Deck 7: Auditing Information Technology-Based Processes

Question 1

Auditors should develop a written audit program so that:

A)All material transactions will be included in substantive testing.
B)Substantive testing performed prior to year-end will be minimized.
C)The procedures will achieve specific audit objectives related to specific management assertions.
D)Each account balance will be tested under either a substantive test or a test of controls.

Answer 1

C

Question 2

Which of the following computer-assisted auditing techniques processes actual client input data (or a copy of the real data) on a controlled program under the auditor's control to periodically test controls in the client's computer system?

A)Test data method
B)Embedded audit module
C)Integrated test facility
D)Parallel simulation

Answer 2

D

Question 3

Which of the following statements regarding an audit program is true?

A)An audit program should be standardized
B)The audit program should be completed by the client company before the audit planning stage begins.
C)An audit program should be developed by the internal auditor during the audit's completion/reporting phase.
D)An audit program establishes responsibility for each audit test by requiring the signature or initials of the auditor who performed the test.

Answer 3

D

Question 4

Suppose that during the planning phase of an audit, the auditor determines that weaknesses exist in the client's computerized systems.These weaknesses make the client company susceptible to the risk of an unauthorized break-in.Which type of audit procedures should be emphasized in the remaining phases of this audit?

A)Tests of controls
B)Penetration tests
C)Substantive tests
D)Rounding errors tests

Question 5

Independent auditors are generally actively involved in each of the following tasks except:

A)Preparation of a client's financial statements and accompanying notes
B)Advising client management as to the applicability of a new accounting standard
C)Proposing adjustments to a client's financial statements
D)Advising client management about the presentation of the financial statements

Question 6

Generalized audit software can be used to:

A)Examine the consistency of data maintained on computer files
B)Perform audit tests of multiple computer files concurrently
C)Verify the processing logic of operating system
D)Process test data against master files that contain both real and fictitious data

Question 7

Which of the following is a general control to test for external access to a client's computerized systems?

A)Penetration tests
B)Hash totals
C)Field checks
D)Program tracing

Question 8

The primary objective of compliance testing in a financial statement audit is to determine whether:

A)Procedures have been updated regularly.
B)Financial statement amounts are accurately stated.
C)Internal controls are functioning as designed.
D)Collusion is taking place.

Question 9

Which of the following computer-assisted auditing techniques allows fictitious and real transactions to be processed together without client personnel being aware of the testing process?

A)Test data method
B)Embedded audit module
C)Integrated test facility
D)Parallel simulation

Question 10

Which of the following is the most significant disadvantage of auditing around the computer rather than through the computer?

A)The time involved in testing processing controls is significant.
B)The cost involved in testing processing controls is significant.
C)A portion of the audit trail is not tested.
D)The technical expertise required to test processing controls is extensive.

Question 11

Which of the following is not a part of general accepted auditing standards?

A)General Standards
B)Standards of Fieldwork
C)Standards of Information Systems
D)Standards of Reporting

Question 12

Which of the following types of audits is most likely to be conducted for the purpose of identifying areas for cost savings?

A)Financial statement audits
B)Operational audits
C)Regulatory audits
D)Compliance audits

Question 13

Which of the following audit objectives relates to the management assertion of existence?

A)A transaction is recorded in the proper period.
B)A transaction actually occurred (i.e., it is real).
C)A transaction is properly presented in the financial statements.
D)A transaction is supported by detailed evidence.

Question 14

In an audit of financial statement in accordance with generally accepted auditing standards, an auditor is required to:

A)Document the auditor's understanding of the client company's internal controls
B)Search for weaknesses in the operation of the client company's internal controls
C)Perform tests of controls to evaluate the effectiveness of the client company's internal controls
D)Determine whether controls are appropriately operating to prevent or detect material misstatements

Question 15

Which of the following audit procedures is most likely to be performed during the planning phase of the audit?

A)Obtain an understanding of the client's risk assessment process
B)Identify specific internal control activities that are designed to prevent fraud
C)Evaluate the rea
D)Test the timely cutoff of cash payments and collections

Question 16

Which of the following best describes what is meant by the term "generally accepted auditing standards"?

A)Procedures used to gather evidence to support the accuracy of a client's financial statements
B)Measures of the quality of an auditor's conduct carrying out professional responsibilities
C)Professional pronouncements issued by the Auditing Standards Board
D)Rules acknowledged by the accounting profession because of their widespread application

Question 17

Risk assessment is a process designed to:

A)Identify possible circumstances and events that may affect the business
B)Establish policies and procedures to carry out internal controls
C)Identify and capture information in a timely manner
D)Review the quality of internal controls throughout the year

Question 18

Which of the following is most likely to be an attribute unique to the financial statement audit work of CPAs, compared with work performed by attorneys or practitioners of other business professions?

A)Due professional care
B)Competence
C)Independence
D)A complex underlying body of professional knowledge

Question 19

Financial statement audits are required to be performed by:

A)Governmental auditors
B)CPAs
C)Internal auditors
D)IT auditors

Question 20

Which of the following is not considered a cause for information risk?

A)Management's geographic location is far from the
B)The information is collected and prepared by per
C)The information relates to business activities that are not well understood by those who collect and summarize the information for decision makers.
D)The information has been tested by internal auditors and a CPA firm.

Question 21

A type of assurance services that involves accumulating and analyzing support for the information provided by management is called an:

A)Audit
B)Investigation
C)Financial statement examination
D)Control test

Question 22

Financial statement audits are performed by _________ who have extensive knowledge of generally accepted accounting principles (GAAP) in the US and/or International Financial Reporting Standards (IFRS).

A)Public auditors
B)Governmental auditors
C)Certified Public Accountants
D)Internal auditors

Question 23

This type of audit is performed by independent auditors who are objective and neutral with respect to the company and the information being audited.

A)Compliance audit
B)Operational audit
C)Internal audit
D)External audit

Question 24

Which of the following is not one of the identified causes of information risk?

A)Audited information
B)Remote information
C)Complexity of data
D)Preparer motive

Question 25

This type of auditor conducts audits of government agencies or income tax returns.

A)IT auditor
B)Government auditor
C)Certified Public Accountant
D)Internal auditor

Question 26

This type of audit is completed to determine whether or not the client has prepared and presented its financial statements fairly, in accordance with established financial accounting criteria.

A)GAAP audit
B)Financial statement audit
C)Compliance audit
D)Fair application audit

Question 27

Which of the following is not one of the three primary types of audits?

A)Compliance audits
B)Financial statement audits
C)IT audits
D)Operational audits

Question 28

Which of the following scenarios does NOT impair the independence of a CPA firm from its client?

A)The lead audit partner is the sister-in-law of the client's VP of Accounting.
B)One of the auditors owns stock in a competitor of the client.
C)One of the auditors is the golf partner of the client's CEO.
D)The lead audit partner owns stock in the client.

Question 29

Decision makers are typically forced to rely on others for information.When the source of the information is removed from the decision maker, the information stands a greater chance of being misstated.A decision maker may become detached from the source of information due to geography, organizational layers, or other factors.This describes which cause of information risk?

A)The lack of CPA independence
B)The volume and complexity of underlying data
C)The motive of the preparer
D)The remoteness of information

Question 30

This type of auditor is an employee of the company he/she audits.

A)IT auditor
B)Government auditor
C)Certified Public Accountant
D)Internal auditor

Question 31

This type of audit is completed in order to determine whether a company has adhered to the regulations and policies established by contractual agreements, governmental agencies, or some other high authority.

A)Compliance audit
B)Operational audit
C)Information audit
D)Financial statement audit

Question 32

This type of auditor specializes in the information systems assurance, control, and security.They may work for CPA firms, government agencies, or with the internal audit group.

A)IT auditor
B)Government auditor
C)Certified Public Accountant
D)Internal auditor

Question 33

Accounting services that improve the quality of information provided to the decision maker, an audit being the most common type of this service, is called:

A)Compliance services
B)Assurance services
C)Substantive services
D)Operational services

Question 34

This type of audit is completed to assess the operating policies and procedures of a client for efficiency and effectiveness.

A)Efficiency audit
B)Effectiveness audit
C)Compliance audit
D)Operational audit

Question 35

The IT environment plays a key role in how auditors conduct their work in all but which of the following areas:

A)Consideration of risk
B)Consideration of information fairness
C)Design and performance of audit tests
D)Audit procedures used

Question 36

The chance that information used by decision makers may be inaccurate is referred to as:

A)Sample risk
B)Data risk
C)Audit trail risk
D)Information risk

Question 37

An important requirement of CPA firms is that they must be ________ with regard to the company being audited.The requirement allows CPA firms to provide a completely unbiased opinion on the information it audits.

A)Neutral
B)Well-informed
C)Materially invested
D)All of the above

Question 38

The independence of a CPA could be impaired by:

A)Having no knowledge of the company or the company management
B)By owning stock of a similar company
C)Having the ability to influence the client's decisions
D)Being married to a stockbroker

Question 39

Which of the following terms in not associated with a financial statement auditor's requirement to maintain independence?

A)Objectivity
B)Neutrality
C)Professional skepticism
D)Competence

Question 40

The main purpose of an audit is to assure users of the financial information about the:

A)Effectiveness of the internal controls of the company
B)Selection of the proper GAAP when preparing financial statements
C)Proper application of GAAS during the examination
D)Accuracy and completeness of the information

Question 41

The role of the auditors is to analyze the underlying facts to decide whether information provided by management is fairly presented.Auditors design ____1_____ to analyze information in order to determine whether ____2_____ is/are valid.

A)1=audit objectives; 2=management's assertions
B)1=audit tests; 2=audit objectives
C)1=audit tests; 2=audit evidence
D)1=audit tests; 2=management's assertions

Question 42

This organization, established by the Sarbanes-Oxley Act, was organized in 2003 for the purpose of establishing auditing standards for public companies.

A)Auditing Standards Board
B)Public Company Accounting Oversight Board
C)International Audit Practices Committee
D)Information Systems Audit and Control As

Question 43

Independence in mental attitude is to be maintained in all matters related to the audit engagement.This is one of the generally accepted auditing standards that is part of the:

A)General Standards
B)Operating Standards
C)Fieldwork Standards
D)Reporting Standards

Question 44

This organization was established by the IFAC to set International Standards on Auditing (ISAs) that contribute to the uniform application of auditing practices on a worldwide basis.

A)International Systems Audit and Control As
B)Auditing Standards Board
C)Public Company Accounting Oversight Board
D)International Auditing and Assurance Standards Board (IAASB)

Question 45

It's necessary to study information-based processing and the related audit function because:

A)Information users often do not have the time or ability to verify information themselves.
B)It may be difficult for decision makers to verify information contained in a computerized accounting system.
C)Both of the above
D)Neither of the above

Question 46

The ten standards that provide broad guidelines for an auditor's professional responsibilities are referred to as:

A)Generally accepted accounting standards
B)General accounting and auditing practices
C)Generally accepted auditing practices
D)Generally accepted auditing standards

Question 47

Claims regarding the condition of the business organization and in terms of its operations, financial results, and compliance with laws and regulations, are referred to as:

A)Financial Statements
B)Management Assertions
C)External Audit
D)Presentation and Disclosure

Question 48

The general guidelines, known as the generally accepted auditing standards, which include the concepts of adequate planning and supervision, internal control, and evidence, relate to the:

A)General Standards
B)Operating Standards
C)Fieldwork Standards
D)Reporting Standards

Question 49

Which management assertion determines that transactions and related asset accounts balances are actually owned and that liability account balances represent actual obligations?

A)Valuation and Allocation
B)Existence
C)Rights and Obligations
D)Classification and Presentation

Question 50

The existence of IT-based business processes often result in details of transactions being entered directly into the computer system, results in a lack of physical evidence to visibly view.This situation is referred to as:

A)Physical evidence risk
B)Loss of audit trail visibility
C)Transaction summary chart
D)Lack of evidence view

Question 51

Audit tests developed for an audit client are documented in a(n):

A)Audit Program
B)Audit Objective
C)Management Assertion
D)General Objectives

Question 52

This organization is part of the AICPA and was the group responsible for issuing statements on auditing standards which were historically widely used in practice.

A)Auditing Standards Board
B)Public Company Accounting Oversight Board
C)International Audit Practices Committee
D)Information Systems Audit and Control As

Question 53

The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor.This is one of the generally accepted auditing standards that is part of the:

A)General Standards
B)Operating Standards
C)Fieldwork Standards
D)Reporting Standards

Question 54

Although there are a number of organizations that provide detailed guidance, it is still necessary for auditors to rely on other direction regarding the types of audit tests to use and the manner in which the conclusions are drawn.These sources of information include:

A)Industry Guidelines
B)PCAOB
C)ASB
D)ASACA

Question 55

The existence of IT-based business processes that result in the details of the transactions being entered directly into the computer system increases the likelihood of the loss or alternation of data due to all of the following, except:

A)System failure
B)Database destruction
C)Programmer incompetence
D)Environmental damage

Question 56

The generally accepted auditing standards are divided into three groups.Which of the following is not one of those groups?

A)General Standards
B)Basic Standards
C)Standards of Fieldwork
D)Standards of Reporting

Question 57

The general guidelines, known as the generally accepted auditing standards, which include the concepts of presentation in accordance with the established criteria, the consistent application of established principles, adequate disclosure, and the expression of an opinion, relate to the:

A)General Standards
B)Operating Standards
C)Fieldwork Standards
D)Reporting Standards

Question 58

GAAS, generally accepted auditing standards, provide a general framework for conducting quality audits, but the specific standards--or detailed guidance--are provided by all of the following groups except:

A)Public Company Accounting Oversight Board
B)Auditing Standards Board
C)Certified Fraud Examiners
D)International Auditing and Assurance Standards Board

Question 59

The advantages of using IT-based accounting systems, where the details of transactions are entered directly into the computer include:

A)Computer controls can compensate for the lack of manual controls
B)Loss of audit trail view
C)Increased internal controls risks
D)Fewer opportunities to authorize and review transactions

Question 60

This organization issues guidelines for conducting the IT audit.The standards issued address practices related to control and security of the IT system.

A)Auditing Standards Board
B)Public Company Accounting Oversight Board
C)International \Audit Practices Committee
D)Information Systems Audit and Control As

Question 61

The management assertion related to valuation of transactions and account balances would include all of the following, except:

A)Accurate in terms of dollar amounts and quantities
B)Supported by detailed evidence
C)Real
D)Correctly summarized

Question 62

During the planning phase of the audit, auditors estimate the monetary amounts that are large enough to make a difference in decision making.This amount is referred to as:

A)Risk
B)Materiality
C)Substantive
D)Sampling

Question 63

Which of the following describes a mathematical sum of data that is meaningless to the financial statements but useful for controlling the data and detecting possible missing items?

A)Hash total
B)Batch total
C)Validation check
D)Sequence verification total

Question 64

The main difference between substantive testing and controls testing is:

A)Substantive testing verifies whether information is correct, whereas control tests determine whether the information is managed under a system that promotes correctness.
B)Substantive testing determines whether the information is managed under a system that promotes correctness, whereas control testing verifies whether information is correct.
C)Substantive testing goes further in depth into the internal controls of a company, whereas controls testing just identifies which controls need further review.
D)Substantive testing identifies which controls need further review, whereas controls testing goes further in depth into the internal controls of a company.

Question 65

During substantive testing, if material misstatements have been found to exist, which of the following actions should be taken next?

A)Proceed to the audit completion in the reporting phase
B)Re-evaluate the audit risk in the planning phase
C)Re-perform detailed tests of balances
D)Re-perform an internal controls systems analysis

Question 66

The likelihood that errors or fraud may occur is referred to as:

A)Risk
B)Materiality
C)Control tests
D)Sampling

Question 67

This approach, referred to as the white box approach, requires auditors to evaluate IT controls and processing so that they can determine whether the information generated from the system is reliable.

A)Auditing through the system
B)Auditing around the system
C)Computer assisted audit techniques
D)Auditing with the computer

Question 68

Which of the following is the most effective way of auditing the internal controls of an IT system?

A)Auditing with the computer
B)Auditing through the computer
C)Auditing around the computer
D)Auditing in the computer

Question 69

The IT auditing approach referred to as "auditing through the system" is necessary under which of the following conditions?

A)Supporting documents are available in both electronic and paper form.
B)The auditor does not require evaluation of computer controls.
C)The auditor wants to test computer controls as a basis for evaluating risk and reducing the amount of substantive audit testing required.
D)The use of the IT system has a low impact on the conduct of the audit.

Question 70

During this phase of the audit, the auditor must gain a thorough understanding of the client's business and financial reporting systems.When completing this phase, the auditors review and assess the risks and controls related to the business.

A)Tests of controls
B)Substantive tests
C)Audit completion / reporting
D)Audit planning

Question 71

A large part of the work performed by an auditor in the audit planning process is the gathering of evidence about the company's internal controls.This can be completed in any of the following ways, except:

A)Interviewing key members of the accounting and IT staff
B)Observing policies and procedures
C)Review IT user manuals and systems
D)Preparing memos to summarize their findings

Question 72

IT auditors may need to be called in to:

A)Consider the effects of computer processing on the audit
B)To assist in testing the automated processes
C)Both of the above
D)Neither of the above

Question 73

Techniques used for gathering evidence include all of the following, except:

A)Physical examination of assets or supporting documentation
B)Observing activities
C)Adequate planning and supervision
D)Analyzing financial relationships

Question 74

Audit procedures designed to evaluate both general controls and application controls are referred to as:

A)Substantive tests
B)Audit planning
C)IT auditing
D)Test of controls

Question 75

The audit practice of "auditing around the computer" is also referred to as:

A)The white box approach
B)The black box approach
C)Computer-assisted audit techniques (CAATs)
D)The gray box approach

Question 76

There are four primary phases of the IT audit.Which of the following is not one of those phases?

A)Planning
B)Evidence audit
C)Tests of controls
D)Substantive tests

Question 77

Many companies design their IT systems so that all documents and reports can be retrieved from the system in readable form.Auditors can then compare the documents used to input the data into the system with reports generated from the system, without needing any extensive knowledge of the computer system or evaluation of computer controls.This process is referred to as:

A)Auditing through the system
B)Auditing around the system
C)Computer-assisted audit techniques
D)Auditing with the computer

Question 78

The proof of the fairness of the financial information is:

A)Tests of controls
B)Substantive tests
C)Audit completion
D)Audit evidence

Question 79

The automated controls that affect all computer applications are referred to as:

A)General controls
B)Specific controls
C)Input controls
D)Application controls

Question 80

Auditing standards address the importance of understanding both the automated and manual procedures that make up an organization's internal controls and consider how misstatements may occur, including all of the following, except:

A)How transactions are entered into the computer
B)How financial statement are printed from the computer
C)How nonstandard journal entries and adjusting entries are initiated, recorded, and processed
D)How standard journal entries are initiated, recorded, and processed