Deck 14: Auditing Information Technology

Question 1

With the advances in technology today,the "around-the-computer" approach to auditing is no longer widely used.

Answer 1

True

Question 2

Using information technology in auditing reduces the time spent on clerical tasks and may improve the overall morale and productivity of auditors.

Answer 2

True

Question 3

Application controls are related to specific computer application systems.

Answer 3

True

Question 4

The external auditor serves the firm's stockbrokers,the government,and the general public.

Question 5

ITF does not involve the input of test data into the master files of the computer system being audited.

Question 6

The degree of independence that auditors can maintain while developing embedded audit routines will depend largely on the level of technical expertise that they possess.

Question 7

Embedded audit routines are more easily added to a program as a modification rather than being added as a program is developed.

Question 8

Some embedded audit routines use automated collection language (ACL)to embed specially programmed modules as in-line code with regular programs.

Question 9

One type of tracing is to verify a hash total of the object code of software to detect modifications to the software.

Question 10

ITF is a powerful information system audit technology.

Question 11

Snapshot technology is generally incorporated into extended records for later review by auditors.

Question 12

Parallel simulation is appropriate where transactions are sufficiently important to require a 100 percent audit.

Question 13

The test data technique requires minimal computer expertise and is usually inexpensive to implement.

Question 14

Parallel simulation processes test data through real programs.

Question 15

A trace can produce thousands of output records if an excessive number of transactions are tagged.

Question 16

Auditing activities undertaken during substantive testing of account balances can be described as "auditing through the computer."

Question 17

Basic auditing standards may be altered by the technology employed in the system to be audited.

Question 18

Total audit cost is increased significantly when some audit resources are directed at reviewing and verifying the internal controls that exist in a system.

Question 19

GAS has a long history of usage because public accounting firms developed it in the 1960s.

Question 20

ITF is the one universal auditing approach used in information system audits.

Question 21

Development standards are major general controls in computerized systems.

Question 22

IT governance has the objective of enhancing and ensuring the efficient application of IT resources as a critical success factor.

Question 23

Information system development audits are more common to large organizations because they often have a formal development process.

Question 24

COBIT contains 34 IT processes and organizes them into 8 domains.

Question 25

Each COBIT IT process should have its own navigation diagram.

Question 26

PCAOB has encouraged a risk-based approach to testing the effectiveness of internal controls as they relate to financial audits.

Question 27

An audit of an organization's computer service center is normally undertaken before any information system application audit.

Question 28

Maturity models are used to evaluate an organization's relative level of achievement of IT governance on a scale from 1-10.

Question 29

Project management controls are concerned with the maintenance of application programs.

Question 30

One very common program change control is to periodically compare actual copies of object code with duplicate copies retained in the past.

Question 31

________ auditors commonly undertake audits that are reviewed and relied upon by ________ auditors.

Question 32

An information systems application audit focuses almost exclusively on the testing of processing controls.

Question 33

Specific documentation showing the nature of application controls in a system is known as control flowcharting.

Question 34

An audit program is a detailed list of the audit procedures to be applied on a particular audit.

Question 35

COBIT is an IT governance framework that is critical in ensuring proper control and governance over information and the system that creates,stores,manipulates,and retrieves that information.

Question 36

In RBA,the subject of the audit is how well the management prevents fraud.

Question 37

Most information system audits follow a four-phase structure,which is followed by analysis and reporting of results.

Question 38

CISA,CISM,and CGEIT are professional certifications in system security.

Question 39

Audits of computer service centers do not require as high a degree of technical expertise as do audits of computerized applications.

Question 40

Risk-based auditing provides assurances relating to the effectiveness of an organization's enterprise risk management process.

Question 41

The primary audit technique used in an information systems development audit is the review and testing of related ________.

Question 42

"Auditing with the computer"

A) is only performed by external auditors.
B) involves activities related to compliance testing.
C) is only performed by internal auditors.
D) involves activities related to substantive testing of account balances.

Question 43

Documentation governing the design,development,and implementation of application systems is known as systems ________ ________.

Question 44

All embedded audit routine techniques require a(n)________ level of technical expertise to set up,and at least a(n)________ level of knowledge to use them effectively.

Question 45

Auditors with little computer expertise can use ________ to perform audit-related data processing functions.

Question 46

Using an integrated-test-facility approach,________ testing is appropriate to ________,real-time processing technology.

Question 47

The ________ ________ technique may be used to verify input transaction validation routines.

Question 48

In RBA,the subject of the audit is how well the management manages ________.

Question 49

In ________ checking,an auditor manually processes test or real program data through the logic of a program.

Question 50

An organization's current status compared to benchmarks and international standards,as well as an organization's strategy for improvement,is called a(n)________ model.

Question 51

________ is an open standard which provides "good practices" across a domain and process framework and presents activities in a manageable and logical structure.

Question 52

An audit of the computer service center is undertaken before any application audits to ensure the ________ ________ of the environment in which the application will function.

Question 53

A comprehensive ________ ________ can be established by collecting,in an extended record,supplementary data concerning processing not normally collected.

Question 54

When batch processing was the dominant method used in computerized data processing,the ________ approach provided an adequate audit.

Question 55

________ is an IT governance professional certification for individuals who manage,design,oversee,and assess an enterprise's information security program.

Question 56

________ can be effectively used in conjunction with a test data technique.

Question 57

Test data used in ITF are identified by special ________ and must be excluded from normal system outputs.

Question 58

RBA provides assurances relating to the effectiveness of an organization's ________ ________ ________ processes.

Question 59

Application controls are divided into ________ general areas.

Question 60

A clear and obvious benefit is obtained from the ________ analysis capability provided by information technology.

Question 61

The information systems auditing technique that uses special software to monitor the execution of a program is called

A) embedded audit routines.
B) mapping.
C) a snapshot.
D) tracing.

Question 62

The comparison of input to output is known as auditing

A) around-the-computer.
B) through the computer.
C) with the computer.
D) without the computer.

Question 63

A financial statement audit

A) consists only of compliance testing of account balances.
B) has the objective of verifying financial statement figures to render a professional opinion of the financial statements.
C) has the objective of establishing the degree to which the internal control system can be relied upon.
D) None of these answers is correct.

Question 64

Confirming the existence,assessing the effectiveness,and checking the continuity of the operation of the internal controls upon which reliance is placed is called

A) compliance testing.
B) financial statement auditing.
C) auditing "around-the-computer."
D) substantive testing.

Question 65

The verification of controls in a computer system is known as auditing

A) around-the-computer.
B) through the computer.
C) with the computer.
D) without the computer.

Question 66

Which of the following procedures uses only auditor-prepared test transactions?

A) The test data approach
B) Integrated test facility
C) Parallel simulation
D) Embedded audit routines

Question 67

Information system audits to verify compliance with internal controls are performed by

A) internal auditors only.
B) external auditors only.
C) outside third-party consultants only.
D) both internal and external auditors.

Question 68

The use of information technology to perform audit work is known as auditing

A) around-the-computer.
B) through the computer.
C) without the computer.
D) with the computer.

Question 69

The first (and oldest)technique used to audit through the computer is

A) the integrated test facility.
B) parallel simulation.
C) the test data approach.
D) generalized audit procedures.

Question 70

An internal auditor conducts an information systems audit using the professional standards promulgated by the

A) Institute of Internal Auditors.
B) American Institute of Certified Public Accountants.
C) Institute of Management Accountants.
D) Information Systems Audit and Control Association.

Question 71

The information systems auditing technique that uses software that has been specifically designed to allow auditors to perform audit-related data processing functions is called

A) mapping.
B) tracing.
C) generalized audit software.
D) embedded audit routines.

Question 72

External auditors typically conduct compliance testing because

A) the main goal of a financial statement audit is to ensure that internal controls are operating effectively.
B) compliance tests yield more reliable evidence than substantive tests.
C) compliance tests determine how much reliance can be placed on the internal controls in substantive tests.
D) compliance testing can be conducted solely by the internal auditors.

Question 73

Which of the following is a possible benefit of using information systems technology in the conduct of an audit?

A) Increased independence from information systems personnel
B) Elimination of most manual calculations, footing, and cross-footing
C) Standardization of audit working papers and correspondence
D) All of these answers are correct.

Question 74

An external auditor conducts an information systems audit using the professional standards promulgated by the

A) Institute of Internal Auditors.
B) American Institute of Certified Public Accountants.
C) Institute of Management Accountants.
D) Information Systems Audit and Control Association.

Question 75

Which of the following statements is an advantage to using the test data technique in information systems auditing?

A) The test can be run only on a specific program at a specific point in time.
B) The test must be announced.
C) Test data is limited to certain combinations of processing conditions.
D) The technique is used for testing programs in which calculations such as interest or depreciation are involved.

Question 76

"Auditing through the computer" refers to

A) substantive tests.
B) compliance tests.
C) transaction tests.
D) application control tests.

Question 77

Which of the following should be developed when the related application system is developed?

A) Test data approach
B) Integrated test facility
C) Parallel simulation approach
D) Artificial intelligence software

Question 78

Information technology is used to perform some audit work that otherwise would be done manually.The use of information technology by auditors is

A) essential.
B) mandatory under AICPA Statements of Auditing Standards.
C) optional.
D) at the sole discretion of the manager in charge of the audit.

Question 79

An interim audit

A) consists only of substantive testing of account balances.
B) has the objective of verifying financial statement figures to render a professional opinion of the financial statements.
C) has the objective of establishing the degree to which the internal control system can be relied upon.
D) None of these answers is correct.

Question 80

Which of the following statements is a disadvantage to using the integrated-test-facility (ITF)approach in information systems auditing?

A) When carefully planned, the costs of using ITF are minimal.
B) No interruption of normal computer activity is involved in using ITF.
C) Fictitious data must be excluded from output reports.
D) ITF is used in large computer application systems that use real-time processing.