Deck 20: Auditing in a Computerized Environment

Question 1

The use of the systems development life cycle is an example of an access to programs and data control.

Answer 1

False

Question 2

The most important preventive controls for computer fraud are those that limit access to computers.

Answer 2

True

Question 3

When weaknesses exist that could lead to computer fraud,the best strategy is to have the client help audit teams plan and execute technical procedures to study and evaluate the system.

Answer 3

False

Question 4

An embedded audit module creates simulated data to be processed by the client's computerized processing system.

Question 5

The major phases in the audit team's study of internal control are the same in a computerized processing environment as those in a manual processing environment.

Question 6

One major difference in a computerized processing environment compared to a manual processing environment is the existence of systematic rather than random errors.

Question 7

The audit team may use internal auditors to develop and run computer-assisted auditing techniques under supervision and review of the audit team.

Question 8

In simple batch processing systems,it is not possible to use the technique of auditing around the computer.

Question 9

Header and trailer labels are examples of external labels.

Question 10

An important hardware control incorporated within computer equipment is a parity check.

Question 11

If an entity's general controls are ineffective,audit teams would likely gain additional assurance by increasing tests of their automated application controls.

Question 12

In an integrated test facility,simulated transactions are processed through the client's computerized processing system along with the client's actual transactions.

Question 13

The method of auditing around the computer treats the computer system as a black box.

Question 14

Input controls are one of the major categories of general controls.

Question 15

When using parallel simulation,audit teams prepare a computer program to duplicate the logic and computer controls in the client's computer program.

Question 16

Computer librarians are primarily responsible for operating the computer for each application system.

Question 17

The basic concept of test data is that once a computer is programmed to handle transactions in a certain way,every transaction will be handled in the same way.

Question 18

In auditing around the computer,audit teams reconcile source documents (input)to processing results.

Question 19

Computer operators should have complete access to programs and application documentation.

Question 20

A program description should contain a program flowchart,a list of the program source code,and a record of all program changes.

Question 21

Which of the following methods allow fictitious and actual transactions to be processed together without client operating personnel being aware of the testing process?

A) Integrated test facility.
B) Input controls matrix.
C) Parallel simulation.
D) Data entry monitor.

Question 22

To obtain evidence that controls over access to computer programs are properly functioning,audit teams most likely would

A) Create checkpoints at periodic intervals after data processing to test for unauthorized use of the system.
B) Examine the transaction log to discover whether any transactions were lost or entered twice due to a system malfunction.
C) Enter invalid identification numbers or passwords to ascertain whether the system rejects them.
D) Vouch a random sample of processed transactions to ensure proper authorization.

Question 23

Each of the following automated application controls is designed to ensure that the input of individual transactions and data is accurate except

A) Check digits.
B) Valid sign tests.
C) Sequence tests.
D) Limit and reasonableness tests.

Question 24

An audit team's approach to evaluating computerized processing systems that compares source documents to the computer output is known as auditing

A) Around the computer.
B) Through the computer.
C) Without the computer.
D) With the computer.

Question 25

The reprocessing of actual data using programs developed by the audit team to evaluate program controls is called

A) Test data.
B) Test deck.
C) Generalized audit software.
D) Parallel simulation.

Question 26

Which of the following organizational positions would evaluate the existing system and design new computerized processing systems and documentation?

A) Programmer.
B) Systems analyst.
C) Computer operator.
D) Data conversion operator.

Question 27

Which of the following is not an appropriate statement with regard to computer control activities?

A) The duties of application programming, computer operation, and control of data files should be separated.
B) Computer operators should maintain control of all software programs.
C) Specific passwords should be required to access online files.
D) Computer programmers should be periodically rotated across different applications.

Question 28

Audit teams would least likely use computer-assisted audit techniques to

A) Access client data files.
B) Prepare spreadsheets.
C) Assess control risk related to computerized processing systems.
D) Construct and perform parallel simulations.

Question 29

When audit teams test a computerized processing system,which of the following is true of the test data approach?

A) Several transactions of each type must be tested.
B) Test data are processed by the client's computer programs under the audit team's control.
C) Test data must consist of all possible valid and invalid combinations.
D) The computer program used to process test data is different from the program used throughout the year by the client.

Question 30

The purpose of test data is to determine whether

A) The audit team's test data are consistent with the client's normal transactions.
B) Controls operate as described in responses to internal control questionnaire items and program flowcharts.
C) Every possible error is prevented or detected by the client's computer controls.
D) All possible combinations of valid data are correctly processed.

Question 31

Audit teams would most likely introduce test data into a computerized payroll system to test internal controls related to the

A) Existence of unclaimed payroll checks held by supervisors.
B) Early cashing of payroll checks by employees.
C) Discovery of invalid employee identification numbers.
D) Proper approval of overtime by supervisors.

Question 32

The audit team made a copy of the client's sales and billing program early in the audit.Several times during the audit,the team used this copy of the program to process actual client data.The output of the secured program was compared to that of the client's system.This audit technique would be considered

A) Generalized audit software.
B) Parallel simulation.
C) Test data.
D) Tagging transactions.

Question 33

Which of the following is an example of a computer operations control?

A) Control totals.
B) Balance of input to output.
C) File backup and retention.
D) Transaction logs.

Question 34

Computer operations controls are typically implemented for files and data used in processing.The major objectives of these controls include each of the following except

A) Ensure that appropriate files are used in computerized processing.
B) Ensure restricted access to the computing environment.
C) Ensure that files are appropriately secured and protected from loss.
D) Ensure that files can be reconstructed from earlier versions of information used in processing.

Question 35

Tests of controls in an advanced computerized processing system

A) Can be performed using only actual transactions because testing simulated transactions does not provide relevant evidence.
B) Can be performed using actual transactions or simulated transactions.
C) Is impractical because many procedures within the computerized processing system leave no visible evidence of having been performed.
D) Is inadvisable because it may distort the evidence in real-time systems.

Question 36

Which of the following ensures that the coding of data does not change when it is moved from one internal storage location to another?

A) Preventive maintenance.
B) Echo check.
C) Internal label.
D) Parity check.

Question 37

Techniques needed to select specific transactions of audit interest for testing would not include

A) Embedded audit modules.
B) Monitoring system activity.
C) Snapshot.
D) Test data.

Question 38

In end-user computing environments,the processing control procedures would ordinarily not include

A) Transaction logs.
B) Control totals.
C) Comparing input to output.
D) Online editing and sight verification.

Question 39

The effectiveness of general controls is an important consideration for audit teams when assessing control risk on an audit.Which management assertions are primarily affected by general controls?

A) Completeness and accuracy.
B) Occurrence and rights and obligations.
C) Accuracy and occurrence.
D) Completeness and occurrence.

Question 40

Which of the following controls most likely would ensure that an organization can reconstruct its financial records?

A) Hardware controls are built into the computer by the computer manufacturer.
B) Backup files are stored in a location separate from original copies.
C) Personnel who are independent of data input perform parallel simulations.
D) System flowcharts provide accurate descriptions of computer operations.

Question 41

Which of the following categories of general controls includes retention and recovery techniques for data and related programs?

A) Access to programs and data.
B) Computer operations.
C) Data file controls.
D) Hardware controls.

Question 42

Which of the following is not a control included as part of the systems development life cycle?

A) Ensuring that all software acquisition and program development efforts are consistent with the organization's needs and objectives.
B) Testing and validating new programs and developing proper implementation plans.
C) Requiring that all programming efforts take place under the control of the requesting user department.
D) Ensuring that data are converted completely and accurately for use in the new systems.

Question 43

Why is it important that the organization establish systems development and documentation standards?

A) These standards enable the organization to understand the programming logic underlying recently developed programs.
B) These standards ensure that the program controls and documentation included in recently developed programs is adequate.
C) The absence of these standards would constitute a material weakness in internal control.
D) These standards ensure the appropriate separation of duties of computer personnel.

Question 44

Which of the following error conditions would not be detected through the use of batch totals?

A) A transposition of numbers in a numeric field.
B) Entry of an unauthorized transaction supported by documentary evidence.
C) Failure to enter a valid transaction through input error.
D) Erroneously entering the same transaction twice.

Question 45

After obtaining a preliminary understanding of a client's computer controls,audit teams may decide not to perform tests of controls.Which of the following would not be a valid reason for choosing to omit tests of controls?

A) The client's computer controls duplicate manual controls existing elsewhere in the system.
B) There appear to be major weaknesses that indicate a high level of control risk.
C) The time and dollar costs of testing computer controls exceed the time and dollar savings in substantive procedures.
D) The client's controls appear to function at an adequate level to justify a low assessment of control risk.

Question 46

Which of the following is likely to be of least importance to audit teams when obtaining an understanding of the computer controls in an organization with a computerized processing system?

A) Separation of duties within the computer function.
B) Controls over source documents.
C) Documentation maintained for accounting applications.
D) Relationship between costs and benefits of computer operations.

Question 47

As part of assessing the risk of material misstatement,the audit team must assess the control risk in the computerized processing system(s).Initially,the audit team must identify the overall processing scope of the system(s),which would include each of the following considerations except

A) The types of transactions that are processed through the system(s).
B) The specific control procedures that have been implemented by the client to prevent or detect misstatements that could occur based on the audit team's analysis.
C) The programs and files that are accessed by the system(s) in processing transactions.
D) The type of output that is created as a result of processing transactions through the system(s).

Question 48

Which of the following control procedures most likely could prevent computer personnel from modifying programs to bypass computer controls?

A) Periodic management review of computer utilization reports and systems documentation.
B) Separation of duties for computer programming and computer operations.
C) Participation of user department personnel in designing and approving new systems.
D) Physical security of computer facilities in limiting access to computer equipment.

Question 49

When programs or files can be accessed from terminals,users should be required to enter a(n)

A) Parity check.
B) Personal identification code.
C) Self-diagnosis test.
D) Echo check.

Question 50

Which of the following would most likely be a weakness in the internal control of a client that utilizes portable computing devices rather than a large computer system?

A) Employee collusion possibilities are increased because portable computing devices from one vendor can process the programs of a system from different vendors.
B) Computer operators may be able to remove hardware and software components and modify them at an off-site location.
C) Programming errors result in all similar transactions being processed incorrectly because those transactions are processed under the same conditions.
D) Certain transactions may be automatically initiated by the computerized processing system and management's authorization of these transactions may be implicit in its acceptance of the system design.

Question 51

When a real-time computerized processing system is in use,the computer controls can be strengthened by

A) Providing for the separation of duties between data input and error listing operations.
B) Using a systems development life cycle for authorization, user involvement, and testing of program modifications.
C) Preparing batch totals to provide assurance that file updates are made for the entire group of transactions.
D) Performing a validity check of an identification number before a user can obtain access to the computer files.

Question 52

Which of the following statements best describes the impact on an audit when a client uses computerized processing of transactions?

A) The objective of the audit examination focuses on detection of fraud and theft through the computer.
B) The type of substantive procedures performed by the audit team change because of the use of computerized processing.
C) The effectiveness of computer controls implemented by the client over its computerized processing may need to be evaluated by audit teams.
D) Different independence standards are introduced for audit teams when clients utilize computerized processing.

Question 53

Computer controls that provide reasonable assurance that data are not altered or modified as they are transmitted through the system are referred to as

A) General controls.
B) Hardware controls.
C) Input controls.
D) Transmission controls.

Question 54

Which of the following is not true with respect to the test data approach for evaluating computer controls?

A) The test data are created for a separate entity and are run simultaneously with the client's actual data.
B) Only one of each type of error transaction needs to be included in the test data.
C) The manual results of processing the test data are compared to the results of processing these data through the client's computerized processing system.
D) Audit teams consider potential errors and conditions of interest in generating the test data.

Question 55

Which of the following input controls would be least likely to identify the failure of an employee to input a transaction for which documentary evidence has been prepared?

A) Batch totals.
B) Hash totals.
C) Missing data tests.
D) Sequence tests.

Question 56

Which of the following is a general control that would most likely assist an organization whose systems analyst resigned during the development of a major project?

A) Grandfather-father-son file retention.
B) Input and output validation routines.
C) Systems documentation.
D) Check digit verification.

Question 57

Which of the following computer controls would provide the best evidence that unauthorized users are not accessing specific computer programs and files?

A) Using passwords requiring access to those programs and files.
B) Periodically reviewing and confirming access rights for the organization's users.
C) Monitoring actual user activity through a program log and comparing that activity to authorized levels.
D) Ensuring that access to programs and files is removed for recently terminated employees.

Question 58

Computer controls that are pervasive and apply to all applications of a computerized processing system are referred to as

A) Computer controls.
B) Environment controls.
C) Automated application controls.
D) General controls.

Question 59

Auditing through the computer

A) Is a required approach under generally accepted auditing standards.
B) Requires the audit team to evaluate the operating effectiveness of important computer controls.
C) Is normally utilized when the client has not implemented significant computer controls.
D) Focuses on reconciling the input data to the results generated by the client's computerized processing system.

Question 60

Which of the following is not an example of a general control?

A) The organization's use of the systems development life cycle when implementing or modifying computerized processing systems.
B) The organization's use of check digits to ensure accurate input of transaction data.
C) Periodic and preventative maintenance performed on the computer and related equipment.
D) The existence of appropriate separation of duties within the computer department.

Question 61

Audit teams cannot test the reliable operation of computer control procedures by

A) Submitting test data at several different times for processing on the computer program the client uses for actual transaction processing.
B) Manually comparing detailed transactions that the internal auditors used to test a program to the program's actual error messages.
C) Programming a model transaction processing system and processing actual client transactions for comparison to the output produced by the client's program.
D) Manually reperforming actual transaction processing with comparison of results to the actual system output.

Question 62

A customer intended to order 100 units of product Z96014 but incorrectly ordered product Z96015,which is not an actual product.Which of the following controls most likely would detect this error?

A) Check digit verification.
B) Record count.
C) Hash total.
D) Redundant data check.

Question 63

An example of a program in which the audit team would be most interested in testing automated application controls is a(n)

A) Payroll processing program.
B) Operating system program.
C) Data management system software.
D) Utility program.

Question 64

When processing controls within the computerized processing system may not leave visible evidence that could be inspected by audit teams,the teams should:

A) Make corroborative inquiries.
B) Observe the separation of duties of personnel.
C) Review transactions submitted for processing and comparing them to related output.
D) Review the run manual.

Question 65

Audit teams can obtain evidence of the proper functioning of password access control to a computerized processing system by

A) Writing a computer program that simulates the logic of a good password control system.
B) Selecting a random sample of the client's completed transactions to check the existence of proper authorization.
C) Attempting to sign on to the computerized processing system with a false password.
D) Obtaining representations from the client's computer personnel that the password control prevents unauthorized entry.

Question 66

Audit teams would most likely use computer-assisted audit techniques to

A) Make copies of client data files for controlled reprocessing.
B) Construct a parallel simulation to test the client's computer controls.
C) Perform tests of a client's hardware controls.
D) Test the operative effectiveness of a client's password access control.

Question 67

In a computerized processing system,hardware controls are designed to

A) Arrange data in a logical sequential manner for processing purposes.
B) Correct errors in the computer programs.
C) Monitor and detect errors in source documents.
D) Detect and control errors arising from use of equipment.

Question 68

When auditing a computerized processing system,which of the following is not true of the test data approach?

A) The client's computer programs process test data under the audit team's control.
B) The test data must consist of all possible valid and invalid conditions.
C) The test data need consist only of those valid and invalid conditions in which audit teams are interested.
D) Only one transaction of each type need be tested.

Question 69

Controls used in the management of a computer center to minimize the possibility of using an incorrect file or program are

A) Control totals.
B) Record counts.
C) Limit checks.
D) External labels.

Question 70

Which of the following would reduce the effectiveness of internal control in a computerized processing system?

A) The computer librarian maintains custody of computer program instructions and detailed lists.
B) Computer operators have access to operator instructions and detailed program lists.
C) The control group is solely responsible for the distribution of all computer output.
D) Computer programmers write and debug programs that perform routines designed by the systems analyst.

Question 71

Which of the following is not a characteristic of a batch processing system?

A) The collection of similar transactions that are sorted and processed sequentially against a master file.
B) The input of transactions prior to processing.
C) The production of numerous printouts.
D) The posting of a transaction as it occurs to several files without intermediate printouts.

Question 72

Which of the following statements most likely represents a control consideration for an entity that performs its accounting using portable computing devices?

A) It is usually difficult to detect arithmetic errors.
B) Unauthorized persons find it easy to access the computer and alter the data files.
C) Transactions are coded for account classifications before they are processed on the computer.
D) Random errors in report printing are rare in packaged software systems.

Question 73

Which of the following computerized processing systems generally can be audited without examining or directly testing the computer programs of the system?

A) A system that performs relatively uncomplicated processes and produces detailed output.
B) A system that affects a number of master files and produces a limited output.
C) A system that updates a few master files and produces no other printed output than final balances.
D) A system that performs relatively complicated processing and produces very little detailed output.

Question 74

When using test data,why are audit teams required to prepare only one transaction to test each computer processing alternative?

A) The speed and efficiency of the computer results in reduced sample sizes.
B) The risk of misstatement is typically lower in a computerized processing environment.
C) Audit teams generally perform more extensive substantive testing in a computerized processing environment, resulting in less need to test processing controls.
D) In a computerized processing environment, each transaction is handled in an identical manner.

Question 75

Audit teams use the test data method to gain certain assurances with respect to

A) Input data.
B) Machine capacity.
C) Control procedures contained within the program.
D) General controls.

Question 76

The client's computerized exception reporting system helps audit teams conduct a more efficient audit because it

A) Condenses data significantly.
B) Highlights abnormal conditions.
C) Decreases the necessary level of tests of computer controls.
D) Is an efficient computer input control.

Question 77

Which of the following automated application controls would offer reasonable assurance that inventory data were completely and accurately entered?

A) Sequence checking.
B) Batch totals.
C) Limit tests.
D) Check digits.

Question 78

Which of the following input controls would not be effective in identifying the erroneous input of numeric fields in a transaction?

A) Batch totals.
B) Hash totals.
C) Check digits.
D) Record counts.

Question 79

Computerized processing performed concurrently with a particular activity so that results are available to influence a decision being made is referred to as

A) Batch processing.
B) Real-time processing.
C) Integrated data processing.
D) Random access processing.

Question 80

Which of the following is true with respect to fraud risk factors in a computerized environment?

A) Employees in a computerized environment are highly skilled.
B) Audit teams cannot evaluate the computerized processing system during the year.
C) Higher dollar amounts are involved in a computerized environment.
D) Employees have increased access to processing systems and computer resources in a computerized environment.