Exam 12: The Impact of Information Technology on the Audit Process

In comparing (1)the adequacy of the hardware controls in the system with (2)the organization's methods of handling the errors that the computer identifies, the independent auditor is:

In an IT system, automated equipment controls or hardware controls are designed to:

Discuss the four areas of responsibility under the IT function that should be segregated in large companies.

Even in a less sophisticated IT environment, automated controls can often be relied on.

Programmers should be allowed access to:

An internal control deficiency occurs when computer personnel:

Controls that are designed for each software application and are intended to help a company satisfy the transaction-related audit objectives are:

The approach to auditing where the auditor does not test automated controls to reduce assessed control risk is called:

The embedded audit module approach requires the auditor to insert an audit module in the client's application system to to identify specific types of transactions.

"Auditing around the computer" is acceptable only if the auditor has access to the client's data in a machine-readable language.

Processing controls are a category of application controls.

Auditors often use Generalized Audit Software during their testing of a client's internal controls.For the following uses of the software provide a description and an example. Verify extensions and footings Print confirmation requests Compare data on separate files

The objective of the computer audit technique known as the test data approach is to determine whether the client's computer programs can correctly process valid and invalid transactions.

Parallel simulation is used primarily to test internal controls over the client's IT systems, whereas the test data approach is used primarily for substantive testing.

An auditor who is testing IT controls in a payroll system would most likely use test data that contain conditions such as:

IT controls are classified as either input controls or output controls.

In IT systems, if general controls are effective, it increases the auditor's ability to rely on application controls to reduce control risk.

When a client uses desktops and networked servers for the accounting functions, there is a risk of computer viruses.

"Auditing around the computer" is most appropriate when the client has not maintained detailed output or source documents in a form readable by humans.

Control risk may be reduced for a company with a complex IT system when compared to a company that relies primarily on manual controls.