Deck 10: The Impact of Information Technology on the Audit Process

Question 1

Which of the following is an enhancement to internal control resulting from integrating IT into accounting systems?

A) Computer controls replace manual ones
B) Higher quality information
C) Both A and B
D) Neither A nor B

Answer 1

C

Question 2

Auditing standards describe which two broad control groupings for IT systems? 1. General controls
2) Application controls
3) Information controls
4) Performance controls

A) 2 and 3
B) 1 and 3
C) 1 and 2
D) 3 and 4

Answer 2

C

Question 3

Which of the following is NOT an example of a test data approach?

A) Testing online passwords
B) Testing input data to final reports
C) Testing authorisation of transactions
D) Testing data access controls

Answer 3

C

Question 4

A database management system:

A) allows quick retrieval of data, but it needs to update files continually.
B) reduces data redundancy.
C) allows quick retrieval of data but at a cost of inefficient use of file space.
D) stores data on different files for different purposes, but always knows where they are and how to retrieve them.

Question 5

A control which relates to all parts of the IT system is called:

A) a systems control.
B) an applications control.
C) a universal control.
D) a general control.

Question 6

Which one of the following computer- assisted auditing techniques allows fictitious and real transactions to be processed together without client operating personnel being aware of the testing process?

A) Test data approach
B) Generalised audit software programming
C) Integrated test facility
D) Parallel simulation

Question 7

The auditor may decide NOT to reduce assessed control risk even if internal controls are adequate. This approach is followed if:

A) the cost of the study and tests of controls will exceed the savings from reduced substantive procedures.
B) the auditor plans to rely on the controls and reduce substantive testing.
C) a qualified opinion will be issued.
D) All of the above are true.

Question 8

Which one of the following is NOT usually part of a contingency plan?

A) Storing copies of critical software off premises
B) Identifying alternative hardware that can be used to process company data
C) Regular changing of access codes
D) Backing up critical data files

Question 9

The accumulation of source documents and records that allows the organisation to trace accounting entries back to their initiation is the:

A) substantiation record.
B) initialisation procedure.
C) outsourcing code.
D) audit trail.

Question 10

The function of an embedded audit module approach:

A) tests data used to test specific controls.
B) analyses the client data.
C) inserts an audit module into the client's application system.
D) uses software to define the content of data records.

Question 11

A computer service centre processes, for an auditor's client, financial data that has a material effect on that client's financial statements. The independent auditor need NOT consider a review of the service centre controls if:

A) he or she is satisfied that a special report on internal controls issued by the service centre's independent auditor can be relied on to the extent desired.
B) the service centre is a partially owned subsidiary of the client company, whose financial statements are examined by another audit firm.
C) the service centre processes data exclusively for the audit client and its subsidiaries.
D) the service centre controls have already been reviewed by the internal audit team of the client.

Question 12

Many clients have their data processed at an independent computer service centre (IT outsourcing). The difficulty the independent auditor faces when a computer service centre is used is:

A) in trying to abide by the joint Code of Professional Conduct to maintain the security and confidentiality of the client's data.
B) in determining the adequacy of the service centre's internal controls.
C) finding compatible programs that will analyse the service centre's programs.
D) gaining the permission of the service centre to review its work.

Question 13

Controls which are designed to assure that the information processed by the computer is authorised, complete and accurate are called:

A) processing controls.
B) general controls.
C) output controls.
D) input controls.

Question 14

Which one of the following statements is incorrect about network environments?

A) Decentralised servers often increase control risk.
B) Many environments lack standardised procedures.
C) Responsibility for purchasing equipment usually resides with a centralised IT function.
D) Network- related software often lacks the security features typically available in traditionally centralised systems.

Question 15

To obtain evidence that all external users in an e- commerce system are authorised, a 'firewall' channels all network connections through a:

A) separate computer service bureau.
B) control gateway.
C) single telephone line.
D) single computer monitor.

Question 16

Which of the following is a generalised audit software package?

A) MYOB
B) ACL
C) Visual Basic
D) None of the above

Question 17

A well- controlled IT system offers greater potential for reducing misstatements because:

A) computers reduce the human error that is likely to occur in traditional manual environments.
B) computers process information consistently.
C) computers handle tremendous volumes of complex business transactions effectively.
D) all of the above

Question 18

The audit procedure which is least useful in gathering evidence on significant computer processes is:

A) test data.
B) generalised audit software.
C) tracing.
D) observation.

Question 19

Application controls vary with each application in the IT system. In attempting to review and gain an understanding of the internal control system, the auditor must evaluate the application controls for:

A) every audit area.
B) every material audit area.
C) every audit area in which the client uses the computer.
D) every audit area where the auditor plans to reduce assessed control risk.

Question 20

Generalised audit software:

A) is a method of verifying the client's data which is recorded in a machine language.
B) is used when client's software is not compatible with the auditor's.
C) is often used even when client's data are not computerised.
D) can be used for all three of the above.

Question 21

Which one of the following is NOT a general control?

A) Processing controls
B) Segregation of IT duties
C) Hardware controls
D) Backup

Question 22

Auditors usually evaluate the effectiveness of:

A) applications controls first.
B) sales- cycle controls first.
C) general controls before applications controls.
D) hardware controls first.

Question 23

The auditor can perform many different kinds of tests and other functions with the auditor's computer program. Which of the following tests or functions CANNOT be performed?

A) Verify extensions and footings.
B) Analyse exception responses returned with confirmations received from customers.
C) Compare data on separate files.
D) Re- sequence data and perform analyses.

Question 24

Internal control is ineffective when computer programmers:

A) design documentation for computerised systems.
B) request physical security be provided for program files.
C) have access to actual programs used to produce accounting information.
D) participate in computer software acquisition decisions.

Question 25

Which of the following is NOT a general control?

A) Post processing reviews
B) Preparation of backup plans
C) Access to hardware is restricted
D) Equipment error causes error messages to appear on the computer monitor

Question 26

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?

A) Totalling the client's accounts receivable balances
B) Random sampling of all other receivables
C) Inquiry of management policy on aged debtors
D) Comparing creditor statements with accounts payable files

Question 27

Auditing around the computer:

A) uses computer programs to perform audit tasks in special circumstances.
B) uses the client's computer as an audit tool.
C) only considers the non- IT controls in assessing control risk.
D) all of the above

Question 28

Strong general controls mitigate which type of risks?

A) Risk of system obsolescence
B) Risk of system crash
C) Risk of theft of information and data
D) All of the above

Question 29

The objective of understanding internal control and assessing control risk in an IT system is:

A) to gain an understanding of the computer hardware and software.
B) to evaluate management's efficiency in designing and using the IT system.
C) to determine if the audit firm must have an IT auditor on the team.
D) to aid in determining the audit evidence that should be accumulated.

Question 30

When the client uses a computer but the auditor chooses to use only the non- IT segment of internal control to assess control risk, it is referred to as auditing around the computer. Which one of the following conditions need NOT be present in order to audit around the computer?

A) Computer programs must be available in English.
B) User controls include comparison of computer- produced records with source documents.
C) The accounting software can display or print ledger balances and transaction details that allow the auditor to trace individual transactions through the accounting records.
D) The source documents are available in a readable form and can be traced easily through the accounting system to output.

Question 31

Should the auditor feel, after obtaining an understanding of IT internal control, that control risk cannot be reduced, he or she will:

A) issue an adverse opinion.
B) increase the sample size for tests of controls.
C) issue a disclaimer.
D) expand the substantive testing portion of the audit.

Question 32

An auditor's investigation of a company's IT control procedures has disclosed the following four circumstances. Indicate which circumstance constitutes a weakness in internal control.

A) Only one copy of backup files is stored in an off- premises location.
B) Computer operators are closely supervised by programmers.
C) Programmers do not have the authorisation to operate equipment.
D) Computer operators do not have access to the complete run manual.

Question 33

Development and changes to IT systems are generally coordinated by a _ analyst.

A) financial
B) technical
C) systems
D) all of the above

Question 34

A key to successful software purchase decisions involves:

A) IT and non- IT personnel.
B) internal auditors.
C) key users of the software.
D) all of the above

Question 35

A site is allowed to retain the Webtrust seal if the auditor monitors compliance at least every:

A) 120 days.
B) 60 days.
C) 30 days.
D) 90 days.

Question 36

IT can significantly impact on an organisation's overall control risk. Which of the following risks would NOT be important from an auditing perspective?

A) Use of unreliable information because of processing errors produced by the technology
B) The inability to retrieve important information because of IT systems failure
C) The potential for material misstatement
D) None of the above, i.e., they are all important.

Question 37

Well- controlled organisations segregate key duties within IT. Ideally, this means the following responsibilities should be separated:

A) IT management separate from operations.
B) IT management separate from data control.
C) IT management separate from systems development.
D) All of the above

Question 38

Parallel testing involves:

A) requiring the user to re- input critical fields to verify accuracy of input.
B) operating the old and the new system simultaneously.
C) implementing a new system in one part of the organisation while other locations continue to rely on the old system.
D) processing test data against a copy of the client's application program.

Question 39

Generalised audit software can be used to perform many different kinds of tests. Which is NOT one of them?

A) Review of accounts receivable balances for amounts over the credit limit
B) Observing cash receipts processes
C) Recalculating employees' net pay calculations
D) Preparing general ledger trial balances

Question 40

When auditing a computerised system, an auditor may use the test data approach as an audit tool. This technique:

A) involves introducing simulated transactions into the client's actual application program(s).
B) should not involve the actual application programs the client uses throughout the year, since use of the actual programs would contaminate the client's accounting data.
C) is more applicable to independent audits than internal audits.
D) is a commonly used audit technique for auditing around the computer.

Question 41

Controls which are built in by the manufacturer to detect equipment failure are called:

A) input controls.
B) manufacturer's controls.
C) hardware controls.
D) fail- safe controls.

Question 42

The audit approach in which the auditor runs his or her own program on a controlled basis in order to verify the client's data recorded in a machine language is:

A) the microcomputer- aided auditing approach.
B) the generalised audit software approach.
C) the test data approach.
D) called auditing around the computer.

Question 43

If the general control environment is weak:

A) auditing through the computer is usually the most cost- effective audit approach.
B) the auditor will need to rely more on application controls and increase testing of these.
C) this tends to have a pervasive effect on the application control environment.
D) all of the above

Question 44

The most important output control is:

A) distribution control, which assures that only authorised personnel receive the reports generated by the system.
B) review of the data for reasonableness by someone who knows what the output should look like.
C) control totals, which are used to verify that the computer's results are correct.
D) logic tests, which verify that no mistakes were made in processing.

Question 45

Which of the following is NOT an application control?

A) Reasonableness test for unit selling price of sale
B) Preprocessing authorisation of sales transactions
C) Separation of duties between computer programmer and operators
D) Post- processing review of sales transactions by the sales department

Question 46

The effect of ITF transactions should be removed:

A) on a surprise basis.
B) after the conclusion of the audit.
C) by inputting adjustment transactions.
D) by the internal audit group.

Question 47

Physical control over computer equipment restricts access to:

A) software.
B) hardware.
C) backup data files.
D) all of the above

Question 48

How do information technologies enhance internal control?

A) Computer controls replace manual controls.
B) Higher quality information is available.
C) Computer controls are cheaper.
D) Both A and B above

Question 49

The focus of output controls is to:

A) detect errors after the completion of processing.
B) confirm that data has been processed in the correct order.
C) check the accuracy of processing.
D) prevent errors before final reports are completed.

Question 50

Pre- designed formats for audit working papers and letters can be created and saved using both electronic spreadsheets and word processors. These are called:

A) audit software.
B) macros.
C) templates.
D) desktop publishing.

Question 51

Program- oriented CAATs:

A) allow the auditor to select records for further testing.
B) may be applied regardless of the level of assessed control risk in an application.
C) are useful primarily for substantive procedures.
D) none of the above

Question 52

An independent auditor uses generalised audit software. The second step in using GAS, application design, might include which of the following?

A) Design the most useful format and contents of the auditor's GAS reports.
B) Develop a logical approach to extract and manipulate data obtained from the client's records.
C) Identify and describe the client's data files and the information to which access is desired.
D) All of the above

Question 53

The use of 'encryption' techniques protect the security of electronic communication during the:

A) recording process.
B) transmission process.
C) data backup process.
D) data output process.

Question 54

Which of the following is NOT an example of an applications control?

A) An equipment failure causes an error message on the monitor.
B) After processing, all sales transactions are reviewed by the sales department.
C) There are reasonableness tests for the unit selling price of a sale.
D) Resonableness tests reviewing hours worked by employees

Question 55

Which of the following is NOT a general control?

A) Processing controls
B) Procedures for documenting, reviewing and approving systems and payments
C) Hardware controls
D) The plan of organisation and operation of IT activity

Question 56

Controls which apply to the processing of individual transactions are called:

A) user controls.
B) systems controls.
C) general controls.
D) applications controls.

Question 57

If a control total were to be computed on each of the following data items, which would BEST be identified as a hash total for a payroll IT application?

A) Department numbers
B) Net pay
C) Total debits and total credits
D) Hours worked

Question 58

Oversight of the IT function to ensure that all activities are carried out consistently with the IT strategic plan is the responsibility of the:

A) librarian.
B) chief information officer.
C) data control group.
D) computer operators.

Question 59

Which one of the following is NOT an application control?

A) Input controls
B) Output controls
C) Processing controls
D) Hardware controls

Question 60

Program- oriented CAATs are useful primarily for:

A) tests of controls.
B) any type of audit testing.
C) tests of balances.
D) analytical review tests.

Question 61

Although IT can enhance a company's internal control, it can also affect a company's overall control risk. Identify any four of these new risks specific to IT environments.

Question 62

An advantage of generalised audit software (GAS) is the ability to access and test client data independently.

Question 63

An auditor who is testing IT controls in a payroll system would most likely use test data that contains conditions such as:

A) time tickets with invalid job numbers.
B) deductions not authorised by employees.
C) overtime not approved by supervisors.
D) payroll cheques with unauthorised signatures.

Question 64

There are three concerns or difficulties that must be overcome before the test data approach can be used by the auditor. Discuss each of these concerns.

Question 65

General controls are normally evaluated earlier in the audit than application controls.

Question 66

The perceived importance of IT within an organisation is often dictated by the attitude of the audit committee.

Question 67

In IT systems, if general controls are effective, it increases the auditor's ability to rely on application controls to reduce control risk.

Question 68

Provide five examples of different IT environments the auditor may encounter.

Question 69

Describe four common audit tasks that can be simplified by the use of microcomputers in practice.

Question 70

Using the test data approach, the auditor processes a set of the client's actual transaction data using the auditor's computer programs on the auditor's computer equipment to determine whether the client's computer programs and equipment are processing data correctly.

Question 71

When the auditor decides to audit around the computer, he or she is not required to test the client's IT controls.

Question 72

The objective of the computer audit technique known as the test data approach is to determine whether the client's computer programs can correctly process valid and invalid transactions.

Question 73

Discuss what is meant by the term 'auditing through the computer'.

Question 74

Data Corporation has just completely computerised its billing and accounts receivable record- keeping. Your firm has recently acquired IDEA software and you want to make maximum use of the computer in your audit of Data Corporation. Which of the following audit techniques could NOT be performed using generalised audit software?

A) Selecting a sample of accounts to be confirmed and printing confirmation requests
B) Comparing data on separate files
C) Resolving differences reported by customers on confirmation requests
D) Examining records for quality, completeness, consistency and correctness

Question 75

Systems development, operations and data control, and librarianship are separated in an IT system.

Question 76

One key to a backup and contingency plan is to make sure that all critical copies of software and data files are backed up and stored off- premises.

Question 77

Tests of controls are normally performed only if the auditor believes the client's internal control may be effective.

Question 78

Discuss how the integration of IT into accounting systems enhances internal control.

Question 79

A common assumption is that 'the information is because the computer produced it'.

A) relevant
B) dubious
C) substantive
D) correct

Question 80

Identify the three categories of application controls and give one example of each.