Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank
Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank
Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank
Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank
Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank
1.
Accounting Information SystemsControls
Processes 3rd Edition Turner Test Bank pdf
download
https://testbankfan.com/product/accounting-information-systems-
controls-processes-3rd-edition-turner-test-bank/
2.
We believe theseproducts will be a great fit for you. Click
the link to download now, or visit testbankfan.com
to discover even more!
Accounting Information Systems Controls Processes 3rd
Edition Turner Solutions Manual
https://testbankfan.com/product/accounting-information-systems-
controls-processes-3rd-edition-turner-solutions-manual/
Accounting Information Systems The Processes Controls
2nd Edition Turner Solutions Manual
https://testbankfan.com/product/accounting-information-systems-
the-processes-controls-2nd-edition-turner-solutions-manual/
Accounting Information Systems The Processes and
Controls 2nd Edition Turner Test Bank
https://testbankfan.com/product/accounting-information-systems-
the-processes-and-controls-2nd-edition-turner-test-bank/
Social Problems 3rd Edition Best Test Bank
https://testbankfan.com/product/social-problems-3rd-edition-best-
test-bank/
3.
Simulation Modeling andAnalysis 5th Edition Law
Solutions Manual
https://testbankfan.com/product/simulation-modeling-and-
analysis-5th-edition-law-solutions-manual/
Microeconomic Theory Basic Principles and Extensions
12th Edition Nicholson Solutions Manual
https://testbankfan.com/product/microeconomic-theory-basic-
principles-and-extensions-12th-edition-nicholson-solutions-
manual/
Principles and Practice of Radiation Therapy 4th
Edition Washington Test Bank
https://testbankfan.com/product/principles-and-practice-of-
radiation-therapy-4th-edition-washington-test-bank/
Management Australia 7th Edition Stagg Test Bank
https://testbankfan.com/product/management-australia-7th-edition-
stagg-test-bank/
Organizational Communication Balancing Creativity and
Constraint 8th Edition Eisenberg Solutions Manual
https://testbankfan.com/product/organizational-communication-
balancing-creativity-and-constraint-8th-edition-eisenberg-
solutions-manual/
4.
Employment and LaborLaw 9th Edition Cihon Solutions
Manual
https://testbankfan.com/product/employment-and-labor-law-9th-
edition-cihon-solutions-manual/
5.
Ch 7 Testbank – 3e Page 1 of 32
ACCOUNTING INFORMATION SYSTEMS/3e
TURNER / WEICKGENANNT/COPELAND
Test Bank: CHAPTER 7: Auditing Information Technology – Bases Processes
NOTE: All new or adjusted questions are in red. New questions are identified by the letter A as part of
the question number; adjusted questions are identified by the letter X as part of the question number.
End of Chapter Questions:
1. Which of the following types of audits is most likely to be conducted for the purpose of
identifying areas for cost savings?
A. Financial Statement Audits
B. Operational Audits
C. Regulatory Audits
D. Compliance Audits
2. Financial statement audits are required to be performed by:
A. Governmental Auditors
B. CPAs
C. Internal Auditors
D. IT Auditors
3. Which of the following is not considered a cause for information risk?
A. Management’s geographic location is far from the source of the information needed to
make effective decisions.
B. The information is collected and prepared by persons who use the information for very
different purposes.
C. The information relates to business activities that are not well understood by those who
collect and summarize the information for decision makers.
D. The information has been tested by internal auditors and a CPA firm.
4. Which of the following is not a part of general accepted auditing standards?
A. General Standards
B. Standards of Fieldwork
C. Standards of Information Systems
D. Standards of Reporting
5. Which of the following best describes what is meant by the term “generally accepted auditing
standards”?
A. Procedures used to gather evidence to support the accuracy of a client’s financial
statements.
B. Measures of the quality of an auditor’s conduct carrying out professional responsibilities.
C. Professional pronouncements issued by the Auditing Standards Board.
D. Rules acknowledged by the accounting profession because of their widespread application.
6.
Ch 7 Testbank – 3e Page 2 of 32
6. In an audit of financial statement in accordance with generally accepted auditing standards, an
auditor is required to:
A. Document the auditor’s understanding of the client company’s internal controls.
B. Search for weaknesses in the operation of the client company’s internal controls.
C. Perform tests of controls to evaluate the effectiveness of the client company’s internal
controls.
D. Determine whether controls are appropriately operating to prevent or detect material
misstatements.
7. Auditors should develop a written audit program so that:
A. All material transactions will be included in substantive testing.
B. Substantive testing performed prior to year end will be minimized.
C. The procedures will achieve specific audit objectives related to specific management
assertions.
D. Each account balance will be tested under either a substantive test or a test of controls.
8. Which of the following audit objectives relates to the management assertion of existence?
A. A transaction is recorded in the proper period.
B. A transaction actually occurred (i.e., it is real)
C. A transaction is properly presented in the financial statements.
D. A transaction is supported by detailed evidence.
9. Which of the following statements regarding an audit program is true?
A. An audit program should be standardized so that it may be used on any client engagement.
B. The audit program should be completed by the client company before the audit planning
stage begins.
C. An audit program should be developed by the internal auditor during the audit’s
completion/reporting phase.
D. An audit program establishes responsibility for each audit test by requiring the signature
or initials of the auditor who performed the test.
10. Risk assessment is a process designed to:
A. Identify possible circumstances and events that may affect the business.
B. Establish policies and procedures to carry out internal controls.
C. Identify and capture information in a timely manner.
D. Review the quality of internal controls throughout the year.
11. Which of the following audit procedures is most likely to be performed during the planning
phase of the audit?
A. Obtain an understanding of the client’s risk assessment process.
B. Identify specific internal control activities that are designed to prevent fraud.
C. Evaluate the reasonableness of the client’s accounting estimates.
D. Test the timely cutoff of cash payments and collections.
7.
Ch 7 Testbank – 3e Page 3 of 32
12. Which of the following is the most significant disadvantage of auditing around the computer
rather than through the computer?
A. The time involved in testing processing controls is significant.
B. The cost involved in testing processing controls is significant.
C. A portion of the audit trail is not tested.
D. The technical expertise required to test processing controls is extensive.
13. The primary objective of compliance testing in a financial statement audit is to determine
whether:
A. Procedures have been updated regularly.
B. Financial statement amounts are accurately stated.
C. Internal controls are functioning as designed.
D. Collusion is taking place.
14. Which of the following computer assisted auditing techniques processes actual client input data
(or a copy of the real data) on a controlled program under the auditor’s control to periodically
test controls in the client’s computer system?
A. Test data method
B. Embedded audit module
C. Integrated test facility
D. Parallel simulation
15. Which of the following computer assisted auditing techniques allows fictitious and real
transactions to be processed together without client personnel being aware of the testing
process?
A. Test data method
B. Embedded audit module
C. Integrated test facility
D. Parallel simulation
16. Which of the following is a general control to test for external access to a client’s computerized
systems?
A. Penetration tests
B. Hash totals
C. Field checks
D. Program tracing
17. Suppose that during the planning phase of an audit, the auditor determines that weaknesses
exist in the client’s computerized systems. These weaknesses make the client company
susceptible to the risk of an unauthorized break-in. Which type of audit procedures should be
emphasized in the remaining phases of this audit?
A. Tests of controls
B. Penetration tests
C. Substantive tests
D. Rounding errors tests
8.
Ch 7 Testbank – 3e Page 4 of 32
18. Generalized audit software can be used to:
A. Examine the consistency of data maintained on computer files.
B. Perform audit tests of multiple computer files concurrently.
C. Verify the processing logic of operating system software.
D. Process test data against master files that contain both real and fictitious data.
19. Independent auditors are generally actively involved in each of the following tasks except:
A. Preparation of a client’s financial statements and accompanying notes.
B. Advising client management as to the applicability of a new accounting standard.
C. Proposing adjustments to a client’s financial statements.
D. Advising client management about the presentation of the financial statements.
20. Which of the following is most likely to be an attribute unique to the financial statement audit
work of CPAs, compared with work performed by attorneys or practitioners of other business
professions?
A. Due professional care
B. Competence
C. Independence
D. A complex underlying body of professional knowledge
21. Which of the following terms in not associated with a financial statement auditor’s requirement
to maintain independence?
A. Objectivity
B. Neutrality
C. Professional Skepticism
D. Competence
TEST BANK - CHAPTER 7 - MULTIPLE CHOICE
1. Accounting services that improve the quality of information provided to the decision maker, an
audit being the most common type of this service, is called:
A. Compliance Services
B. Assurance Services
C. Substantive Services
D. Operational Services
2. A type of assurance services that involves accumulating and analyzing support for the
information provided by management is called an:
A. Audit
B. Investigation
C. Financial Statement Examination
D. Control Test
3. The main purpose of an audit is to assure users of the financial information about the:
A. Effectiveness of the internal controls of the company.
B. Selection of the proper GAAP when preparing financial statements.
C. Proper application of GAAS during the examination.
D. Accuracy and completeness of the information.
9.
Ch 7 Testbank – 3e Page 5 of 32
4. Which of the following is not one of the three primary types of audits?
A. Compliance Audits
B. Financial Statement Audits
C. IT Audits
D. Operational Audits
5. This type of audit is completed in order to determine whether a company has adhered to the
regulations and policies established by contractual agreements, governmental agencies, or some
other high authority.
A. Compliance Audit
B. Operational Audit
C. Information Audit
D. Financial Statement Audit
6. This type of audit is completed to assess the operating policies and procedures of a client for
efficiency and effectiveness.
A. Efficiency Audit
B. Effectiveness Audit
C. Compliance Audit
D. Operational Audit
7. This type of audit is completed to determine whether or not the client has prepared and
presented its financial statements fairly, in accordance with established financial accounting
criteria.
A. GAAP Audit
B. Financial Statement Audit
C. Compliance Audit
D. Fair Application Audit
8. Financial statement audits are performed by _________ who have extensive knowledge of
generally accepted accounting principles (GAAP) in the US and/or International Financial
Reporting Standards (IFRS).
A. Public Auditors
B. Governmental Auditors
C. Certified Public Accountants
D. Internal Auditors
9. This type of auditor is an employee of the company he / she audits.
A. IT Auditor
B. Government Auditor
C. Certified Public Accountant
D. Internal Auditor
10.
Ch 7 Testbank – 3e Page 6 of 32
10. This type of auditor specializes in the information systems assurance, control, and security.
They may work for CPA firms, government agencies, or with the internal audit group.
A. IT Auditor
B. Government Auditor
C. Certified Public Accountant
D. Internal Auditor
11. This type of auditor conducts audits of government agencies or income tax returns.
A. IT Auditor
B. Government Auditor
C. Certified Public Accountant
D. Internal Auditor
12. An important requirement of CPA firms is that they must be ________ with regard to the
company being audited. The requirement allows CPA firms to provide a completely unbiased
opinion on the information it audits.
A. Neutral
B. Well-informed
C. Materially invested
D. All of the above
13. This type of audit is performed by independent auditors who are objective and neutral with
respect to the company and the information being audited.
A. Compliance Audit
B. Operational Audit
C. Internal Audit
D. External Audit
14. Which of the following scenarios does NOT impair the independence of a CPA firm from its
client?
A. The lead audit partner is the sister-in-law of the client’s VP of Accounting
B. One of the auditors owns stock in a competitor of the client
C. One of the auditors is the golf partner of the client’s CEO
D. The lead audit partner owns stock in the client
15. The independence of a CPA could be impaired by:
A. Having no knowledge of the company or the company management
B. By owning stock of a similar company
C. Having the ability to influence the client’s decisions
D. Being married to a stockbroker
11.
Ch 7 Testbank – 3e Page 7 of 32
16. Decision makers are typically forced to rely on others for information. When the source of the
information is removed from the decision maker, the information stands a greater chance of
being misstated. A decision maker may become detached from the source of information due
to geography, organizational layers, or other factors. This describes which cause of information
risk?
A. The lack of CPA independence
B. The volume and complexity of underlying data
C. The motive of the preparer
D. The remoteness of information
17. The IT environment plays a key role in how auditors conduct their work in all but which of the
following areas:
A. Consideration of Risk
B. Consideration of Information Fairness
C. Design and Performance of Audit Tests
D. Audit Procedures Used
18. The chance that information used by decision makers may be inaccurate is referred to as:
A. Sample Risk
B. Data Risk
C. Audit Trail Risk
D. Information Risk
19. Which of the following is not one of the identified causes of information risk?
A. Audited information
B. Remote information
C. Complexity of data
D. Preparer motive
20. The main reasons that it is necessary to study information-based processing and the related
audit function include:
A. Information users often do not have the time or ability to verify information themselves.
B. It may be difficult for decision makers to verify information contained in a computerized
accounting system.
C. Both of the above.
D. Neither of the above.
21. The existence of IT-based business processes often result in details of transactions being
entered directly into the computer system, results in a lack of physical evidence to visibly view.
This situation is referred to as:
A. Physical Evidence Risk
B. Loss of Audit Trail Visibility
C. Transaction Summary Chart
D. Lack of Evidence View
12.
Ch 7 Testbank – 3e Page 8 of 32
22. The existence of IT-based business processes, that result in the details of the transactions being
entered directly into the computer system, increases the likelihood of the loss or alternation of
data due to all of the following, except:
A. System Failure
B. Database Destruction
C. Programmer Incompetence
D. Environmental Damage
23. The advantages of using IT-based accounting systems, where the details of transactions are
entered directly into the computer include:
A. Computer controls can compensate for the lack of manual controls
B. Loss of audit trail view
C. Increased internal controls risks
D. Fewer opportunities to authorize and review transactions
24. The ten standards that provide broad guidelines for an auditor’s professional responsibilities are
referred to as:
A. Generally accepted accounting standards
B. General accounting and auditing practices
C. Generally accepted auditing practices
D. Generally accepted auditing standards
25. The generally accepted auditing standards are divided into three groups. Which of the following
is not one of those groups?
A. General Standards
B. Basic Standards
C. Standards of Fieldwork
D. Standards of Reporting
26. GAAS, generally accepted auditing standards, provide a general framework for conducting
quality audits, but the specific standards - or detailed guidance - are provided by all of the
following groups, except:
A. Public Company Accounting Oversight Board
B. Auditing Standards Board
C. Certified Fraud Examiners
D. International Auditing and Assurance Standards Board
27. This organization, established by the Sarbanes-Oxley Act, was organized in 2003 for the purpose
of establishing auditing standards for public companies.
A. Auditing Standards Board
B. Public Company Accounting Oversight Board
C. International Audit Practices Committee
D. Information Systems Audit and Control Association
13.
Ch 7 Testbank – 3e Page 9 of 32
28. This organization is part of the AICPA and was the group responsible for issuing Statements on
Auditing Standards which were historically widely used in practice.
A. Auditing Standards Board
B. Public Company Accounting Oversight Board
C. International Audit Practices Committee
D. Information Systems Audit and Control Association
29. This organization was established by the IFAC to set International Standards on Auditing (ISAs)
that contribute to the uniform application of auditing practices on a worldwide basis.
A. International Systems Audit and Control Association
B. Auditing Standards Board
C. Public Company Accounting Oversight Board
D. International Auditing and Assurance Standards Board (IAASB)
30. This organization issues guidelines for conducting the IT audit. The standards issued address
practices related to control and security of the IT system.
A. Auditing Standards Board
B. Public Company Accounting Oversight Board
C. International Audit Practices Committee
D. Information Systems Audit and Control Association
31. The audit is to be performed by a person or persons having adequate technical training and
proficiency as an auditor. This is one of the generally accepted auditing standards that is part of
the:
A. General Standards
B. Operating Standards
C. Fieldwork Standards
D. Reporting Standards
32. Independence in mental attitude is to be maintained in all matters related to the audit
engagement. This is one of the generally accepted auditing standards that is part of the:
A. General Standards
B. Operating Standards
C. Fieldwork Standards
D. Reporting Standards
33. The general guidelines, known as the generally accepted auditing standards, which include the
concepts of adequate planning and supervision, internal control, and evidence relate to the:
A. General Standards
B. Operating Standards
C. Fieldwork Standards
D. Reporting Standards
14.
Ch 7 Testbank – 3e Page 10 of 32
34. The general guidelines, known as the generally accepted auditing standards, which include the
concepts of presentation in accordance with the established criteria, the consistent application
of established principles, adequate disclosure, and the expression of an opinion, relate to the:
A. General Standards
B. Operating Standards
C. Fieldwork Standards
D. Reporting Standards
35. The role of the auditors is to analyze the underlying facts to decide whether information
provided by management is fairly presented. Auditors design ____1_____ to analyze
information in order to determine whether ____2_____ is/are valid.
A. 1=audit objectives; 2=management’s assertions
B. 1=audit tests; 2=audit objectives
C. 1=audit tests; 2=audit evidence
D. 1=audit tests; 2=management’s assertions
36. Although there are a number of organizations that provide detailed guidance, it is still necessary
for auditors to rely on other direction regarding the types of audit tests to use and the manner
in which the conclusions are drawn. These sources of information include:
A. Industry Guidelines
B. PCAOB
C. ASB
D. ASACA
37. Claims regarding the condition of the business organization and in terms of its operations,
financial results, and compliance with laws and regulations, are referred to as:
A. Financial Statements
B. Management Assertions
C. External Audit
D. Presentation and Disclosure
38. Which management assertion determines that transactions and related asset accounts balances
are actually owned and that liability account balances represent actual obligations?
A. Valuation and Allocation
B. Existence
C. Rights and Obligations
D. Classification and Presentation
39. Audit tests developed for an audit client are documented in a(n):
A. Audit Program
B. Audit Objective
C. Management Assertion
D. General Objectives
15.
Ch 7 Testbank – 3e Page 11 of 32
40. The management assertion related to valuation of transactions and account balances would
include all of the following, except:
A. Accurate in terms of dollar amounts and quantities
B. Supported by detailed evidence
C. Real
D. Correctly summarized
41. There are four primary phases of the IT audit. Which of the following is not one of those phases?
A. Planning
B. Evidence Audit
C. Tests of Controls
D. Substantive Tests
42. The main difference between substantive testing and controls testing is:
A. Substantive testing verifies whether information is correct, whereas control tests
determine whether the information is managed under a system that promotes
correctness.
B. Substantive testing determines whether the information is managed under a system that
promotes correctness, whereas Control testing verifies whether information is correct.
C. Substantive testing goes further in depth into the internal controls of a company, whereas
controls testing just identifies which controls need further review.
D. Substantive testing identifies which controls need further review, whereas controls testing
goes further in depth into the internal controls of a company.
43. During substantive testing, if material misstatements have been found to exist, which of the
following actions should be taken next?
A. Proceed to the audit completion in the reporting phase
B. Re-evaluate the audit risk in the planning phase
C. Re-perform detailed tests of balances
D. Re-perform an internal controls systems analysis
44. The proof of the fairness of the financial information is:
A. Tests of Controls
B. Substantive Tests
C. Audit Completion
D. Audit Evidence
45. Techniques used for gathering evidence include all of the following, except:
A. Physical examination of assets or supporting documentation
B. Observing activities
C. Adequate planning and supervision
D. Analyzing financial relationships
16.
Ch 7 Testbank – 3e Page 12 of 32
46. During this phase of the audit, the auditor must gain a thorough understanding of the client’s
business and financial reporting systems. When completing this phase, the auditors review and
assess the risks and controls related to the business.
A. Tests of Controls
B. Substantive Tests
C. Audit Completion / Reporting
D. Audit Planning
47. During the planning phase of the audit, auditors estimate the monetary amounts that are large
enough to make a difference in decision making. This amount is referred to as:
A. Risk
B. Materiality
C. Substantive
D. Sampling
48. The likelihood that errors or fraud may occur is referred to as:
A. Risk
B. Materiality
C. Control Tests
D. Sampling
49. A large part of the work performed by an auditor in the audit planning process is the gathering
of evidence about the company’s internal controls. This can be completed in any of the
following ways, except:
A. Interviewing key members of the accounting and IT staff.
B. Observing policies and procedures
C. Review IT user manuals and systems
D. Preparing memos to summarize their findings
50. Auditing standards address the importance of understanding both the automated and manual
procedures that make up an organization’s internal controls and consider how misstatements
may occur, including all of the following, except:
A. How transactions are entered into the computer
B. How financial statement are printed from the computer
C. How nonstandard journal entries and adjusting entries are initiated, recorded, and
processed.
D. How standard journal entries are initiated, recorded, and processed.
51. IT auditors may need to be called in to:
A. Consider the effects of computer processing on the audit.
B. To assist in testing the automated processes.
C. Both of the above.
D. None of the above.
17.
Ch 7 Testbank – 3e Page 13 of 32
52. Many companies design their IT system so that all documents and reports can be retrieved from
the system in readable form. Auditors can then compare the documents used to input the data
into the system with reports generated from the system, without gaining any extensive
knowledge of the computer system and does not require the evaluation of computer controls.
This process is referred to as:
A. Auditing through the system
B. Auditing around the system
C. Computer assisted audit techniques
D. Auditing with the computer
53. The audit practice of “auditing around the computer” is also referred to as:
A. The white box approach
B. The black box approach
C. Computer-assisted audit techniques (CAATs)
D. The gray box approach
54. Which of the following is the most effective way of auditing the internal controls of an IT
system?
A. Auditing with the Computer
B. Auditing through the computer
C. Auditing around the computer
D. Auditing in the computer
55. This approach, referred to as the whitebox approach, requires auditors to evaluate IT controls
and processing so that they can determine whether the information generated from the system
is reliable.
A. Auditing through the system
B. Auditing around the system
C. Computer assisted audit techniques
D. Auditing with the computer
56. The IT auditing approach referred to as “Auditing through the system” is necessary under which
of the following conditions?
A. Supporting documents are available in both electronic and paper form.
B. The auditor does not require evaluation of computer controls.
C. The auditor wants to test computer controls as a basis for evaluating risk and reducing the
amount of substantive audit testing required.
D. The use of the IT system has a low impact on the conduct of the audit.
57. Audit procedures designed to evaluate both general controls and application controls are
referred to as:
A. Substantive Tests
B. Audit Planning
C. IT Auditing
D. Test of Controls
18.
Ch 7 Testbank – 3e Page 14 of 32
58. The automated controls that affect all computer applications are referred to as:
A. General Controls
B. Specific Controls
C. Input Controls
D. Application Controls
59. Which of the following describes a mathematical sum of data that is meaningless to the financial
statements but useful for controlling the data and detecting possible missing items?
A. Hash Total
B. Batch Total
C. Validation Check
D. Sequence Verification total
60. The two broad categories of general controls that relate to IT systems include which of the
following:
A. IT systems documentation
B. IT administration and the related operating systems development and maintenance
processes
C. Authenticity table
D. Computer security and virus protection
61. Related audit tests to review the existence and communication of company policies regarding
important aspects of IT administrative control include all of the following, except:
A. Personal accountability and segregation of incompatible responsibilities
B. Job description and clear lines of authority
C. Prevention of unauthorized access
D. IT systems documentation
62. Auditors may send text messages through a company’s system to find out whether encryption
of private information is occurring properly. In addition, special software programs are available
to help auditors identify weak points in a company’s security measures. These are examples of:
A. Penetration tests
B. Authenticity tests
C. Vulnerability assessments
D. Access log reviews
63. Controls meant to prevent the destruction of information as the result of unauthorized access to
the IT system are referred to as:
A. IT administration
B. System controls
C. Information administration
D. Security controls
19.
Ch 7 Testbank – 3e Page 15 of 32
64. In addition to testing system documentation, auditors should test the three main functions of
computer applications. Which of the following is not one of these functions?
A. Output
B. Input
C. Processing
D. Data Storage
65. All of the following are examples of security controls except for?
A. Biometric access controls
B. Swipe Key access controls
C. Online firewall protection controls
D. All of the Above are examples of security controls
66. Auditors should perform this type of test to determine the valid use of the company’s computer
system, according to the authority tables.
A. Authenticity tests
B. Penetration tests
C. Vulnerability assessments
D. IT systems documentation
67. These tests of the security controls involve various methods of entering the company’s system
to determine whether controls are working as intended.
A. Authenticity tests
B. Penetration tests
C. Vulnerability assessments
D. IT systems documentation
68. These tests of security controls analyze a company’s control environment for possible
weaknesses. Special software programs are available to help auditors identify weak points in
their company’s security measures.
A. Authenticity tests
B. Penetration tests
C. Vulnerability assessments
D. IT systems documentation
69. One of the most effective ways a client can protect its computer system is to place physical
controls in the computer center. Physical controls include all of the following, except:
A. Proper temperature control
B. Locks
C. Security guards
D. Cameras
70. One of the most effective ways a client can protect its computer system is to place
environmental controls in the computer center. Environmental controls include:
A. Card keys
B. Emergency power supply
C. Alarms
D. Security guards
20.
Ch 7 Testbank – 3e Page 16 of 32
71. This type of application control is performed to verify the correctness of information entered
into software programs. Auditors are concerned about whether errors are being prevented and
detected during this stage of data processing.
A. Security controls
B. Processing controls
C. Input controls
D. Output controls
72. IT audit procedures typically include a combination of data accuracy tests where the data
processed by computer applications are reviewed for correct dollar amounts or other numerical
values. These procedures are referred to as:
A. Security controls
B. Processing controls
C. Input controls
D. Output controls
73. This type of processing control test involves a comparison of different items that are expected
to have the same values, such as comparing two batches or comparing actual data against a
predetermined control total.
A. Validation Checks
B. Batch Totals
C. Run-to-Run Totals
D. Balancing Tests
74. This law, also known as the first-digit law, was named after a physicist who discovered a specific,
but non-uniform pattern in the frequency of digits occurring as the first number in a list of
numbers:
A. Number-up Law
B. Benford’s Law
C. Adams’ Digit Law
D. Jackson First Digit Law
75. This is one of the computer-assisted audit techniques related to processing controls that
involves processing company data through a controlled program designed to resemble the
company’s application. This test is run to find out whether the same results are achieved under
different systems.
A. Integrated Test Facility
B. Embedded Audit Module
C. Parallel Simulation
D. Test Data Method
76. Regardless of whether the results are printed or retained electronically, auditors may perform
all of the following procedures to test application outputs, except:
A. Integrated Tests
B. Reasonableness Tests
C. Audit Trail Tests
D. Rounding Errors Tests
21.
Ch 7 Testbank – 3e Page 17 of 32
77. The auditor’s test of the accuracy of monetary amounts of transactions and account balances is
known as:
A. Testing of controls
B. Substantive tests
C. Compliance tests
D. Application tests
78. A process of constant evidence gathering and analysis to provide assurance on the information
as soon as it occurs, or shortly thereafter, is referred to as:
A. Real-time auditing
B. Virtual auditing
C. E-auditing
D. Continuous auditing
79. This phase of auditing occurs when the auditors evaluate all the evidence that has been
accumulated and makes a conclusion based on that evidence.
A. Tests of Controls
B. Audit Planning
C. Audit Completion / Reporting
D. Substantive Testing
80. This piece of audit evidence is often considered to be the most important because it is a signed
acknowledgment of management’s responsibility for the fair presentation of the financial
statements and a declaration that they have provided complete and accurate information to the
auditors during all phases of the audit.
A. Letter of Representation
B. Audit Report
C. Encounter Statement
D. Auditors Contract
81. Which of the following is a proper description of an auditor report?
A. Unqualified opinion - identifies certain exceptions to the clean opinion.
B. Adverse opinion - notes that there are material misstatements presented.
C. Qualified opinion - states that the auditors believe the financial statements are fairly and
consistently presented in accordance with GAAP.
D. Unqualified opinion - states that the auditors were not able to reach a conclusion.
82. When PCs are used for accounting instead of mainframes or client-server system, they face a
greater risk of loss due to which of the following:
A. Authorized access
B. Segregation of duties
C. Lack of backup control
D. All of the above
22.
Ch 7 Testbank – 3e Page 18 of 32
83. When companies rely on external, independent computer service centers to handle all or part of
their IT needs it is referred to as:
A. External Processing
B. WAN Processing
C. Database Management System
D. IT Outsourcing
84. Because it is not possible to test all transactions and balances, auditors rely on this to choose
and test a limited number of items and transactions and then make conclusions about the
balance as a whole.
A. Sampling
B. Materiality
C. Compliance
D. Substance
85. All types of auditors must follow guidelines promoting ethical conduct. For financial statement
auditors, the PCAOB/AICPA has established a Code of Professional Conduct, commonly called
the Code of Ethics, which consists of two sections. Which of the following correctly states the
two sections?
A. Integrity and responsibility
B. Principles and rules
C. Objectivity and independence
D. Scope and nature
86. The rule in the PCAOB/AICPA Code of Professional Conduct that is referred to as Responsibilities,
can be stated as:
A. CPAs should act in a way that will serve the public interest, honor the public trust, and
demonstrate commitment to professionalism.
B. To maintain and broaden public confidence, CPAs should perform their professional duties
with the highest sense of integrity.
C. In carrying out their professional duties, CPAs should exercise sensitive professional and
moral judgments in all their activities.
D. CPAs in public practice should observe the principles of the Code of Professional Conduct in
determining the scope and nature of services to be provided.
87. This concept means that the auditors should not automatically assume that their clients are
honest, but that they (the auditors) must have a questioning mind and a persistent approach to
evaluating evidence for possible misstatements.
A. Independence
B. Integrity
C. Due Care
D. Professional Skepticism
23.
Ch 7 Testbank – 3e Page 19 of 32
TEST BANK - CHAPTER 7 - TRUE / FALSE
1. All users of financial data - business managers, investors, creditors, and government agencies -
have an enormous amount of data to use to make decisions. Due to the use of IT systems, it is
easy to verify the accuracy and completeness of the information.
FALSE
2. In order to properly carry out an audit, accountants collect and evaluate proof of procedures,
transactions, and / or account balances, and compare the information with established
criteria.
TRUE
3. The only person who can perform a financial statement audit of a publicly traded company is a
government auditor who has extensive knowledge of generally accepted accounting
principles.
FALSE
4. Any professionally trained accountant is able to perform an operational audit.
TRUE
5. An important requirement for CPA firms is that they must be personally involved with the
management of the firm that is being audited.
FALSE
6. The most common type of audit service is the operating audit performed by internal auditors.
FALSE
7. All types of auditors should have knowledge about technology-based systems so that they can
properly audit IT systems.
TRUE
8. A financial statement audit is part of the IT audit.
FALSE
9. Auditors do not need to be experts on the intricacies of computer systems but they do need to
understand the impact of IT on their clients’ accounting systems and internal controls.
TRUE
10. An internal auditor is not allowed to assist in the performance of a financial statement audit.
FALSE
11. A financial statement audit is conducted in order for an opinion to be expressed on the fair
presentation of financial statements. This goal is affected by the presence or absence of IT
accounting systems.
FALSE
24.
Ch 7 Testbank – 3e Page 20 of 32
12. Information risk is the chance that information used by decision makers may be inaccurate.
TRUE
13. As a business grows, the volume and complexity of its transactions increase. At the same timed,
there is a decrease in the chance that misstated information may exist undetected.
FALSE
14. The remoteness of information, one of the causes of information risk, can relate to geographic
distance or organizational layers.
TRUE
15. The most common method for decision makers to reduce information risk is to rely on
information that has been audited by an independent party.
TRUE
16. Auditors have the primary responsibility to make sure that they comply with international
standards in all cases.
FALSE
17. There is not much room for professional judgement when performing audits, as a result of the
detailed guidance provided by organizations, such as the PCAOB.
FALSE
18. The responsibility for operations, compliance, and financial reporting lies with the auditors.
FALSE
19. The role of the auditor is to analyze the underlying facts to decide whether information
provided by management is fairly presented.
TRUE
20. Management assertions relate to the actual existence and proper valuation of transactions
and account balances.
TRUE
21. The same audit tests would test for completeness of a liability or an asset.
FALSE
22. Auditing testing for any single general auditing objective would involve the same testing
techniques even though there are different types of information collected to support different
accounts and transactions.
FALSE
23. Auditors must think about how the features of a company’s IT systems influence its
management assertions and the general audit objectives even though these matters have
little or no impact on the choice of audit methodologies used.
FALSE
24. Risk can be inherent in the company’s business, due to things such as the nature of
25.
Ch 7 Testbank – 3e Page 21 of 32
operations, or may be caused by weak internal controls.
TRUE
25. The audit planning process is unlikely to vary if the company has adopted IFRS, or is in the
process of convergence.
FALSE
26. Adapting to fair value measures in the preparation of IFRS-based financial statements will
likely cause auditors to evaluate supporting evidence differently than if US GAAP was used.
TRUE
27. IFRS does not allow as much use of judgment as is allowed under GAAP.
FALSE
28. Auditors do not need to concern themselves with risks unless there is an indication that there
is an internal control weakness.
FALSE
29. The auditor’s understanding of internal controls provides the basis for designing appropriate
audit tests to be used in the remaining phases of the audit.
TRUE
30. The process of evaluating internal controls and designing meaningful audit tests is more
complex for manual systems than for automated systems.
FALSE
31. Computer-assisted audit techniques are useful audit tools because they make it possible for
auditors to use computers to audit large amounts of evidence in less time.
TRUE
32. In order to enhance controls, reconciliations should be performed by company personnel who
are independent from the tasks of initiating or recording the transactions with the accounts
being reconciled.
TRUE
33. Substantive tests are also referred to as compliance tests.
FALSE
34. General controls relate to specific software and application controls relate to all aspects of the
IT environment.
FALSE
35. General controls must be tested before application controls.
TRUE
26.
Ch 7 Testbank – 3e Page 22 of 32
36. Systems operators and users should not have access to the IT documentation containing
details about the internal logic of computer systems.
TRUE
37. Control tests verify whether financial information is accurate, where substantive tests
determine whether the financial information is managed under a system that promotes
accuracy.
FALSE
38. Regardless of the results of the control testing, some level of substantive testing must take
place.
TRUE
39. The use of generalized audit software is especially useful when there are large volumes of
data and when there is a need for accurate information.
TRUE
40. All of the risks and audit procedures that apply to a PC environment may also exist in
networks, but the risk of loss of much lower.
FALSE
41. Network operations typically involve a large number of computers, many users, and a high
volume of data transfers, so any lack of network controls could cause widespread damage.
Because of this, it is necessary for auditors to apply strict tests to a representative sample of
the network.
FALSE
42. When audit clients use a database system, the relating data is organized in a consistent
manner which tends to make it easier for auditors to select items for testing.
TRUE
43. When a client company is using IT outsourcing, and that service center has its own auditors
who report on internal control, the third-party report (from the independent auditors) cannot
be used as audit evidence without the auditor performing an adequate amount of compliance
testing.
FALSE
44. Risk assessment in cloud computing is particularly challenging because the threats to a
company’s data are uncontrolled, and often unforeseen, by the company.
TRUE
45. Within the cloud computing environment, the service provider is responsible to make sure
that all relevant risks have been identified and controlled. Because of this, the company using
the cloud computing does not need to repeat that evaluation.
FALSE
27.
Ch 7 Testbank – 3e Page 23 of 32
46. Because there is no such thing as a standard cloud, it is not possible to standardize a risk
assessment process and audit procedures for a cloud computing environment.
TRUE
47. When an auditor is engaged to audit a company that uses cloud computing, the auditor must
rely on the SOC reports provided by the service company’s auditors.
FALSE
48. When a client changes the type of hardware or software used or in other ways modifies its IT
environment, the auditors need to test only the new system in order to determine the
effectiveness of the controls.
FALSE
49. When a client plans to implement new computerized systems, auditors will find it
advantageous to review the new system before it is placed in use.
TRUE
50. A sample is random when each item in the population has an equal chance of being chosen.
TRUE
51. Of all the principles applicable to auditors, the one that generally receives the most attention
is the requirement that financial statement auditors maintain integrity.
FALSE
52. The Sarbanes-Oxley Act has placed restrictions on auditors by prohibiting certain types of
services historically performed by auditors for their clients.
TRUE
53. The Sarbanes-Oxley Act decreased management’s responsibilities regarding the fair
presentation of the financial statements.
FALSE
54. The responsibility of the auditor to search for fraud is less than the responsibility to search for
errors.
FALSE
55. Management fraud is the intentional misstatement of financial information and may be
difficult for auditors to find because the perpetrator will attempt to hide the fraud.
TRUE
56. The PCAOB/AICPA Code of Professional Conduct is made up of two sections. One section, the
rules, are the foundations for the honorable behavior expected of CPAs while performing
professional duties.
FALSE
FOR SHORT ANSWER AND ESSAY QUESTIONS REFER TO THE NEXT PAGE.
ALL SHORT ANSWER AND ESSAY QUESTIONS ARE NEW IN THIS EDITION
28.
Ch 7 Testbank – 3e Page 24 of 32
Question 1. SO2 Types of Audits
Main purpose of an audit is to assure users of financial information about the accuracy and
completeness of the information. Identify and describe the three primary types of audits, discussed in
the text and class.
Type of Audit Explanation
1.
2.
3.
Answer: TYPES OF AUDITS (SO 2)
Three primary types of audits include
◆ compliance audits,
◆ operational audits, and
◆ financial statement audits.
The main purpose of the audit is to assure users of financial information about the accuracy and
completeness of the information. To carry out an audit, accountants collect and evaluate proof of
procedures, transactions, and/or account balances and compare the information with established
criteria. The three primary types of audits include:
• compliance audits,
• operational audits, and
• financial statement audits
Compliance audits determine whether the company has complied with regulations and policies
established by contractual agreements, governmental agencies, company management, or other high
authority.
Operational audits assess operating policies and procedures for efficiency and effectiveness
Financial statement audits determine whether the company has prepared and presented its financial
statements fairly, and in accordance with established financial accounting criteria.
• financial statement audits are performed by certified public accountants who have extensive
knowledge of generally accepted accounting principles (GAAP) in the United States and/or
International Financial Reporting Standards (IFRS)
29.
Ch 7 Testbank – 3e Page 25 of 32
Question 2. SO6 Four Primary Phases of an IT Audit
Identify and explain, in order of occurrence, the four primary phases to an IT audit
Phase Explanation
1.
2.
3.
4.
Answer: Steps in an IT audit are the same four steps in a traditional audit.
PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6)
There are four primary phases of the audit:
• planning,
• tests of controls,
• substantive tests, and
• audit completion/reporting