a "suitable, recognized control framework" but does not specify COBIT as the only option.

Question 18

Tests of controls determine whether the database contents fairly reflect the organization's transactions.

Accepted Answer

Tests of controls are designed to evaluate the effectiveness of an organization's internal controls over financial reporting, not to directly assess the fair reflection of transactions in the database contents.

Question 19

A qualified opinion on management's assessment of internal controls over the financial reporting system necessitates a qualified opinion on the financial statements?

Accepted Answer

A qualified opinion on management's assessment of internal controls over financial reporting does not automatically necessitate a qualified opinion on the financial statements themselves. The two are separate assessments, and issues with internal controls may not directly impact the accuracy or integrity of the financial statements as presented.

Question 20

To ensure sound internal control,program coding and program processing should be separated.

Accepted Answer

Separating program coding and program processing helps to reduce the risk of errors or fraud being introduced into the program during processing. It also helps to improve accountability and traceability in the programming process.

Quiz 15: IT Controls Part I: Sarbanes-Oxley and It Governance