Chapter 7: Computer-Assisted Audit Tools and Techniques Flashcards

1
Q

The data collection component of the information system is responsible for _____________________

A

for bringing data into the system for processing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The data collection component of the information system is responsible for bringing data into the system for processing. _____________ at this stage are designed to ensure that these transactions are valid, accurate, and complete.

A

Input Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Classes of Input Controls

A
  • Source document controls
  • Data coding controls
  • Batch controls
  • Validation controls
  • Input error correction
  • Generalized data input systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

two types of transposition errors:

A

single transposition errors and multiple transposition errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A ______________ is a control digit (or digits) added to the code when it is originally assigned that allows the integrity of the code to be established during subsequent processing

A

check digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

_________ are an effective method of managing high volumes of transaction data through a system.

A

Batch controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The objective of batch control is _______________________.

A

to reconcile output produced by the system with the input originally entered into the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

______________ refers to a simple control technique that uses nonfinancial data to keep track of the records in a batch.

A

Hash total

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Input _______________ are intended to detect errors in transaction data before the data are processed.

A

validation controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

There are three levels of input validation controls:

A
  1. Field interrogation
  2. Record interrogation
  3. File interrogation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

__________________ involves programmed procedures that examine the characteristics of the data in the field.

A

Field interrogation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

________________ are used to examine the contents of a field for the presence of blank spaces.

A

Missing data checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

_______________________ checks determine whether the correct form of data is in a field. For example, a customer’s account balance should not contain alphabetic data.

A

Numeric-alphabetic data checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

____________________ are used to verify that certain fields are filled with zeros. Some program languages require that fields used in mathematical operations be initiated with zeros prior to processing

A

Zero-value checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

_________ determine if the value in the field exceeds an authorized limit. For example, assume the firm’s policy is that no employee works more than 44 hours per week. The payroll system validation program can interrogate the hours-worked field in the weekly payroll records for values greater than 44.

A

Limit checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

____________ assign upper and lower limits to acceptable data values

A

Range checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The purpose of this control is to detect keystroke errors that shift the decimal point one or more places.

A

Range checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

____________ compare actual values in a field against known acceptable values. This control is used to verify such things as transaction codes, state abbreviations, or employee job skill codes. If the value in the field does not match one of the acceptable values, the record is determined to be in error.

A

Validity checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

______________ controls identify keystroke errors in key fields by testing the internal validity of the code

A

Check digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

______________ procedures validate the entire record by examining the interrelationship of its field values.

A

Record interrogation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

______________________ determine if a value in one field, which has already passed a limit check and a range check, is reasonable when considered along with other data fields in the record.

A

Reasonableness checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

_________ are tests to see if the sign of a field is correct for the type of record being processed. For example, in a sales order processing system, the dollar amount field must be positive for sales orders but negative for sales return transactions.

A

Sign checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

_____________ are used to determine if a record is out of order. In batch systems that use sequential master files, the transaction files being processed must be sorted in the same order as the primary keys of the corresponding master file.

A

Sequence checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The purpose of _______________ is to ensure that the correct file is being processed by the system. These controls are particularly important for master files, which contain permanent records of the firm and which, if destroyed or corrupted, are difficult to replace.

A

file interrogation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

____________ verify that the file processed is the one the program is actually calling for.

A

Internal label checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

________________ are used to verify that the version of the file being processed is correct. In a grandparent–parent–child approach, many versions of master files and transactions may exist. This control compares the version number of the files being processed with the program’s requirements.

A

Version checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

An __________________ prevents a file from being deleted before it expires. In a GPC system, for example, once an adequate number of backup files is created, the oldest backup file is scratched (erased from the disk or tape) to provide space for new files.

A

expiration date check

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The three common error
handling techniques:

A

(1) correct immediately,
(2) create an error file, and
(3) reject the entire batch.

29
Q

To achieve a high degree of control and standardization over input validation procedures, some organizations employ a __________________________.

A

generalized data input system (GDIS)

30
Q

The GDIS approach has three advantages:

A

First, it improves control by having one common system perform all data validation.
Second, GDIS ensures that each AIS application applies a consistent standard for data validation.
Third, GDIS improves systems development efficiency.

31
Q

A GDIS has five major components:

A
  1. Generalized validation module
  2. Validated data file
  3. Error file
  4. Error reports
  5. Transaction log
32
Q

The _________________________ performs standard validation routines that are common to many different applications. These routines are customized to an individual application’s needs through parameters that specify the program’s specific requirements.

A

generalized validation module (GVM)

33
Q

The input data that are validated by the GVM are stored on a
_________________. This is a temporary holding file through which validated transactions flow to their respective applications. The file is analogous to a tank of water whose level is constantly changing, as it is filled from the top by the GVM and emptied from the bottom by applications.

A

validated data file

34
Q

The ___________ in the GDIS plays the same role as a traditional error file. Error records detected during validation are stored in the file, corrected, and then resubmitted to the GVM.

A

error file

35
Q

Standardized _____________ are distributed to users to facilitate error
correction

A

error reports

36
Q

The ___________________ is a permanent record of all validated transactions. From an accounting records point of view, it is equivalent to the journal and is an important element in the audit trail.

A

transaction log

37
Q

Processing controls are divided into three categories:

A

run-to-run controls,
operator intervention controls,
and Audit Trail Controls.

38
Q

______________________ use batch figures to monitor the batch as it moves from one programmed procedure (run) to another. These controls ensure that each run in the system processes the batch correctly and completely.

A

Run-to-run controls

39
Q

The ______________ control compares the sequence of each record in the batch with the previous record to ensure that proper sorting took place.

A

sequence check

40
Q

Systems sometimes require _________________________ to initiate certain actions, such as entering control totals for a batch of records, providing parameter values for logical operations, and activating a program from a different point when reentering semi-processed
error records.

A

operator intervention

41
Q

Systems that limit operator intervention through ___________________ are thus less prone to processing errors.

A

operator intervention controls

42
Q

________________ ensure that system output is not lost, misdirected, or corrupted and that privacy is not violated.

A

Output controls

43
Q

Applications waiting to print output occupy computer memory and block other applications from entering the processing stream. To ease this burden, applications are often designed to direct their output to a magnetic disk file rather than to the printer directly. This is called _______________

A

output spooling

44
Q

When the printer becomes available, the print run program produces hard copy output from the output file. ________________ are often complex systems that require operator intervention.

A

Print Programs

45
Q

Print program controls are designed to deal with two types of exposures presented by this environment:

A

(1) the production of unauthorized copies of output and
(2) employee browsing of sensitive data.

46
Q

When output reports are removed from the printer, they go to the _____________ stage to have their pages separated and collated.

A

bursting

47
Q

In some organizations, the ____________________ is responsible for verifying the accuracy of computer output before it is distributed to the user.

A

data control group

48
Q

The primary risks associated with ______________ include reports being lost, stolen, or misdirected in transit to the user.

A

report distribution

49
Q

Auditors testing with the _______________ do not rely on a detailed knowledge of the application’s internal logic.

A

black-box approach

50
Q

The advantage of the __________________ is that the application need not be removed from service and tested directly. This approach is feasible for testing applications that are relatively simple.

A

black-box approach

51
Q

The _________________ relies on an in-depth understanding of the internal logic of the application being tested. This approach includes several techniques for testing application logic directly. These techniques use small numbers of specially created test transactions to verify specific aspects of an application’s logic and controls.

A

white-box approach

52
Q

________________ verify that an individual, a programmed procedure, or a message (such as an EDI transmission) attempting to access a system

A

Authenticity tests

53
Q

________________, which ensure that the system processes only data values that conform to specified tolerances. Examples include range tests, field tests, and limit tests.

A

Accuracy tests

54
Q

________________ identify missing data within a single record and entire records missing from a batch. The types of tests performed are field tests, record sequence tests, hash totals, and control totals.

A

Completeness tests

55
Q

_________________ determine that an application processes each record only once.

A

Redundancy tests

56
Q

_____________ ensure that the application prevents authorized users from unauthorized access to data. Access controls include passwords, authority tables, userdefined procedures, data encryption, and inference controls.

A

Access tests

57
Q

______________ ensure that the application creates an adequate audit trail. This includes evidence that the application records all transactions in a transaction log, posts data values to the appropriate accounts, produces complete transaction listings, and generates error files and reports for all exceptions.

A

Audit trail tests

58
Q

__________________ verify the correctness of rounding procedures. Rounding errors occur in accounting information when the level of precision used in the calculation is greater than that used in the reporting.

A

Rounding error tests,

59
Q

____________________ tend to affect a large number of victims, but the harm to each is immaterial. This type of fraud takes its name from the analogy of slicing a large salami (the fraud objective) into many thin pieces

A

Salami frauds

60
Q

The _____________________ is used to establish application integrity by processing specially prepared sets of input data through production applications that are under review.

A

test data method

61
Q

When the set of test data in use is
comprehensive, the technique is called the _______________________. These
tests are conducted with a set of test transactions containing all possible transaction types. These are processed through repeated iterations during systems development testing until consistent and valid results are obtained.

A

base case system evaluation (BCSE).

62
Q

A type of test data technique called ___________ performs an electronic walkthrough of the application’s internal logic.

A

tracing

63
Q

Advantages of Test Data Techniques

A

First, they employ through the computer testing, thus providing the auditor with explicit evidence concerning application functions.
Second, if properly planned, test data runs can be employed with only minimal disruption to the organization’s operations.
Third, they require only minimal computer expertise on the part of auditors.

64
Q

Disadvantages of Test Data Techniques

A
  1. Auditors must rely on computer services personnel to obtain a copy of the application for test purposes.
  2. They provide a static picture of
    application integrity at a single point in time. They do not provide a convenient means of gathering evidence about ongoing application functionality.
  3. test data techniques have relatively high cost of implementation, which results in audit inefficiency
65
Q

The __________________approach is an automated technique that enables the auditor to test an application’s logic and controls during its normal operation.

A

integrated test facility (ITF)

66
Q

Advantages of (integrated test facility) ITF

A

First, ITF supports ongoing monitoring of controls as required by SAS 78.
Second, applications with ITF can
be economically tested without disrupting the user’s operations and without the intervention of computer services personnel.

67
Q

_______________ requires the auditor to write a program that simulates key features or processes of the application under review.

A

Parallel simulation

68
Q

Under source document controls, the organization must implement control procedures over source documents to account for each document. These are:

A
  1. Use Pre-numbered Source Documents
  2. Use Source Documents in Sequence
  3. Periodically Audit Source Documents