Question 1

What are commodity IT assets?

Accepted Answer

Commodity IT assets are not unique to a particular organization and are thus easily acquired in the marketplace.These include such things as network management,systems operations,server maintenance,and help-desk functions.

Question 2

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Accepted Answer

A) True 
 B)False  False

Question 3

Why should new systems development activities be segregated from the program change (maintenance)function.

Accepted Answer

Combining these functions increases the potential for two problems: inadequate documentation and fraud.Inadequate systems documentation is a chronic IT problem and a significant challenge for many organizations seeking SOX compliance.The potential for fraud is increased when the original programmer of a system also has maintenance responsibility,.

Question 4

Internal control in a computerized environment can be divided into two broad categories.What are they? Explain each.

Accepted Answer

Internal controls can be divided into tw

Question 5

Explain vendor exploitation.

Accepted Answer

Once the client firm has divested itself

Question 6

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

Accepted Answer

A) True 
 B)False

Question 7

All of the following are components of audit risk except

Accepted Answer

A)  control risk 
B)  legal risk 
C)  detection risk 
D)  inherent risk 
A)  control risk 
B)  legal risk 
C)  detection risk 
D)  inherent risk

Question 8

Name three types of program fraud.

Accepted Answer

Program fraud includes:
(1)creating ille

Question 9

Define general controls.

Accepted Answer

General controls apply to all systems.Th

Question 10

Explain the outsourcing risk of failure to perform.

Accepted Answer

Once a client firm has outsourced specif

Question 11

Explain the role of a SAS 70 report in reviewing internal controls.

Accepted Answer

SAS 70 report is the means by which an o

Question 12

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Accepted Answer

A) True 
 B)False

Question 13

Which of the following is NOT a requirement in management's report on the effectiveness of internal controls over financial reporting?

Accepted Answer

A)  A statement of management's responsibility for establishing and maintaining adequate internal control user satisfaction. 
B)  A statement that the organization's internal auditors has issued an attestation report on management's assessment of the companies internal controls. 
C)  A statement identifying the framework used by management to conduct their assessment of internal controls. 
D)  An explicit written conclusion as to the effectiveness of internal control over financial reporting. 
A)  A statement of management's responsibility for establishing and maintaining adequate internal control user satisfaction. 
B)  A statement that the organization's internal auditors has issued an attestation report on management's assessment of the companies internal controls. 
C)  A statement identifying the framework used by management to conduct their assessment of internal controls. 
D)  An explicit written conclusion as to the effectiveness of internal control over financial reporting.

Question 14

Which statement is not true?

Accepted Answer

A)  Auditors must maintain independence. 
B)  IT auditors attest to the integrity of the computer system. 
C)  IT auditing is independent of the general financial audit. 
D)  IT auditing can be performed by both external and internal auditors. 
A)  Auditors must maintain independence. 
B)  IT auditors attest to the integrity of the computer system. 
C)  IT auditing is independent of the general financial audit. 
D)  IT auditing can be performed by both external and internal auditors.

Question 15

Describe how a Corporate Computer Services Function can overcome some of the problems associated with distributed data processing.

Accepted Answer

The Corporate Computer Services Function

Question 16

Which of the following is not an essential feature of a disaster recovery plan?

Accepted Answer

A)  off-site storage of backups 
B)  computer services function 
C)  second site backup 
D)  critical applications identified 
A)  off-site storage of backups 
B)  computer services function 
C)  second site backup 
D)  critical applications identified

Question 17

What control framework is recommended by the PCAOB?

Accepted Answer

The PCAOB's Auditing Standard

Question 18

For disaster recovery purposes,what criteria are used to identify an application or data as critical?

Accepted Answer

Critical application and files

Question 19

Does a qualified opinion on management's assessment of internal controls over the financial reporting system necessitate a qualified opinion on the financial statements? Explain.

Accepted Answer

No.Auditors are permitted to simultaneou

Question 20

Systems development is separated from data processing activities because failure to do so

Accepted Answer

A)  weakens database access security 
B)  allows programmers access to make unauthorized changes to applications during execution 
C)  results in inadequate documentation 
D)  results in master files being inadvertently erased 
A)  weakens database access security 
B)  allows programmers access to make unauthorized changes to applications during execution 
C)  results in inadequate documentation 
D)  results in master files being inadvertently erased

What are commodity IT assets?

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Why should new systems development activities be segregated from the program change (maintenance)function.

Internal control in a computerized environment can be divided into two broad categories.What are they? Explain each.

Explain vendor exploitation.

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

All of the following are components of audit risk except

Name three types of program fraud.

Define general controls.

Explain the outsourcing risk of failure to perform.

Explain the role of a SAS 70 report in reviewing internal controls.

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Which of the following is NOT a requirement in management's report on the effectiveness of internal controls over financial reporting?

Which statement is not true?

Describe how a Corporate Computer Services Function can overcome some of the problems associated with distributed data processing.

Which of the following is not an essential feature of a disaster recovery plan?

What control framework is recommended by the PCAOB?

For disaster recovery purposes,what criteria are used to identify an application or data as critical?

Does a qualified opinion on management's assessment of internal controls over the financial reporting system necessitate a qualified opinion on the financial statements? Explain.

Systems development is separated from data processing activities because failure to do so

The Information System: An Accountant’s Perspective

Introduction to Transaction Processing

Ethics, Fraud, and Internal Control

The Revenue Cycle

The Expenditure Cycle Part I: Purchases and Cash Disbursements Procedures

The Expenditure Cycle Part II: Payroll Processing and Fixed Asset Procedures

The Conversion Cycle

General Ledger, Financial Reporting, and Management Reporting Systems

Database Management Systems

The REA Approach to Business Process Modeling

Enterprise Resource Planning Systems

Electronic Commerce Systems

Managing the Systems Development Life Cycle

Construct, Deliver, and Maintain Systems Projects

IT Controls : Security and Access

IT Controls : Systems Development Program Changes and Application Controls

Filters

Exam 15: IT Controls : Sarbanes-Oxley and IT Governance

What are commodity IT assets?

To fulfill the segregation of duties control objective,computer processing functions (like authorization of credit and billing)are separated.

Why should new systems development activities be segregated from the program change (maintenance)function.

Internal control in a computerized environment can be divided into two broad categories.What are they? Explain each.

Explain vendor exploitation.

Corporate management (including the CEO)must certify monthly and annually their organization's internal controls over financial reporting.

All of the following are components of audit risk except

Name three types of program fraud.

Define general controls.

Explain the outsourcing risk of failure to perform.

Explain the role of a SAS 70 report in reviewing internal controls.

Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.

Which of the following is NOT a requirement in management's report on the effectiveness of internal controls over financial reporting?

Which statement is not true?

Describe how a Corporate Computer Services Function can overcome some of the problems associated with distributed data processing.

Which of the following is not an essential feature of a disaster recovery plan?

What control framework is recommended by the PCAOB?

For disaster recovery purposes,what criteria are used to identify an application or data as critical?

Does a qualified opinion on management's assessment of internal controls over the financial reporting system necessitate a qualified opinion on the financial statements? Explain.

Systems development is separated from data processing activities because failure to do so

The Information System: An Accountant’s Perspective

Introduction to Transaction Processing

Ethics, Fraud, and Internal Control

The Revenue Cycle

The Expenditure Cycle Part I: Purchases and Cash Disbursements Procedures

The Expenditure Cycle Part II: Payroll Processing and Fixed Asset Procedures

The Conversion Cycle

General Ledger, Financial Reporting, and Management Reporting Systems

Database Management Systems

The REA Approach to Business Process Modeling

Enterprise Resource Planning Systems

Electronic Commerce Systems

Managing the Systems Development Life Cycle

Construct, Deliver, and Maintain Systems Projects

IT Controls : Security and Access

IT Controls : Systems Development Program Changes and Application Controls

Filters