Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AUD > Auditing IT Systems > Flashcards

Auditing IT Systems Flashcards

1
Q

What is EDP?

A

Electronic data processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the six elements of an EDP-based system?

A

(1) hardware
(2) software
(3) documentation
(4) personnel
(5) data
(6) controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is important to know about documentation for IT systems?

A

Control procedures for IT systems often do not leave documentary evidence behind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is important to know regarding a change in IT system?

A

IT systems are more difficult to change than manual systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are two different transaction processing models?

A

Batch processing and online processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is batch processing?

A

Accumulating transactions into groups that can then be processed all at once, as one batch, rather than each being processed individually as they arose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a disadvantage of batch processing?

A

Since transactions are not processed immediately, errors will not be detected as quickly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is online processing?

A

Immediately processing transactions online as they occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an OLRT system?

A

An online, real-time system – it processes data quickly enough to interact with and receive responses for other data

E.g. for airline reservations, a customer’s data can be inputted, and then the available flights are returned, and then the customer can select the flight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an integrated system?

A

A system where a transaction affects all the relevant files at once, rather than needing separate actions

E.g. a sale can update revenues, accounts receivable, and inventory at once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are different ways to do external information processing?

A

(1) Block time = renting the use of another entity’s computer
(2) Time-sharing = having equal access with other users to one system
(3) Service bureau = an outside entity which provides data service at a cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is parallel processing?

A

Running a new system-to-be-implemented at the same as the old system, comparing their results

This makes the conversion smoother (providing a stepping stone) and can avoid disaster if the new system crashes

Also called parallel operating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is volume testing?

A

Testing the ability of a new system to handle various volumes of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is important about IT documentation?

A

It provides all sorts of info concerning the system’s purpose, input and output, users, controls, etc., which can be very useful to the auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the different kinds of IT documentation?

A

(1) Problem definition
(2) Systems
(3) Program
(4) Operations
(5) User
(6) Operator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is CAAT?

A

Computer-assisted audit techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is important to auditors concerning transaction trails?

A

IT systems might leave complete records of transactions only for a short time or only in computer-readable form

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is important to auditors concerning the uniformity of transaction processing?

A

Since computers process things uniformly, they will either avoid error uniformly or commit error uniformly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is important to auditors concerning the segregation of duties?

A

Since computers naturally perform many tasks at once, someone with access to the computer can have too much authority to do separate functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is important to auditors concerning the chance of fraud?

A

Insofar as computers process transactions without human involvement, the chance of detecting fraud is reduced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is important to auditors concerning management supervision?

A

Computers provide the tools to increase the ways in which management can supervise various activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is important to auditors concerning transaction authorization?

A

Routine transactions that would have had periodic authorization in a manual system might not have any documentation for authorization in a computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are two different kinds of internal accounting control procedures?

A

(1) General – overall controls for data and for program changes and maintenance
(2) Application – controls for specific applications (e.g. inputs and outputs for accounts payable)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is important for an auditor to remember when reviewing internal control?

A

Since controls are very concentrated in IT systems, their interconnections play a big role.

E.g. application controls’ reliability usually depends on general controls’ reliability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is EDI?

A

Electronic Data Interchange

Business conducted electronically between customers and vendors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is data mining?

A

Taking large amounts of data and acquiring new info (specifically, patterns or trends) from it

Good for checking for fraud, e.g. checking employee addresses to vendor addresses, vendor records with P.O. box addresses, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a fraud profile?

A

A set of data characteristics which would signify a higher chance of fraud, given the entity’s internal controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are some ways in which paper evidence is superior to electronic evidence?

A
  • more difficult to alter
  • more credible in its source (direct mailing rather than through electronic system)
  • often includes approvals in the documentation
  • easier to use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are some benefits to an IT system over a traditional/manual system?

A
  • can perform large and complex calculations
  • increases how timely, available, and accurate info is
  • allows further analysis
  • allows further monitoring
  • can have stricter controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are some risks to an IT system?

A
  • errors can be systematic
  • unauthorized access can give the user great power
  • data can be lost
  • programs can be neglected/not updated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is one way in which control automation informs an auditor’s judgment about controls’ effectiveness?

A

Since IT controls are more uniform and interrelated, judgments on controls’ effectiveness for more general controls can bear on more specific controls

E.g. if there is evidence for application controls’ implementation and general controls’ effectiveness, that could constitute evidence for the application controls’ effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What two segregation controls are important in small-business IT environments?

A
  • between data entry and processing

- between IT and transaction authorization for users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What might an auditor do if a company does not document changes made to an IT program?

A

Obtain the original software from the manufacturer and see what changes have been made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are distributed systems?

A

Systems with a main/central computer system and several remote computer sites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are important factors to remember if a client utilizes an IT service center?

A

(1) Transmission
(2) Error correction
(3) Audit trail
(4) Master file changes
(5) Output
(6) Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are some general controls restricting IT department activity?

A

(1) Segregating functions of users and the IT department
(2) Barring IT people from making or authorizing transactions
(3) Segregating duties within the IT department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are different IT functions that ought to be segregated?

A

(1) Control group
(2) Operators
(3) Programmers
(4) Analysts
(5) Librarians

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the role of a control group in the IT department?

A

It oversees internal control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the role of operators in the IT department?

A

They convert data into a machine-readable form

40
Q

What is the role of programmers in the IT department?

A

They write and debug programs

  • Applications programmers = deal with application programs
  • Systems programmers = deal with software that runs the hardware
41
Q

What is the role of analysts in the IT department?

A

They design the overall system, mapping it out with a flowchart

42
Q

What is the role of librarians in the IT department?

A

They track the access, use, and storage of programs or other files, including backups

43
Q

What are some general controls related to systems development?

A
  • users should be involved in the procedures for system design and the choice of software
  • systems testing should involve both users and IT people
  • there should be controls barring unauthorized changes
  • mgmt should require documentation for choices made regarding the system
44
Q

What is a parity bit?

A

A way to test hardware for malfunctions

Odd parity = characters are represented by some odd number of magnetized dots
Even parity = characters are represented by some even number

A parity bit tests for whether a character has the wrong number (e.g. due to dust)

45
Q

What is an echo check?

A

Signal is sent to activate a device, which sends a signal back, and the computer “checks” this “echo”

46
Q

What is a hardware check?

A

The computer checks the hardware equipment

47
Q

What is boundary protection?

A

Separates files or programs when they are shared in a common place (e.g. in time-sharing)

48
Q

What are two different kinds of internal file labels?

A

(1) Header label = at beginning of file
- contains name, ID #, tape reel #
(2) Trailer label = at end of file
- contains # of records in file, end-of-file code

49
Q

What is an external label?

A

A label that is attached to some secondary storage device rather than inside the file, readable by humans rather than machines

50
Q

What is a file protection ring?

A

A plastic ring placed around magnetic tape to avoid accidentally erasing information through physical writing or marking

51
Q

What are different file protection plans?

A

(1) Duplicate files
(2) Disk reconstruction plan
(3) Grandfather-father-son retention

52
Q

What is a disk reconstruction plan?

A

Periodically saves a disk file, so that the file can be reconstructed at any given point in time

53
Q

What is grandfather-father-son retention?

A

When a master file has a day’s transactions processed against it, the new master file will be the father and the old one the grandfather. When the father master file has the next day’s transactions processed against it, the new file will be the son.

The terms “grandfather,” “father,” and “son” are relative, referring to how far back in the chain older files are retained. For instance, when the son master file (mentioned above) has a new day’s transactions processed against it, the new master file is effectively the son, the old son file is the father, the old father is the grandfather, and the old grandfather is erased. The important point is that two older files are retained for backup purposes at any given time – the grandfather and father are the two backups for the son.

54
Q

What are some important factors to consider concerning physical safeguards?

A

(1) Temperature, humidity, dust, and other factors are not problematic/extreme
(2) The environment is prepared for physical disaster (e.g. basement flooding)
(3) Other facilities are ready in case of disaster

55
Q

For backup facilities, what do the terms “cold” and “hot” mean?

A 
Cold = facility is unprepared for resuming operations (also less expensive)
Hot = facility is prepared for resuming operations

There can be degrees of “warmth” involved here

56
Q

What do microcomputers signify for internal controls?

A

A weakness in internal controls – since they are usually not in isolated areas, and since they can more easily be modified (including at home)

57
Q

What are different types of inputs which should have internal controls as safeguards?

A

(1) transaction entries
(2) file maintenance
(3) inquiries
(4) error corrections

58
Q

What are control totals?

A

A type of internal control meant to double-check data inputted into the system

Can be financial totals (e.g. total $ in A/Rs), hash totals (e.g. sum of account #s), or record/document counts (# of transactions processed)

59
Q

What are edit tests?

A

Checks performed by a computer to test data being inputted

60
Q

What is a limit test?

A

An edit test to see whether a value is not greater than or lesser than certain amounts

Also called a reasonableness test

61
Q

What is a character test?

A

An edit test to see whether an input has a proper size and composition (e.g. if an input ought to always have 7 numbers)

Also called a valid field test

62
Q

What is a code test?

A

An edit test to ensure that a wrong number is not used (e.g. if a company has four stores, the entry should not be greater than 4)

Also called a valid number test

63
Q

What is a sequence check?

A

An edit test that ensures data is inputted in the right order

64
Q

What is a missing data test?

A

An edit test to see whether all fields contain data

65
Q

What is a valid transaction test?

A

An edit test that sees whether an inputted transaction is the right kind for the file (e.g. for A/R, it might be that all inputted transactions are either debits or credits to A/R)

66
Q

What is a valid combination of fields test?

A

An edit test that sees whether certain data, when combined, is reasonable (e.g. selling a large quantity of washers and dryers to a single customer – this might show that the wrong quantity was entered)

67
Q

What is a self-checking digit?

A

An edit test where a digit is added to some number (e.g. an order ID number) based off the number itself, and then checked for accuracy later

E.g. there might be a formula to add the sum of the 2nd and 5th digits of an order ID, so an order ID of 41853 would be changed to 418534, since 1+3=4. This can help ensure that other data is inputted correctly.

68
Q

What is a valid sign test?

A

An edit test that checks whether a sign (i.e. positive or negative) is accurate for a record

69
Q

What is an error log?

A

A record of transactions that aren’t processed due to some error – exists to ensure that transactions skipped over (due to error) will later be corrected

Also called an error listing

70
Q

What are some application controls related to processing?

A

(1) Reconciling control totals with inputs
(2) Prevention of processing the wrong files
(3) Limit tests built into programs

71
Q

What are some application controls related to output?

A

(1) Reconciling output totals with input totals
(2) Comparing scanned outputs to original documents
(3) Distributing outputs only to authorized users

72
Q

What does it mean to audit “around” or “without” the computer?

A

The auditor ignores the workings of the computer, focusing only on input and output without directly testing computer controls

73
Q

For what systems is auditing around the computer appropriate?

A

Systems that are (a) simple and (b) provide a good audit trail of documentation

74
Q

How does auditing around the computer generally test computer controls?

A

Through the error log – sees what the specific errors were

75
Q

What does it mean to audit “through” or “with” the computer?

A

Auditing where the computer is directly included in performing tests of control and substantive tests, focusing more on the inputs and the processing

76
Q

What is one way to summarize the difference between auditing around the computer and auditing through the computer?

A

Around = focuses on inputs and outputs, ignoring the processing (since if inputs and outputs are good, processing probably is)

Through = focuses on inputs and processing, ignoring the outputs (since if inputs and processing are good, outputs probably are)

77
Q

When is auditing through the computer necessary?

A

More complex systems do more processing only in machine-readable form, thus leaving a smaller (or no) audit trail. Thus the processing has to be analyzed.

78
Q

What are the first three different ways for auditing through the computer?

A

(1) Writing one’s own program for a substantive test
(2) Embedded audit modules
(3) Tagging

79
Q

What are embedded audit modules?

A

These are chunks of program code included in the application program and designed to gather audit information

Best to include in systems design, rather than after the system is already functioning

80
Q

What is tagging?

A

Marking transactions before they are inputted, so that extra documentation is produced with specific reference to those transactions as they are processed

81
Q

What are the second three different ways for auditing through the computer?

A

(4) Client-prepared program
(5) Utility program/routine
(6) Program comparison

82
Q

What is a client-prepared program?

A

Programs to collect audit evidence that are already made by the client’s internal auditors

These programs need to be tested by the external auditor before being used, however

83
Q

What is a utility program (or utility routine)?

A

A processing function already included in a program by the manufacturer

Auditor will need to make sure these have not been altered

84
Q

What is program comparison?

A

The auditor compares his copy of the program with the program being used by the client

This is usually done by surprise, so that the auditor can find any unauthorized changes in the program

A problem with this is that the auditor’s copy could simply be wrong, as programs can be updated frequently

85
Q

What are the final five different ways for auditing through the computer?

A

(7) Test data/deck
(8) Review of program logic
(9) Integrated test facility (ITF), minicompany approach
(10) Parallel simulation
(11) Program tracing

86
Q

What is test data (or a test deck)?

A

When the auditor prepares fake data with certain errors to see if the processes catch the errors

The auditor must be careful to keep the fake data separate from real data

87
Q

What is a review of program logic?

A

The auditor simply analyzes the program itself, e.g. as a flowchart, to understand it

Can take a long time

88
Q

What is the integrated test facility (ITF) minicompany approach?

A

The auditor includes some fake account or customer within the real data, unbeknownst to the client, and then does certain actions to see if the system processes it correctly

E.g. for an A/R system, he could underpay it, overpay it, make no payments, etc.

Similar to test data, except that it is mixed with true data and tested over a longer period

89
Q

What is parallel simulation?

A

The auditor processes the client data through his own copy of the program and compares the outputs to the data run through the client’s program

90
Q

What is program tracing?

A

This is a process that prints the steps of a program which a transaction goes through

91
Q

What is GAS?

A

Generalized audit software – programs designed to do auditing processing

Also called general purpose audit software (GPAS) or general purpose computer audit software (GPCAS)

92
Q

Why is GAS frequently used?

A

(1) Can be used for a variety of machine-readable data
(2) Can deal with large volumes of data
(3) Removes need for other personnel
(4) Can remove need for technical understanding of client IT

93
Q

What are the six main tasks accomplished by GAS?

A

(1) Testing for quality, completeness, consistency, and correctness
(2) Testing calculations
(3) Comparing data on separate files
(4) Selecting, printing, and analyzing samples
(5) Summarizing/resequencing data
(6) Comparing data from other audit procedures with company records

94
Q

What is a coding sheet?

A

A sheet on which the auditor describes the GAS routines in order, including info on the client system and data files

95
Q

Should the auditor always remain in physical control of GAS?

A

Yes – and he should be present as it is run

AUD (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions