Module H Flashcards
0
Q
Step 2: customer order transaction file submitted for automated processing
A
System accesses the customer master file, using the customer
name/number to ensure sale is made to approved customer
Program then accesses inventory master file to verify current
Inventory items are available at current prices
1
Q
Automated processing of sales transaction, 3 steps
A
1 customer order
2 customer order transaction file
3 automated transaction processing system
2
Q
Automated processing sales transaction step 3, 3 things
A
1 Computerized system processes order using price from inventory
Master file and quantity from customer order
2 prepares shipping document and sales invoice
3 updates sales transaction file
3
Q
What 5 circumstances must be considered by audit team for information technology environments?
A
1 possibility of input errors
2 existence of systematize rather that random processing errors
3 lack of audit trail
4 possibility of inappropriate access to computer files and programs
5 reduced human involvement in processing transactions
4
Q
The possibility of input errors
A
The need for client personnel to convert/enter info into electronic
Format introduces possibility of errors
5
Q
Existence or systematic rather than random processing errors
A
technology systems handle all transactions in an identical Manner
Can Result in accounting system erroneously processing all
Transactions
6
Q
Lack of an audit trail
A
Audit team can’t see a paper trail because all info is directly
Entered into computer system
And processing is completed electronically producing only a
Hard copy of the final result
7
Q
3 major phases in audit team’s evaluation of internal control
A
1 understanding
2 assessment
3 testing
8
Q
Understanding 2
A
1 obtain understanding of controls established by client related
To automated processing of transactions
2 document controls established by client related to automated
Processing of transactions
9
Q
Assessment
A
Consider controls established by client related to automated processing of transactions in preliminary assessment of control risk
10
Q
Testing 3
A
1 identify controls related to automated processing of transactions
To be tested and degree of compliance required
2 perform test of those controls
3 evaluate degree of compliance with stated criteria and perform
Planned substantive procedures
11
Q
Major issue introduced in automated processing of transactions is The need for audit team to understand, consider and evaluate IT controls…
A
that have been designed to mitigate risk of material misstatement
At assertion level
12
Q
General controls
A
Apply to all applications of accounting info system
Ex. Processing transactions across various cycles
13
Q
Automated application controls
A
Controls applied to specific business activities within an accounting
Info system
To address management assertions regarding the financial
Statements
Ex. Processing transactions within the revenue cycle
14
Q
Because general controls apply to all applications of an accounting information system, the effectiveness of these controls has…
A
A pervasive effect on the entity’s automated processing of
Transactions
15
Q
4 categories of general controls
A
1 program development controls
2 program change controls
3 computer operations controls
4 access to programs and data controls
16
Q
objectives of program development controls, are to provide reasonable assurance that:
acquisition or development of computer programs and software is…3
A
1 properly authorized
2 conducted in accordance with entity policies
3 supports entity’s financial reporting requirements
17
Q
objectives of program development controls, are to provide reasonable assurance that:
Appropriate users participate in…
A
Software acquisition or program development process
18
Q
objectives of program development controls, are to provide reasonable assurance that:
Programs and software are tested and…
A
Validated prior to being placed into operation
19
Q
objectives of program development controls, are to provide reasonable assurance that:
All software and programs have…
A
Appropriate documentation
20
Q
Systems development life cycle (SDLC)
A
Important program development control used by entity
Process to plan, develop and implement new accounting Information systems (or database)
21
Q
Effective systems development life cycle SDLC controls ensure that the entity:
Follows established policies and procedures for…
A
Acquiring or developing software or programs
22
Q
Effective systems development life cycle SDLC controls ensure that the entity:
Involves users in the design of…
A
Programs, selection of prepackaged software and programs
And testing of programs
23
Q
Effective systems development life cycle SDLC controls ensure that the entity:
Tests and validates new programs and…
A
Develops proper implementation and “back out” plans
Prior to placing programs into operation
24
Back out plans
Plans to cancel the results of processing
in the event of an error or program failure
25
Effective systems development life cycle SDLC controls ensure that the entity:
Periodically reviews policies and procedures for acquiring and developing software or programs for continued...
Appropriateness
and modifying these policies and procedures if necessary
26
Documentation for SDLC, why does the audit team evaluate controls over the documentation? 2
1 gain understanding of system and determine whether
documentation is adequate to support proper use of programs
2 determine whether client personnel follow standards
27
Of utmost importance is whether the client has established...2
1 systems development
2 Documentation standards
28
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Are properly...3
1 authorized
2 conducted in accordance with entity policies
3 support entities financial reporting requirements
29
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Involve appropriate users in the...
Program modification process
30
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Are tested and...
Validated prior to being placed into operation
31
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Have been appropiately...
Documented
32
Program change controls parallel those relating to...
Program development
33
Computer operations controls,
Are concerned with providing reasonable assurance that:
processing of transactions through...
accounting info system is in accordance with entity's objectives
34
Computer operations controls,
Are concerned with providing reasonable assurance that:
Processing failures are resolved and do...
Not affect/delay processing of other transactions within the batch
35
Computer operations controls,
Are concerned with providing reasonable assurance that:
Actions are taken to facilitate...
The backup and recovery of important data when need arises
36
Systems analysts, 3 job functions
1 examine requirements for information
2 evaluate the existing system
3 design new/improved accounting info systems (with
specifications and documentation)
37
Programmers, 2 job functions
1 prepare flow harts and code the logic of computer programs
Required by accounting info system designed by systems analyst
2 prepare program documentation
38
Computer operators, job function
Operate computer for each accounting application system
According to written operating procedures found in computer
Operation instructions
39
Data conversion operators, job function
Prepare data for machine processing
by converting manual data into machine readable form or
Directly entering transactions into the system using remote
Terminals
40
Librarians, job function
Maintain control over...2
1 system and program documentation
2 data files and programs using processing transactions
41
Control group, 3 job functions
1 ensures the integrity of data
2 monitors the accuracy of processing and output
3 controls distribution of output to appropriate user groups
42
Separation of duties performed by systems analysts, programmers and computer operators is an important...
2) Otherwise what would this be considered?
General control
2) serious weakness in general control
43
Anyone who designs an accounting information system should not...
Do technical programming work
44
Only computer operators should have access to...
Equipment
45
Computer operations controls for files and data used in processing:
The files used in automated processing are appropriate
Accomplished through use of external labels on portable files
And use of header and trailer labels on internal records
46
Computer operations controls for files and data used in processing:
Files are secured and protected from loss
Accomplished by storing them in fireproof and waterproof
Locations
Also storage of back up files at offsite locations
47
3 Computer operations controls for files and data used in processing
1 files used in automated processing are appropriate
2 files are appropriately secured and protected from loss
3 files can be reconstructed from earlier versions of info used in
Processing
48
Computer operations controls for files and data used in processing:
Files can be reconstructed from earlier versions of info used in processing
Accomplished by creating and implementing policies to retain
| Prior versions of files for specified time periods
49
Access to programs and data controls
Provides reasonable assurance that access to programs and
| Data is granted only to authorized users
50
The most common form of control related to access is...
The use of passwords
51
3 areas where separation of duties should occur
1 authorization to execute transactions
2 recording of transactions
3 custody of related assets
52
With increasing ability of employees to access systems remotely, physical security controls are becoming...
Less effective in restricting access to programs and data
53
Assertion: Accuracy, 3
For information technology
Ensuring accuracy of data and testing computer programs
Prior to implementation
Increases probability that transactions are processed properly
Ex. Program development controls, program change controls,
Computer operations controls
54
Assertion: Occurrence,3
For information technology
Restricting inappropriate access to programs and data
reduces probability that fictitious transactions are entered into
The system and processed
Ex. Computer operations control (separation of duties), access
To program and data controls
55
Program development, 2 examples
1 Use of systems development life cycle (SDLC) for authorization,
User involvement, testing/validation of new programs
2 appropriate documentation for new programs
56
Program development, objective
Programs developed and software acquired by entity are consistent
With entity's objectives
57
Program change, objective
Modifications to existing programs are authorized and are
| consistent with entity's objectives
58
4 objectives of computer operations
1 transactions are processed in accordance with entity's objectives
2 appropriate files and records are used in processing transactions
3 files are appropriately secured/protected from loss
4 files can be reconstructed from previous versions
59
Automated application controls
Applied to specific business activities within the accounting info
System to achieve financial reporting objectives
60
Automated application controls are specific to...
Each cycle (revenue and collection, acquisition and expenditure)
61
Automated application controls, function
Designed to ensure proper recording of activities and prevent/
Detect fraud and error for transactions within the cycles
62
3 categories of automated application controls
1 input controls
2 processing controls
3 output controls
63
Input controls
Designed to provide reasonable assurance that data for
processing by the computer department
Has been properly authorized and accurately entered or converted
For processing
64
Input controls also provide the opportunity for entity personnel to...
Correct and resubmit data initially rejected as erroneous
65
Input control:
data entry and formatting controls 3
Controls related to design of data entry interface to provide
Familiar consistent format
And reduce frequency of input errors by personnel
Ex. Pull down menus, standardized formats and screens
66
Standardized formats and screens
Increase user familiarity with various fields
And reduce data are inadvertently input in incorrect field
67
Input control:
Authorization and approval controls
Only properly authorized and approved input should be accepted
For processing
68
Digitized signature
An approved encrypted password that releases a transaction
| By assigning a special code to it
69
Online editing and site verification (data entry and formatting control)
Ability of personnel to review input prior to submitting it for
Processing within the system
70
Input control:
Check digits
```
Check digit is an extra number tagged onto the end of a basic
Identification number (such as employee ID or account number)
```
71
Check digits are used to detect...
Coding errors or keying errors (such as transportation of digits)
72
Input control:
Record counts
Known # of records entered can be compared to count of
Records produced by data conversion device
Ex. Number of sales transactions or count of records
73
Record counts: differences between the manual counts of transactions and the number of transactions processed indicate that transactions...
May have been Inputted more than once
74
Input control:
Batch totals
Sum of important quantity, Used the same way as record counts
(Ex. Total sales dollars in a batch of invoices)
Totals allow input errors to be detected prior to submission
For processing, ensure all transactions entered only once
75
Input control:
Hash total
Similar to batch total but not meaningful for accounting records
(Ex. Sum of invoice numbers)
Allow input errors to be detected prior to submission, and all
Transactions are entered only once
76
Input control:
Valid character tests
Input controls used to check input fields when they are supposed
To have numbered
Or alphabetic characters when they are supposed to have
alphabetic characters
77
Input control:
Valid sign tests
Similar to valid character tests
Signed data fields are checked for appropriate positive or negative
Signs
78
Input control:
Missing data tests
Evaluate fields to verify whether any are blank when they must
Contain data for the record entry to be correct
79
Input control:
Sequence tests
Normally applied to evaluate input data for numerical sequence
Of documents when sequence is important for processing
Can check for missing documents in prenumbered series
80
Input control:
Limit and reasonableness tests
Determine whether data values exceed or fall below some
Predetermined limit
Ex. Payroll application can have a limit test to flag or reject
Any weekly payroll time record of 50 or more hours
81
Input control:
Error correction and resubmission procedures
These policies and procedures ensure identification of input
Errors on a timely basis
And correction and resubmission by appropriate personnel
For processing
82
Processing controls
Designed to provide reasonable assurance that data processing
Has been performed accurately
without any omission or duplicate processing of transactions
83
The most fundamental (yet important) processing control a client can implement is...
Periodically testing and evaluating the processing accuracy of its programs
84
Processing control:
File and operator controls
Ensure proper files are used in applications,
external and internal labels can be used to identify files
Systems software should produce log at records time and be
Reviewed by personnel
85
Processing control:
Run-to-run totals
Movement of data from one department to another is controlled
86
Run-to-run totals can be...
Record counts, batch totals or hash totals obtained at end
| Of one processing run
87
Runs
Sequential processing operations
88
Control totals
Record counts, batch totals, hash totals and run-to-run totals
89
Processing control:
Control total reports
Control totals should be calculated during processing operations
And summarized in report
Total should be reconciled by entity personnel
90
Processing control:
Limit and reasonableness tests
Programmed to ensure illogical conditions don't occur
(Ex. Depreciating an asset below 0, calculating negative inventory
Quantity)
Important and should generate error reports for supervisor
Review
91
Processing control:
Error correction and resubmission procedures
Controls related to identification of errors/unusual conditions
Encountered in processing transactions on timely basis
Correction and resubmission for processing should be implemented
As transactions are processed
92
Output controls
Represent final check of accuracy of results of automated
Transaction processing
Designed to provide reasonable assurance that only authorized
Persons receive output
93
Output controls are concerned with...
Detecting errors rather than preventing errors
94
Preventing errors is the focus of...
Input and processing controls
95
Output control:
Review of output for reasonableness
Individual knowledgeable about nature of transactions and
Processing should perform overall review of output for
reasonableness
Helps detect systematic errors
Ex. Employee gets paid 10 times their normal salary
96
Output control:
Control total reports
Control totals produced as output should be compared
And reconciled to input and run-to-run control totals
Independent data control group should be responsible for
Reviewing output control totals and investigating differences
97
Output control:
Master file changes
Master files are updated during transaction processing
Any changes should be authorized by entity and reported
In detail to user department
98
Output distribution
Systems' output should only be distributed to persons authorized
To receive the output
A distribution list should be maintained and used to deliver
Report copies
99
Management assertions for technology:
Accuracy 2
Input of individual transactions and data is accurate
Processing transactions is accurate
100
Management assertions for technology:
Completeness
All transactions are entered
101
Management assertions for technology:
Occurrence
Transactions are entered only once
102
How audit team assesses control risk of IT environment 4
1 identify types of misstatements that can occur in significant
Accounting applications
2 identify points in flow of transactions where specific types of
Misstatements could occur
3 identify specific control procedures designed to prevent/detect
Misstatements
4 evaluate design of control procedures to determine whether
The design suggests a low control risk and whether controls are
Cost effective
103
4 methods of testing operating effectiveness of controls
1 inquiry
2 observation
3 document examination
4 reperformance
104
Type of general control: program development
Method of testing?
Examine documentation related to development of programs
105
Type of general control: program change
Method of testing?
Examine documentation related to proper authorization for program changes and implementation of those changes
106
Type of general control: computer operations
Method of testing? 2
1 observe separation of duties of systems analysts, programmers,
Computer operators
2 examine documentary evidence regarding use of backup
And file reconstruction techniques
107
Type of general control: access to programs and data
Method of testing? 2
1 examine documentary evidence related to authorization for
accessing programs and data
2 observe the use of passwords required to access programs
And data
108
Type of automated application control: input
Method of testing? 2
1 inquire, observe or examine documentary evidence regarding
The use of various input controls
2 examine documentary evidence related to the resolution
Of errors identified by input controls
109
Type of automated application control,
Method of testing-Processing:
Inquire, observe, or examine documentary evidence that the client...
Periodically tests programs for processing accuracy
110
Type of automated application control,
Method of testing-Processing:
Through reperformance, test the...
Client's programs for processing accuracy
111
Type of automated application control,
Method of testing-Processing:
Inquire, observe, or examine documentary evidence regarding use of...
Various processing controls
112
Type of automated application control,
Method of testing-Processing:
Examine documentary evidence related to the resolution of...
Errors or unusual conditions identified during processing
113
Type of automated application control,
Method of testing-Output:
Inquire, observe, or examine documentary evidence that the client...
Reviews output for reasonableness
114
Type of automated application control,
Method of testing-Output:
Examine documentary evidence related to use of control...
Total reports and reconciliation of those reports to input and
Run-to-run totals
115
Type of automated application control,
Method of testing-Output:
Examine documentary evidence related to authorization for...
Changes in master file information
116
Type of automated application control,
Method of testing-Output:
Observe, inquire, or inspect documentary evidence related to limited...
Distribution of output to identified users
117
End users
Individuals who use personal computers, laptops, tablets
| And other portable computing devices
118
End user computing environments introduce the 4 control issues that the audit team must consider
1 lack of separation of duties
2 lack of physical security
3 lack of program documentation and testing
4 limited computer knowledge
119
Lack of program documentation and testing
Because users often modify or adapt existing programs for
Their own use,
End user computing environments are often characterized by
A lack of appropriate program documentation and testing
120
Limited computer knowledge
Extensive reliance on packaged software and utility programs
In end user environments
May result in personnel having limited computer knowledge
121
Computer operations controls
Involve limiting concentration of functions (separation of duties)
Establish proper supervision over individuals performing these
Functions
122
With respect to separation of duties, 2 compensating controls that increase the likelihood of accurate processing
1 comparison of manual control totals with totals from computer
Output
2 careful inspection of output for accuracy
123
Usefulness of computer operations controls:
Joint operation of...
Computerized processing by 2 or more individuals
124
Usefulness of computer operations controls:
Rotation of...
Assigned duties among individuals
125
Usefulness of computer operations controls:
Comparisons of computer use time to...
Averages or norms and investigation of excess usage
126
Usefulness of computer operations controls:
Proper supervision of...
Computer operations
127
Usefulness of computer operations controls:
Required...
Vacations for all individuals
128
In end user computing environments, the most important controls are those over...
Online data entry (accounting transactions)
129
3 data entry controls
1 restrictions on access to input devices
2 standard screens and computer prompting
3 online editing and sight verification
130
Restrictions on access to input devices 3
1 locking terminals
2 requiring use of passwords for access
3 using automatic terminal log off
131
4 important processing controls, to ensure appropriate processing of data
1 transaction logs
2 control totals
3 data comparisons
4 audit trail
132
Transaction logs
Transaction entry through terminal should be captured
automatically in computerized log
Transaction logs for each terminal should be summarized into
Equivalent batch totals
133
Control totals
Master files should contain records that accumulate the number
Of records and batch totals
Update processing should automatically change these control
Records
134
Data comparisons
Summary of daily transactions and the master file control
Totals from computer
Should be compared to manual control totals maintained
By accounting department
135
Audit trail
Transaction logs and periodic dumps of master files should
| Provide audit trail and means for recovery
136
Service organizations
Because of lack of expertise and cost benefit analysis entities
May outsource specialized data processing to service organizations
137
Computer abuse AKA Computer fraud
Use of information technology by perpetrator to achieve gain
| At expense of victim
138
Prevention controls
Keep errors and frauds from entering the system
139
Detection controls
Designed to discover frauds, should they get past the prevention
Controls
140
Damage-limiting controls
Designed to limit damage if fraud does occur
141
Administrative level controls
Affect the management of an entity's computer resources
Limit nature and scope of activities personnel can perform
142
Physical controls
Affect computer equipment and related documents
143
Technical controls example
Encrypting data
144
Computer forensics
Science of acquiring, preserving, retrieving and presenting data
That have been processed electronically
and stored in computer database
145
Using computer forensics, when computer hard drives are used
as storage media evidence can be...
retrieved even when data is deleted
