Deck 11: Information Technology Auditing

Question 1

The CISSP is the most widely recognized and respected certification for IT auditors.

Answer 1

False

Question 2

The most important skills needed by information technology auditors are people skills.

Answer 2

True

Question 3

Many of the IIA's GTAGs provide an overview of risks, controls and proposed audit procedures for a wide array of IT audit areas.

Answer 3

True

Question 4

External auditors report through a Chief Audit Executive to the Audit Committee of the Board of Directors.

Question 5

Use of test data is not recommended when evaluating integrated online systems.

Question 6

Embedded audit modules and audit hooks are examples of continuous auditing techniques.

Question 7

The main objective of information technology auditing is to evaluate an organization's IT infrastructure, processes and practices to provide assurance on the confidentiality, integrity and availability of information systems.

Question 8

The impetus for IT auditing can be traced to the adoption of computerized accounting systems, migration of business processes to computerized platforms, and enforcement of data security.

Question 9

Both the internal audit and the external audit have the same primary objective (i.e., to verify that the financial records of the company have been prepared according to generally accepted accounting principles).

Question 10

Computer assisted audit techniques are used primarily when auditing around the computer.

Question 11

Normal transactions rather than exception transactions are of most interest to auditors.

Question 12

The Institute of Internal Auditors (IIA)released the Information Technology Assurance Framework (ITAF)as a "professional practices framework for IS audit and assurance".

Question 13

The greatest advantage of an integrated test facility is that it enables an auditor to examine both manual and computerized steps companies use to process business transactions.
Renumber all questions below and adjust solutions accordingly

Question 14

An auditing around the computer approach pays little or no attention to the control procedures within an IT environment.

Question 15

Public companies are required to adopt the Control Objectives for Information and Related Technology framework under SOX.

Question 16

If control procedures over a company's computerized financial accounting system are particularly strong, auditors will not need to perform any substantive testing.

Question 17

Many of the assurance services auditors offer today involve information technology.

Question 18

?Renumber all questions below and adjust solutions accordingly
An information systems risk assessment is as concerned with errors and accidents as it is with fraud.
Renumber all questions below and adjust solutions accordingly

Question 19

Certified Information Systems Auditors must have an accounting degree.

Question 20

Electronic Workpaper software (EWP)enable the auditor to review computer files without continually rewriting processing programs.

Question 21

It is relatively easy to prevent hackers from unauthorized access to data and programs.

Question 22

Program comparison tools can detect unauthorized changes to accounting systems.

Question 23

SAS No.99 - Consideration of Fraud in a Financial Statement Audit guides auditors in being more proactive in detecting fraud than did the predecessor standard, SAS No.82.

Question 24

Information technology governance:

A)Is a component of IT auditing
B)Has one objective - to ensure that IT is used strategically to fulfill an organization's mission
C)Is intended to ensure both the strategic use of IT and control over IT resources
D)Is primarily intended to deter IT fraud

Question 25

Internal audit functions are spending less time auditing information technology today because accounting systems are becoming too complex to audit.

Question 26

Information Technology (IT)governance includes using IT responsibly and efficiently, but not necessarily strategically.

Question 27

The scope of an internal audit function includes all of the following except:

A)efficiency and effectiveness of operations
B)compliance with laws and regulations
C)reliability of internal and external reporting
D)managing day to day operations of business units

Question 28

The IT Assurance Framework (ITAF)includes three broad groups of standards: General Standards, Governance Standards, and Reporting Standards.

Question 29

Section 404 of SOX requires that the information technology auditor "sign off" that the financial statements are reliable.

Question 30

A computerized AIS is harder to audit than a manual system for all of the following reasons except:

A)The file information is not human readable
B)The volume of transaction records and master file records is usually much larger in computerized systems than in manual systems
C)An audit trail does not exist in a computerized AIS
D)Computerized systems often use remote real-time data processing, thus complicating the tracing of transaction records to their sources

Question 31

One purpose of generalized auditing packages is to enable an auditor to examine the contents of computer files of interest without having to write a computer program himself/herself.
Renumber all questions below and adjust solutions accordingly

Question 32

Auditors may use transaction tagging to verify how a system processes certain transactions.

Question 33

Which of the following is not true regarding the CISA certification?

A)CISAs must comply with the Code of Professional Ethics
B)Maintaining the CISA designation requires substantial continuing professional education
C)The CISA exam covers a variety of job practice areas relevant to IT auditing
D)The CISA exam is administered by the Institute of Internal Auditors

Question 34

The best educational background for a Certified Information Systems Auditor is:

A)A degree in information systems or technology
B)A degree which combines the study of accounting with the study of information systems
C)No college degree, but work experience in information systems
D)An accounting degree

Question 35

Test data makes it possible to determine whether computer code is free from errors or fraud.

Question 36

Computer assisted audit techniques:

A)Are never used in compliance testing
B)May be used for substantive and compliance testing
C)Are used primarily when auditing around the computer
D)Are good tools for auditors who are lacking in technical computer skills

Question 37

If an auditor were to audit a payroll application using around-the-computer auditing techniques, the individual would:

A)Use test data
B)Verify that the output from the computerized processing was correct for the input data used to generate it
C)Never use a surprise audit because of the amount of time and work involved
D)Prepare a profile of a computer file and check the processed data with the profile thus obtained

Question 38

The advantages of around-the-computer auditing include:

A)The emphasis which is placed on testing data processing exceptions
B)Use of live data
C)The minimal disturbance of a company's records
D)both b and c

Question 39

Which of the following is not one of the groups of SOX compliance requirements?

A)Requirements to use an IT auditor to evaluate controls
B)Regulations governing executive reporting and conduct
C)Rules about financial statement reporting
D)Audit committee/corporate governance requirements

Question 40

Through-the-computer auditing uses all of the following except:

A)Confirmation sampling
B)Test data
C)Tests of program authorization
D)Embedded audit modules

Question 41

Which of the following is not typically checked by an auditor in a review of a responsibility system of computer program development and maintenance?

A)Documentation of all program changes on proper change-request forms
B)Proper costing of all program change requests
C)A review of each program change request by an internal auditor
D)Matches between program documentation and the production version of a computer program

Question 42

The greatest drawback of an integrated test facility is that:

A)It requires the construction of a high volume of test data
B)It introduces artificial transactions into the transaction stream
C)It produces overkill in the audit function
D)It is not broad enough to cover the entire spectrum of activities involved in the AIS

Question 43

The most important advantage of an integrated test facility is that it:

A)Allows auditors to evaluate transactions in an operational setting
B)Can test every exception transaction as opposed to test data which includes only a limited set of such transactions
C)Works best at evaluating input controls
D)Has no disadvantages

Question 44

Which section of SOX requires CEOs and CFOs to "sign off" on their company's financial statements?

A)Section 404
B)Section 201
C)Section 103
D)Section 302

Question 45

Which of the following statements is not true regarding people skills for IT auditors?

A)People skills are more important than technical skills
B)An example of people skills would be the ability to work on a team
C)In the case of protecting against computer viruses, technical skills matter more than people skills
D)Many internal controls evaluated by auditors concern human behavior

Question 46

Which of the following audit techniques is likely to require the most technical expertise on the part of an auditor?

A)Test data
B)Integrated test facility
C)Evaluation of program change control
D)Parallel simulation

Question 47

When an auditor audits with the computer, the auditor:

A)Uses the computer to process transaction data under normal processing conditions
B)Uses the computer as a tool to assist in various other auditing tasks
C)Relies heavily upon test data to evaluate the presence or absence of specific computer controls
D)Must also use an integrated test facility

Question 48

All of the following are true concerning embedded audit modules except:

A)They provide for continuous auditing of application processing
B)The auditor does not have to be involved in the development of these programs
C)Once implemented, the system can capture information that is useful to the auditor on an ongoing basis
D)With this approach, the application program incorporates subroutines for audit purposes

Question 49

Which audit technique examines the way transactions are processed?

A)Exception reporting technique
B)Transaction tagging technique
C)Snapshot technique
D)Parallel simulation technique

Question 50

Prewritten computer programs used for audit purposes are called:

A)Sequential access program systems
B)Positive confirmation audit systems
C)Embedded audit modules
D)Generalized auditing packages

Question 51

Within the IT Assurance Framework (ITAF), the General Standards:

A)Provide guidance on the planning and execution of IT assurance activities
B)Provide guidance on the attributes of the IT auditing profession
C)Provide guidance on the nature of communications issued by the IT auditor
D)Provide guidance on the distribution of IT audit reports

Question 52

The auditor's role in reviewing the system of computer program development:

A)Does not include checking to see that all program changes are properly documented
B)Does not include a check of librarian functions
C)Does not include checking to see that program change requests are properly costed
D)Includes a cross-check of program changes against in-use programs

Question 53

The term "test data" is associated with:

A)Auditing through-the-computer
B)Auditing around-the-computer
C)Auditing of manual accounting systems
D)Non-auditing procedures performed by a firm's accounting subsystem employees

Question 54

An integrated test facility is used to:

A)Test only the computer programs of an AIS
B)Test only the manual operations of an AIS
C)Test both the programs and the manual operations of an AIS in an operational setting
D)Test the computer programs, the manual operations, and the auditing procedures of a company using a computerized AIS

Question 55

All of the following are examples of parameters that might be used to set passwords except:

A)A minimum password length of six digits
B)Restriction of passwords to numeric characters only
C)Required use of words that can be found in a dictionary
D)A requirement for a minimum interval (such as one day)before a password may be changed

Question 56

Information Technology governance includes all of the following except:

A)A decentralized approach to IT acquisition
B)Using IT strategically to carry out the objectives of an organization
C)Ensuring effective management of an organization's IT resources
D)Control over IT-related risks

Question 57

Three common techniques auditors use to test computer programs are:

A)Test data, integrated test facilities, and parallel simulation
B)Test data, edit checks, and integrated test facilities
C)Test data, program change control, and parallel simulation
D)Program change control, edit checks, and parallel simulation

Question 58

SQL is:

A)An example of an integrated test facility
B)A generalized audit software program
C)A tool used for continuous auditing
D)A query language used by auditors to retrieve and manipulate data

Question 59

The four approaches to through-the-computer auditing include all but which of the following:

A)Use of embedded audit modules
B)Testing of outputs to verify processing
C)Computer program testing
D)Validation of computer programs

Question 60

Which of the following services does SOX not prevent auditors from performing for their own clients?

A)Internal auditing outsourcing services
B)Expert services related to the audit
C)Actuarial services
D)Implementation of a financial information system

Question 61

Information technology governance is the process of using information technology resources:

A)In governmental agencies
B)To audit accounting systems
C)To achieve organizational objectives
D)To hire the board of directors

Question 62

Controls over access to IT systems are particularly important because:

A)Weak access controls prevent unauthorized use of systems
B)Access controls allow auditors to employ continuous auditing techniques
C)Access controls make test data more effective
D)Weak access controls can allow users to bypass many other controls

Question 63

Increased use of big data by organizations is causing internal audit functions:

A)To increase recruiting of IT specialists
B)To abandon the CISA certification
C)To stop using cloud computing
D)To increase their focus on debits and credits

Question 64

Risks of using an integrated test facility include:

A)Failure to remove fake transactions from the client's system
B)High costs of building the facility
C)Discovery of many control weaknesses
D)none of the above

Question 65

Continuous audit techniques can improve the effectiveness of the audit by:

A)Focusing most of the audit effort near the year-end
B)Alerting auditors to potential problems when the problems occur
C)Protecting the privacy of the auditors
D)Facilitating parallel simulation

Question 66

All of the following are reasons why SOX was enacted, except:

A)Enron's CEO, Jeffrey Skilling, claimed he did not know about the company's financial shenanigans because he was not involved in their accounting
B)Public perception was that auditors were having conflicts of interest with respect to the auditing and consulting services they provided
C)The FASB has long been thought to be ineffective
D)Congress wanted to restore investor confidence in the wake of a rash of corporate scandals

Question 67

The IT Assurance Framework's (ITAF)Performance Standards

A)Provide guidance on the planning and execution of IT assurance activities
B)Provide guidance on the attributes of the IT auditing profession
C)Provide guidance on the nature of communications issued by the IT auditor
D)Provide guidance on the distribution of IT audit reports