Question 1

A strong internal control system will reduce the amount of substantive testing that must be performed.

Accepted Answer

A strong internal control system is designed to prevent or detect errors and frauds in financial statements. As a result, auditors can rely on those controls and perform less substantive testing. Therefore, a strong internal control system will reduce the amount of substantive testing that must be performed.

Question 2

The same internal control objectives apply to manual and computer-based information systems.

Accepted Answer

Internal control objectives, such as safeguarding assets, ensuring data accuracy and completeness, and promoting operational efficiency, apply to both manual and computer-based information systems.

Question 3

An IT auditor expresses an opinion on the fairness of the financial statements.

Accepted Answer

An IT auditor does not express an opinion on the fairness of the financial statements. Their role is to evaluate the effectiveness of the organization's IT systems and processes, and to identify any potential risks or vulnerabilities. This information may be used by the company's external auditors in their assessment of the financial statements, but the IT auditor does not provide an opinion on the financial statements themselves.

Question 4

Audit risk is the probability that the auditor will render an unqualified opinion on financial statements that are materially misstated.

Accepted Answer

This is an accurate definition of audit risk.

Question 5

External auditors can cooperate with and use evidence gathered by internal audit departments that are organizationally independent and that report to the audit committee of the board of directors.

Accepted Answer

External auditors can indeed cooperate with and use evidence gathered by internal audit departments that are organizationally independent and that report to the audit committee of the board of directors. This collaboration can enhance the effectiveness of the overall audit process.

Question 6

The database administrator should be separated from systems development.

Accepted Answer

Separating the roles of the database administrator and systems development can help ensure the integrity and security of the data, as well as prevent conflicts of interest. The database administrator is responsible for the management, maintenance, and security of the database, while systems development involves creating and implementing new software applications. Separating these roles can help prevent bias or favoritism when making decisions about the database and its use.

Question 7

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

Accepted Answer

Corporate management, including the CEO and CFO, are required to certify their organization's internal controls over financial reporting annually, not monthly, as per the Sarbanes-Oxley Act of 2002.

Question 8

Substantive testing techniques provide information about the accuracy and completeness of an application's processes.

Accepted Answer

The answer of Substantive testing techniques provide information about the...

Question 9

Statements on Auditing Standards recommendations must be followed by every member of the profession unless it can be shown why a standard does not apply in a given situation.

Accepted Answer

This statement is true. As per the American Institute of Certified Public Accountants (AICPA), Statements on Auditing Standards (SAS) are authoritative guidance for auditors in performing auditing procedures. Members of the profession must follow these standards unless they demonstrate that a different procedure or approach provides equivalent assurance.

Question 10

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Accepted Answer

While the SEC and the PCAOB recommend the use of the COBIT framework as a helpful tool in assessing internal control adequacy, they do not require its use. The COSO framework is the most commonly used framework for internal control assessment and is often referenced in SEC and PCAOB guidance.

Question 11

Application controls apply to a wide range of exposures that threaten the integrity of all programs processed within the computer environment.

Accepted Answer

Application controls are specific to individual applications and focus on ensuring the accuracy, completeness, and validity of data within those specific applications, rather than addressing a wide range of exposures across all programs.

Question 12

A disaster recovery plan is a comprehensive statement of all actions to be taken after a disaster.

Accepted Answer

A disaster recovery plan is a comprehensive document that outlines all the procedures and processes that need to be followed after a disaster to ensure that critical business operations can be restored as quickly as possible. It typically includes detailed recovery strategies, procedures, and other critical information required to rebuild operations and restore normalcy after a disruption.

Question 13

A qualified opinion on management's assessment of internal controls over the financial reporting system necessitates a qualified opinion on the financial statements.

Accepted Answer

A qualified opinion on management's assessment of internal controls over financial reporting does not automatically necessitate a qualified opinion on the financial statements themselves. The two are separate assessments, and issues with internal controls may not directly impact the accuracy or integrity of the financial statements as presented.

Question 14

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Accepted Answer

The answer of To fulfill the segregation of duties control...

Question 15

External auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization.

Accepted Answer

External auditing is conducted by an independent body outside of the organization to provide an objective assessment of financial statements and compliance with applicable laws and regulations.

Question 16

The most common access point for perpetrating computer fraud is at the data collection stage.

Accepted Answer

The data collection stage is where sensitive information is often first recorded and stored, making it a prime target for criminals seeking to perpetrate computer fraud. By compromising this stage, hackers can gain access to valuable data and potentially wreak havoc on an organization's systems and operations. Therefore, it is important for companies to implement strong security measures to protect their data at this stage and throughout the entire data lifecycle.

Question 17

Tests of controls determine whether the database contents fairly reflect the organization's transactions.

Accepted Answer

Tests of controls are designed to evaluate the effectiveness of an organization's internal controls over financial reporting, not to directly assess the fair reflection of transactions in the database contents.

Question 18

Some systems professionals have unrestricted access to the organization's programs and data.

Accepted Answer

Some systems professionals such as IT administrators, network administrators or application developers have unrestricted access to the organization's programs and data. This access is required to perform their job functions effectively. However, most organizations have policies and procedures in place to ensure that such access is granted based on the principle of least privilege and is monitored closely to prevent any misuse or unauthorized access.

Question 19

IT auditing is a small part of most external and internal audits.

Accepted Answer

The answer of IT auditing is a small part of...

Question 20

Both the SEC and the PCAOB recommend management to use the COSO framework for assessing internal control adequacy.

Accepted Answer

Both the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB) recommend the use of the Committee of Sponsoring Organizations (COSO) framework as a standard for evaluating the effectiveness of internal control systems.

Quiz 14: Auditing It Controls Part I: Sarbanes-Oxley and It Governance