1.
Which of the following client computer systems generally can be audited without examining or
directly testing computer programs of the system?
A) A system that performs relatively uncomplicated processes and produces detailed output.
B) A system that affects a number of essential master files and produces a limited output.
C) A system that updates a few essential master files and produces no printed output other than
final balances.
D) A system that performs relatively complicated processing and produces very little detailed
output.
A) A system that performs relatively uncomplicated processes and produces detailed output.
2. An auditor may decide not to perform tests of controls related to the computer portion of the
client's controls. Which of the following would not be a valid reason for choosing to omit tests of
controls?
A) The controls appear adequate.
B) The controls duplicate operative controls existing elsewhere in the system.
C) There appear to be major conditions that would preclude reliance on the stated procedure.
D) The time and dollar costs of testing exceed the time and dollar savings in substantive testing
if the tests of controls show the controls to be operative.
A) The controls appear adequate.
3. When companies use information technology (IT) extensively, evidence may be available only in
electronic form. What is an auditor's best course of action in such situations?
A) Assess the control risk as high.
B) Use audit software to perform analytical procedures.
C) Use generalized audit software to extract evidence from client databases.
D) Perform limited tests of controls over electronic data.
C) Use generalized audit software to extract evidence from client databases.
4. Which of the following is an advantage of using a value-added network for EDI transactions?
A) Making corroborative inquiries.
B) Observing the separation of duties of personnel.
C) Reviewing transactions submitted for processing and comparing them to related output.
D) Reviewing the run manual.
C) Reviewing transactions submitted for processing and comparing them to related output.
5. Auditing by testing the input and output of a computer system instead of the computer program
itself will
A) Not detect program errors which do not show up in the output sampled.
B) Detect all program errors, regardless of the nature of the output.
C) Provide the auditor with the same type of evidence.
D) Not provide the auditor with confidence in the results of the auditing procedures.
A) Not detect program errors which do not show up in the output sampled.
6. Smith Corporation has numerous customers. A customer file is kept on disk storage. Each
customer file contains name, address, credit limit, and account balance. The auditor wishes to
test this file to determine whether credit limits are being exceeded. The best procedure for the
auditor to follow would be to
A) Develop test data that would cause some account balances to exceed the credit limit and
determine if the system properly detects such situations.
B) Develop a program to compare credit limits with account balances and print out the details of
any account with a balance exceeding its credit limit.
C) Request a printout of all account balances so they can be manually checked against the credit
limits.
D) Request a printout of a sample of account balances so they can be individually checked
against the credit limits.
B) Develop a program to compare credit limits with account balances and print out the details of any
account with a balance exceeding its credit limit.
7. Which of the following is an advantage of generalized computer audit packages?
A) They are all written in one identical computer language.
B) They can be used for audits for clients that use differing computer equipment and file
formats.
C) They have reduced the need for the auditor to study input controls for computer-related
procedures.
D) Their use can be substituted for a relatively large part of the required tests of controls.
B) They can be used for audits for clients that use differing computer equipment and file formats.
8. An audit technique which involves actual analysis of the logic of a computer program's
processing routines is referred to as
A) Code review.
B) Comparison review.
C) Extended records.
D) Test data.
A) Code review.
9. In parallel simulation, actual client data are reprocessed using an auditor software program. An
advantage of using parallel simulation, instead of performing tests of controls without a
computer, is that
A) The test includes all types of transaction errors and exceptions that may be encountered.
B) The client's computer personnel do not know when the data are being tested.
C) There is no risk of creating potentially material errors in the client's data.
D) The size of the sample can be greatly expanded at relatively little additional cost.
D) The size of the sample can be greatly expanded at relatively little additional cost.
10. Which of the following is necessary to audit balances in an on-line EDP system in an
environment of destructive updating?
A) Periodic dumping of transaction files.
B) Year-end utilization audit hooks.
C) An integrated test facility.
D) A well-documented audit trail.
D) A well-documented audit trail.
11. In auditing through a computer, the test data method is used by auditors to test the
A) Accuracy of input data.
B) Validity of the output.
C) Procedures contained within the program.
D) Normalcy of distribution of test data.
C) Procedures contained within the program.
12. When an auditor tests the internal controls of a computerized accounting system, which of the
following is true of the test data approach?
A) Test data are coded to a dummy subsidiary so they can be extracted from the system under
actual operating conditions.
B) Test data programs need not be tailor-made by the auditor for each client's computer
applications.
C) Test data programs usually consist of all possible valid and invalid conditions regarding
compliance with internal controls.
D) Test data are processed with the client's computer and the results are compared with the
auditor's predetermined results.
D) Test data are processed with the client's computer and the results are compared with the auditor's
predetermined results.
13. A primary advantage of using generalized audit packages in the audit of an advanced computer
system is that it enables the auditor to
A) Substantiate the accuracy of data through self-checking digits and hash totals.
B) Utilize the speed and accuracy of the computer.
C) Verify the performance of machine operations which leave visible evidence of occurrence.
D) Gather and store large quantities of supportive audit evidence in machine readable form.
B) Utilize the speed and accuracy of the computer.
14. When an auditor tests a computerized accounting system, which of the following is true of the
test data approach?
A) Test data should consist of all possible valid and invalid conditions.
B) The program tested is different from the program used throughout the year by the client.
C) Several transactions of each type should be tested.
D) Test data are processed by the client's computer programs under the auditor's control.
D) Test data are processed by the client's computer programs under the auditor's control.
15. The individual with whom an auditor would be most likely to discuss specific access controls
within a client's relational database management system is the
A) Database administrator.
B) Controller.
C) Systems analyst.
D) Systems librarian.
A) Database administrator.
16. Which of the following is not a problem associated with the use of test data for computer-audit
purposes?
A) Auditing through the computer is more difficult than auditing around the computer.
B) It is difficult to design test data that incorporate all potential variations in transactions.
C) Test data may be commingled with live data causing operating problems for the client.
D) The program with which the test data are processed may differ from the one used in actual
operations.
A) Auditing through the computer is more difficult than auditing around the computer.
17. Which of the following could be difficult to determine because electronic evidence may not be
retrievable after a specific period?
A) The acceptance level of detection risk.
B) The timing of control and substantive tests.
C) Whether to adopt substantive or reliance test strategies.
D) The assessed level of inherent risk.
B) The timing of control and substantive tests.
18. A primary advantage of using generalized audit software packages to audit the financial
statements of a client that uses a computer system is that the auditor may
A) Consider increasing the use of substantive tests of transactions in place of analytical
procedures.
B) Substantiate the accuracy of data through self-checking digits and hash totals.
C) Reduce the level of required tests of controls to a relatively small amount.
D) Access information stored on computer files while having a limited understanding of the
client's hardware and software features.
D) Access information stored on computer files while having a limited understanding of the client's
hardware and software features.
19. An auditor anticipates assessing control risk at a low level in a computerized environment.
Under these circumstances, on which of the following controls would the auditor initially focus?
A) Programmed controls.
B) Application controls.
C) Output controls.
D) General controls.
D) General controls.
20. Which of the following outcomes is a likely benefit of information technology used for internal
control?
A) Processing of unusual or nonrecurring transactions.
B) Enhanced timeliness of information.
C) Potential loss of data.
D) Recording of unauthorized transactions.
B) Enhanced timeliness of information.
21. To obtain evidence that user identification and password controls are functioning as designed,
an auditor would most likely
A) Review the online transaction log to ascertain whether employees using passwords have
access to data files and computer programs.
B) Examine a sample of assigned passwords and access authority to determine whether
password holders have access authority incompatible with their other responsibilities.
C) Extract a random sample of processed transactions and ensure that transactions are
appropriately authorized.
D) Observe the file librarian's activities to discover whether other systems personnel are
permitted to operate computer equipment without restriction.
B) Examine a sample of assigned passwords and access authority to determine whether password
holders have access authority incompatible with their other responsibilities.
22. When conducting fieldwork for a physical inventory, an auditor cannot perform which of the
following steps using a generalized audit software package?
A) Observing inventory.
B) Selecting sample items of inventory.
C) Analyzing data resulting from inventory.
D) Recalculating balances in inventory reports.
A) Observing inventory.
23. In auditing an entity's computerized payroll transactions, an auditor would be least likely to use
test data to test controls concerning
A) Overpayment of employees for hours not worked.
B) Control and distribution of unclaimed checks.
C) Withholding of taxes and Social Security contributions.
D) Missing employee identification numbers.
B) Control and distribution of unclaimed checks.
24. Which of the following is not a major reason for maintaining an audit trail for a computer
system?
A) Deterrent to irregularities.
B) Monitoring purposes.
C) Analytical procedures.
D) Query answering.
C) Analytical procedures.
25. When testing a computerized accounting system, which of the following is not true of the test
data approach?
A) The test data need consist of only those valid and invalid conditions in which the auditor is
interested.
B) Only one transaction of each type need be tested.
C) Test data are processed by the client's computer programs under the auditor's control.
D) The test data should consist of all possible valid and invalid conditions.
D) The test data should consist of all possible valid and invalid conditions.
26. Which of the following is not a technique to continuously test controls within a computer
system?
A) Controlled reprocessing.
B) Extended records.
C) Systems control audit review files.
D) Transaction tagging.
A) Controlled reprocessing.
27. Which of the following is a computer-assisted audit technique that permits an auditor to use the
auditor's version of a client's program to process data and compare the output with the client's
output?
A) Test data module.
B) Frame relay protocol.
C) Remote node router.
D) Parallel simulation.
D) Parallel simulation.
28. Carmel Department Store has an ERP information system and is planning to issue credit cards to
creditworthy customers. To strengthen internal control by making it difficult for one to create a
valid customer account number, the company's independent auditor has suggested the
inclusion of a check digit which should be placed
A) At the beginning of a valid account number only.
B) In the middle of a valid account number only.
C) At the end of a valid account number only.
D) Consistently in any position
D) Consistently in any position
29. An independent auditor studies and evaluates a client's computer system. The auditor's study
includes tests of controls that might include which of the following?
A) Examination of systems flowcharts to determine whether they reflect the current status of
the system.
B) Examination of the systems manuals to determine whether existing procedures are
satisfactory.
C) Examination of the machine room log book to determine whether control information is
properly recorded.
D) Examination of organization charts to determine whether electronic data processing
department responsibilities are properly separated to afford effective control.
C) Examination of the machine room log book to determine whether control information is properly
recorded.
30. In which of the following circumstances would an auditor expect to find that an entity
implemented automated controls to reduce risks of misstatement?
A) When errors are difficult to predict.
B) When misstatements are difficult to define.
C) When large, unusual, or nonrecurring transactions require judgment.
D) When transactions are high-volume and recurring.
D) When transactions are high-volume and recurring.
31. A computer-assisted audit technique that is most likely to be effective in a continuous auditing
environment is
A) Parallel simulation.
B) Controlled reprocessing.
C) Embedded audit modules.
D) Transaction tripping.
C) Embedded audit modules.