Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Audit > Chapter 8 > Flashcards

Chapter 8 Flashcards

1
Q

Definition of Hardware and Software?

A

Hardware -
Digital computer and peripheral equipment

Software -
Various programs and routines for operating the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Advantages and disadvantages of IT-Based Systems

A
  • May enhance reliability of financial information
    - Process transactions uniformly
    - Reduce human errors

May increase certain risks
Program defects may result in all transactions being processed incorrectly
Errors/fraud may not be as easily detectable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Systems possesses one or more of the following elements:

A
  • Batch processing
  • Online capabilities
  • Database storage
  • IT networks
  • End user computing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The principle hardware component is known as the (CPU)

A

Central Processing Unit

  • Uses a series of on and off circuits to communicate (binary language)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Application software includes programs designed to perform a specific data processing task. True or false?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Describe peripheral devices

A

Devices for inputting information (e.g., input terminals, scanners, electronic cash registers, bar code readers)
Devices for secondary storage (e.g., magnetic tape, magnetic disk, optical disk drives)
Devices for information output (e.g., display terminals, printers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define batch processing

A

Input data gathered and processed periodically in discrete groups. Often more efficient than other types of systems, but do not always provide up-to-minute information.

Example: Accumulate all of a day’s sales transactions and process them as a “batch” at end of day

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define IT Networks

A

Computers linked together through telecommunication links that enable computers to communicate information back and forth. Allows distributed data processing - resources, data, and programs shared by a large number of users based on their specifications (LAN and WAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Disadvantages of Database storage

A

Redundant information stored in several files

Increased storage costs

May cause data inconsistencies due to file discrepancies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe the three methods used to establish networks

A

Internet – exchange of information through remote locations

Intranet – internet software for use in closed networks

Extranet – intranets that include external business partners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Names of two types of Online Systems

A

Online transaction processing (OLTP):

  • Process various types of transactions
  • Individual transactions entered directly from the originators at remote locations

Online analytical processing (OLAP)
-Enables user to query a system for various analyses

Examples: Data warehouses, decision support systems, expert systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define End User Computing

A

User departments are responsible for the development and execution of certain IT applications. Involves a decentralized processing system – user department generates and uses its own information.

(non-programmers can create working applications to better integrate themselves into computing environment for problem-solving)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define Electronic Data Interchange (EDI)

A

enable company and customers/suppliers to exchange business data electronically over a private line of communication (more secure than the internet) – must have strong IT controls to ensure privacy (e.g., firewalls, data encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

More automation reduces potential for human errors and increases potential for systematic errors. True or false?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is audit trail necessary in printed form?

A

Not often in printed form, but definitely still necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define an End-user Application

A

designed with end user in mind for a specific, custom purpose. NOT a personal computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IT Responsibilities can be broken down into (there are a ton!)

A

Information systems Management

Systems Analysis

Application Programming

Database Administration

Data entry

IT Operations

Program and File Librarians

Data control

Telecommunication Specialists

systems Programming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Telecommunication Specialists

A

Responsible for maintaining and enhancing IT networks (including monitoring for improper access)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which IT responsibility supervises the operation of the department and report to vice president of finance/controller, or serve on vice president level as CIO reporting directly to president

A

Information Systems Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which IT responsibility reviews and tests all input procedures, monitors processes, reviews exception reports, reprocesses exceptions, and reviews and distributes IT logs (also reviews operator intervention and library usage logs)?

A

Data Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

History shows the person responsible for frauds in many situations set up the system and controlled its modifications. True or False?

A

True, so segregation of duties.

 Programming separate from controlling data entry
 Computer operator from functions having custody or detailed knowledge of programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define IT Operations

A

Run and monitor central computers, maintain detailed log of all operator intervention (NOTE: vital for IT operations to be separate from programming to prevent unauthorized program changes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which responsibility is defined as follows: Prepare and verify input data for processing (today, typically done by user departments)

A

Data Entry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which responsibility is responsible for designing the information system?

A

Systems Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Organizational controls is NOT effective in mitigating collusion, true or false?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is internal auditing in IT interested in?

A

evaluating the overall efficiency and effectiveness of information systems operations and related controls throughout the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Computer operators ____ (should or should not) have access to programming.

A

should not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Describe Programmed Control Activities

A

written into programs to ensure accuracy of input and processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Adequate security controls to safeguard hardware, files, and programs against loss, damage, and unauthorized access. True or false?

A

True

Examples: User ID and password controls – changed and updated for personnel changes regularly with a log of failed access attempts; Data transmission controls to prevent access/changes to transmitted network information – e.g., encryption, private network lines; Physical controls – e.g., employee badges, locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How might one control unauthorized changes to data, introduction of unauthorized data or programs, unauthorized viewing of data, and viruses?

A

Firewalls, physical control over terminals, password systems, data encryption, antivirus software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

If Use of IT does not significantly impact audit trail, audit ____ (through/around) the computer

A

around (manual testing to compare with computer output)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How might one control unauthorized access?

A

Physical Controls/Segregation of Duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How might one control Destruction or infrastructure of data

A

Segregation of Duties/ program and user controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How might one control Unauthorized changes?

A

Controls over access, segregation of duties, testing of programs, backup copies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

If much of audit trail is eectornically embedded, audit ____ (through/around) the computer

A

Through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define a Generalized Audit Software

A

programs are computer programs that can be used to test reliability of client’s programs and perform other audit procedures digitally. Pretty much automate substantive procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Define the “Tagging and Tracing Approach”

A

Auditor inserts an audit module in the
client’s application system to identify
specific types of transactions. Allows auditors to continuously audit
transactions processed by the client, unlike
the other two methods which contain irregular testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Auditors processing their own “dummy” test data using the client’s system simultaneously. This approach if known as the

A

Test Data Approach -

  1. Test data should include all relevant conditions that the auditor wants tested.
  2. Application programs tested by the auditors’ test data must be the same as
    those the client used throughout the year.
  3. Test data must be eliminated from the client’s records.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Sometimes o The auditor uses auditor-controlled generalized audit software to perform parallel operations to the client’s software by using the same data files. This is known as the

A

Parallel Simulation Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Once auditor has access to client records, can apply substantive procedures to them using generalized audit software to

A
  • Examine client’s records for overall quality, completeness, and valid conditions
  • Rearrange data and perform analyses
  • Select audit samples
  • Compare data on separate files
  • Compare results of audit procedures with client’s records
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

The auditor’s auditing of the inputs and outputs of the system without verification of the processing of the data is which type of audit technique?

A

Auditing around the computer

42
Q

Processing fictitious and real data separately through the entity’s IT system is which type of audit technique?

A

Test Data Method

43
Q

Program written by the auditor to perform a specific task for a particular entity is which type of audit technique?

A

Custom Audit Software

44
Q

How might audit software be used to observe the physical count or make appropriate test counts?

A

By determining which items are to be counted from the inventory files

45
Q

How might audit software be used to compare the client’s physical count data to inventory records?

A

By comparing the quantity of each item counted to the quantity on hand in inventory file

46
Q

How might audit software be used to Test the mathematical accuracy of inventory?

A

By multiplying the inventory quantity by the cost per unit to verify the total cost

47
Q

How might audit software be used to confirm existence located in public warehouses?

A

By listing said items and printing their confirmations

48
Q

How might audit software be used to test purchase and sales cutoff?

A

Extract a sample of items for which the date of the purchase is on, or immediately before, date of physical count

49
Q

How might audit software be used to perform a lower-cost-or-market test by obtaining a list of current costs per item from vendors

A

Compare the current costs per unit to the cost per unit in the inventory file; print out extended value of item, user the lover of the two unit costs, and add extended amounts

50
Q

How might one mitigate destruction of data?

A

Program and user controls

51
Q

How might one mitigate unauthorized changes?

A

Controls over access and backup companies

52
Q

How might one mitigate destruction of infrastructure or data?

A

Physical and user controls

53
Q

How might one mitigate introduction of unauthorized data or programs

A

firewalls and password systems

54
Q

How might one mitigate unauthorized access to data or programs?

A

physical controls over terminals and testing of user programs and applications

55
Q

Can firewalls be used to mitigate the risk of viruses in electronic commerce?

A

Yes

56
Q

Can Controls over Access be used to mitigate the risk of unauthorized changes to computer programs?

A

Yes

57
Q

Backup copies can be used to mitigate risk of _____

A

destruction of data

58
Q

PHysical controls may be used to mitigate the risk of unauthorized access in computer operations

A

true

59
Q

The computer operator may also be the librarian without adversely affecting control over a computer system.. True or false?

A

False

60
Q

Programs designed to perform specific data processing tasks are known as application soft­ware. True or false?

A

true

61
Q

A weakness in internal control would exist if the data control group also operated the computer.True or False?

A

true

62
Q

Data stored on a device with direct access must be stored sequentially. True or false?

A

False

63
Q

Application control activities include controls over making changes to programs and systems

A

False. Application control activities include both programmed control activities, which are written into the computer programs, and manual follow-up activities performed on the exception reports that are generated by the system

64
Q

Segregation of duties is not a feasible method to help establish control over computer systems. True or False?

A

False

65
Q

A limit test is a program control that is used to test the reasonableness of a particular transaction. True or False?

A

True

66
Q

Back‑up copies of files and records should be filed conveniently with the originals. True or false?

A

False. Should be filed at a separate location

67
Q

Microcomputers are generally operated by end user personnel. True or false?

A

true

68
Q

An echo check is an example of a control that is performed by a user. True or false?

A

false. Echo check is a Message acknowledgment technique in which in which the receiving device sends a message that verifies a transmission back to the sending device.

69
Q

Distributed data processing systems have data communication capabilities. True or false??

A

true

70
Q

Internal file labels are printed labels that are placed on the inside of a tape container. True or false?

A

False. For magnetic tapes, internal labels that are machine-readable are used in conjunction with gummed-paper external labels to prevent operators from accidentally processing the wrong file

71
Q

Advanced computer systems do not generally produce audit trails. True or False?

A

False, advanced computer systems actually make it easier to find audit trail

72
Q

Using test data is primarily a substantive procedure approach. True or false?

A

false

73
Q

Elimination of data redundancy is a chief advantage of a database system. True or false?

A

true

74
Q

Substantive procedures and tests are

A

Tests of account balances and transactions designed to detect any material misstatements in the financial statements. The nature, timing, and extent of substantive procedures are determined by the auditors’ assessment of risks and their consideration of the client’s internal control.

75
Q

The objective of the auditor’s consideration of internal control is different for a client with a computer system. True or false?

A

False

76
Q

Distributed data processing by a client requires that an auditor use computer-assisted audit techniques. True or false?

A

False

77
Q

Generalized computer audit software is used for both substantive procedures and tests of controls. True or falsse?

A

True

78
Q

Which of the following is not a characteristic of a batch processed IT system??

 Data input, followed by machine processing. correct	

 Posting of a   transaction, as it occurs, to several files, without intermediate printouts.

 Production of numerous printouts.

 The collection of like transactions which are sorted and processed sequentially against a master file.
A

Posting of a transaction, as it occurs, to several files, without intermediate printouts.

79
Q

The computer flags any transmission for which the control field value did not match with that of an existing file record. This is an example of a

A

validity test

80
Q

define an Integrated Test Facility, a process data using simulated files provides an auditor with information about the operating effectiveness of controls

A

An integrated test facility is a subsystem of dummy records and files built into the regular IT-based system. These dummy files permit test data to be processed simultaneously with regular (live) input without adversely affecting the live data files or output.

81
Q

The program analysis technique involves examination of the details of the processing steps for tagged transactions. True or false?

A

false. Program analysis techniques have been developed that can generate computer-made flowcharts of other programs. A trained auditor can examine the flowcharts to test the logic of application programs and to ensure that the client’s program documentation describes the program that is actually being used.

82
Q

Computer programmers have access to input data.

Is this compatible with good internal control in an information systems department?

A

Np

83
Q

Which of the following is an example of application control activities in IT systems?

Documentation procedures

hardware controls

programmed control activities

controls over access to equipment and data files

A

programmed control activities

84
Q

Computer programmers have unsupervised access to computer terminals.

Is this compatible with good internal control in an information systems department?

A

No

85
Q

Computer operators have detailed knowledge of computer programs.
Is this compatible with good internal control in an information systems department?

A

No

86
Q

Computer librarians have physical control of program documentation. Is this compatible with good internal control in an information systems department?

A

Yes

87
Q

Is this considered a test of control?

Examination of organization charts to determine whether electronic data processing department responsibilities are properly separated to afford effective control.

A

No

88
Q

Is this considered a test of control?

Examination of the systems manuals to determine whether existing procedures are satisfactory.

A

No, part of obtaining understanding of computer system

89
Q

Define the EXTRANET

A

suppliers or business partners, or customers

90
Q

Considered a test of control?

Examination of the machine room log book to determine whether control activity information is properly recorded

A

yes

91
Q

What is the IT process called when data processing is performed concurrently with a particular activity and the results are available soon enough to influence the particular course of action being taken or the decision being made?

A

Real-Time Processing

92
Q

computers talking to computers is a part of

A

e-commerce

93
Q

The auditors may decide not to perform tests of the controls within the computerized portion of the client’s internal control. Which of the following would not be a valid reason for choosing to omit such tests?

The controls appear adequate.

There appear to be major weaknesses in the control system that would preclude reliance on the stated procedures.

The controls duplicate operative controls existing elsewhere in the system.

The time and dollar costs of testing exceed the time and dollar savings in substantive testing if the tests show the controls operating effectively

A

The controls appear adequate.

94
Q

Would the documentation of client’s IT-based system depend on the complexity of system?

A

Yes, once again they are

Narrative
Systems flowchart
Program flowchart
Internal control questionnaires

95
Q

Test of control?

Examination of systems flowcharts to determine whether they reflect the current status of the system

A

No

96
Q

When testing it controls, always consider unauthorized access and equipment failure as high-risk areas.
True or false?

A

True

97
Q

What are risks to Hardware and Data?

A
  1. Reliance too much on hardware and software
  2. Unauthorized access
  3. Data loss
  4. Systematic vs Random errors (glitches)
98
Q

Is the Data administrator also responsible for integrity of the data?

A

Yes

99
Q

CPU is key hardware component. Brain of the computer. True or false?

A

true

100
Q

The main purpose of input validation is

A

to test if something was correctly input.

101
Q

Auditors start with testing general controls because their effectiveness directly impacts application control effectiveness. True or false?

A

True

102
Q

An IT specialist is more likely needed in which steps of the audit process?

A

Step 1 – Consider IT system in planning

Step 2 – Obtain an understanding of the client’s IT environment

Audit (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions