Auditing In Cis

Front 1

Which statement is incorrect when auditing in a CIS environment?

Back 1

a.    A CIS environment exists when a computer of any type or size is involved in the processing by the entity of financial information of significance to the audit, whether that computer is operated by the entity or by a third party.
b.    The auditor should consider how a CIS environment affects the audit.
c.    The use of a computer changes the processing, storage and communication of financial information and may affect the accounting and internal control systems employed by the entity.
d.    A CIS environment changes the overall objective and scope of an audit.

Hint 1

d

Front 2

Which of the following standards or group of standards is mostly affected by a computerized information system environment?

Back 2

a. General standards
b. Reporting standards
c. Second standard of field work 
d. Standards of fieldwork

Hint 2

d

Front 3

Which of the following is least considered if the auditor has to determine whether specialized CIS skills are needed in an audit?

Back 3

a. The auditor needs to obtain a sufficient understanding of the accounting and internal control system affected by the CIS environment.
b. The auditor needs to determine the effect of the CIS environment on the assessment of overall risk and of risk at the account balance and class of transactions level.
c. Design and perform appropriate tests of controls and substantive procedures.
d. The need of the auditor to make analytical procedures during the completion stage of audit.

Hint 3

d

Front 4

Which of the following least likely indicates a complexity of computer processing?

Back 4

a. Transactions are exchanged electronically with other organizations without manual review of their propriety.
b. The volume of the transactions is such that users would find it difficult to identify and correct errors in processing.
c. The computer automatically generates material transactions or entries directly to another applications.
d. The system generates a daily exception report.

Hint 4

d

Front 5

It relates to materiality of the financial statement assertions affected by the computer processing.

Back 5

Significance

Front 6

The nature of the risks and the internal characteristics in CIS environment that the auditors are mostly concerned include the following except:

Back 6

a. Lack of segregation of functions.
b. Lack of transaction trails.
c. Dependence of other control over computer processing.
d. Cost-benefit ratio.

Hint 6

d

Front 7

Which of the following is least likely a risk characteristic associated with CIS environment?

Back 7

a. Errors embedded in an application’s program logic maybe difficult to manually detect on a timely basis.
b. Many control procedures that would ordinarily be performed by separate individuals in manual system maybe concentrated in CIS.
c. The potential unauthorized access to data or to alter them without visible evidence maybe greater.
d. Initiation of changes in the master file is exclusively handled by respective users.

Hint 7

d

Front 8

Which of the following significance and complexity of the CIS activities should an auditor least understand?

Back 8

a. The organizational structure of the client’s CIS activities.
b. Lack of transaction trails.
c. The significance and complexity of computer processing in each significant accounting application.
d. The use of software packages instead of customized software.

Hint 8

d

Front 9

Which statement is correct regarding personal computer systems?

Back 9

a. Personal computers or PCs are economical yet powerful self-contained general purpose computers consisting typically of a central processing unit (CPU), memory, monitor, disk drives, printer cables and modems.
b. Programs and data are stored only on non-removable storage media.
c. Personal computers cannot be used to process accounting transactions and produce reports that are essential to the preparation of financial statements.
d. Generally, CIS environments in which personal computers are used are the same with other CIS environments.

Hint 9

a

Front 10

A personal computer can be used in various configurations, including

Back 10

a. A stand-alone workstation operated by a single user or a number of users at different times.
b. A workstation which is part of a local area network of personal computers.
c. A workstation connected to a server.
d. All of the above

Hint 10

d

Front 11

Which statement is incorrect regarding personal computer configurations?

Back 11

a. The stand-alone workstation can be operated by a single user or a number of users at different times accessing the same or different programs.
b. A stand-alone workstation may be referred to as a distributed system.
c. A local area network is an arrangement where two or more personal computers are linked together through the use of special software and communication lines.
d. Personal computers can be linked to servers and used as part of such systems, for example, as an intelligent on-line workstation or as part of a distributed accounting system.

Hint 11

b

Front 12

Which of the following is the least likely characteristic of personal computers?

Back 12

a.    They are small enough to be transportable.
b.    They are relatively expensive.
c.    They can be placed in operation quickly.
d.    The operating system software is less comprehensive than that found in larger computer environments

Hint 12

b

Front 13

Which of the following is an inherent characteristic of software package?

Back 13

a.    They are typically used without modifications of the programs.
b.    The programs are tailored-made according to the specific needs of the user.
c.    They are developed by software manufacturer according to a particular user’s specifications.
d.    It takes a longer time of implementation.

Hint 13

a

Front 14

Which of the following is not normally a removable storage media?

Back 14

a. Compact disk
b. Tapes
c. Diskettes   
d. Hard disk

Hint 14

d

Front 15

It is a computer program (a block of executable code) that attaches itself to a legitimate program or data file and uses its as a transport mechanism to reproduce itself without the knowledge of the user.

Back 15

Virus

Front 16

Which statement is incorrect regarding internal control in personal computer environment?

Back 16

a.    Generally, the CIS environment in which personal computers are used is less structured than a centrally-controlled CIS environment.
b.    Controls over the system development process and operations may not be viewed by the developer, the user or management as being as important or cost-effective.
c.    In almost all commercially available operating systems, the built-in security provided has gradually increased over the years.
d.    In a typical personal computer environment, the distinction between general CIS controls and CIS application controls is easily ascertained.

Hint 16

d

Front 17

Personal computers are susceptible to theft, physical damage, unauthorized access or misuse of equipment.  Which of the following is least likely a physical security to restrict access to personal computers when not in use?

Back 17

a.    Using door locks or other security protection during non-business hours.
b.    Fastening the personal computer to a table using security cables.
c.    Locking the personal computer in a protective cabinet or shell.
d.    Using anti-virus software programs.

Hint 17

d

Front 18

Which of the following is not likely a control over removable storage media to prevent misplacement, alteration without authorization or destruction?

Back 18

a.    Using cryptography, which is the process of transforming programs and information into an unintelligible form.
b.    Placing responsibility for such media under personnel whose responsibilities include duties of software custodians or librarians.
c.    Using a program and data file check-in and check-out system and locking the designated storage locations.
d.    Keeping current copies of diskettes, compact disks or back-up tapes and hard disks in a fireproof container, either on-site, off-site or both.

Hint 18

a

Front 19

Which of the following least likely protects critical and sensitive information from unauthorized access in a personal computer environment?

Back 19

a.
Using secret file names and hiding the files.
b. Keeping of back up copies offsite.
c. Employing passwords.
d. Segregating data into files organized under separate file directories.

Hint 19

b

Front 20

It refers to plans made by the entity to obtain access to comparable hardware, software and data in the event of their failure, loss or destruction.

Back 20

Back-up

Front 21

The effect of personal computers on the accounting system and the associated risks will least likely depend on

Back 21

a.    The extent to which the personal computer is being used to process accounting applications.
b.    The type and significance of financial transactions being processed.
c.    The nature of files and programs utilized in the applications.
d.    The cost of personal computers.

Hint 21

d

Front 22

The auditor may often assume that control risk is high in personal computer systems since , it may not be practicable or cost-effective for management to implement sufficient controls to reduce the risks of undetected errors to a minimum level.  This least likely entail

Back 22

a.    More physical examination and confirmation of assets.
b.    More analytical procedures than tests of details.
c.    Larger sample sizes.
d.    Greater use of computer-assisted audit techniques, where appropriate.

Hint 22

b

Front 23

computer system that enable users to access data and programs directly through workstations are referred to as

Back 23

On-line computer systems

Front 24

On-line systems allow users to initiate various functions directly.  Such functions include:
I.      Entering transactions
III.   Requesting report
II.    Making inquiries
IV.   Updating master files

Back 24

a.     I, II, III and IV
b.   I and II
c.     I, II and III
d.   I and IV

Hint 24

a

Front 25

Many different types of workstations may be used in on-line computer systems.  The functions performed by these workstations least likely depend on their

Back 25

a.   Logic
b.   Transmission                     c.   Storage
d.   Cost

Hint 25

d

Front 26

Types of workstations include General Purpose Terminals and Special Purpose Terminals.  Special Purpose Terminals include

Back 26

Point of sale devices

Front 27

Special Purpose Terminal used to initiate, validate, record, transmit and complete various banking transactions

Back 27

Automated teller machines

Front 28

Which statement is incorrect regarding workstations?

Back 28

a.    Workstations may be located either locally or at remote sites.
b.    Local workstations are connected directly to the computer through cables.
c.    Remote workstations require the use of telecommunications to link them to the computer.
d.    Workstations cannot be used by many users, for different purposes, in different locations, all at the same time.

Hint 28

d

Front 29

On-line computer systems may be classified according to

Back 29

a.    How information is entered into the system.
b.    How it is processed.
c.    When the results are available to the user.
d.    All of the above.

Hint 29

d

Front 30

In an on-line/real time processing system

Back 30

Individual transactions are entered at workstations, validated and used to update related computer files immediately.

Front 31

It combines on-line/real time processing and on-line/batch processing.

Back 31

On-Line/Memo Update (and Subsequent Processing)

Front 32

It is a communication system that enables computer users to share computer equipment, application software, data and voice and video transmissions.

Back 32

Network 

Front 33

A type of network that multiple buildings are close enough to create a campus, but the space between the buildings is not under the control of the company is

Back 33

Metropolitan Area Network (MAN)

Front 34

Which of the following is least likely a characteristic of Wide Area Network (WAN)?

Back 34

a.    Created to connect two or more geographically separated LANs.
b.    Typically involves one or more long-distance providers, such as a telephone company to provide the connections.
c.    WAN connections tend to be faster than LAN.
d.    Usually more expensive than LAN.

Hint 34

c

Front 35

Gateway is

Back 35

A hardware and software solution that enables communications between two dissimilar networking systems or protocols.

Front 36

A device that works to control the flow of data between two or more network segments

Back 36

Router

Front 37

The undesirable characteristics of on-line computer systems least likely include

Back 37

a.    Data are usually subjected to immediate validation checks.
b.    Unlimited access of users to all of the functions in a particular application.
c.    Possible lack of visible transaction trail.
d.    Potential programmer access to the system.

Hint 37

a

Front 38

Certain general CIS controls that are particularly important to on-line processing least likely include

Back 38

a.    Access controls.
b.    System development and maintenance controls.
c.    Edit, reasonableness and other validation tests.
d.    Use of anti-virus software program.

Hint 38

c

Front 39

Certain CIS application controls that are particularly important to on-line processing least likely include

Back 39

a.    Pre-processing authorization.
c.   Transaction logs.
b.    Cut-off procedures.
d.   Balancing.

Hint 39

c

Front 40

Risk of fraud or error in on-line systems may be reduced in the following circumstances, except

Back 40

a.    If on-line data entry is performed at or near the point where transactions originate, there is less risk that the transactions will not be recorded.
b.    If invalid transactions are corrected and re-entered immediately, there is less risk that such transactions will not be corrected and re-submitted on a timely basis.
c.    If data entry is performed on-line by individuals who understand the nature of the transactions involved, the data entry process may be less prone to errors than when it is performed by individuals unfamiliar with the nature of the transactions.
d.    On-line access to data and programs through telecommunications may provide greater opportunity for access to data and programs by unauthorized persons.

Hint 40

d

Front 41

The following matters are of particular importance to the auditor in an on-line computer system, except

Back 41

a.    Authorization, completeness and accuracy of on-line transactions.
b.    Integrity of records and processing, due to on-line access to the system by many users and programmers.
c.    Changes in the performance of audit procedures including the use of CAAT's.
d.    Cost-benefit ratio of installing on-line computer system.

Hint 41

d

Front 42

A collection of data that is shared and used by a number of different users for different purposes

Back 42

Database  

Front 43

Which of the following is least likely a characteristic of a database system?

Back 43

a.    Individual applications share the data in the database for different purposes.
b.    Separate data files are maintained for each application and similar data used by several applications may be repeated on several different files.
c.    A software facility is required to keep track of the location of the data in the database.
d.    Coordination is usually performed by a group of individuals whose responsibility is typically referred to as "database administration."

Hint 43

b

Front 44

Database administration tasks typically include
I.      Defining the database structure.
II.    Maintaining data integrity, security and completeness.
III.   Coordinating computer operations related to the database.
IV.  Monitoring system performance.
V.    Providing administrative support.

Back 44

a.   All of the above
b.   All except I
c.   II and V only
d.   II, III and V only

Hint 44

a

Front 45

Due to data sharing, data independence and other characteristics of database systems

Back 45

General CIS controls normally have a greater influence than CIS application controls on database systems.

Front 46

Which statement is incorrect regarding the general CIS controls of particular importance in a database environment?

Back 46

a.    Since data are shared by many users, control may be enhanced when a standard approach is used for developing each new application program and for application program modification.
b.    Several data owners should be assigned responsibility for defining access and security rules, such as who can use the data (access) and what functions they can perform (security).
c.    User access to the database can be restricted through the use of passwords.
d.    Responsibilities for performing the various activities required to design, implement and operate a database are divided among technical, design, administrative and user personnel.

Hint 46

b

Front 47

These require a database administrator to assign security attributes to data that cannot be changed by database users.

Back 47

Mandatory access controls       

Front 48

A discretionary access control wherein users are permitted or denied access to data resource depending on the time series of accesses to and actions they have undertaken on data resources.

Back 48

History-dependent restriction

Front 49

The effect of a database system on the accounting system and the associated risks will least likely depend on:

Back 49

a.    The extent to which databases are being used by accounting applications.
b.    The type and significance of financial transactions being processed.
c.    The nature of the database, the DBMS, the database administration tasks and the applications.
d.    The CIS application controls.

Hint 49

d

Front 50

Audit procedures in a database environment will be affected principally by

Back 50

a.    The extent to which the data in the database are used by the accounting system.
b.    The type and significance of financial transactions being processed.
c.    The nature of the database, the DBMS, the database administration tasks and the applications.
d.    The general CIS controls which are particularly important in a database environment.

Hint 50

a

Front 51

Which statement is incorrect regarding the characteristics of a CIS organizational structure?

Back 51

a.    Certain data processing personnel may be the only ones with a detailed knowledge of the interrelationship between the source of data, how it is processed and the distribution and use of the output.
b.    Many conventional controls based on adequate segregation of incompatible functions may not exist, or in the absence of access and other controls, may be less effective.
c.    Transaction and master file data are often concentrated, usually in machine-readable form, either in one computer installation located centrally or in a number of installations distributed throughout an entity.
d.    Systems employing CIS methods do not include manual operations since the number of persons involved in the processing of financial information is significantly reduced.

Hint 51

d

Front 52

System characteristics that may result from the nature of CIS processing include, except

Back 52

a.    Absence of input documents.
b.    Lack of visible transaction trail.         
c.    Lack of visible output.
d.    Difficulty of access to data and computer programs.

Hint 52

d

Front 53

The development of CIS will generally result in design and procedural characteristics that are different from those found in manual systems.  These different design and procedural aspects of CIS include, except:

Back 53

a.    Consistency of performance.
b.    Programmed control procedures.
c.    Vulnerability of data and program storage media
d.    Multiple transaction update of multiple computer files or databases.

Hint 53

d

Front 54

Which statement is incorrect regarding internal controls in a CIS environment?

Back 54

a.    Manual and computer control procedures comprise the overall controls affecting the CIS environment (general CIS controls) and the specific controls over the accounting applications (CIS application controls).
b.    The purpose of general CIS controls is to establish a framework of overall control over the CIS activities and to provide a reasonable level of assurance that the overall objectives of internal control are achieved.
c.    The purpose of CIS application controls is to establish specific control procedures over the application systems in order to provide reasonable assurance that all transactions are authorized and recorded, and are processed completely, accurately and on a timely basis.
d.    The internal controls over computer processing, which help to achieve the overall objectives of internal control, include only the procedures designed into computer programs.

Hint 54

d

Front 55

General CIS controls may include, except:

Back 55

a.    Organization and management controls.
c.   Delivery and support controls.
b.    Development and maintenance controls.
d.   Controls over computer data files.

Hint 55

d

Front 56

CIS application controls include, except

Back 56

a.    Controls over input.
b.    Controls over processing and computer data files.
c.    Controls over output.
d.    Monitoring controls.

Hint 56

d

Front 57

Which statement is incorrect regarding the review of general CIS controls and CIS application controls?

Back 57

a.    The auditor should consider how these general CIS controls affect the CIS applications significant to the audit.
b.    General CIS controls that relate to some or all applications are typically interdependent controls in that their operation is often essential to the effectiveness of CIS application controls.
c.    Control over input, processing, data files and output may be carried out by CIS personnel, by users of the system, by a separate control group, or may be programmed into application software.
d.    It may be more efficient to review the design of the application controls before reviewing the general controls.

Hint 57

d

Front 58

Which statement is incorrect regarding the evaluation of general CIS controls and CIS application controls?

Back 58

a.    The general CIS controls may have a pervasive effect on the processing of transactions in application systems.
b.    If general CIS controls are not effective, there may be a risk that misstatements might occur and go undetected in the application systems.
c.    Manual procedures exercised by users may provide effective control at the application level.
d.    Weaknesses in general CIS controls cannot preclude testing certain CIS application controls.

Hint 58

d

Front 59

The applications of auditing procedures using the computer as an audit tool refer to

Back 59

a.   Integrated test facility                                      c.   Auditing through the computer
b.   Data-based management system
d.   Computer assisted audit techniques

Hint 59

d