Module H Flashcards

0
Q

Step 2: customer order transaction file submitted for automated processing

A

System accesses the customer master file, using the customer
name/number to ensure sale is made to approved customer

Program then accesses inventory master file to verify current
Inventory items are available at current prices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Automated processing of sales transaction, 3 steps

A

1 customer order

2 customer order transaction file

3 automated transaction processing system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Automated processing sales transaction step 3, 3 things

A

1 Computerized system processes order using price from inventory
Master file and quantity from customer order
2 prepares shipping document and sales invoice

3 updates sales transaction file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What 5 circumstances must be considered by audit team for information technology environments?

A

1 possibility of input errors
2 existence of systematize rather that random processing errors
3 lack of audit trail
4 possibility of inappropriate access to computer files and programs
5 reduced human involvement in processing transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The possibility of input errors

A

The need for client personnel to convert/enter info into electronic
Format introduces possibility of errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Existence or systematic rather than random processing errors

A

technology systems handle all transactions in an identical Manner

Can Result in accounting system erroneously processing all
Transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Lack of an audit trail

A

Audit team can’t see a paper trail because all info is directly
Entered into computer system

And processing is completed electronically producing only a
Hard copy of the final result

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

3 major phases in audit team’s evaluation of internal control

A

1 understanding

2 assessment

3 testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Understanding 2

A

1 obtain understanding of controls established by client related
To automated processing of transactions

2 document controls established by client related to automated
Processing of transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Assessment

A

Consider controls established by client related to automated processing of transactions in preliminary assessment of control risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Testing 3

A

1 identify controls related to automated processing of transactions
To be tested and degree of compliance required
2 perform test of those controls

3 evaluate degree of compliance with stated criteria and perform
Planned substantive procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Major issue introduced in automated processing of transactions is The need for audit team to understand, consider and evaluate IT controls…

A

that have been designed to mitigate risk of material misstatement
At assertion level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

General controls

A

Apply to all applications of accounting info system

Ex. Processing transactions across various cycles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Automated application controls

A

Controls applied to specific business activities within an accounting
Info system

To address management assertions regarding the financial
Statements

Ex. Processing transactions within the revenue cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Because general controls apply to all applications of an accounting information system, the effectiveness of these controls has…

A

A pervasive effect on the entity’s automated processing of

Transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4 categories of general controls

A

1 program development controls
2 program change controls
3 computer operations controls
4 access to programs and data controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

objectives of program development controls, are to provide reasonable assurance that:

acquisition or development of computer programs and software is…3

A

1 properly authorized

2 conducted in accordance with entity policies

3 supports entity’s financial reporting requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

objectives of program development controls, are to provide reasonable assurance that:

Appropriate users participate in…

A

Software acquisition or program development process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

objectives of program development controls, are to provide reasonable assurance that:

Programs and software are tested and…

A

Validated prior to being placed into operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

objectives of program development controls, are to provide reasonable assurance that:

All software and programs have…

A

Appropriate documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Systems development life cycle (SDLC)

A

Important program development control used by entity

Process to plan, develop and implement new accounting
Information systems (or database)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Effective systems development life cycle SDLC controls ensure that the entity:

Follows established policies and procedures for…

A

Acquiring or developing software or programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Effective systems development life cycle SDLC controls ensure that the entity:

Involves users in the design of…

A

Programs, selection of prepackaged software and programs

And testing of programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Effective systems development life cycle SDLC controls ensure that the entity:

Tests and validates new programs and…

A

Develops proper implementation and “back out” plans

Prior to placing programs into operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Back out plans

A

Plans to cancel the results of processing

in the event of an error or program failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Effective systems development life cycle SDLC controls ensure that the entity:

Periodically reviews policies and procedures for acquiring and developing software or programs for continued…

A

Appropriateness

and modifying these policies and procedures if necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Documentation for SDLC, why does the audit team evaluate controls over the documentation? 2

A

1 gain understanding of system and determine whether
documentation is adequate to support proper use of programs

2 determine whether client personnel follow standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Of utmost importance is whether the client has established…2

A

1 systems development

2 Documentation standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:

Are properly…3

A

1 authorized
2 conducted in accordance with entity policies
3 support entities financial reporting requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:

Involve appropriate users in the…

A

Program modification process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:

Are tested and…

A

Validated prior to being placed into operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:

Have been appropiately…

A

Documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Program change controls parallel those relating to…

A

Program development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Computer operations controls,
Are concerned with providing reasonable assurance that:

processing of transactions through…

A

accounting info system is in accordance with entity’s objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Computer operations controls,
Are concerned with providing reasonable assurance that:

Processing failures are resolved and do…

A

Not affect/delay processing of other transactions within the batch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Computer operations controls,
Are concerned with providing reasonable assurance that:

Actions are taken to facilitate…

A

The backup and recovery of important data when need arises

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Systems analysts, 3 job functions

A

1 examine requirements for information

2 evaluate the existing system

3 design new/improved accounting info systems (with
specifications and documentation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Programmers, 2 job functions

A

1 prepare flow harts and code the logic of computer programs
Required by accounting info system designed by systems analyst

2 prepare program documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Computer operators, job function

A

Operate computer for each accounting application system

According to written operating procedures found in computer
Operation instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Data conversion operators, job function

A

Prepare data for machine processing

by converting manual data into machine readable form or
Directly entering transactions into the system using remote
Terminals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Librarians, job function

Maintain control over…2

A

1 system and program documentation

2 data files and programs using processing transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Control group, 3 job functions

A

1 ensures the integrity of data

2 monitors the accuracy of processing and output

3 controls distribution of output to appropriate user groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Separation of duties performed by systems analysts, programmers and computer operators is an important…

2) Otherwise what would this be considered?

A

General control

2) serious weakness in general control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Anyone who designs an accounting information system should not…

A

Do technical programming work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Only computer operators should have access to…

A

Equipment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Computer operations controls for files and data used in processing:

The files used in automated processing are appropriate

A

Accomplished through use of external labels on portable files

And use of header and trailer labels on internal records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Computer operations controls for files and data used in processing:

Files are secured and protected from loss

A

Accomplished by storing them in fireproof and waterproof
Locations

Also storage of back up files at offsite locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

3 Computer operations controls for files and data used in processing

A

1 files used in automated processing are appropriate

2 files are appropriately secured and protected from loss

3 files can be reconstructed from earlier versions of info used in
Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Computer operations controls for files and data used in processing:

Files can be reconstructed from earlier versions of info used in processing

A

Accomplished by creating and implementing policies to retain

Prior versions of files for specified time periods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Access to programs and data controls

A

Provides reasonable assurance that access to programs and

Data is granted only to authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

The most common form of control related to access is…

A

The use of passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

3 areas where separation of duties should occur

A

1 authorization to execute transactions

2 recording of transactions

3 custody of related assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

With increasing ability of employees to access systems remotely, physical security controls are becoming…

A

Less effective in restricting access to programs and data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Assertion: Accuracy, 3

For information technology

A

Ensuring accuracy of data and testing computer programs
Prior to implementation

Increases probability that transactions are processed properly

Ex. Program development controls, program change controls,
Computer operations controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Assertion: Occurrence,3

For information technology

A

Restricting inappropriate access to programs and data

reduces probability that fictitious transactions are entered into
The system and processed

Ex. Computer operations control (separation of duties), access
To program and data controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Program development, 2 examples

A

1 Use of systems development life cycle (SDLC) for authorization,
User involvement, testing/validation of new programs

2 appropriate documentation for new programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Program development, objective

A

Programs developed and software acquired by entity are consistent
With entity’s objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Program change, objective

A

Modifications to existing programs are authorized and are

consistent with entity’s objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

4 objectives of computer operations

A

1 transactions are processed in accordance with entity’s objectives
2 appropriate files and records are used in processing transactions
3 files are appropriately secured/protected from loss
4 files can be reconstructed from previous versions

59
Q

Automated application controls

A

Applied to specific business activities within the accounting info
System to achieve financial reporting objectives

60
Q

Automated application controls are specific to…

A

Each cycle (revenue and collection, acquisition and expenditure)

61
Q

Automated application controls, function

A

Designed to ensure proper recording of activities and prevent/
Detect fraud and error for transactions within the cycles

62
Q

3 categories of automated application controls

A

1 input controls

2 processing controls

3 output controls

63
Q

Input controls

A

Designed to provide reasonable assurance that data for
processing by the computer department

Has been properly authorized and accurately entered or converted
For processing

64
Q

Input controls also provide the opportunity for entity personnel to…

A

Correct and resubmit data initially rejected as erroneous

65
Q

Input control:

data entry and formatting controls 3

A

Controls related to design of data entry interface to provide
Familiar consistent format

And reduce frequency of input errors by personnel

Ex. Pull down menus, standardized formats and screens

66
Q

Standardized formats and screens

A

Increase user familiarity with various fields

And reduce data are inadvertently input in incorrect field

67
Q

Input control:

Authorization and approval controls

A

Only properly authorized and approved input should be accepted
For processing

68
Q

Digitized signature

A

An approved encrypted password that releases a transaction

By assigning a special code to it

69
Q

Online editing and site verification (data entry and formatting control)

A

Ability of personnel to review input prior to submitting it for
Processing within the system

70
Q

Input control:

Check digits

A
Check digit is an extra number tagged onto the end of a basic
Identification number (such as employee ID or account number)
71
Q

Check digits are used to detect…

A

Coding errors or keying errors (such as transportation of digits)

72
Q

Input control:

Record counts

A

Known # of records entered can be compared to count of
Records produced by data conversion device

Ex. Number of sales transactions or count of records

73
Q

Record counts: differences between the manual counts of transactions and the number of transactions processed indicate that transactions…

A

May have been Inputted more than once

74
Q

Input control:

Batch totals

A

Sum of important quantity, Used the same way as record counts
(Ex. Total sales dollars in a batch of invoices)

Totals allow input errors to be detected prior to submission
For processing, ensure all transactions entered only once

75
Q

Input control:

Hash total

A

Similar to batch total but not meaningful for accounting records
(Ex. Sum of invoice numbers)

Allow input errors to be detected prior to submission, and all
Transactions are entered only once

76
Q

Input control:

Valid character tests

A

Input controls used to check input fields when they are supposed
To have numbered

Or alphabetic characters when they are supposed to have
alphabetic characters

77
Q

Input control:

Valid sign tests

A

Similar to valid character tests

Signed data fields are checked for appropriate positive or negative
Signs

78
Q

Input control:

Missing data tests

A

Evaluate fields to verify whether any are blank when they must
Contain data for the record entry to be correct

79
Q

Input control:

Sequence tests

A

Normally applied to evaluate input data for numerical sequence
Of documents when sequence is important for processing

Can check for missing documents in prenumbered series

80
Q

Input control:

Limit and reasonableness tests

A

Determine whether data values exceed or fall below some
Predetermined limit

Ex. Payroll application can have a limit test to flag or reject
Any weekly payroll time record of 50 or more hours

81
Q

Input control:

Error correction and resubmission procedures

A

These policies and procedures ensure identification of input
Errors on a timely basis

And correction and resubmission by appropriate personnel
For processing

82
Q

Processing controls

A

Designed to provide reasonable assurance that data processing
Has been performed accurately

without any omission or duplicate processing of transactions

83
Q

The most fundamental (yet important) processing control a client can implement is…

A

Periodically testing and evaluating the processing accuracy of its programs

84
Q

Processing control:

File and operator controls

A

Ensure proper files are used in applications,
external and internal labels can be used to identify files

Systems software should produce log at records time and be
Reviewed by personnel

85
Q

Processing control:

Run-to-run totals

A

Movement of data from one department to another is controlled

86
Q

Run-to-run totals can be…

A

Record counts, batch totals or hash totals obtained at end

Of one processing run

87
Q

Runs

A

Sequential processing operations

88
Q

Control totals

A

Record counts, batch totals, hash totals and run-to-run totals

89
Q

Processing control:

Control total reports

A

Control totals should be calculated during processing operations
And summarized in report

Total should be reconciled by entity personnel

90
Q

Processing control:

Limit and reasonableness tests

A

Programmed to ensure illogical conditions don’t occur
(Ex. Depreciating an asset below 0, calculating negative inventory
Quantity)

Important and should generate error reports for supervisor
Review

91
Q

Processing control:

Error correction and resubmission procedures

A

Controls related to identification of errors/unusual conditions
Encountered in processing transactions on timely basis

Correction and resubmission for processing should be implemented
As transactions are processed

92
Q

Output controls

A

Represent final check of accuracy of results of automated
Transaction processing

Designed to provide reasonable assurance that only authorized
Persons receive output

93
Q

Output controls are concerned with…

A

Detecting errors rather than preventing errors

94
Q

Preventing errors is the focus of…

A

Input and processing controls

95
Q

Output control:

Review of output for reasonableness

A

Individual knowledgeable about nature of transactions and
Processing should perform overall review of output for
reasonableness

Helps detect systematic errors

Ex. Employee gets paid 10 times their normal salary

96
Q

Output control:

Control total reports

A

Control totals produced as output should be compared
And reconciled to input and run-to-run control totals

Independent data control group should be responsible for
Reviewing output control totals and investigating differences

97
Q

Output control:

Master file changes

A

Master files are updated during transaction processing

Any changes should be authorized by entity and reported
In detail to user department

98
Q

Output distribution

A

Systems’ output should only be distributed to persons authorized
To receive the output

A distribution list should be maintained and used to deliver
Report copies

99
Q

Management assertions for technology:

Accuracy 2

A

Input of individual transactions and data is accurate

Processing transactions is accurate

100
Q

Management assertions for technology:

Completeness

A

All transactions are entered

101
Q

Management assertions for technology:

Occurrence

A

Transactions are entered only once

102
Q

How audit team assesses control risk of IT environment 4

A

1 identify types of misstatements that can occur in significant
Accounting applications
2 identify points in flow of transactions where specific types of
Misstatements could occur
3 identify specific control procedures designed to prevent/detect
Misstatements
4 evaluate design of control procedures to determine whether
The design suggests a low control risk and whether controls are
Cost effective

103
Q

4 methods of testing operating effectiveness of controls

A

1 inquiry
2 observation
3 document examination
4 reperformance

104
Q

Type of general control: program development

Method of testing?

A

Examine documentation related to development of programs

105
Q

Type of general control: program change

Method of testing?

A

Examine documentation related to proper authorization for program changes and implementation of those changes

106
Q

Type of general control: computer operations

Method of testing? 2

A

1 observe separation of duties of systems analysts, programmers,
Computer operators

2 examine documentary evidence regarding use of backup
And file reconstruction techniques

107
Q

Type of general control: access to programs and data

Method of testing? 2

A

1 examine documentary evidence related to authorization for
accessing programs and data

2 observe the use of passwords required to access programs
And data

108
Q

Type of automated application control: input

Method of testing? 2

A

1 inquire, observe or examine documentary evidence regarding
The use of various input controls

2 examine documentary evidence related to the resolution
Of errors identified by input controls

109
Q

Type of automated application control,
Method of testing-Processing:

Inquire, observe, or examine documentary evidence that the client…

A

Periodically tests programs for processing accuracy

110
Q

Type of automated application control,
Method of testing-Processing:

Through reperformance, test the…

A

Client’s programs for processing accuracy

111
Q

Type of automated application control,
Method of testing-Processing:

Inquire, observe, or examine documentary evidence regarding use of…

A

Various processing controls

112
Q

Type of automated application control,
Method of testing-Processing:

Examine documentary evidence related to the resolution of…

A

Errors or unusual conditions identified during processing

113
Q

Type of automated application control,
Method of testing-Output:

Inquire, observe, or examine documentary evidence that the client…

A

Reviews output for reasonableness

114
Q

Type of automated application control,
Method of testing-Output:

Examine documentary evidence related to use of control…

A

Total reports and reconciliation of those reports to input and
Run-to-run totals

115
Q

Type of automated application control,
Method of testing-Output:

Examine documentary evidence related to authorization for…

A

Changes in master file information

116
Q

Type of automated application control,
Method of testing-Output:

Observe, inquire, or inspect documentary evidence related to limited…

A

Distribution of output to identified users

117
Q

End users

A

Individuals who use personal computers, laptops, tablets

And other portable computing devices

118
Q

End user computing environments introduce the 4 control issues that the audit team must consider

A

1 lack of separation of duties
2 lack of physical security
3 lack of program documentation and testing
4 limited computer knowledge

119
Q

Lack of program documentation and testing

A

Because users often modify or adapt existing programs for
Their own use,

End user computing environments are often characterized by
A lack of appropriate program documentation and testing

120
Q

Limited computer knowledge

A

Extensive reliance on packaged software and utility programs
In end user environments

May result in personnel having limited computer knowledge

121
Q

Computer operations controls

A

Involve limiting concentration of functions (separation of duties)

Establish proper supervision over individuals performing these
Functions

122
Q

With respect to separation of duties, 2 compensating controls that increase the likelihood of accurate processing

A

1 comparison of manual control totals with totals from computer
Output

2 careful inspection of output for accuracy

123
Q

Usefulness of computer operations controls:

Joint operation of…

A

Computerized processing by 2 or more individuals

124
Q

Usefulness of computer operations controls:

Rotation of…

A

Assigned duties among individuals

125
Q

Usefulness of computer operations controls:

Comparisons of computer use time to…

A

Averages or norms and investigation of excess usage

126
Q

Usefulness of computer operations controls:

Proper supervision of…

A

Computer operations

127
Q

Usefulness of computer operations controls:

Required…

A

Vacations for all individuals

128
Q

In end user computing environments, the most important controls are those over…

A

Online data entry (accounting transactions)

129
Q

3 data entry controls

A

1 restrictions on access to input devices

2 standard screens and computer prompting

3 online editing and sight verification

130
Q

Restrictions on access to input devices 3

A

1 locking terminals

2 requiring use of passwords for access

3 using automatic terminal log off

131
Q

4 important processing controls, to ensure appropriate processing of data

A

1 transaction logs
2 control totals
3 data comparisons
4 audit trail

132
Q

Transaction logs

A

Transaction entry through terminal should be captured
automatically in computerized log

Transaction logs for each terminal should be summarized into
Equivalent batch totals

133
Q

Control totals

A

Master files should contain records that accumulate the number
Of records and batch totals

Update processing should automatically change these control
Records

134
Q

Data comparisons

A

Summary of daily transactions and the master file control
Totals from computer

Should be compared to manual control totals maintained
By accounting department

135
Q

Audit trail

A

Transaction logs and periodic dumps of master files should

Provide audit trail and means for recovery

136
Q

Service organizations

A

Because of lack of expertise and cost benefit analysis entities
May outsource specialized data processing to service organizations

137
Q

Computer abuse AKA Computer fraud

A

Use of information technology by perpetrator to achieve gain

At expense of victim

138
Q

Prevention controls

A

Keep errors and frauds from entering the system

139
Q

Detection controls

A

Designed to discover frauds, should they get past the prevention
Controls

140
Q

Damage-limiting controls

A

Designed to limit damage if fraud does occur

141
Q

Administrative level controls

A

Affect the management of an entity’s computer resources

Limit nature and scope of activities personnel can perform

142
Q

Physical controls

A

Affect computer equipment and related documents

143
Q

Technical controls example

A

Encrypting data

144
Q

Computer forensics

A

Science of acquiring, preserving, retrieving and presenting data
That have been processed electronically

and stored in computer database

145
Q

Using computer forensics, when computer hard drives are used
as storage media evidence can be…

A

retrieved even when data is deleted