Question 1

Explain how application version numbers can be used as a audit toll for assessing program change controls.

Accepted Answer

The SPLMS assigns a version number automatically to each program stored on the SPL.When programs are first placed in the libraries (at implementation),they are assigned version number zero.With each modification to the program,the version number is increased by one.This feature,when combined with audit trail reports,provides a basis for detecting unauthorized changes to the application program.An unauthorized change is signaled by a version number on the production load module that cannot be reconciled to the number of authorized changes.For example,if 10 changes were authorized but the production program is Version 11,then two possible control violations may have happened: (1)an authorized change occurred,which for some reason went undocumented,or (2)an unauthorized change was made,which incremented the version number.

Question 2

The base case system evaluation is a variation of the test data method.

Accepted Answer

A) True 
 B)False  True

Question 3

Use of the integrated test facility poses no threat to organizational data files.

Accepted Answer

A) True 
 B)False  False

Question 4

Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

Accepted Answer

reconcile program ve

Question 5

Programs in their compiled state are very susceptible to the threat of unauthorized modification.

Accepted Answer

A) True 
 B)False

Question 6

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

Accepted Answer

A) True 
 B)False

Question 7

The programmer's authority table will specify the libraries a programmer may access.

Accepted Answer

A) True 
 B)False

Question 8

When using the test data method,the presence of multiple error messages indicates a flaw in the preparation of test transactions.

Accepted Answer

A) True 
 B)False

Question 9

Tracing is a method used to verify the logical operations executed by a computer application.

Accepted Answer

A) True 
 B)False

Question 10

Which statement is not true?

Accepted Answer

A)  An audit objective for systems maintenance is to detect unauthorized access to application databases. 
B)  An audit objective for systems maintenance is to ensure that applications are free from errors. 
C)  An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version numbers. 
D)  An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized access. 
A)  An audit objective for systems maintenance is to detect unauthorized access to application databases. 
B)  An audit objective for systems maintenance is to ensure that applications are free from errors. 
C)  An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version numbers. 
D)  An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized access.

Question 11

The technical design activities translate a set of detailed technical specifications for a system into user specifications.

Accepted Answer

A) True 
 B)False

Question 12

What is meant by auditing around the computer versus auditing through the computer? Why is this so important?

Accepted Answer

Auditing around the computer involves bl

Question 13

What are the audit's objectives relating to systems development?

Accepted Answer

The auditor's objectives are to ensure t

Question 14

What is the purpose of the auditor's review of SDLC documentation?

Accepted Answer

In reviewing the SDLC documentation,the

Question 15

The black box approach to testing computer program controls is also known as auditing around the computer.

Accepted Answer

A) True 
 B)False

Question 16

Contrast the black box approach to IT auditing and the through-the-computer audit approach.Which is preferred?

Accepted Answer

The black box approach is not concerned

Question 17

Describe and contrast the test data method with the integrated test facility.

Accepted Answer

In the test data method,a specially prep

Question 18

Generalized audit software packages perform all of the following tasks except

Accepted Answer

A)  recalculate data fields 
B)  compare files and identify differences 
C)  stratify statistical samples 
D)  analyze results and form opinions 
A)  recalculate data fields 
B)  compare files and identify differences 
C)  stratify statistical samples 
D)  analyze results and form opinions

Question 19

Contrast embedded audit modules with generalized audit software.

Accepted Answer

Both techniques permit auditors to acces

Question 20

New system development activity controls must focus on the authorization,development,and implementation of new systems and its maintenance.Discuss at least five control activities that are found in an effective system development life cycle.

Accepted Answer

System authorization activities assure t

Explain how application version numbers can be used as a audit toll for assessing program change controls.

The base case system evaluation is a variation of the test data method.

Use of the integrated test facility poses no threat to organizational data files.

Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

Programs in their compiled state are very susceptible to the threat of unauthorized modification.

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

The programmer's authority table will specify the libraries a programmer may access.

When using the test data method,the presence of multiple error messages indicates a flaw in the preparation of test transactions.

Tracing is a method used to verify the logical operations executed by a computer application.

Which statement is not true?

The technical design activities translate a set of detailed technical specifications for a system into user specifications.

What is meant by auditing around the computer versus auditing through the computer? Why is this so important?

What are the audit's objectives relating to systems development?

What is the purpose of the auditor's review of SDLC documentation?

The black box approach to testing computer program controls is also known as auditing around the computer.

Contrast the black box approach to IT auditing and the through-the-computer audit approach.Which is preferred?

Describe and contrast the test data method with the integrated test facility.

Generalized audit software packages perform all of the following tasks except

Contrast embedded audit modules with generalized audit software.

New system development activity controls must focus on the authorization,development,and implementation of new systems and its maintenance.Discuss at least five control activities that are found in an effective system development life cycle.

The Information System: an Accountants Perspective

Introduction to Transaction Processing

Ethics,fraud,and Internal Control

The Revenue Cycle

The Expenditure Cycle Part I: Purchases and Cash Disbursements Procedures

The Expenditure Cycle Part Ii: Payroll Processing and Fixed Asset Procedures

The Conversion Cycle

General Ledger,financial Reporting,and Management Reporting Systems

Database Management Systems

The Rea Approach to Business Process Modeling

Enterprise Resource Planning Systems

Electronic Commerce Systems

Managing the Systems Development Life Cycle

Construct,deliver,and Maintain Systems Projects

IT Controls Part I: Sarbanes-Oxley and It Governance

IT Controls Part II: Security and Access

Filters

Exam 17: IT Controls Part III: Systems Development, program Changes, and Application Controls

Explain how application version numbers can be used as a audit toll for assessing program change controls.

The base case system evaluation is a variation of the test data method.

Use of the integrated test facility poses no threat to organizational data files.

Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

Programs in their compiled state are very susceptible to the threat of unauthorized modification.

The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

The programmer's authority table will specify the libraries a programmer may access.

When using the test data method,the presence of multiple error messages indicates a flaw in the preparation of test transactions.

Tracing is a method used to verify the logical operations executed by a computer application.

Which statement is not true?

The technical design activities translate a set of detailed technical specifications for a system into user specifications.

What is meant by auditing around the computer versus auditing through the computer? Why is this so important?

What are the audit's objectives relating to systems development?

What is the purpose of the auditor's review of SDLC documentation?

The black box approach to testing computer program controls is also known as auditing around the computer.

Contrast the black box approach to IT auditing and the through-the-computer audit approach.Which is preferred?

Describe and contrast the test data method with the integrated test facility.

Generalized audit software packages perform all of the following tasks except

Contrast embedded audit modules with generalized audit software.

New system development activity controls must focus on the authorization,development,and implementation of new systems and its maintenance.Discuss at least five control activities that are found in an effective system development life cycle.

The Information System: an Accountants Perspective

Introduction to Transaction Processing

Ethics,fraud,and Internal Control

The Revenue Cycle

The Expenditure Cycle Part I: Purchases and Cash Disbursements Procedures

The Expenditure Cycle Part Ii: Payroll Processing and Fixed Asset Procedures

The Conversion Cycle

General Ledger,financial Reporting,and Management Reporting Systems

Database Management Systems

The Rea Approach to Business Process Modeling

Enterprise Resource Planning Systems

Electronic Commerce Systems

Managing the Systems Development Life Cycle

Construct,deliver,and Maintain Systems Projects

IT Controls Part I: Sarbanes-Oxley and It Governance

IT Controls Part II: Security and Access

Filters