Which of the following is the least likely characteristic of personal computers?

0% found this document useful (0 votes)

1K views15 pages

Auditing CIS Reviewer

Original Title:

Auditing_CIS_Reviewer.docx

Uploaded by

LawrenceValdez

Full description

AUDITING IN A COMPUTERIZED ENVIRONMENT

1. Which statement is incorrect when auditing in a CIS

environment?

a. A CIS environment exists when a computer of any

type or size is involved in the processing by the entity

of financial information of significance to the audit,

whether that computer is operated by the entity or by

a third party.

b. The auditor should consider how a CIS environment

affects the audit.

c. The use of a computer changes the processing,

storage and communication of financial information

and may affect the accounting and internal control

systems employed by the entity.

d. A CIS environment changes the overall objective and

scope of an audit.

2. Which of the following standards or group of standards is

mostly affected by a computerized information system

environment?

a. General standards

b. Reporting standards

c. Second standard of field work

d. Standards of fieldwork

3. Which of the following is least considered if the auditor has to

determine whether specialized CIS skills are needed in an

audit?

a. The auditor needs to obtain a sufficient

understanding of the accounting and internal control

system affected by the CIS environment.

b. The auditor needs to determine the effect of the CIS

environment on the assessment of overall risk and of

risk at the account balance and class of transactions

level.

c. Design and perform appropriate tests of controls and

substantive procedures.

d. The need of the auditor to make analytical

procedures during the completion stage of audit.

4. It relates to materiality of the financial statement assertions

affected by the computer processing.

a. Threshold

b. Relevance

c. Complexity

d. Significance

5. Which of the following least likely indicates a complexity of

computer processing?

a. Transactions are exchanged electronically with other

organizations without manual review of their

propriety.

b. The volume of the transactions is such that users

would find it difficult to identify and correct errors in

processing.

c. The computer automatically generates material

transactions or entries directly to another

applications.

d. The system generates a daily exception report

6. The nature of the risks and the internal characteristics in CIS

environment that the auditors are mostly concerned include the

following except:

a. Lack of segregation of functions.

b. Lack of transaction trails.

c. Dependence of other control over computer

processing.

d. Cost-benefit ratio.

7. Which of the following is least likely a risk characteristic

associated with CIS environment?

a. Errors embedded in an application’s program logic

maybe difficult to manually detect on a timely basis.

b. Many control procedures that would ordinarily be

performed by separate individuals in manual system

maybe concentrated in CIS.

c. The potential unauthorized access to data or to alter

them without visible evidence maybe greater.

d. Initiation of changes in the master file is exclusively

handled by respective users.

8. Which of the following significance and complexity of the CIS

activities should an auditor least understand?

a. The organizational structure of the client’s CIS

activities.

b. Lack of transaction trails.

c. The significance and complexity of computer

processing in each significant accounting application.

d. The use of software packages instead of customized

software.

9. Which statement is correct regarding personal computer

systems?

a. Personal computers or PCs are economical yet

powerful self-contained general purpose computers

consisting typically of a central processing unit

(CPU), memory, monitor, disk drives, printer cables

and modems.

b. Programs and data are stored only on non-

removable storage media.

c. Personal computers cannot be used to process

accounting transactions and produce reports that are

essential to the preparation of financial statements.

d. Generally, CIS environments in which personal

computers are used are the same with other CIS

environments.

10. A personal computer can be used in various configurations,

including

a. A stand-alone workstation operated by a single user

or a number of users at different times.

b. A workstation which is part of a local area network of

personal computers.

c. A workstation connected to a server.

d. All of the above.

11. Which statement is incorrect regarding personal computer

configurations?

a. The stand-alone workstation can be operated by a

single user or a number of users at different times

accessing the same or different programs.

b. A stand-alone workstation may be referred to as a

distributed system.

c. A local area network is an arrangement where two

or more personal computers are linked together

through the use of special software and

communication lines.

d. Personal computers can be linked to servers and

used as part of such systems, for example, as an

intelligent on-line workstation or as part of a

distributed accounting system.

12. Which of the following is the least likely characteristic of

personal computers?

a. They are small enough to be transportable.

b. They are relatively expensive.

c. They can be placed in operation quickly.

d. The operating system software is less

comprehensive than that found in larger computer

environments.

13. Which of the following is an inherent characteristic of software

package?

a. They are typically used without modifications of the

programs.

b. The programs are tailored-made according to the

specific needs of the user.

c. They are developed by software manufacturer

according to a particular user’s specifications.

d. It takes a longer time of implementation.

14. Which of the following is not normally a removable storage

media?

a. Compact disk

b. Tapes

c. Diskettes

d. Hard disk

15. It is a computer program (a block of executable code) that

attaches itself to a legitimate program or data file and uses

itself as a transport mechanism to reproduce itself without the

knowledge of the user.

a. Virus

b. System management program

c. Utility program

d. Encryption

16. Which statement is incorrect regarding internal control in

personal computer environment?

a. Generally, the CIS environment in which personal

computers are used is less structured than a

centrally-controlled CIS environment.

b. Controls over the system development process and

operations may not be viewed by the developer, the

user or management as being as important or cost-

effective.

c. In almost all commercially available operating

systems, the built-in security provided has gradually

increased over the years.

d. In a typical personal computer environment, the

distinction between general CIS controls and CIS

application controls is easily ascertained.

17. Personal computers are susceptible to theft, physical damage,

unauthorized access or misuse of equipment. Which of the

following is least likely a physical security to restrict access to

personal computers when not in use?

a. Using door locks or other security protection during

non-business hours.

b. Fastening the personal computer to a table using

security cables.

c. Locking the personal computer in a protective

cabinet or shell.

d. Using anti-virus software programs.

18. Which of the following is not likely a control over removable

storage media to prevent misplacement, alteration without

authorization or destruction?

a. Using cryptography, which is the process of

transforming programs and information into an

unintelligible form.

b. Placing responsibility for such media under

personnel whose responsibilities include duties of

software custodians or librarians.

c. Using a program and data file check-in and check-

out system and locking the designated storage

locations.

d. Keeping current copies of diskettes, compact disks

or back-up tapes and hard disks in a fireproof

container, either on-site, off-site or both.

19. 19. Which of the following least likely protects critical and

sensitive information from unauthorized access in a personal

computer environment?

a. Using secret file names and hiding the files.

b. Keeping of back up copies offsite.

c. Employing passwords.

d. Segregating data into files organized under separate

file directories.

20. It refers to plans made by the entity to obtain access to

comparable hardware, software and data in the event of their

failure, loss or destruction.

a. Back-up

b. Encryption

c. Anti-virus

d. Wide Area Network (WAN)

21. The effect of personal computers on the accounting system

and the associated risks will least likely depend on

a. The extent to which the personal computer is being

used to process accounting applications.

b. The type and significance of financial transactions

being processed.

c. The nature of files and programs utilized in the

applications.

d. The cost of personal computers.

22. The auditor may often assume that control risk is high in

personal computer systems since, it may not be practicable or

cost-effective for management to implement sufficient controls

to reduce the risks of undetected errors to a minimum level.

This least likely entail

a. More physical examination and confirmation of

assets.

b. More analytical procedures than tests of details.

c. Larger sample sizes.

d. Greater use of computer-assisted audit techniques,

where appropriate.

23. Computer systems that enable users to access data and

programs directly through workstations are referred to as

a. On-line computer systems

b. Personal computer systems

c. Database management systems (DBMS)

d. Database systems

24. On-line systems allow users to initiate various functions

directly. Such functions include:

I. Entering transactions

II. Requesting reports

III. Making inquiries

IV. Updating master files

a. I, II, III and IV

b. I and II

c. I, II and III

d. I and IV

25. Many different types of workstations may be used in on-line

computer systems. The functions performed by these

workstations least likely depend on their

a. Logic

b. Transmission

c. Storage

d. Cost

26. Types of workstations include General Purpose Terminals and

Special Purpose Terminals.Special Purpose Terminals

include

a. Basic keyboard and monitor

b. Point of sale devices

c. Intelligent terminal

d. Personal computers

27. Special Purpose Terminal used to initiate, validate, record,

transmit and complete various banking transactions

a. Automated teller machines

b. Intelligent terminal

c. Point of sale devices

d. Personal computers

28. Which statement is incorrect regarding workstations?

a. Workstations may be located either locally or at

remote sites.

b. Local workstations are connected directly to the

computer through cables.

c. Remote workstations require the use of

telecommunications to link them to the computer.

d. Workstations cannot be used by many users, for

different purposes, in different locations all at the

same time.

29. On-line computer systems may be classified according to

a. How information is entered into the system.

b. How it is processed.

c. When the results are available to the user.

d. All of the above.

30. In an on-line/real time processing system

a. Individual transactions are entered at workstations,

validated and used to update related computer files

immediately.

b. Individual transactions are entered at a workstation,

subjected to certain validation checks and added to a

transaction file that contains other transactions

entered during the period.

c. Individual transactions immediately update a memo

file containing information which has been extracted

from the most recent version of the master file.

d. The master files are updated by other systems.

31. It combines on-line/real time processing and on-line/batch

processing.

a. On-Line/Memo Update (and Subsequent Processing)

b. On-Line Downloading/Uploading Processing

c. On-Line/Inquiry

d. On-Line/Combined Processing

32. It is a communication system that enables computer users to

share computer equipment, application software, data and

voice and video transmissions.

a. Network

b. File server

c. Host

d. Client

33. A type of network that multiple buildings are close enough to

create a campus, but the space between the buildings is not

under the control of the company is

a. Local Area Network (LAN)

b. Metropolitan Area Network (MAN)

c. Wide Area Network (WAN)

d. World Wide Web (WWW)

34. Which of the following is least likely a characteristic of Wide

Area Network (WAN)?

a. Created to connect two or more geographically

separated LANs.

b. Typically involves one or more long-distance

providers, such as a telephone company to provide

the connections.

c. WAN connections tend to be faster than LAN.

d. Usually more expensive than LAN.

35. Gateway is

a. A hardware and software solution that enables

communications between two dissimilar networking

systems or protocols.

b. A device that forwards frames based on destination

addresses.

c. A device that connects and passes packets between

two network segments that use the same

communication protocol.

d. A device that regenerates and retransmits the signal

on a network.

36. A device that works to control the flow of data between two or

more network segments

a. Bridge

b. Router

c. Repeater

d. Switch

37. The undesirable characteristics of on-line computer systems

least likely include

a. Data are usually subjected to immediate validation

checks.

b. Unlimited access of users to all of the functions in a

particular application.

c. Possible lack of visible transaction trail.

d. Potential programmer access to the system.

38. Certain general CIS controls that are particularly important to

on-line processing least likely include

a. Access controls.

b. System development and maintenance controls.

c. Edit, reasonableness and other validation tests.

d. Use of anti-virus software program.

39. Certain CIS application controls that are particularly important

to on-line processing least likely include

a. Pre-processing authorization.

b. Transaction logs.

c. Cut-off procedures.

d. Balancing.

40. Risk of fraud or error in on-line systems may be reduced in the

following circumstances, except

a. If on-line data entry is performed at or near the point

where transactions originate, there is less risk that

the transactions will not be recorded.

b. If invalid transactions are corrected and re-entered

immediately, there is less risk that such transactions

will not be corrected and re-submitted on a timely

basis.

c. If data entry is performed on-line by individuals who

understand the nature of the transactions involved,

the data entry process may be less prone to errors

than when it is performed by individuals unfamiliar

with the nature of the transactions.

d. On-line access to data and programs through

telecommunications may provide greater opportunity

for access to data and programs by unauthorized

persons.

41. Risk of fraud or error in on-line computer systems may be

increased for the following reasons, except

a. If workstations are located throughout the entity, the

opportunity for unauthorized use of a workstation and

the entry of unauthorized transactions may increase.

b. Workstations may provide the opportunity for

unauthorized uses such as modification of previously

entered transactions or balances.

c. If on-line processing is interrupted for any reason,

for example, due to faulty telecommunications, there

may be a greater chance that transactions or files

may be lost and that the recovery may not be

accurate and complete.

d. If transactions are processed immediately on-line,

there is less risk that they will be processed in the

wrong accounting period.

42. 42. The following matters are of particular importance to the

auditor in an on-line computer system, except

a. Authorization, completeness and accuracy of on-line

transactions.

b. Integrity of records and processing, due to on-line

access to the system by many users and

programmers.

c. Changes in the performance of audit procedures

including the use of CAAT's.

d. Cost-benefit ratio of installing on-line computer

system.

43. A collection of data that is shared and used by a number of

different users for different purposes.

a. Database

b. Information file

c. Master file

d. Transaction file

44. Which of the following is least likely a characteristic of a

database system?

a. Individual applications share the data in the database

for different purposes.

b. Separate data files are maintained for each

application and similar data used by several

applications may be repeated on several different

files.

c. A software facility is required to keep track of the

location of the data in the database.

d. Coordination is usually performed by a group of

individuals whose responsibility is typically referred to

as "database administration."

45. Database administration tasks typically include

I. Defining the database structure.

II. Maintaining data integrity, security and

completeness.

III. Coordinating computer operations related to the

database.

IV. Monitoring system performance.

V. Providing administrative support.

a. All of the above

b. All except I

c. II and V only

d. II, III and V only

46. Due to data sharing, data independence and other

characteristics of database systems

a. General CIS controls normally have a greater

influence than CIS application controls on database

systems.

b. CIS application controls normally have a greater

influence than general CIS controls on database

systems.

c. General CIS controls normally have an equal

influence with CIS application controls on database

systems.

d. CIS application controls normally have no influence

on database systems.

47. Which statement is incorrect regarding the general CIS controls

of particular importance in a database environment?

a. Since data are shared by many users, control may

be enhanced when a standard approach is used for

developing each new application program and for

application program modification.

b. Several data owners should be assigned

responsibility for defining access and security rules,

such as who can use the data (access) and what

functions they can perform (security).

c. User access to the database can be restricted

through the use of passwords.

d. Responsibilities for performing the various activities

required to design, implement and operate a

database are divided among technical, design,

administrative and user personnel.

48. These require a database administrator to assign security

attributes to data that cannot be changed by database users.

a. Discretionary access controls

b. Name-dependent restrictions

c. Mandatory access controls

d. Content-dependent restrictions.

49. A discretionary access control wherein users are permitted or

denied access to data resource depending on the time series

of accesses to and actions they have undertaken on data

resources.

a. Name-dependent restrictions

b. Context-dependent restriction

c. Content-dependent restriction

d. History-dependent restriction

50. The effect of a database system on the accounting system and

the associated risks will least likely depend on:

a. The extent to which databases are being used by

accounting applications.

b. The type and significance of financial transactions

being processed.

c. The nature of the database, the DBMS, the database

administration tasks and the applications.

d. The CIS application controls.

51. Audit procedures in a database environment will be affected

principally by

a. The extent to which the data in the database are

used by the accounting system.

b. The type and significance of financial transactions

being processed.

c. The nature of the database, the DBMS, the database

administration tasks and the applications.

d. The general CIS controls which are particularly

important in a database environment.

52. Which statement is incorrect regarding the characteristics of a

CIS organizational structure?

a. Certain data processing personnel may be the only

ones with a detailed knowledge of the

interrelationship between the source of data, how it is

processed and the distribution and use of the output.

b. Many conventional controls based on adequate

segregation of incompatible functions may not exist,

or in the absence of access and other controls, may

be less effective.

c. Transaction and master file data are often

concentrated, usually in machine-readable form,

either in one computer installation located centrally or

in a number of installations distributed throughout an

entity.

d. Systems employing CIS methods do not include

manual operations since the number of persons

involved in the processing of financial information is

significantly reduced.

53. System characteristics that may result from the nature of CIS

processing include, except

a. Absence of input documents.

b. Lack of visible transaction trail.

c. Lack of visible output.

d. Difficulty of access to data and computer programs.

54. The development of CIS will generally result in design and

procedural characteristics that are different from those found in

manual systems. These different design and procedural

aspectsof CIS include, except:

a. Consistency of performance.

b. Programmed control procedures.

c. Vulnerability of data and program storage media

d. Multiple transaction update of multiple computer files

or databases.

55. Which statement is incorrect regarding internal controls in a

CIS environment?

a. Manual and computer control procedures comprise

the overall controls affecting the CIS environment

(general CIS controls) and the specific controls over

the accounting applications (CIS application

controls).

b. The purpose of general CIS controls is to establish a

framework of overall control over the CIS activities

and to provide a reasonable level of assurance that

the overall objectives of internal control are achieved.

c. The purpose of CIS application controls is to

establish specific control procedures over the

application systems in order to provide reasonable

assurance that all transactions are authorized and

recorded, and are processed completely, accurately

and on a timely basis.

d. The internal controls over computer processing,

which help to achieve the overall objectives of

internal control, include only the procedures

designed into computer programs.

56. General CIS controls may include, except:

a. Organization and management controls.

b. Delivery and support controls.

c. Development and maintenance controls.

d. Controls over computer data files.

57. 57. CIS application controls include, except

a. Controls over input.

b. Controls over processing and computer data files.

c. Controls over output.

d. Monitoring controls.

58. Which statement is incorrect regarding the review of general

CIS controls and CIS application controls?

a. The auditor should consider how these general CIS

controls affect the CIS applications significant to the

audit.

b. General CIS controls that relate to some or all

applications are typically interdependent controls in

that their operation is often essential to the

effectiveness of CIS application controls.

c. Control over input, processing, data files and output

may be carried out by CIS personnel, by users of the

system, by a separate control group, or may be

programmed into application software.

d. It may be more efficient to review the design of the

application controls before reviewing the general

controls.

59. Which statement is incorrect regarding the evaluation of

general CIS controls and CIS application controls?

a. The general CIS controls may have a pervasive

effect on the processing of transactions in application

systems.

b. If general CIS controls are not effective, there may

be a risk that misstatements might occur and go

undetected in the application systems.

c. Manual procedures exercised by users may provide

effective control at the application level.

d. Weaknesses in general CIS controls cannot preclude

testing certain CIS application controls.

60. The applications of auditing procedures using the computer as

an audit tool refer to

a. Integrated test facility

b. Auditing through the computer

c. Data-based management system

d. Computer assisted audit techniques

61. Which statement is incorrect regarding CAATs?

a. CAATs are often an efficient means of testing a large

number of transactions or controls over large

populations.

b. To ensure appropriate control procedures, the

presence of the auditor is not necessarily required at

the computer facility during the running of a CAAT.

c. The general principles outlined in PAPS 1009 apply

in small entity IT environments.

d. Where smaller volumes of data are processed, the

use of CAATs is more cost effective.

62. Consists of generalized computer programs designed to

perform common audit tasks or standardized data processing

functions.

a. Package or generalized audit software

b. Utility programs

c. Customized or purpose-written programs

d. System management programs

63. Audit automation least likely include

a. Expert systems.

b. Tools to evaluate a client’s risk management

procedures.

c. Manual working papers.

d. Corporate and financial modeling programs for use

as predictive audit tests.

64. An internal auditor noted the following points when conducting

a preliminary survey in connection with the audit of an EDP

department. Which of the following would be considered a

safeguard in the control system on which the auditor might

rely?

a. Programmers and computer operators correct daily

processing problems as they arise.

b. The control group works with user organizations to

correct rejected input.

c. New systems are documented as soon as possible

after they begin processing live data.

d. The average tenure of employees working in the

EDP department is ten months.

65. An on-line access control that checks whether the user’s code

number is authorized to initiate a specific type of transaction or

inquiry is referred to as

a. Password

b. Compatibility test

c. Limit check

d. Reasonableness test

66. A control procedure that could be used in an on-line system to

provide an immediate check on whether an account number

has been entered on a terminal accurately is a

a. Compatibility test

b. Record count

c. Hash total

d. Self-checking digit

67. A control designed to catch errors at the point of data entry is

a. Batch total

b. Self-checking digit

c. Record count

d. Checkpoints

68. Program documentation is a control designed primarily to

ensure that

a. Programmers have access to the tape library or

information on disk files.

b. Programs do not make mathematical errors.

c. Programs are kept up to date and perform as

intended.

d. Data have been entered and processed.

69. Some of the more important controls that relate to automated

accounting information systems are validity checks, limit

checks, field checks, and sign tests. These are classified as

a. Control total validation routines

b. Output controls

c. Hash totaling

d. Input validation routines

70. Most of today’s computer systems have hardware controls that

are built in by the computer manufacturer. Common hardware

controls are

a. Duplicate circuitry, echo check, and internal header

labels

b. Tape file protection, cryptographic protection, and

limit checks

c. Duplicate circuitry, echo check, and dual reading

d. Duplicate circuitry, echo check, tape file protection,

and internal header labels

71. Computer manufacturers are now installing software programs

permanently inside the computer as part of its main memory to

provide protection from erasure or loss if there is interrupted

electrical power. This concept is known as

a. File integrity

b. Random access memory (RAM)

c. Software control

d. Firmware

72. Which one of the following represents a lack of internal control

in a computer-based information system?

a. The design and implementation is performed in

accordance with management’s specific

authorization.

b. Any and all changes in application programs have

the authorization and approval of management.

c. Provisions exist to protect data files from

unauthorized access, modification, or destruction.

d. Both computer operators and programmers have

unlimited access to the programs and data files.

73. In an automated payroll processing environment, a department

manager substituted the time card for a terminated employee

with a time card for a fictitious employee. The fictitious

employee had the same pay rate and hours worked as the

terminated employee. The best control technique to detect this

action using employee identification numbers would be a

a. Batch total

b. Hash total

c. Record count

d. Subsequent check

74. An employee in the receiving department keyed in a shipment

from a remote terminal and inadvertently omitted the purchase

order number. The best systems control to detect this error

would be

a. Batch total

b. Sequence check

c. Completeness test

d. Reasonableness test

75. The reporting of accounting information plays a central role in

the regulation of business operations. Preventive controls are

an integral part of virtually all accounting processing systems,

and much of the information generated by the accounting

system is used for preventive control purposes. Which one of

the following is not an essential element of a sound preventive

control system?

a. Separation of responsibilities for the recording,

custodial, and authorization functions.

b. Sound personnel policies.

c. Documentation of policies and procedures.

d. Implementation of state-of-the-art software and

hardware.

76. The most critical aspect regarding separation of duties within

information systems is between

a. Project leaders and programmers

b. Programmers and systems analysts

c. Programmers and computer operators

d. Data control and file librarians

77. Whether or not a real time program contains adequate controls

is most effectively determined by the use of

a. Audit software

b. A tracing routine

c. An integrated test facility

d. A traditional test deck

78. Compatibility tests are sometimes employed to determine

whether an acceptable user is allowed to proceed. In order to

perform compatibility tests, the system must maintain an

access control matrix. The one item that is not part of an

access control matrix is a

a. List of all authorized user code numbers and

passwords.

b. List of all files maintained on the system.

c. Record of the type of access to which each user is

entitled.

d. Limit on the number of transaction inquiries that can

be made by each user in a specified time period.

79. Which one of the following input validation routines is not likely

to be appropriate in a real time operation?

a. Field check

b. Sequence check

c. Sign check

d. Redundant data check

80. Which of the following controls is a processing control designed

to ensure the reliability and accuracy of data processing?

Limit test Validity check test

a. Yes Yes

b. No No

c. No Yes

d. Yes No

81. Which of the following characteristics distinguishes computer

processing from manual processing?

a. Computer processing virtually eliminates the

occurrence of computational error normally

associated with manual processing.

b. Errors or irregularities in computer processing will be

detected soon after their occurrences.

c. The potential for systematic error is ordinarily greater

in manual processing than in computerized

processing.

d. Most computer systems are designed so that

transaction trails useful for audit do not exist.

82. Which of the following most likely represents a significant

deficiency in the internal control structure?

a. The systems analyst review applications of data

processing and maintains systems documentation.

b. The systems programmer designs systems for

computerized applications and maintains output

controls.

c. The control clerk establishes control over data

received by the EDP department and reconciles

control totals after processing

d. The accounts payable clerk prepares data for

computer processing and enters the data into the

computer.

83. Which of the following activities would most likely be performed

in the EDP Department?

a. Initiation of changes to master records.

b. Conversion of information to machine-readable form.

c. Correction of transactional errors.

d. Initiation of changes to existing applications.

84. For control purposes, which of the following should be

organizationally segregated from the computer operations

function?

a. Data conversion

b. Systems development

c. Surveillance of CRT messages

d. Minor maintenance according to a schedule

85. Which of the following is not a major reason for maintaining an

audit trail for a computer system?

a. Deterrent to irregularities

b. Analytical procedures

c. Monitoring purposes

d. Query answering

86. In an automated payroll system, all employees in the finishing

department were paid the rate of P75 per hour when the

authorized rate was P70 per hour. Which of the following

controls would have been most effective in preventing such an

error?

a. Access controls which would restrict the personnel

department’s access to the payroll master file data.

b. A review of all authorized pay rate changes by the

personnel department.

c. The use of batch control totals by department.

d. A limit test that compares the pay rates per

department with the maximum rate for all employees.

87. Which of the following errors would be detected by batch

controls?

a. A fictitious employee as added to the processing of

the weekly time cards by the computer operator.

b. An employee who worked only 5 hours in the week

was paid for 50 hours.

c. The time card for one employee was not processed

because it was lost in transit between the payroll

department and the data entry function.

d. All of the above.

88. The use of a header label in conjunction with magnetic tape is

most likely to prevent errors by the

a. Computer operator

b. Computer programmer

c. Keypunch operator

d. Maintenance technician

89. For the accounting system of ACME Company, the amounts of

cash disbursements entered into an EDP terminal are

transmitted to the computer that immediately transmits the

amounts back to the terminal for display on the terminal screen.

This display enables the operator to

a. Establish the validity of the account number

b. Verify the amount was entered accurately

c. Verify the authorization of the disbursements

d. Prevent the overpayment of the account

90. When EDP programs or files can be accessed from terminals,

users should be required to enter a(an)

a. Parity check

b. Self-diagnostic test

c. Personal identification code

d. Echo check

91. The possibility of erasing a large amount of information stored

on magnetic tape most likely would be reduced by the use of

a. File protection ring

b. Completeness tests

c. Check digits

d. Conversion verification

92. Which of the following controls most likely would assure that an

entity can reconstruct its financial records?

a. Hardware controls are built into the computer by the

computer manufacturer.

b. Backup diskettes or tapes of files are stored away

from originals.

c. Personnel who are independent of data input

perform parallel simulations.

d. System flowcharts provide accurate descriptions of

input and output operations.

93. Mill Co. uses a batch processing method to process its sales

transactions. Data on Mill’s sales transaction tape are

electronically sorted by customer number and are subject to

programmed edit checks in preparing its invoices, sales

journals, and updated customer account balances. One of the

direct outputs of the creation of this tape most likely would be a

a. Report showing exceptions and control totals.

b. Printout of the updated inventory records.

c. Report showing overdue accounts receivable.

d. Printout of the sales price master file.

94. Using microcomputers in auditing may affect the methods used

to review the work of staff assistants because

a. The audit field work standards for supervision may

differ.

b. Documenting the supervisory review may require

assistance of consulting services personnel.

c. Supervisory personnel may not have an

understanding of the capabilities and limitations of

microcomputers.

d. Working paper documentation may not contain

readily observable details of calculations.

95. An auditor anticipates assessing control risk at a low level in a

computerized environment. Under these circumstances, on

which of the following procedures would the auditor initially

focus?

a. Programmed control procedures

b. Output control procedures

c. Application control procedures

d. General control procedures

96. After the preliminary phase of the review of a client’s EDP

controls, an auditor may decide not to perform tests of controls

(compliance tests) related to the control procedures within the

EDP portion of the client’s internal control structure. Which of

the following would not be a valid reason for choosing to omit

such tests?

a. The controls duplicate operative controls existing

elsewhere in the structure.

b. There appear to be major weaknesses that would

preclude reliance on the stated procedure.

c. The time and costs of testing exceed the time and

costs in substantive testing if the tests of controls

show the controls to be operative.

d. The controls appear adequate.

97. Which of the following client electronic data processing (EDP)

systems generally can be audited without examining or directly

testing the EDP computer programs of the system?

a. A system that performs relatively uncomplicated

processes and produces detailed output.

b. A system that affects a number of essential master

files and produces a limited output.

c. A system that updates a few essential master files

and produces no printed output other than final

balances.

d. A system that performs relatively complicated

processing and produces very little detailed output.

98. Computer systems are typically supported by a variety of utility

software packages that are important to an auditor because

they

a. May enable unauthorized changes to data files if not

properly controlled.

b. Are very versatile programs that can be used on

hardware of many manufacturers.

c. May be significant components of a client’s

application programs.

d. Are written specifically to enable auditors to extract

and sort data.

99. To obtain evidence that online access controls are properly

functioning, an auditor most likely would

a. Create checkpoints at periodic intervals after live

data processing to test for unauthorized use of the

system.

b. Examine the transaction log to discover whether any

transactions were lost or entered twice due to a

system malfunction

c. Enter invalid identification numbers or passwords to

ascertain whether the system rejects them.

d. Vouch a random sample of processed transactions to

assure proper authorization

100. Which of the following statements most likely represents a

disadvantage for an entity that keeps microcomputer-prepared

data files rather than manually prepared files?

a. Attention is focused on the accuracy of the

programming process rather than errors in individual

transactions.

b. It is usually easier for unauthorized persons to

access and alter the files.

c. Random error associated with processing similar

transactions in different ways is usually greater.

d. It is usually more difficult to compare recorded

accountability with physical count of assets.

101. An auditor would least likely use computer software to

a. Access client data files

b. Assess EDP controls

c. Prepare spreadsheets

d. Construct parallel simulations

102. A primary advantage of using generalized audit software

packages to audit the financial statements of a client that uses

an EDP system is that the auditor may

a. Consider increasing the use of substantive tests of

transactions in place of analytical procedures.

b. Substantiate the accuracy of data through self-

checking digits and hash totals.

c. Reduce the level of required tests of controls to a

relatively small amount.

d. Access information stored on computer files while

having a limited understanding of the client’s

hardware and software features.

103. Auditors often make use of computer programs that perform

routine processing functions such as sorting and merging.

These programs are made available by electronic data

processing companies and others and are specifically referred

to as

a. Compiler programs

b. Utility programs

c. Supervisory programs

d. User programs

104. Smith Corporation has numerous customers. A customer file is

kept on disk storage. Each customer file contains name,

address, credit limit, and account balance. The auditor wishes

to test this file to determine whether the credit limits are being

exceeded. The best procedure for the auditor to follow would

be to

a. Develop test data that would cause some account

balances to exceed the credit limit and determine if

the system properly detects such situations.

b. Develop a program to compare credit limits with

account balances and print out the details of any

account with a balance exceeding its credit limit.

c. Request a printout of all account balances so they

can be manually checked against the credit limits.

d. Request a printout of a sample of account balances

so they can be individually checked against the credit

limits.

105. The use of generalized audit software package

a. Relieves an auditor of the typical tasks of

investigating exceptions, verifying sources of

information, and evaluating reports.

b. Is a major aid in retrieving information from

computerized files.

c. Overcomes the need for an auditor to learn much

about computers.

d. Is a form of auditing around the computer.

106. An auditor used test data to verify the existence of controls in a

certain computer program. Even though the program

performed well on the test, the auditor may still have a concern

that

a. The program tested is the same one used in the

regular production runs.

b. Generalized audit software may have been a better

tool to use.

c. Data entry procedures may change and render the

test useless.

d. The test data will not be relevant in subsequent audit

periods.

107. An auditor most likely would introduce test data into a

computerized payroll system to test internal controls related to

the

a. Existence of unclaimed payroll checks held by

supervisors.

b. Early cashing of payroll checks by employees.

c. Discovery of invalid employee I.D. numbers.

d. Proper approval of overtime by supervisors.

108. When an auditor tests a computerized accounting system,

which of the following is true of the test data approach?

a. Test data must consist of all possible valid and

invalid conditions.

b. The program tested is different from the program

used throughout the year by the client.

c. Several transactions of each type must be tested.

d. Test data are processed by the client’s computer

programs under the auditor’s control.

109. Which of the following statements is not true to the test data

approach when testing a computerized accounting system?

a. The test need consist of only those valid and invalid

conditions which interest the auditor

b. Only one transaction of each type need be tested.

c. The test data must consist of all possible valid and

invalid conditions.

d. Test data are processed by the client’s computer

programs under the auditor’s control.

110. Which of the following is not among the errors that an auditor

might include in the test data when auditing a client’s EDP

system?

a. Numeric characters in alphanumeric fields.

b. Authorized code.

c. Differences in description of units of measure.

d. Illogical entries in fields whose logic is tested by

programmed consistency checks.

111. An auditor who is testing EDP controls in a payroll system

would most likely use test data that contain conditions such as

a. Deductions not authorized by employees.

b. Overtime not approved by supervisors.

c. Time tickets with invalid job numbers.

d. Payroll checks with unauthorized signatures.

112. Auditing by testing the input and output of an EDP system

instead of the computer program itself will

a. Not detect program errors which do not show up in

the output sampled.

b. Detect all program errors, regardless of the nature of

the output.

c. Provide the auditor with the same type of evidence.

d. Not provide the auditor with confidence in the results

of the auditing procedures.

113. Which of the following computer-assisted auditing techniques

allows fictitious and real transactions to be processed together

without client operating personnel being aware of the testing

process?

a. Integrated test facility

b. Parallel simulation

c. Input controls matrix

d. Data entry monitor

114. Which of the following methods of testing application controls

utilizes a generalized audit software package prepared by the

auditors?

a. Parallel simulation

b. Test data approach

c. Integrated testing facility approach

d. Exception report tests

115. Misstatements in a batch computer system caused by incorrect

programs or data may not be detected immediately because

a. Errors in some transactions may cause rejection of

other transactions in the batch.

b. The identification of errors in input data typically is

not part of the program.

c. There are time delays in processing transactions in a

batch system.

d. The processing of transactions in a batch system is

not uniform.

116. Which of the following is not a characteristic of a batch

processed computer system?

a. The collection of like transactions which are sorted

and processed sequentially against a master file.

b. Keypunching of transactions, followed by machine

processing.

c. The production of numerous printouts.

d. The posting of a transaction, as it occurs, to several

files, without immediate printouts.

117. Where disk files are used, the grandfather-father-son updating

backup concept is relatively

118. difficult to implement because the

a. Location of information points on disks is an

extremely time consuming task.

b. Magnetic fields and other environmental factors

cause off-site storage to be impractical.

c. Information must be dumped in the form of hard copy

if it is to be reviewed before used in

d. Process of updating old records is destructive.

119. An auditor would most likely be concerned with which of the

following controls in a distributed data processing system?

a. Hardware controls

b. Access controls

c. Systems documentation controls

d. Disaster recovery controls

120. If a control total were computed on each of the following data

items, which would best be identified as a hash total for a

payroll EDP application?

a. Total debits and total credits

b. Department numbers

c. Net pay

d. Hours worked

121. Which of the following is a computer test made to ascertain

whether a given characteristic belongs to the group?

a. Parity check

b. Echo check

c. Validity check

d. Limit check

122. A control feature in an electronic data processing system

requires the central processing unit (CPU) to send signals to

the printer to activate the print mechanism for each character.

The print mechanism, just prior to printing, sends a signal back

to the CPU verifying that the proper print position has been

activated. This type of hardware control is referred to as

a. Echo check

b. Signal control

c. Validity control

d. Check digit control

123. Which of the following is an example of a check digit?

a. An agreement of the total number of employees to