Deck 7: Control Activities

Question 1

Which of the following controls is the most effective for preventing unauthorized access to data and program files?

A) No access except during normal working hours
B) Fingertip scanners
C) Policy prohibiting unauthorized access
D) Passwords

Answer 1

B

Question 2

Which of the following controls most likely would assure that an organization can reconstruct its files?

A) Hardware controls that are built into the computer by the computer manufacturer.
B) Backup copies of data and program files that are stored away from originals.
C) Personnel, who are independent of data input, perform parallel simulations.
D) System flowcharts that provide accurate descriptions of input and output operations.

Answer 2

B

Question 3

The segregation of duties between the custody of cash and the recording of cash receipts best illustrates which of the following control concepts?

A) Oversight
B) Isolation
C) Redundancy
D) Accountability

Answer 3

B

Question 4

The authority to grant credit for returns and allowances should be independent of which function?

A) Shipping
B) Sales order processing
C) Billing (sometimes called customer invoicing)
D) Cash receipts

Question 5

General controls apply to the reliability and consistency of the overall information processing environment. To what do application controls apply?

A) All information processing activities
B) The flow of data in and among individual applications
C) The assignment and supervision of personnel
D) Accounting systems that use databases

Question 6

What is the purpose of user authentication?

A) To verify that the user is entitled to enter transaction data
B) To verify the identity of the user
C) To verify that the user can access data files
D) To verify that the transaction was authorized

Question 7

What kind of reasonable assurance do check digits, screen properties, and reasonableness tests provide?

A) Processing has been performed as intended without omission or double counting of transactions.
B) Only authorized persons have access to files.
C) Data have been correctly entered.
D) Coding of data internal to the computer did not change when the data were moved from one internal storage location to another.

Question 8

To enable a user to access data and program files, what should the user be required to enter?

A) A parity check
B) A personal identification code
C) A self-diagnosis test
D) An echo check

Question 9

Data access control activities include which of the following?

A) User authentication, encryption, firewall, automatic log off
B) Encryption, batch controls, directory and file attributes
C) User authentication, user rights, callback device, check digit
D) Segregation of duties, user authentication, automatic rollback

Question 10

For what purpose would the system administrator be likely to use a user rights table?

A) To create an audit trail for detecting access violations
B) To plan for access security
C) To encrypt data for high-level protection
D) To store user authentication codes

Question 11

What is the most likely source of errors in a computerized accounting system?

A) Operator action
B) Output
C) Processing
D) Input

Question 12

What is the most common computer-related problem confronting organizations?

A) Hardware malfunction
B) Input errors
C) Disruption to the processing activities as a result of natural disasters
D) Fraud

Question 13

Which of the following would be the most effective user password?

A) Smith
B) 123456789
C) tuttle236cog
D) ssssssssssss

Question 14

Control activities can be designed to provide reasonable assurance that all except which of the following will happen?

A) Transactions will be recorded to permit preparation of financial statements.
B) All risks will be eliminated.
C) Access to assets will be permitted only in accordance with management's authorization.
D) The recorded accountability for assets will be compared with the existing assets at periodic intervals.

Question 15

Which of the following represents weak internal control?

A) The design and implementation is performed in accordance with management's specific authorization.
B) Any and all changes in application programs have the authorization and approval of management.
C) Provisions exist to protect data files from unauthorized access, modification, or destruction.
D) Application developers test their own new or modified applications before the applications are implemented.

Question 16

What is the single most effective control that avoids allowing one person to be in a position to perpetrate and then conceal errors or inappropriate activities?

A) The segregation of authorization of transactions, custody of related assets, and modification or creation of related data and program files (or paper- based records).
B) The requirement that each employee take a vacation each year.
C) The establishment of an internal auditing department.
D) The bonding of personnel in positions that necessitate handling cash and negotiable securities.

Question 17

Which of the following control activities would most likely influence the behavior of managers?

A) Monitoring compliance with internal controls
B) Limiting direct access to assets by physical isolation and security devices
C) Establishing budgets or standards and identifying variances from these budgets or standards
D) Supporting employees with the resources necessary to discharge their responsibilities

Question 18

Of the following control activities, which is the most effective?

A) Bonding of employees
B) Segregation of duties
C) Rotation of assignments
D) Enforced vacations

Question 19

Which of the following transactions is least likely to require the entry of a specific authorization code?

A) Weekly payroll totaling $10,000
B) Cash disbursement for $1,000
C) $2,000 write-down of obsolete inventory
D) $500 credit sale to a new customer

Question 20

Which of the following duties should be segregated for good internal control?

A) Approval of credit from issuance of sales orders
B) Shipment of goods and entry of shipping transaction data
C) Receipt of cash and maintenance of the cash account
D) All of the above are proper segregation of duties.

Question 21

The authority for receiving incoming shipments of goods and the responsibility for checking them normally resides with which of the following?

A) Receiving department and quality control personnel
B) Purchasing agent and quality control personnel
C) Employee who initiated the order and quality control personnel
D) Quality control personnel

Question 22

A clerk was entering a sales transaction in her cash register and accidentally entered a sales representative code for a terminated employee. This error could have been detected if the system included a

A) Dual read check
B) Valid code check
C) Valid character check
D) Reasonableness test

Question 23

Some of the more important control activities in computerized accounting information systems are validity checks, reasonableness checks, and checks for logical relationships. How are these activities classified?

A) Control total validation routines
B) Hash totals
C) Output controls
D) Input verification controls

Question 24

The authority for establishing credit policy normally resides with which of the following?

A) Treasurer and upper management
B) Controller and upper management
C) Sales department and upper management
D) Credit department and upper management

Question 25

What kind of input control is involved when a self-checking digit is appended to a customer account number?

A) Data verification control
B) Data capture control
C) Classification and identification control
D) Hash control

Question 26

When data are to be maintained at a company's site, which keys should be used for encryption?

A) Private
B) Public
C) Digital
D) Both A and B

Question 27

While entering data into a cash receipts transaction file, an employee transposed two numbers in a numeric code. Which of the following controls would have prevented this type of error?

A) Sequence check
B) Record check
C) Self-checking digit
D) Field-length check

Question 28

Which of the following is an example of a data verification check?

A) The system checks that a numerical amount in a field does not exceed some predetermined amount.
B) As the system corrects errors and data are successfully resubmitted, the causes of the errors are printed out.
C) The system returns an error message if the value entered in a field does not match one in a reference file of permissible values.
D) After transaction data are entered, certain data are sent back to the workstation for comparison with data originally sent.

Question 29

Which of the following would detect a data input error in the entry of a customer code?

A) A logic check
B) A combination check
C) A valid code check
D) A parity check

Question 30

The authority for ordering goods and services normally resides with which of the following?

A) Treasurer
B) Originating department manager
C) Controller
D) Employee who initiates the order

Question 31

The authority for approving employee time data normally resides with which of the following?

A) The payroll department
B) The personnel department
C) An employee's immediate supervisor
D) The controller

Question 32

The need for prenumbered documents best relates to which of the following?

A) Validation of transactions
B) Segregation of duties
C) Authorization of transactions
D) Processing of all transactions

Question 33

Omen Company is a manufacturer of men's shirts and distributes weekly sales reports to each sales manager. The quantity 2R5 appeared in the quantity sold column for one of the items on the weekly sales report for one of the sales managers. What is the most likely explanation for what occurred?

A) The output quantity was stated in hexadecimal numbers.
B) The computer malfunctioned during execution.
C) The printer malfunctioned and the "R" should have been a decimal point.
D) The system did not contain a verification control for input data.

Question 34

What is a function of control totals?

A) To ensure that all authorized transactions are processed once and only once
B) To ensure that as a batch transmittal ticket progresses through the various processing stages it is not altered
C) To verify the accuracy and completeness of programmed processing
D) To ensure that an initial computation is correct and has not been altered during processing

Question 35

An employee in the receiving department keyed in a receiving record and inadvertently omitted the purchase order number. What control will prevent this error?

A) Anticipation of contents
B) Sequence check
C) Reasonableness test
D) Smartcard

Question 36

The authority for establishing selling prices normally resides with which of the following?

A) Treasurer and upper management
B) Controller and upper management
C) Sales department and upper management
D) Credit department and upper management

Question 37

In the processing of a batch of purchase transactions, which of the following would be used to compute a hash total?

A) Vendor account numbers
B) Dollar amounts of vendor invoices
C) Number of vendor invoices in batch
D) Number of inventory items purchased

Question 38

What type of control is control total analysis?

A) Input control
B) Processing control
C) Output control
D) Access control

Question 39

The accuracy and completeness of the general ledger update process can be tested y comparing the accounts receivable balance before the update, the total debits and credits to the accounts receivable account in the sales transaction file, and the accounts receivable balance after the update. What does this process use?

A) Check digit analysis
B) Control total analysis
C) Validity analysis
D) Hash total analysis

Question 40

The authority for disbursing cash for vendor payments or payroll disbursements normally resides with which of the following?

A) The cash disbursements clerk
B) The treasurer
C) The credit manager
D) The purchasing agent

Question 41

Which of the following procedures is most likely to prevent the improper disposition of equipment?

A) A periodic analysis of the scrap sales and the repairs and maintenance accounts.
B) The segregation of duties between those authorized to dispose of equipment and those authorized to enter the disposition transaction.
C) The use of serial numbers to identify equipment that can be sold.
D) A periodic comparison of equipment removal work orders with the authorizing documentation.

Question 42

When using both private and public keys for cryptography, which of the following statements is correct?

A) The digital certificate is used for encryption.
B) The private key is used for decryption.
C) The public key is used for decryption.
D) The digital certificate is used for decryption.

Question 43

The BEST explanation for the absence of complete information on computer crime would be:

A) Abuse is handled as an internal matter.
B) Hesitant disclosure of abuse due to embarrassment.
C) Documentation of abuses hasn't caught up with actual abuses.
D) Most computer crime is not caught and/or reported.

Question 44

Which of the following defines the integrated test facility (ITF) method of auditing through the computer?

A) Hypothetical data are used to test programmed controls and logic.
B) The auditor uses another program to test actual data and compare them to the company's results.
C) Artificial data are used to test the accounting information system.
D) A module is inserted into the application to monitor and collect data.

Question 45

The total computed on which of the following would be a hash total for payroll applications?
A )Hours worked.
B) Total debits/credits.
C) Net pay.
D) Department numbers.

Question 46

Self-checking digits are used to detect which of the following errors?

A) Processing data in the wrong sequence.
B) Losing data between processing functions.
C) Assigning a valid code to the wrong customer.
D) Entering an invalid customer code.

Question 47

Which of the following are methods of auditing in computerized environments?

A) Auditing around the computer.
B) Auditing with the computer.
C) Auditing through the computer.
D) B and C only.
E) All of the above. E

Question 48

What is (are) included in IT governance?

A) The corporate charter, policies, and bylaws of the corporation.
B) The issues surrounding IT management and security.
C) The entire organization's management of resources and risks.
D) All of these are included in IT governance.

Question 49

ABC Company inputs sales transaction data in batches that are subject to edit checks. What would be a direct output of the edit checks?

A) Printout of all user IDs and passwords.
B) Report of all missing sales invoices.
C) List of all voided shipping documents.
D) Report of all rejected sales transactions.

Question 50

What are controls that concern all computer activities?

A) General controls.
B) Application controls.
C) Change controls.
D) IT audit controls.

Question 51

Which of the following statements regarding cryptography is not correct?

A) Much emphasis is placed on the encryption side of cryptography.
B) When using private and public keys, the decrypting key is never sent anywhere.
C) A solution to the problem of securing data that leave their original location is the private key.
D) Locating encryption keys on Web servers is not as difficult as once believed.

Question 52

Which of the following is (are) application controls

A) Access security.
B) Passwords.
C) Input controls.
D) All of the above.
E) None of the above. C

Question 53

Disaster recovery plans help reduce which of the following types of risk?

A) Business risk.
B) Information access risk.
C) General controls risk.
D) All of the above.

Question 54

What is the advantage of having a "hot site" as a back-up control?

A) Power and space are available at the site to set up processing equipment on short notice (e.g., after a disaster)..
B) The site is located in another branch of the company in a neighboring county.
C) The system is configured in a manner similar to the normal day-to-day processing and is available for immediate use.
D) All of the above are advantages of having a hot site.

Question 55

Disaster recovery plans should include all of the following EXCEPT:

A) An alternative means to continue processing after disaster.
B) A strong audit trail for all transactions.
C) Required employee training and periodic testing of the plan.
D) All of the above should be included in the disaster recovery plan.

Question 56

Segregation of duties reduces the opportunities for a person to be in a position to do which of the following?

A) Perpetrate and conceal errors and inappropriate acts.
B) Record both cash receipts and cash disbursements.
C) Journalize entries and prepare financial statements.
D) Establish control activities and authorize transactions.

Question 57

When auditing a client's database, the purpose of extracting high value and old invoices is to:

A) Determine which vendors and employees have the same addresses.
B) Determine potential invoices for review.
C) Determine unusual relationships between high dollar amounts and past due invoices.
D) Determine which invoices are open and are past due.

Question 58

Which of the following statements about computer forensics experts is (are) TRUE?

A) Erasing all data on the computer by the fraud perpetrator makes it impossible for the forensics expert to extract evidence.
B) Computer forensic experts collect evidence and information for use in fraud cases using legally accepted methods.
C) Computer forensics experts are NOT allowed to train the company's employees.
D) All of these statements are true.

Question 59

Which of the following controls would be most effective in assuring the proper custody of investment securities?

A) Direct access to securities in the safety deposit box is limited to only one corporate office.
B) Personnel who post investment security transactions in the general ledger master file are prohibited from updating the investment securities master files
C) The purchase and sale of investment securities are executed upon the specific authorization of the board of directors.
D) The balances in the investment security master file are periodically compared with the physical investment securities by independent personnel.

Question 60

Of the following control activities, which is the MOST effective for minimizing the possibility of fraudulent activity?

A) Bonding of employees.
B) Segregation of duties.
C) Rotation of assignments.
D) Enforced vacations.

Question 61

What is automatic rollback?
A An in-house backup that is completed through the Internet.
B) A pricing method used by retailers.
C) feature that backs out incomplete transactions.
D) A feature that aids in the recovery of data.

Question 62

A network that uses fiber optic cable provides better access security than cables that transmit electrical impulses.

Question 63

General controls apply to the reliability and consistency of the overall information processing environment, and they support application controls.

Question 64

Computer hardware controls are built in by the manufacturer.

Question 65

A company updates its account receivable master file weekly and retains the master files and corresponding transaction files for the most recent two-week period. What is the purpose of this practice?

A) Permit reconstruction of the master file if needed.
B) Match logical relationships to detect errors in the master file records.
C) Verify run-to-run totals.
D) Match logical relationships to detect errors in the master file records.

Question 66

What are the three types of firewalls?

A) On-screen applications, operating system-based firewalls, and general firewalls.
B) On-screen applications, offline firewalls, and applications-based firewalls.
C) Screen routers, offline firewalls, and general firewalls.
D) Screen routers, operating system-based firewalls, and applications-based firewalls.

Question 67

To provide a high level of assurance, a large organization would normally not need more than fifty controls.

Question 68

A disaster recovery plan is which of the following?

A) An application control.
B) An automated preventive control.
C) A general control.
D) An automated application control.

Question 69

What is a popular way of shielding an organization's private network from intruders outside of the organization?

A) File attributes.
B) Uninterruptible power supply.
C) Auxiliary power supply.
D) Firewall.

Question 70

A warehouse employee of a retail company was able to conceal the theft of items of inventory by entering adjustment transactions to the inventory transactions to the inventory transaction file indicating that the items had been damaged or lost. What control would have prevented the adjustments from being recorded?

A) Including a check digit in the inventory part number.
B) Requiring separate authorization for input of adjustment transactions.
C) Including a parity check on the inventory part number.
D) Providing an edit check for the validity of the inventory part number.

Question 71

An accounts payable program posted a payable to a vendor not included in the vendor master file. What is a control that would have prevented this error?

A) Validity check.
B) Range check.
C) Reasonableness test.
D) Parity check.

Question 72

What should be the role of an information services steering committee?

A) Initiate all applications development; set priorities for implementing, applications; develop system security.
B) Assign duties to systems personnel; prepare and monitor application implementation plans; prepare system flowcharts.
C) Establish/approve information processing policies, system projects, and priorities for implementing systems; evaluate effectiveness of processing operations; monitor processing activities.
D) Decide on specific information needs; prepare detailed plans for system evaluations; set priorities for developing applications; decide what computer hardware will be purchased.

Question 73

What is a control to ensure that transactions are reconstructed correctly after an unplanned termination of processing?

A) Automatic rollback.
B) Record count and control total.
C) Anticipation and hash total.
D) Concurrence and sequence number.

Question 74

What principle of segregation of duties is demonstrated by segregating the duties of hiring personnel from distributing payroll checks?

A) Authorization of transactions from the custody of related assets.
B) Operational responsibility from recordkeeping responsibility.
C) Human resources function from the controllership function.
D) Administrative controls from the internal accounting controls.

Question 75

Which of the following is an effective way to reduce business risk?

A) Having a strong internal control system
B) Having well-documented management policies and procedures.
C) Having regular assessments of the risks to information assets.
D) Having a documented and regularly tested disaster recovery plan.

Question 76

What are general computer controls?

A) Controls related to the flow of data in and among support applications.
B) Controls related to the reliability and consistency of the processing environment.
C) Controls that separate functions that are not compatible.
D) Controls to authorize staff to use specific programs.

Question 77

Which of the following is a valid method for monitoring internal control?

A) Conducted as a separate project by IT auditors and supervisory personnel.
B) Conducted on an ongoing basis by flagging items that should be investigated.
C) Conducted as a separate project by IT auditors and supervisory personnel or conducted on an ongoing basis by flagging items that should be investigated.
D) None of these is a valid method for monitoring internal control.

Question 78

Which of the following represent physical controls?

A) Separation of the authorization and modification functions of purchasing.
B) Alarms and surveillance cameras for the warehouse.
C) Back-ups of all master files.
D) All of the above.

Question 79

which of the following is (are) categories of control activities?

A) Information processing.
B) Physical controls.
C) Performance reviews.
D) Segregation of duties.
E) A, B, and D only. F. All of the above.

Question 80

Which of the following concepts relate to control activities?

A) Isolation and accountability.
B) Redundancy and oversight.
C) Comparison and assistance.
D) A and B only.
E) All of the above. E