Question 1

These tests of security controls analyze a company's control environment for possible weaknesses.Special software programs are available to help auditors identify weak points in a company's security measures.
A)Authenticity tests
B)Penetration tests
C)Vulnerability assessments
D)IT systems documentation

Accepted Answer

These tests are typically referred to as "vulnerability assessments." Authenticity tests focus on verifying the identity of users, while penetration tests involve actively attempting to break through security measures. IT systems documentation refers to the documentation of a company's IT systems, which may include information about security controls but would not necessarily involve testing their effectiveness.

Question 2

All of the following are examples of security controls except:
A)Biometric access controls
B)Swipe key access controls
C)Online firewall protection controls
D)All of the above are examples of security controls

Accepted Answer

All of the given options are examples of security controls, hence D is the correct answer.

Question 3

Auditors may send text messages through a company's system to find out whether encryption of private information is occurring properly.In addition, special software programs are available to help auditors identify weak points in a company's security measures.These are examples of:
A)Penetration tests
B)Authenticity tests
C)Vulnerability assessments
D)Access log reviews

Accepted Answer

The examples given in the question (sending text messages and using special software) are methods commonly used in vulnerability assessments. Penetration tests typically involve attempting to exploit weaknesses in a company's security measures to demonstrate their potential impact, while authenticity tests and access log reviews are focused on verifying the legitimacy and accountability of system users.

Question 4

A process of constant evidence gathering and analysis to provide assurance on the information as soon as it occurs or shortly thereafter is referred to as:
A)Real-time auditing
B)Virtual auditing
C)E-auditing
D)Continuous auditing

Accepted Answer

The process described is known as continuous auditing, which involves ongoing testing and monitoring of key controls and transactions through automated tools and techniques. This approach provides real-time assurance and enables prompt corrective action if any issues or anomalies are detected. The other answer options (A, B, C) do not accurately describe this concept.

Question 5

The two broad categories of general controls that relate to IT systems include which of the following:
A)IT systems documentation
B)IT administration and the related operating systems development and maintenance processes
C)Authenticity table
D)Computer security and virus protection

Accepted Answer

The two broad categories of general controls related to IT systems are IT administration, which encompasses the operating system development and maintenance processes, and computer security and virus protection. IT systems documentation and authenticity table are not broad categories of general controls for IT systems.

Question 6

In addition to testing system documentation, auditors should test the three main functions of computer applications.Which of the following is not one of these functions?
A)Output
B)Input
C)Processing
D)Data storage

Accepted Answer

The three main functions of computer applications are input, processing, and output. Data storage is a supporting function and not considered one of the main functions. Therefore, option D is not one of the main functions of computer applications.

Question 7

Auditors should perform this type of test to determine the valid use of the company's computer system, according to the authority tables.
A)Authenticity tests
B)Penetration tests
C)Vulnerability assessments
D)IT systems documentation

Accepted Answer

Authenticity tests are performed to determine the validity of the access provided to users in the computer system according to the authority tables. These tests ensure that users can access only the data that they are authorized to access. Penetration tests are used to identify security vulnerabilities by simulating an attack on the system. Vulnerability assessments are used to identify weaknesses and security holes in a system, and IT systems documentation provides a record of the system's configuration and operation.

Question 8

The auditor's test of the accuracy of monetary amounts of transactions and account balances is known as:
A)Testing of controls
B)Substantive tests
C)Compliance tests
D)Application tests

Accepted Answer

Substantive tests are specifically designed to test the accuracy of monetary amounts of transactions and account balances, which is the given scenario. Testing of controls evaluates whether internal controls are in place and operating effectively, compliance tests ensure that transactions and processes comply with applicable laws and regulations, and application tests test the functionality of computer systems and software applications.

Question 9

Regardless of whether the results are printed or retained electronically, auditors may perform all of the following procedures to test application outputs, except:
A)Integrated tests
B)Reasonableness tests 
C)Audit trail tests
D)Rounding errors tests

Accepted Answer

Integrated tests are used to test the processing of transactions within an application, not specifically to test application outputs.

Question 10

This type of application control is performed to verify the correctness of information entered into software programs.Auditors are concerned about whether errors are being prevented and detected during this stage of data processing.
A)Security controls
B)Processing controls
C)Input controls
D)Output controls

Accepted Answer

Input controls are specifically designed to verify the accuracy and completeness of information entered into software programs, ensuring that errors are detected and prevented at an early stage of data processing. Auditors typically focus on input controls as part of their efforts to assess the effectiveness of internal controls over financial reporting.

Question 11

This phase of auditing occurs when the auditors evaluate all the evidence that has been accumulated and makes a conclusion based on that evidence.
A)Tests of controls
B)Audit planning
C)Audit completion / reporting
D)Substantive testing

Accepted Answer

Audit completion/reporting is the phase in which the auditors evaluate all accumulated evidence and draw conclusions. Tests of controls and substantive testing take place earlier in the audit process, while audit planning occurs at the beginning.

Question 12

Related audit tests to review the existence and communication of company policies regarding important aspects of IT administrative control include all of the following, except:
A)Personal accountability and segregation of incompatible responsibilities 
B)Job description and clear lines of authority
C)Prevention of unauthorized access
D)IT systems documentation

Accepted Answer

The answer of Related audit tests to review the existence...

Question 13

One of the most effective ways a client can protect its computer system is to place physical controls in the computer center.Physical controls include all of the following, except:
A)Proper temperature control
B)Locks
C)Security guards
D)Cameras

Accepted Answer

Proper temperature control is not a physical control aimed at preventing unauthorized access or damage by individuals; it is rather an environmental control designed to ensure the hardware operates within safe temperature ranges.

Question 14

IT audit procedures typically include a combination of data accuracy tests where the data processed by computer applications are reviewed for correct dollar amounts or other numerical values.These procedures are referred to as:
A)Security controls
B)Processing controls
C)Input controls
D)Output controls

Accepted Answer

Data accuracy tests are a type of processing control, which involves reviewing the data processed by computer applications. Security controls involve activities such as access controls and monitoring of system usage, input controls focus on verifying the accuracy and completeness of data entered into a system, and output controls ensure that data is presented in a clear and understandable format.

Question 15

This law, also known as the first-digit law, was named after a physicist who discovered a specific but non-uniform pattern in the frequency of digits occurring as the first number in a list of numbers:
A)Number-Up Law
B)Benford's Law
C)Adams' Digit Law
D)Jackson First-Digit Law

Accepted Answer

The law described is commonly known as Benford's Law, named after physicist Frank Benford who first observed the pattern. The law states that in many naturally occurring sets of numbers, the first digit is more likely to be a smaller digit (such as 1 or 2) than a larger digit (such as 8 or 9). This phenomenon has been observed in various fields, including finance and accounting.

Question 16

Controls meant to prevent the destruction of information as the result of unauthorized access to the IT system are referred to as:
A)IT administration
B)System controls
C)Information administration
D)Security controls

Accepted Answer

Security controls are specifically designed to prevent unauthorized access or destruction of information in an IT system. IT administration, system controls, and information administration may have overlapping responsibilities related to security, but they do not specifically target the prevention of unauthorized destruction of information.

Question 17

This type of processing control test involves a comparison of different items that are expected to have the same values, such as comparing two batches or comparing actual data against a predetermined control total.
A)Validation checks
B)Batch totals
C)Run-to-Run totals
D)Balancing tests

Accepted Answer

Balancing tests involve comparing different items that are expected to have the same values to ensure consistency and accuracy, such as comparing actual data against a predetermined control total.

Question 18

These tests of the security controls involve various methods of entering the company's system to determine whether controls are working as intended.
A)Authenticity tests
B)Penetration tests
C)Vulnerability assessments
D)IT systems documentation

Accepted Answer

Penetration tests involve attempting to exploit vulnerabilities in a company's system to determine if the security controls are effective. This type of testing can be done externally or internally and can identify potential weaknesses before they are exploited by attackers. Authenticity tests are not specifically related to testing security controls, vulnerability assessments are a separate type of testing that focuses on identifying vulnerabilities in the system, and IT systems documentation is not a type of testing at all.

Question 19

One of the most effective ways a client can protect its computer system is to place environmental controls in the computer center.Environmental controls include:
A)Card keys
B)Emergency power supply
C)Alarms
D)Security guards

Accepted Answer

Environmental controls refer to physical measures taken to protect the computer system, including temperature and humidity controls, fire suppression systems, and emergency power supplies. While card keys, alarms, and security guards are important security measures, they do not specifically address environmental factors that can harm the computer system. Therefore, the best choice for environmental controls is option B, an emergency power supply.

Question 20

This is one of the computer-assisted audit techniques, related to processing controls, that involves processing company data through a controlled program designed to resemble the company's application.This test is run to find out whether the same results are achieved under different systems.
A)Integrated test facility
B)Embedded audit module
C)Parallel simulation
D)Test data method

Accepted Answer

Parallel simulation involves running the same data through a separate program (the auditor's software) that simulates the company's application, to verify that both systems produce the same results. This technique is used to assess the reliability of the client's processing controls.

Quiz 7: Auditing Information Technology-Based Processes

These tests of security controls analyze a company's control environment for possible weaknesses.Special software programs are available to help auditors identify weak points in a company's security measures.

All of the following are examples of security controls except:

Auditors may send text messages through a company's system to find out whether encryption of private information is occurring properly.In addition, special software programs are available to help auditors identify weak points in a company's security measures.These are examples of:

A process of constant evidence gathering and analysis to provide assurance on the information as soon as it occurs or shortly thereafter is referred to as:

The two broad categories of general controls that relate to IT systems include which of the following:

In addition to testing system documentation, auditors should test the three main functions of computer applications.Which of the following is not one of these functions?

Auditors should perform this type of test to determine the valid use of the company's computer system, according to the authority tables.

The auditor's test of the accuracy of monetary amounts of transactions and account balances is known as:

Regardless of whether the results are printed or retained electronically, auditors may perform all of the following procedures to test application outputs, except:

This type of application control is performed to verify the correctness of information entered into software programs.Auditors are concerned about whether errors are being prevented and detected during this stage of data processing.

This phase of auditing occurs when the auditors evaluate all the evidence that has been accumulated and makes a conclusion based on that evidence.

Related audit tests to review the existence and communication of company policies regarding important aspects of IT administrative control include all of the following, except:

One of the most effective ways a client can protect its computer system is to place physical controls in the computer center.Physical controls include all of the following, except:

IT audit procedures typically include a combination of data accuracy tests where the data processed by computer applications are reviewed for correct dollar amounts or other numerical values.These procedures are referred to as:

This law, also known as the first-digit law, was named after a physicist who discovered a specific but non-uniform pattern in the frequency of digits occurring as the first number in a list of numbers:

Controls meant to prevent the destruction of information as the result of unauthorized access to the IT system are referred to as:

This type of processing control test involves a comparison of different items that are expected to have the same values, such as comparing two batches or comparing actual data against a predetermined control total.

These tests of the security controls involve various methods of entering the company's system to determine whether controls are working as intended.

One of the most effective ways a client can protect its computer system is to place environmental controls in the computer center.Environmental controls include:

This is one of the computer-assisted audit techniques, related to processing controls, that involves processing company data through a controlled program designed to resemble the company's application.This test is run to find out whether the same results are achieved under different systems.