Question 1

How could auditors determine if unauthorized program changes have been made?

Accepted Answer

A) By interviewing and making inquiries of the programming staff. 
B) By examining the systems design and programming documentation. 
C) By using a source code comparison program. 
D) By interviewing and making inquiries of recently terminated programming staff. 
A) By interviewing and making inquiries of the programming staff. 
B) By examining the systems design and programming documentation. 
C) By using a source code comparison program. 
D) By interviewing and making inquiries of recently terminated programming staff.

Question 2

An auditor creates a fictitious customer in the system and then creates several fictitious sales to the customer.The records are then tracked as they are processed by the system.The auditor is using

Accepted Answer

A) an integrated test facility. 
B) the snapshot technique. 
C) a system control audit review file. 
D) continuous and intermittent simulation. 
A) an integrated test facility. 
B) the snapshot technique. 
C) a system control audit review file. 
D) continuous and intermittent simulation.

Question 3

Using embedded audit modules to continuously monitor transactions,collect data on transactions with special audit significance,and store the data to later identify and investigate questionable transactions is an example of

Accepted Answer

A) integrated test facility. 
B) snapshot technique. 
C) system control audit review file. 
D) audit hooks. 
A) integrated test facility. 
B) snapshot technique. 
C) system control audit review file. 
D) audit hooks.

Question 4

When programmers are working with program code,they often employ utilities that are also used in auditing.For example,as program code evolves,it is often the case that blocks of code are superseded by other blocks of code.Blocks of code that are not executed by the program can be identified by

Accepted Answer

A) embedded audit modules. 
B) scanning routines. 
C) mapping programs. 
D) automated flow charting programs. 
A) embedded audit modules. 
B) scanning routines. 
C) mapping programs. 
D) automated flow charting programs.

Question 5

Which type of work listed below is not typical of internal auditors?

Accepted Answer

A) Operational and management audits. 
B) Information system audits. 
C) Financial statement audit. 
D) Financial audit of accounting records. 
A) Operational and management audits. 
B) Information system audits. 
C) Financial statement audit. 
D) Financial audit of accounting records.

Question 6

Describe how audit evidence can be collected.

Accepted Answer

Since the audit effort revolves around t

Question 7

The possibility that a material error will occur even though auditors are following audit procedures and using good judgment is referred to as

Accepted Answer

A) control risk. 
B) detection risk. 
C) inherent risk. 
D) investigating risk. 
A) control risk. 
B) detection risk. 
C) inherent risk. 
D) investigating risk.

Question 8

You are an internal auditor for Ron Burgandy Suits.The CEO has asked you to perform an audit of the program modifications process.Identify one procedure you might use to test controls surrounding the program modification process.

Accepted Answer

A) Review logical access control policies. 
B) Discuss modification policies with management, users, and systems personnel. 
C) Verify logical access controls are in effect for program changes. 
D) Separate development, test, and production versions of programs. 
A) Review logical access control policies. 
B) Discuss modification policies with management, users, and systems personnel. 
C) Verify logical access controls are in effect for program changes. 
D) Separate development, test, and production versions of programs.

Question 9

Auditors often use reperformance to test a company's internal control.

Accepted Answer

A) True 
 B)False

Question 10

In the ________ stage of an operational audit,the auditor measures the actual system against an ideal standard.

Accepted Answer

A) evidence collection 
B) evidence evaluation 
C) testing 
D) internal control 
A) evidence collection 
B) evidence evaluation 
C) testing 
D) internal control

Question 11

Define and give examples of embedded audit modules.

Accepted Answer

Embedded audit modules are segments of p

Question 12

The use of a secure file library and restrictions on physical access to data files are control procedures used together to prevent

Accepted Answer

A) an employee or outsider obtaining data about an important client. 
B) a data entry clerk from introducing data entry errors into the system. 
C) a computer operator from losing or corrupting files or data during transaction processing. 
D) programmers making unauthorized modifications to programs. 
A) an employee or outsider obtaining data about an important client. 
B) a data entry clerk from introducing data entry errors into the system. 
C) a computer operator from losing or corrupting files or data during transaction processing. 
D) programmers making unauthorized modifications to programs.

Question 13

When a control deficiency is identified,the auditor should inquire about

Accepted Answer

A) tests of controls. 
B) compensating controls. 
C) the feasibility of a systems review. 
D) materiality and inherent risk factors. 
A) tests of controls. 
B) compensating controls. 
C) the feasibility of a systems review. 
D) materiality and inherent risk factors.

Question 14

Which of the following is not an information systems audit test of controls?

Accepted Answer

A) Observe computer-site access procedures. 
B) Investigate how unauthorized access attempts are handled. 
C) Review logical access policies and procedures. 
D) Examine the results of disaster recovery plan simulations. 
A) Observe computer-site access procedures. 
B) Investigate how unauthorized access attempts are handled. 
C) Review logical access policies and procedures. 
D) Examine the results of disaster recovery plan simulations.

Question 15

What type of data does CAATS use to produce an auditing program?

Accepted Answer

A) Archived data. 
B) Backup data. 
C) Live data. 
D) A copy of live data. 
A) Archived data. 
B) Backup data. 
C) Live data. 
D) A copy of live data.

Question 16

Auditors have the ability to change detection risk.

Accepted Answer

A) True 
 B)False

Question 17

What is the purpose of an information systems audit?

Accepted Answer

A) To determine the inherent risk factors found in the system. 
B) To review and evaluate the internal controls that protect the system. 
C) To examine the reliability and integrity of accounting records. 
D) To examine whether resources have been used in an economical and efficient manner in keeping with organization goals and objectives. 
A) To determine the inherent risk factors found in the system. 
B) To review and evaluate the internal controls that protect the system. 
C) To examine the reliability and integrity of accounting records. 
D) To examine whether resources have been used in an economical and efficient manner in keeping with organization goals and objectives.

Question 18

Which auditing technique will not assist in determining if unauthorized programming changes have been made?

Accepted Answer

A) The use of a source code comparison program. 
B) The use of the reprocessing technique to compare program output. 
C) By interviewing and making inquiries of the programming staff. 
D) The use of parallel simulation to compare program output. 
A) The use of a source code comparison program. 
B) The use of the reprocessing technique to compare program output. 
C) By interviewing and making inquiries of the programming staff. 
D) The use of parallel simulation to compare program output.

Question 19

Auditing involves the

Accepted Answer

A) collection, review, and documentation of audit evidence. 
B) planning and verification of economic events. 
C) collection of audit evidence and approval of economic events. 
D) testing, documentation, and certification of audit evidence. 
A) collection, review, and documentation of audit evidence. 
B) planning and verification of economic events. 
C) collection of audit evidence and approval of economic events. 
D) testing, documentation, and certification of audit evidence.

Question 20

The information systems audit objective that pertains to having management's authorization and approval is known as

Accepted Answer

A) overall security. 
B) program development. 
C) program modifications. 
D) processing. 
A) overall security. 
B) program development. 
C) program modifications. 
D) processing.

Exam 11: Auditing Computer-Based Information Systems

How could auditors determine if unauthorized program changes have been made?

An auditor creates a fictitious customer in the system and then creates several fictitious sales to the customer.The records are then tracked as they are processed by the system.The auditor is using

Using embedded audit modules to continuously monitor transactions,collect data on transactions with special audit significance,and store the data to later identify and investigate questionable transactions is an example of

When programmers are working with program code,they often employ utilities that are also used in auditing.For example,as program code evolves,it is often the case that blocks of code are superseded by other blocks of code.Blocks of code that are not executed by the program can be identified by

Which type of work listed below is not typical of internal auditors?

Describe how audit evidence can be collected.

The possibility that a material error will occur even though auditors are following audit procedures and using good judgment is referred to as

You are an internal auditor for Ron Burgandy Suits.The CEO has asked you to perform an audit of the program modifications process.Identify one procedure you might use to test controls surrounding the program modification process.

Auditors often use reperformance to test a company's internal control.

In the ________ stage of an operational audit,the auditor measures the actual system against an ideal standard.

Define and give examples of embedded audit modules.

The use of a secure file library and restrictions on physical access to data files are control procedures used together to prevent

When a control deficiency is identified,the auditor should inquire about

Which of the following is not an information systems audit test of controls?

What type of data does CAATS use to produce an auditing program?

Auditors have the ability to change detection risk.

What is the purpose of an information systems audit?

Which auditing technique will not assist in determining if unauthorized programming changes have been made?

Auditing involves the

The information systems audit objective that pertains to having management's authorization and approval is known as

Conceptual Foundations of Accounting Information Systems

Overview of Transaction Processing and Enterprise Resource Planning Systems

Systems Documentation Techniques

Relational Databases

Computer Fraud

Computer Fraud and Abuse Techniques

Control and Accounting Information Systems

Controls for Information Security

Confidentiality and Privacy Controls

Processing Integrity and Availability Controls

The Revenue Cycle: Sales to Cash Collections

The Expenditure Cycle: Purchasing to Cash Disbursements

The Production Cycle

The Human Resources Management and Payroll Cycle

General Ledger and Reporting System

Database Design Using the Rea Data Model

Implementing an Rea Model in a Relational Database

Special Topics in Rea Modeling

Introduction to Systems Development and Systems Analysis

Ais Development Strategies

Systems Design, implementation, and Operation

Filters