Information Technology Flashcards
When companies use information technology (IT) extensively, evidence may be available only in electronic form. What is an auditor’s best course of action in such situations?
A. Assess the control risk as high
B. Use audit software to perform analytical procedures
C. Use generalized audit software to extract evidence from client databases
D. Perform limited tests of controls over electronic data
C.
Generalized audit software (GAS) makes it possible for an auditor to access data in electronic form; typically GAS will analyze data and present results in a meaningful and convenient form. Assessing control risk as high may result in unnecessary additional audit procedures; an IT system may have strong internal control, and consequently, low control risk. Analytics cannot be performed if the information is available only in electronic form and there is no means to access it. If data is available only in electronic form, tests of controls over that data likely should be extensive, rather than limited.
An auditor would most likely be concerned with which of the following controls in a distributed data processing system?
A. Hardware controls
B. Systems documentation controls
C. Access controls
D. Disaster recovery controls
C.
A distributed data processing system is one in which many different users have access to the main computer through various computer locations. Thus, access controls, which restrict access to the main computer, are necessary to maintain a strong internal control structure, because those with access to the computer are in a position to perform incompatible functions. Hardware controls, systems documentation controls, and disaster recovery controls would not be as important in assessing control risk and would not likely present unusual problems in a distributed system.
Which of the following controls is a processing control designed to ensure the reliability and accuracy of data processing?
Limit test
Validity check test
Yes; Yes
Computers can be programmed to perform a wide range of edit tasks on records as they are being inputted into the system. If a particular record does not meet the test, it would not be processed. Edit tests include limit tests, validity check tests, check digit tests, etc. This is an example of a specific question you shouldn’t hang your head over if it appears on the exam. While all topics covered on the exam are important, a question like this that probably was covered in one or two sentences does not carry the amount of weight as some of the clearly more pressing topics do.
Which of the following statements is correct concerning internal control in an electronic data interchange (EDI) system?
A. Preventive controls generally are more important than detective controls in EDI systems.
B. Control objectives for EDI systems generally are different from the objectives for other information systems.
C. Internal controls in EDI systems rarely permit control risk to be assessed at below the maximum.
D. Internal controls related to the segregation of duties generally are the most important controls in EDI systems.
A.
Preventive controls are generally more important than detective controls in EDI systems because of the speed with which goods and services are delivered. Objectives remain the same as for other information systems. Internal controls in EDI systems must be strong to minimize losses. Segregation of duties is not as important as protection of assets in an EDI system.
Which of the following controls most likely would assure that an entity can reconstruct its financial records?
A. Hardware controls are built into the computer by the computer manufacturer.
B. Backup diskettes or tapes of files are stored away from originals.
C. Personnel who are independent of data input perform parallel simulations.
D. System flowcharts provide accurate descriptions of input and output operations.
B.
Backup files stored off-site are an effective means of preserving data in the event of a catastrophe or other loss of information requiring the reconstruction of the material. Hardware controls are built into the computer to detect and report hardware malfunctions. Parallel simulation refers to internal controls practiced within the company. System flowcharts that provide an accurate description of input and output operations refer to internal controls directed at the flow of processing information through the company.
An auditor anticipates assessing control risk at a low level in a computerized environment. Under these circumstances, on which of the following procedures would the auditor initially focus?
A. Programmed control procedures
B. Application control procedures
C. Output control procedures
D. General control procedures
D.
When an auditor anticipates assessing control risk at a low level in a computerized environment, generally, the auditor would initially focus on general control procedures, which are those controls that relate to all or many computerized accounting activities and often include control over the development, modification, and maintenance of computer programs and control over the use of and changes to data maintained on computer files.
To obtain evidence that online access controls are properly functioning, an auditor most likely would
A. Create checkpoints at periodic intervals after live data processing to test for unauthorized use of the system
B. Examine the transaction log to discover whether any transactions were lost or entered twice due to a system malfunction
C. Enter invalid identification numbers or passwords to ascertain whether the system rejects them
D. Vouch a random sample of processed transactions to assure proper authorization
C.
Password controls, used in restricting access to computers, are designed to preclude access capabilities of those employees whose regular functions are incompatible with computer use. To obtain evidence that user identification and password controls are functioning as designed, an auditor would most likely examine a sample of invalid passwords or numbers to determine whether the computer is recognizing the invalid passwords and rejecting access.
Answer (A) checks the level of authorization an employee has once within the system rather than access to the online system.
Answer (B) is a procedure for determining the completeness of transaction processing.
Answer (D) does not address whether the online access is being limited or circumvented.
Which of the following statements most likely represents a disadvantage for an entity that keeps microcomputer-prepared data files rather than manually prepared files?
A. Attention is focused on the accuracy of the programming process rather than errors in individual transactions.
B. It is usually easier for unauthorized persons to access and alter the files.
C. Random error associated with processing similar transactions in different ways is usually greater.
D. It is usually more difficult to compare recorded accountability with physical count of assets.
B.
Many internal control procedures once performed by separate individuals in manual systems may be concentrated in systems that use computer processing. Therefore, an individual who has access to the computer may be in a position to perform incompatible functions. Answers (a) and (c) are false statements. Detailed ledger accounts may be maintained as easily with microcomputer data files as with manually prepared files.
Which of the following characteristics distinguishes computer processing from manual processing?
A. Computer processing virtually eliminates the occurrence of computational error normally associated with manual processing
B. The potential for systematic error is ordinarily greater in manual processing than in computerized processing
C. Errors or fraud in computer processing will be detected soon after their occurrences
D. Most computer systems are designed so that transaction trails useful for audit purposes do not exist
A.
An advantage of computer processing is that it virtually eliminates computational errors. Errors or fraud are not detected more quickly when computer processing is used. The potential for systematic errors is greater in computer processing than in manual processing. Transaction trails useful for audit purposes are created but the data may be available for only a short period of time.
An auditor would least likely use computer software to
A. Construct parallel simulations
B. Access client data files
C. Prepare spreadsheets
D. Assess IT control risk
D.
After obtaining an understanding of the client’s IT controls, the auditor must assess control risk for the IT portion of the client’s internal control. Assessing control risk is the process of evaluating the effectiveness of an entity’s internal control policies and procedures in preventing or detecting material misstatements in the financial statements. Procedures to judge the effectiveness of internal control design would include inquiries, observations, and inspections. One would not need computer software to accomplish this task. Gaining access to client data files, preparing spreadsheets, and constructing parallel simulations would all make use of computer software.
Editor’s note: Remember the keyword in the question, least likely.
An IT input control is designed to ensure that
A. Only authorized personnel have access to the computer area.
B. Machine processing is accurate.
C. Data received for processing are properly authorized and converted to machine readable form.
D. Electronic data processing has been performed as intended for the particular application.
C.
Input controls are designed to provide reasonable assurance that data received by IT have been properly authorized, converted into machine readable form and identified as well as that data has not been lost, added, duplicated, or otherwise improperly changed.
Answer (A) describes an access control.
Answer (B) describes an output control.
Answer (D) describes a processing control.
Internal control is ineffective when computer department personnel
A. Design documentation for computerized systems
B. Participate in computer software acquisition decisions
C. Originate(开始，开创；起源，开端) changes in master files
D. Provide physical security for program files
C.
Internal control is considered ineffective when computer department personnel can: (1) originate or correct transactions, (2) authorize transactions, (3) prepare the initial data, (4) maintain custody or control over non-EDP assets, (5) authorize a change in controls, or (6) originate master file changes.
Which of the following is a general control that would most likely assist an entity whose systems analyst left the entity in the middle of a major project?
A. Grandfather-father-son record retention
B. Input and output validation routines
C. Systems documentation
D. Check digit verification
C.
When an entity’s systems analyst leaves the entity in the middle of a major project, the greatest assistance in continuing the project could be obtained from systems documentation that adequately describes the systems operations and procedures up to that point in time. Given good documentation, a new systems analyst could immediately begin to understand the systems operations.
Which of the following input controls is a numeric value computed to provide assurance that the original value has not been altered in construction or transmission?
A. Hash total
B. Parity check
C. Encryption
D. Check digit
D.
A check digit is a digit that is appended to a piece of numeric data following a pre-specified routine. A hash total is a numeric total with meaning only as a control. A parity check is an extra bit attached to the end of a string of bits to detect errors resulting from electronic interference when transmitting the string. Encryption is the conversion of a message into a coded message.
In parallel simulation, actual client data are reprocessed using an auditor software program. An advantage of using parallel simulation, instead of performing tests of controls without a computer, is that
A. The test includes all types of transaction errors and exceptions that may be encountered.
B. The client’s computer personnel do not know when the data are being tested.
C. There is no risk of creating potentially material errors in the client’s data.
D. The size of the sample can be greatly expanded at relatively little additional cost.
D.
Compared to auditing without a computer, the size of the sample can be greatly expanded at little cost using a computer. Parallel simulation might not include all types of transaction errors and exceptions that may be encountered. Using parallel simulation is no guarantee that the client’s personnel are unaware that the data is being tested. As there is little risk of creating material errors in the client’s data with a non-computer audit procedure, this hardly can be said to be an advantage of parallel simulation using a computer over not using a computer at all.
When an auditor tests the internal controls of a computerized accounting system, which of the following is true of the test data approach?
A. Test data are coded to a dummy subsidiary so they can be extracted from the system under actual operating conditions.
B. Test data programs need not be tailor-made by the auditor for each client’s computer applications.
C. Test data programs usually consist of all possible valid and invalid conditions regarding compliance with internal controls.
D. Test data are processed with the client’s computer and the results are compared with the auditor’s predetermined results.
D.
In the test data approach to testing a computerized accounting system, test data are processed by the client’s computer programs under the auditor’s control. No dummy subsidiary is involved. Test data must be customized to each audit. The auditor need not include test data for all possible valid and invalid conditions.
Which of the following methods of testing application controls utilizes a generalized audit software package prepared by the auditors?
A. Program code checking
B. Parallel simulation
C. Controlled reprocessing
D. Integrated testing facility
B.
Parallel simulation involves creating a model of the EDP system to be tested. The auditor reviews the application system to gain an understanding of its functioning and then utilizes a generalized audit software package to create a model or simulation of the application processing. In program code checking, the auditor reviews the client’s program documentation, including a narrative description and source code. In controlled reprocessing, the auditor maintains control over the reprocessing of previously processed results using a version of the program the auditor has tested, and compares the computer output of the original processing and reprocessing. An integrated test facility includes processing of dummy records with the client’s records using the client’s program.
When an auditor tests a computerized accounting system, which of the following is true of the test data approach?
A. Several transactions of each type must be tested.
B. Test data are processed by the client’s computer programs under the auditor’s control.
C. Test data must consist of all possible valid and invalid conditions.
D. The program tested is different from the program used throughout the year by the client.
B.
In the test data approach to testing a computerized accounting system, test data are processed by the client’s computer programs under the auditor’s control. The auditor will determine how many transactions and what types of transactions to test which may or may not include several transactions of each type. The auditor need not include test data for all possible valid and invalid conditions. The object is to test the client’s program that is used throughout the year and the auditor must take steps to make sure that the program being tested is the one that is actually used in routine processing; thus, a different program would not be tested.
Which of the following is usually a benefit of using electronic funds transfer for international cash transactions?
A. Improvement of the audit trail for cash receipts and disbursements
B. Creation of self-monitoring access controls
C. Reduction of the frequency of data entry errors
D. Off-site storage of source documents for cash transactions
C.
With EDI, information is entered into a system once and transmitted to other parties. These other parties do not have to re-enter the information into their systems, eliminating an opportunity for errors to occur. Using EDI, audit trails typically are less clear, if anything. Creation of self-monitoring access controls and off-site storage of source documents for cash transactions could occur with or without EDI.
Which of the following is a computer-assisted audit technique that permits an auditor to insert the auditor’s version of a client’s program to process data and compare the output with the client’s output?
A. Test data module
B. Frame relay protocol
C. Remote node router
D. Parallel simulation
D.
A parallel simulation is a computer-assisted audit technique that permits an auditor to insert the auditor’s version of a client’s program to process data and compare the output with the client’s output.
Which of the following would an auditor ordinarily consider the greatest risk regarding an entity’s use of electronic data interchange (EDI)?
A. Authorization of EDI transactions
B. Duplication of EDI transmissions
C. Improper distribution of EDI transactions
D. Elimination of paper documents
C.
Improper transactions or disclosure of transactions, regardless of the media, are usually the greatest risk. Appropriate authorization of EDI transactions doesn’t present a risk. Duplication of EDI transactions likely would be found by one of the involved parties upon reconciliation. Elimination of paper documents is a goal of EDI.
Which of the following strategies would a CPA most likely consider in auditing an entity that processes most of its financial data only in electronic form, such as a paperless system?
A. Continuous monitoring and analysis of transaction processing with an embedded audit module
B. Increased reliance on internal control activities that emphasize the segregation of duties
C. Verification of encrypted digital certificates used to monitor the authorization of transactions
D. Extensive testing of firewall boundaries that restrict the recording of outside network traffic
A.
When a client processes financial data in electronic form without paper documentation, the auditor may audit on a more continuous basis than a traditional system, as a convenience, and may be required to audit on a more continuous basis to obtain sufficient, competent evidence as documentation for some transactions may be available only for a limited time. An embedded audit module can facilitate this ‘continuous’ auditing. If anything, an auditor may rely less on internal control activities that emphasize the segregation of duties. Digital certificate verification and testing of firewall boundaries are more concerned with security than internal control.
Able Co. uses an online sales order processing system to process its sales transactions. Able’s sales data are electronically sorted and subjected to edit checks. A direct output of the edit checks most likely would be a
A. Report of all missing sales invoices
B. File of all rejected sales transactions
C. List of all voided shipping documents
D. Printout of all user code numbers and passwords
B.
The most likely output from an online sales order processing system is a file of all rejected sales transactions. An edit check occurs when information is entered into the system. A report of all missing sales invoices would be generated by the system, but not as a direct output from an edit check. Answers (c) and (d) are not relevant outputs from the online sales order processing system, but would be outputs of other applications.
