IT Auditing

Question 1

What are the increased risks involving information technology?

Answer 1

• No automatic judgment or discretion
• No physical trace or “natural” audit trail for online transactions
• High concentration of duties leads to a poor separation of duties

Question 2

Control activities to look for when auditing IT:

Answer 2

General Controls

Application Controls

Question 3

Refer to the system that is built around IT.

Answer 3

General Controls

Question 4

Any weakness in general controls will have a _______ effect on the entire system.

Answer 4

Pervasive

Question 5

When auditing IT, which duties should be separate for general controls?

Answer 5

• Separate IT from users of output
• IT Department should never authorize or initiate transactions
• IT Department only processes transactions

Question 6

There must be procedures to review, test, approve, and document…

Answer 6

• Systems & changes to systems

- Programs & changes to programs

Question 7

Hardware/Software controls such as firewalls, virus protections, and anti-hacking software are all part of…

Answer 7

General Controls

Question 8

Types of General Controls

Answer 8

Hardware/Software Controls
Access Controls
IT Department's Separation of Duties
Changes made to systems & programs
Physical Safeguards

Question 9

Proper Separation of Duties within IT consists of…

Answer 9

C - Control Group
O - Operations
P - Programmers
A - Analysts
L - Librarians

Question 10

Group of employees that are responsible for I/C within IT

Answer 10

Control Group

Question 11

Employee that keeps the mater files, the programs, & the documentation

Answer 11

Librarian

Question 12

Application Controls consist of what types of controls?

Answer 12

• Input
• Processing
• Output

Question 13

Ensures all transactions are properly initiated, authorized, and approved. Includes things such as control totals, record counts, & hash totals.

Answer 13

Input Controls

Question 14

are an input control. They are a nonsense total; for example, the sum of the digits of an invoice number. A hash total is similar to a control total and is used to verify processing (or output) compared to input.

Answer 14

Hash Totals

Question 15

a specific type of input control, consisting of a single digit at the end of an identification code that is computed from the other digits in a field. If the identification code is mis-keyed, a formula or algorithm will reveal that the check digit is not correct, and the field will not accept the entry.

Answer 15

Check Digit

Question 16

controls that apply to all systems components, processes, and data for an organization or IT environment. The objectives are to ensure the proper development and implementation of applications, as well as integrity of programs, data files, and computer operations.

Answer 16

General IT Controls

Question 17

refers to the transactions and data relating to each computer-based application system and are, therefore, specific to each such application.

Answer 17

Application Controls

Question 18

What are the objectives of Application Controls?

Answer 18

The objectives of application controls, which may be manual or programmed, are to ensure the completeness and accuracy of the records and the validity of the entries made therein.

Question 19

Application controls consist of…

Answer 19

input controls, processing controls, and output controls.

Question 20

an edit check of logical correctness of the relationships among the values in an input data set, or the value of an input item with the values of a related data item in a master file.

Answer 20

Reasonableness Check

Question 21

used to edit data during input or processing to validate data. The data is above an amount, below an amount, or between two amounts.

Answer 21

A limit test or limit check

Question 22

an organization or segment of an organization that provides services to user entities that are relevant to those user entities’ internal control over financial reporting.

Answer 22

Service Organization

Question 23

Report on management’s description of a service organization’s internal control system and the suitability of DESIGN of controls.

Answer 23

Service Organization: Type 1 Report

Question 24

As an auditor, you cannot use a Type 1 report as…

Answer 24

a basis for reducing your assessed level of control risk

Question 25

Report on management’s description of a service organization’s internal control system and the suitability of DESIGN & OPERATING EFFECTIVENESS of controls.

Answer 25

Service Organization: Type 2 Report

Question 26

Which type of report would be suitable for an auditor to lower the assessed level of control risk?

Answer 26

Type 2 Report