Question 1

Which of the following is not a general control in an IT system:
A)Processing controls
B)Authentication of Users and Limiting Unauthorized Access
C)Establishment of an Organizational Structure
D)Physical Security of IT equipment

Accepted Answer

Processing controls are application controls, not general controls. General controls include authentication, organizational structure, and physical security.

Question 2

The risk of an unauthorized user gaining access is likely to be a risk for which of the following areas?
A)Telecommuting workers
B)Internet
C)Wireless networks
D)All of the above

Accepted Answer

Unauthorized access can be a risk for telecommuting workers who may use insecure networks or computers outside of the company's control, for internet users who may encounter malicious websites or phishing scams, and for wireless networks that may not have proper security measures in place. Therefore, all of the options listed are likely to have a risk of unauthorized user access.

Question 3

Which programmed input validation check determines whether the appropriate type of data, either alphabetic or numeric, was entered?
A)Completeness check
B)Validity check
C)Reasonableness check 
D)Field check

Accepted Answer

A field check ensures that data is of the appropriate type, either alphabetic or numeric. The other types of input validation checks (completeness, validity, and reasonableness) do not specifically address data type.

Question 4

Which programmed input validation makes sure that a value was entered in all of the critical fields?
A)Completeness check
B)Validity check
C)Reasonableness check 
D)Field check

Accepted Answer

The completeness check ensures that all required fields have been filled out, which is important for data accuracy and completeness. Validity checks ensure that the data entered is within acceptable ranges or formats, reasonableness checks compare the entered data to expectations or norms, and field checks ensure that the data entered is of the correct type or format for the specific field. While all of these checks are important, the completeness check specifically addresses the scenario in the question.

Question 5

The risk that an unauthorized user would shut down systems within the IT system is a(n):
A)Security risk
B)Availability risk
C)Processing integrity risk
D)Confidentiality risk

Accepted Answer

The risk of an unauthorized user shutting down IT systems relates to the availability of the system, as it could result in the unavailability of the system or disruption of business. This is not a confidentiality risk as it does not involve the unauthorized access of sensitive information. It is also not a processing integrity risk as it does not relate to the accuracy, completeness or validity of data processing. Therefore, the best choice is B.

Question 6

Unchecked risks and threats to the IT system could result in:
A)An interruption of the computer operations
B)Damage to an organization
C)Incorrect or incomplete accounting information
D)All of the above

Accepted Answer

All of the options listed could be potential results of unchecked risks and threats to the IT system. Interruptions in computer operations could lead to downtime and lost productivity, damage to an organization could impact its reputation or even result in financial losses, and inaccurate accounting information could have serious legal and financial consequences. Therefore, it is important to identify and manage risks and threats to the IT system in order to avoid these negative outcomes.

Question 7

An IT governance committee has several responsibilities.Which of the following is least likely to be a responsibility of the IT governance committee?
A)Develop and maintain the database and ensure adequate controls over the database.
B)Develop, monitor, and review security policies.
C)Oversee and prioritize changes to IT systems.
D)Align IT investments to business strategy.

Accepted Answer

Developing and maintaining the database and ensuring adequate controls over the database is typically the responsibility of the IT department or a specific database management team. The IT governance committee is responsible for overseeing and providing direction on IT strategy, investments, and policies to ensure alignment with business objectives.

Question 8

AICPA Trust Principles describe five categories of IT risks and controls.Which of these five categories would be described by the statement, "The system is protected against unauthorized access"?
A)Security
B)Confidentiality
C)Processing integrity
D)Availability

Accepted Answer

The statement "The system is protected against unauthorized access" describes security, which is one of the five categories of IT risks and controls in the AICPA Trust Principles. The other categories are confidentiality, processing integrity, availability, and privacy.

Question 9

In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand?
A)The accounting information system
B)The description of the general and application controls that should exist in IT system
C)The type and nature of risks in IT systems
D)The recognition of how controls can be used to reduce risk

Accepted Answer

The accounting information system is not directly related to mastering risks and controls in the context of IT systems. Understanding general and application controls, the nature of risks in IT systems, and how controls can mitigate those risks are more directly relevant.

Question 10

A company has the following invoices in a batch: $ \begin{array}{cccc}\text { Invoice No. } & \text { Product ID } & \text { Quantity } & \text { Unit Price } \ 401 & \text { H42 } & 150 & \$ 30.00 \ 402 & \text { K56 } & 200 & \$ 25.00 \ 403 & \text { H42 } & 250 & \$ 10.00 \ 404 & \text { L27 } & 300 & \$ 5.00\end{array} $ Which of the following numbers represents a valid record count?
A)1
B)4
C)70
D)900

Accepted Answer

Each invoice is a record, so the number of records is equal to the total number of invoices, which is 4. Choice A is too small, as there is more than one invoice. Choice C and D are both too large, as there are not enough products or quantities to generate that many records.

Question 11

In entering client contact information in the computerized database of a telemarketing business, a clerk erroneously entered nonexistent area codes for a block of new clients.This error rendered the block of contacts useless to the company.Which of the following would most likely have led to discovery of this error into the company's computerized system?
A)Limit check
B)Validity check
C)Sequence check
D)Record count

Accepted Answer

A validity check ensures that the data entered into the system meets a specific set of criteria, such as the correct format for a phone number, zip code, or area code. If a validity check had been run when the new client contact information was entered, the error would have been caught and corrected before the block of contacts became useless to the company. The other options (limit check, sequence check, and record count) are unlikely to catch this type of error.

Question 12

Internal controls that apply overall to the IT accounting system, that are not restricted to any particular accounting application, are referred to as a(n):
A)Specific controls
B)Application controls
C)General controls
D)IT controls

Accepted Answer

General controls apply to the overall IT environment and are not specific to any particular application. They ensure the integrity, availability, and confidentiality of data throughout the IT system. Examples of general controls include access controls, backup and recovery procedures, and network security measures. Specific controls and application controls are more specific to individual accounting applications or processes, while IT controls may include both general and specific controls related to the IT system.

Question 13

All of the following are general controls except for:
A)Passwords
B)Physical hardware controls
C)Software controls 
D)Inventory controls

Accepted Answer

Passwords, physical hardware controls, and software controls are all examples of general controls. Inventory controls, on the other hand, are a specific type of control that focuses on managing physical assets and tracking inventory levels.

Question 14

Internal controls used specifically in accounting applications to control inputs, processing, and outputs are referred to as a(n):
A)Specific controls
B)Application controls
C)General controls
D)IT controls

Accepted Answer

Application controls are internal controls specifically implemented within accounting applications to control inputs, processing, and outputs. These controls are designed to ensure the accuracy, completeness, and validity of financial data. Specific controls refer to controls that are tailored to a particular process or system, while general controls are controls that are applied across the entire organization. IT controls refer to controls related to the organization's overall IT environment.

Question 15

Internal controls that apply overall to the IT system are called:
A)Overall Controls
B)Technology Controls
C)Application Controls
D)General Controls

Accepted Answer

General Controls are internal controls that apply to the overall IT system, including its security, backup and recovery, and change management processes. These controls are designed to provide a framework for ensuring the effectiveness and efficiency of IT operations and are implemented at the system level, rather than at the application level. Examples of general controls include password policies, network security, and disaster recovery planning.

Question 16

General controls are divided into five broad categories.Which of the following is not one of these categories?
A)Authentication of users and limiting unauthorized access
B)Hacking and other network break-ins
C)Fraud Prevention
D)Business Continuity

Accepted Answer

The answer of General controls are divided into five broad...

Question 17

Which of the following is not a control intended to authenticate users?
A)User logâ€"in
B)Security token
C)Encryption
D)Biometric devices

Accepted Answer

Encryption is a security measure to protect data, but it is not typically used as a means of authenticating users.

Question 18

Which programmed input validation check compares the value in a field with related fields which determine whether the value is appropriate?
A)Completeness check
B)Validity check
C)Reasonableness check .
D)Completeness check.

Accepted Answer

The described programmed input validation check is a reasonableness check, which compares the value in a field with related fields to ensure that it falls within an appropriate range or is consistent with other data. Completeness checks ensure that required fields are not left empty, while validity checks ensure that data fits specific formats or criteria. Therefore, the best choice is C, reasonableness check.

Question 19

Management of an internet retail company is concerned about the possibility of computer data eavesdropping and wiretapping, and wants to maintain the confidentiality of its information as it is transmitted.The company should make use of:
A)Data encryption
B)Redundant servers
C)Input controls
D)Password codes

Accepted Answer

Data encryption is the best choice in this situation as it ensures that any data transmitted is scrambled and difficult to decipher if intercepted. Redundant servers, input controls, and password codes are all important measures for ensuring data security, but do not directly address the issue of data eavesdropping and wiretapping.

Question 20

Which control total is the total of field values that are added for control purposes, but not added for any other purpose?
A)Record count
B)Hash total
C)Batch total
D)Field total

Accepted Answer

Hash total is a control total that is used for control purposes only and is not added for any other purpose. Like other control totals, it provides a mechanism for verifying the accuracy and completeness of data, but it does so by adding together field values that have been hashed or transformed into a fixed-length string of characters. The hash total can be used to detect errors or fraud in the data, such as missing records, duplicate records, or incorrect data values, by comparing the hash total computed at different stages of data processing.

Quiz 4: Internal Controls and Risks in IT Systems

Which of the following is not a general control in an IT system:

The risk of an unauthorized user gaining access is likely to be a risk for which of the following areas?

Which programmed input validation check determines whether the appropriate type of data, either alphabetic or numeric, was entered?

Which programmed input validation makes sure that a value was entered in all of the critical fields?

The risk that an unauthorized user would shut down systems within the IT system is a(n) :

Unchecked risks and threats to the IT system could result in:

An IT governance committee has several responsibilities.Which of the following is least likely to be a responsibility of the IT governance committee?

AICPA Trust Principles describe five categories of IT risks and controls.Which of these five categories would be described by the statement, "The system is protected against unauthorized access"?

In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand?

Internal controls that apply overall to the IT accounting system, that are not restricted to any particular accounting application, are referred to as a(n) :

All of the following are general controls except for:

Internal controls used specifically in accounting applications to control inputs, processing, and outputs are referred to as a(n) :

Internal controls that apply overall to the IT system are called:

General controls are divided into five broad categories.Which of the following is not one of these categories?

Which of the following is not a control intended to authenticate users?

Which programmed input validation check compares the value in a field with related fields which determine whether the value is appropriate?

Management of an internet retail company is concerned about the possibility of computer data eavesdropping and wiretapping, and wants to maintain the confidentiality of its information as it is transmitted.The company should make use of:

Which control total is the total of field values that are added for control purposes, but not added for any other purpose?