Coursehero >> Pennsylvania >> IUP >> IFMG 488 Course Hero has millions of student submitted documents

similar to the one below including study guides, practice problems, reference materials, practice exams, textbook help and tutor support. Information Accounting Systems, 12e (Romney/Steinbart) Chapter 11 Auditing Computer-Based Information Systems 1) Auditing involves the A) collection, review, and documentation of audit evidence. B) planning and verification of economic events. C) collection of audit evidence and approval of economic events. D) testing, documentation, and certification of audit evidence. Answer: A Page Ref: 303 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 2) What is not a typical responsibility of an internal auditor? A) helping management to improve organizational effectiveness B) assisting in the design and implementation of an AIS C) preparation of the company's financial statements D) implementing and monitoring of internal controls Answer: C Page Ref: 303 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 3) Which type of work listed below is not typical of internal auditors? A) operational and management audits B) information system audits C) financial statement audit D) financial audit of accounting records Answer: C Page Ref: 303 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 4) The ________ audit examines the reliability and integrity of accounting records. A) financial B) informational C) information systems D) operational Answer: A Page Ref: 303 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 1 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 5) The ________ audit reviews the general and application controls of an AIS to assess its compliance with internal control policies and procedures and its effectiveness in safeguarding assets. A) financial B) information systems C) management D) internal control Answer: B Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 6) One type of audit that is concerned with the economical and efficient use of resources and the accomplishment of established goals and objectives is known as a(n) ________ audit. A) financial B) information systems C) internal control D) operational or management Answer: D Page Ref: 304 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 7) The ________ audit is concerned with the economical and efficient use of resources and the accomplishment of established goals and objectives. A) financial B) informational C) information systems D) operational Answer: D Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 8) The purpose of ________ is to determine why, how, when, and who will perform the audit. A) audit planning B) the collection of audit evidence C) the communication of audit results D) the evaluation of audit evidence Answer: A Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 2 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 9) Organizing the audit team and the physical examination of assets are components of which two separate audit stages? A) planning; evaluating audit evidence B) planning; collecting audit evidence C) collecting audit evidence; communicating audit results D) communicating audit results; evaluating audit evidence Answer: B Page Ref: 304-305 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 10) With which stage in the auditing process are the consideration of risk factors and materiality most associated? A) audit planning B) collection of audit evidence C) communication of audit results D) evaluation of audit evidence Answer: A Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 11) A system that employs various types of advanced technology has more ________ risk than traditional batch processing. A) control B) detection C) inherent D) investing Answer: C Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 12) Control risk is defined

as the A) susceptibility to material risk in the absence of controls. B) risk that a material misstatement will get through the internal control structure and into the financial statements. C) risk that auditors and their audit procedures will not detect a material error or misstatement. D) risk auditors will not be given the appropriate documents and records by management who wants to control audit activities and procedures. Answer: B Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 3 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 13) The possibility that a material error will occur even though auditors are following audit procedures and using good judgment is referred to as A) control risk. B) detection risk. C) inherent risk. D) investigating risk. Answer: B Page Ref: 305 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 14) The ________ stage of the auditing process involves (among other things) the auditors observing the operating activities and having discussions with employees. A) audit planning B) collection of audit evidence C) communication of audit results D) evaluation of audit evidence Answer: B Page Ref: 305 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 15) Verifying the accuracy of certain information, often through communication with third parties, is known as A) reperformance. B) confirmation. C) substantiation. D) documentation. Answer: B Page Ref: 305 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 16) The evidence collection method that examines all supporting documents to determine the validity of a transaction is called A) review of documentation. B) vouching. C) physical examination. D) analytical review. Answer: B Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 4 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 17) The evidence collection method that considers the relationships and trends among information to detect items that should be investigated further is called A) review of the documentation. B) vouching. C) physical examination. D) analytical review. Answer: D Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 18) Assessing the quality of internal controls, the reliability of information, and operating performance are all part of which stage of the auditing process? A) audit planning B) collection of audit evidence C) evaluation of audit evidence D) communication of audit results Answer: C Page Ref: 306 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 19) An auditor must be willing to accept some degree of risk that the audit conclusion is incorrect. Accordingly, the auditor's objective is to seek ________ that no material error exists in the information audited. A) absolute reliability B) reasonable evidence C) reasonable assurance D) reasonable objectivity Answer: C Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 20) The risk-based audit approach is A) a four-step approach to internal control evaluation. B) a four-step approach to financial statement review and recommendations. C) a three-step approach to internal control evaluation. D) a three-step approach to financial statement review and recommendations. Answer: A Page Ref: 306 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 5 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 21) Which of the following is the first step in the risk-based audit approach? A) Identify the control procedures that should be in place. B) Evaluate the control procedures. C) Determine the threats facing the AIS. D) Evaluate weaknesses to determine their effect on the audit procedures. Answer: C Page Ref: 306 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 22) Determining whether the necessary control procedures are in place is accomplished by conducting A) a systems overhaul. B) a systems review. C) tests of controls. D) both B and C Answer: B Page Ref: 306 Objective: Learning Objective 1 Difficulty : Difficult AACSB: Analytic 23) According to the risk-based auditing approach, when a control deficiency is identified, the auditor should inquire

about A) tests of controls. B) the feasibility of a systems review. C) materiality and inherent risk factors. D) compensating controls. Answer: D Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 24) The ________ to auditing provides auditors with a clear understanding of possible errors and irregularities and the related risks and exposures. A) risk-based approach B) risk-adjusted approach C) financial audit approach D) information systems approach Answer: A Page Ref: 306 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 6 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 25) What is the purpose of an information systems audit? A) To determine the inherent risk factors found in the system B) To review and evaluate the internal controls that protect the system C) To examine the reliability and integrity of accounting records D) To examine whether resources have been used in an economical and efficient manner in keeping with organization goals and objectives Answer: B Page Ref: 307 Objective: Learning Objective 2 Difficulty : Moderate AACSB: Analytic 26) The information systems audit objective that pertains to source data being processed into some form of output is known as A) overall security. B) program development. C) program modifications. D) processing. Answer: D Page Ref: 307 Objective: Learning Objective 2 Difficulty : Easy AACSB: Analytic 27) To maintain the objectivity necessary for performing an independent evaluation function, auditors should not be involved in A) making recommendations to management for improvement of existing internal controls. B) examining system access logs. C) examining logical access policies and procedures. D) developing the information system. Answer: D Page Ref: 309 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 28) The auditor's role in systems development should be as A) an advisor and developer of internal control specifications. B) a developer of internal controls. C) an independent reviewer only. D) A and B above Answer: C Page Ref: 309 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 7 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 29) Regarding program modifications, which statement below is incorrect? A) Only material program changes should be thoroughly tested and documented. B) When a program change is submitted for approval, a list of all required updates should be compiled and then approved by management and program users. C) During the change process, the developmental version of the program must be kept separate from the production version. D) After the modified program has received final approval, the change is implemented by replacing the developmental version with the production version. Answer: A Page Ref: 311 Objective: Learning Objective 3 Difficulty : Easy AACSB: Analytic 30) How could auditors determine if unauthorized program changes have been made? A) By interviewing and making inquiries of the programming staff B) By examining the systems design and programming documentation C) By using a source code comparison program D) By interviewing and making inquiries of recently terminated programming staff Answer: C Page Ref: 311 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 31) Which auditing technique will not assist in determining if unauthorized programming changes have been made? A) Use of a source code comparison program B) Use of the reprocessing technique to compare program output C) Interviewing and making inquiries of the programming staff D) Use of parallel simulation to compare program output Answer: C Page Ref: 311 Objective: Learning Objective 3 Difficulty : Easy AACSB: Analytic 32) Strong ________ controls can partially compensate for inadequate ________ controls. A) development; processing B) processing; development C) operational; internal D) internal; operational Answer: B Page Ref: 310 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 8 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 33) The ________ procedure for auditing computer process controls uses a

hypothetical series of valid and invalid transactions. A) concurrent audit techniques B) test data processing C) integrated test facility D) dual process Answer: B Page Ref: 312 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 34) The auditor uses ________ to continuously monitor the system and collect audit evidence while live data are processed. A) test data processing B) parallel simulation C) concurrent audit techniques D) analysis of program logic Answer: C Page Ref: 313 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 35) Auditors have several techniques available to them to test computer-processing controls. An audit technique that immediately alerts auditors of suspicious transactions is known as A) a SCARF. B) an audit hook. C) an audit sinker. D) the snapshot technique. Answer: B Page Ref: 313 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 36) A type of software that auditors can use to analyze program logic and detect unexecuted program code is A) a mapping program. B) an audit log. C) a scanning routine. D) program tracing. Answer: A Page Ref: 314 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 9 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 37) One tool used to document the review of source data controls is A) a flowchart generator program. B) a mapping program. C) an input control matrix. D) a program algorithm matrix. Answer: C Page Ref: 314 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 38) An audit software program that generates programs that perform certain audit functions, based on auditor specifications, is referred to as a(n) A) input controls matrix. B) CAATS. C) embedded audit module. D) mapping program. Answer: B Page Ref: 317 Objective: Learning Objective 4 Difficulty : Moderate AACSB: Analytic 39) The use of a secure file library and restrictions on physical access to data files are control procedures used together to prevent A) an employee or outsider obtaining data about an important client. B) a data entry clerk from introducing data entry errors into the system. C) a computer operator from losing or corrupting files or data during transaction processing. D) programmers making unauthorized modifications to programs. Answer: A Page Ref: 316 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 40) An auditor might use which of the following to convert data from several sources into a single common format? A) computer assisted audit techniques software B) Windows Media Converter C) concurrent audit technique D) Adobe Professional Answer: A Page Ref: 317 Objective: Learning Objective 4 Difficulty : Easy AACSB: Analytic 10 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 41) What is the primary purpose of computer audit software? A) eliminate auditor judgment errors B) assist the auditor in retrieving and reviewing information C) detect unauthorized modifications to system program code D) recheck all mathematical calculations, cross-foot, reprocess financial statements and compare to originals Answer: B Page Ref: 317 Objective: Learning Objective 4 Difficulty : Easy AACSB: Analytic 42) The scope of a(n) ________ audit encompasses all aspects of systems management. A) operational B) information systems C) financial D) internal control Answer: A Page Ref: 318 Objective: Learning Objective 5 Difficulty : Moderate AACSB: Analytic 43) Evaluating effectiveness, efficiency, and goal achievement are objectives of ________ audits. A) financial B) operational C) information systems D) all of the above Answer: B Page Ref: 318 Objective: Learning Objective 5 Difficulty : Easy AACSB: Analytic 44) In the ________ stage of an operational audit, the auditor measures the actual system against an ideal standard. A) evidence collection B) evidence evaluation C) testing D) internal control Answer: B Page Ref: 318 Objective: Learning Objective 5 Difficulty : Easy AACSB: Analytic 11 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 45) An increase in the effectiveness of internal controls would have the greatest effect on A) reducing control risk. B) reducing detection risk.

C) reducing inherent risk. D) reducing audit risk. Answer: A Page Ref: 304 Objective: Learning Objective 1 Difficulty : Difficult AACSB: Analytic 46) An expansion of a firm's operations to include production in Russia and China will have the effect of A) increasing inherent risk. B) reducing inherent risk. C) increasing control risk. D) reducing control risk. Answer: A Page Ref: 304 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 47) An increase in the effectiveness of auditing software will have the effect of A) increasing detection risk. B) reducing detection risk. C) increasing control risk. D) reducing control risk. Answer: B Page Ref: 305 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 48) An auditor examines all documents related to the acquisition, history, repair and disposal of a firm's delivery van. This is an example of collecting audit evidence by A) confirmation. B) reperformance. C) vouching. D) analytical review. Answer: C Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 12 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 49) An auditor manually calculates accumulated depreciation on a delivery van and compares her calculation with accounting records. This is an example collecting audit evidence by A) confirmation. B) reperformance. C) vouching. D) analytical review. Answer: B Page Ref: 305 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 50) An auditor finds that employee absentee rates are significantly higher on Mondays and Fridays than on other work days. This is an example collecting audit evidence by A) confirmation. B) reperformance. C) vouching. D) analytical review. Answer: D Page Ref: 306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 51) An auditor creates a fictitious customer in the system and then creates several fictitious sales to the customer. The records are then tracked as they are processed by the system. The auditor is using A) an integrated test facility. B) the snapshot technique. C) a system control audit review file. D) continuous and intermittent simulation. Answer: A Page Ref: 313 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 52) An auditor sets an embedded audit module to flag all credit transactions in excess of $1,500. The flag causes the system state to be recorded before and after each transaction is processed. The auditor is using A) an integrated test facility. B) the snapshot technique. C) a system control audit review file. D) audit hooks. Answer: B Page Ref: 313 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 13 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 53) An auditor sets an embedded audit module to record all credit transactions in excess of $1,500 and store the data in an audit log. The auditor is using A) the snapshot technique. B) a system control audit review file. C) audit hooks. D) continuous and intermittent simulation. Answer: B Page Ref: 313 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 54) An auditor sets an embedded audit module to flag questionable online transactions, display information about the transaction on the auditor's computer, and send a text message to the auditor's cell phone. The auditor is using A) the snapshot technique. B) a system control audit review file. C) audit hooks. D) continuous and intermittent simulation. Answer: C Page Ref: 313 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 55) An auditor sets an embedded audit module to selectively monitor transactions. Selected transactions are then reprocessed independently, and the results are compared with those obtained by the normal system processing. The auditor is using A) an integrated test facility. B) the snapshot technique. C) a system control audit review file. D) continuous and intermittent simulation. Answer: D Page Ref: 313 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 56) Which of the following is not one of the types of internal audits? A) reviewing corporate organizational structure and reporting hierarchies B) examining procedures for reporting and disposing of hazardous waste C) reviewing source

documents and general ledger accounts to determine integrity of recorded transactions D) comparing estimates and analysis made before purchase of a major capital asset to actual numbers and results achieved Answer: A Page Ref: 304 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Reflective Thinking 14 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 57) When programmers are working with program code, they often employ utilities that are also used in auditing. For example, as program code evolves, it is often the case that blocks of code are superseded by other blocks of code. Blocks of code that are not executed by the program can be identified by A) embedded audit modules. B) scanning routines. C) mapping programs. D) automated flow charting programs. Answer: C Page Ref: 314 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 58) When programmers are working with program code, they often employ utilities that are also used in auditing. For example, as program code evolves, it is often the case that variables defined during the early part of development become irrelevant. The occurrences of variables that are not used by the program can be found using A) program tracing. B) scanning routines. C) mapping programs. D) embedded audit modules. Answer: B Page Ref: 314 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 59) Explain the differences between each type of audit risk. Answer: Inherent risk is the threat faced just by conducting business in a chosen way. For example, a business with multiple locations in several foreign countries faces more threats than a business with a single location. Control risk is the threat that a company has inadequate, nonexistent or unenforced policies and procedures to prevent errors and fraud from getting into the system and being reflected in the financial statements. Detection risk is the threat that errors or fraud get into the system and audit procedures do not identify the errors or fraud. Page Ref: 304-305 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 15 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 60) Explain why the auditor's role in program development and acquisition should be limited. Answer: The auditor's role in any organization systems development should be limited only to an independent review of systems development activities. The key to the auditor's role is independence; the only way auditors can maintain the objectivity necessary for performing an independent evaluation function is by avoiding any and all involvement in the development of the system itself. If auditor independence is impaired, the audit itself may be of little value and its results could easily be called into question. The auditors could be basically reviewing their own work. Page Ref: 309 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 61) How and to whom does an auditor communicate the audit results? Answer: The auditor prepares a written report summarizing the findings and recommendations, with references to supporting evidence in working papers. The report is presented to management, the audit committee, the board of directors, and other appropriate parties. The auditor then follows up later to determine if recommendations were implemented. Page Ref: 306 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 62) Audit tests and procedures traditionally have been performed on a sample basis. Do options exist for auditors to test significantly more (or all) transactions? Answer: Computer assisted audit techniques (CAATS) allow auditors to automate and simplify the audit process. Large amounts of data can be examined by software, created from auditorsupplied specifications. Two popular CAATS packages are Audit Control Language (ACL) and Interactive Data Extraction and Analysis (IDEA). Auditors can also use concurrent audit techniques to identify and collect information about certain types of transactions in real-time. Examples of concurrent audit techniques are embedded audit modules, integrated test facility, system control audit review file (SCARF), snapshot technique, audit hooks and continuous and

intermittent simulation (CIS). Page Ref: 313, 317 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 63) When doing an information systems audit, auditors must review and evaluate the program development process. What errors or fraud could occur during the program development process? Answer: There can be unintentional errors due to misunderstood systems specifications, incomplete specifications, or poor programming. Developers could insert unauthorized code instructions into the program for fraudulent purposes. Page Ref: 309 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 16 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 64) Briefly describe tests that can be used to detect unauthorized program modifications. Answer: Review procedures for requesting, approving, programming, and testing changes. Review or observe specific testing and implementation procedures. Compare source code from the approved and tested program with the program code currently in use. Randomly and without notice, use the source code from the approved and tested program to reprocess transactions, and compare the results with the operational system results. Write new code designed to replicate the approved and tested code and use parallel simulation to reprocess transactions, and compare the results with the operational system results. Page Ref: 311 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 65) Define and give examples of embedded audit modules. Answer: Embedded audit modules are segments of program code that perform audit functions, report test results and store collected evidence for later review. An Integrated Test Facility (ITF) processes fictitious records through the operational system in real-time. The snapshot technique records master file records immediately before and immediately after processing specifically selected transactions. A System Control Audit Review File (SCARF) continuously monitors transactions and collects transaction data that meet, or fall outside, predetermined criteria. Audit Hooks immediately notify auditors of suspicious transactions being processed, or submitted for processing. Continuous and Intermittent Simulation (CIS) identifies specific transactions with audit significance and processes the transactions parallel to the operational system. If discrepancies result, the CIS can store the evidence for later review or can prevent transaction processing. Page Ref: 313 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 66) How is a financial audit different from an information systems audit? Answer: Financial audits examine the reliability and integrity of accounting records in terms of financial and operating information. An information systems (IS) audit reviews the general and application controls of an AIS to assess its compliance with internal control policies and procedures and its effectiveness in safeguarding assets. Although the AIS may generate accounting records and financial information, it is important that the AIS itself be audited to verify compliance with internal controls and procedures. Page Ref: 303-304 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 17 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 67) Why do all audits follow a sequence of events that can be divided into four stages, and what are the four stages? Answer: The auditor's function generally remains the same no matter what type of audit is being conducted. The process of auditing can be broken down into the four stages of planning, collecting evidence, evaluating evidence, and communicating audit results. These stages form a working template for any type of financial, information systems, or operational or management audits. Page Ref: 305 Objective: Learning Objective 1 Difficulty : Easy AACSB: Analytic 68) Name and describe the different types of audits. Answer: The financial audit this audit examines the reliability and integrity of accounting records (both financial and operating information). The information systems audit this audit reviews the general and application controls of an AIS and assesses its compliance with internal

control policies and procedures and effectiveness in safeguarding assets. The operational or management audit this audit conducts an evaluation of the efficient and effective use of resources, as well as an evaluation of the accomplishment of established goals and objectives. Page Ref: 303-304 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 69) Describe the risk-based audit approach. Answer: The risk-based audit approach has four steps that evaluate internal controls. This approach provides a logical framework for conducting an audit of the internal control structure of a system. The first step is to determine the threats facing the AIS. Threats here can be defined as errors and irregularities in the AIS. Once the threat risk has been established, the auditor should identify the control procedures that should be in place to minimize each threat. The control procedures identified should either be able to prevent or detect errors and irregularities within the AIS. The next step is to evaluate the control procedures. This step includes a systems review of documentation and also interviewing the appropriate personnel to determine whether the needed procedures are in place within the system. The auditor can then use tests of controls to determine if the procedures are being satisfactorily followed. The fourth step is to evaluate weaknesses found in the AIS. Weaknesses here means errors and irregularities not covered by the AIS control procedures. When such deficiencies are identified, the auditor should see if there are compensating controls that may counterbalance the deficiency. A deficiency in one area may be neutralized given control strengths in other areas. The ultimate goal of the risk-based approach is to provide the auditor with a clear understanding of errors and irregularities that may be in the system along with the related risks and exposures. Once an understanding has been obtained, the auditor may provide recommendations to management as to how the AIS control system can be improved. Page Ref: 306 Objective: Learning Objective 1 Difficulty : Difficult AACSB: Analytic 18 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall 70) a) What is test data processing? b) How is it done? c) What are the sources that an auditor can use to generate test data? Answer: a) Test data processing is a technique used to examine the integrity of the computer processing controls. b) Test data processing involves the creation of a series of hypothetical valid and invalid transactions and the introduction of those transactions into the system. The invalid data may include records with missing data, fields containing unreasonably large amounts, invalid account numbers, etc. If the program controls are working, then all invalid transactions should be rejected. Valid transactions should all be properly processed. c) The various ways test data can be generated are: A listing of actual transactions. The initial transactions used by the programmer to test the system. A test data generator program that generates data using program specifications. Page Ref: 312-313 Objective: Learning Objective 3 Difficulty : Difficult AACSB: Analytic 71) Describe the disadvantages of test data processing. Answer: The auditor must spend considerable time developing an understanding of the system and preparing an adequate set of test transactions. Care must be taken to ensure that test data does not affect the company's files and databases. The auditor can reverse the effects of the test transactions or process the transactions in a separate run using a copy of the file or database. However, a separate run removes some of the authenticity obtained from processing test data with regular transactions. Also, since the reversal procedures may reveal the existence and nature of the auditor's test to key personnel, it can be less effective than a concealed test. Page Ref: 313 Objective: Learning Objective 3 Difficulty : Moderate AACSB: Analytic 72) Describe how audit evidence can be collected. Answer: Since the audit effort revolves around the identification, collection, and evaluation of evidence, most audit effort is spent in the collection process. To identify, collect, and evaluate evidence, several methods have been developed to assist in the effort. These methods include: 1) the observation of the

activities being audited; 2) a review of documentation to gain a better understanding of the AIS; 3) discussions with employees about their jobs and how procedures are carried out; 4) the creation and administration of questionnaires to gather data about the system; 5) physical examination of tangible assets; 6) confirmation of the accuracy of certain information; 7) reperformance of selected calculations; 8) vouching for the validity of a transaction by examination of all supporting documentation; and, 9) analytical review of relationships and trends among information to detect items that should be further investigated. It is important to remember that only a sample of evidence is collected for audit purposes, as it is not feasible to perform audit procedures on the entire set of activities, records, assets, or documents that are under the review process in an audit. Page Ref: 305-306 Objective: Learning Objective 1 Difficulty : Moderate AACSB: Analytic 19 Copyright 2012 Pearson Education, Inc. publishing as Prentice Hall Find millions of documents on Course Hero - Study Guides, Lecture Notes, Reference Materials, Practice Exams and more. Course Hero has millions of course specific materials providing students with the best way to expand their education. Below is a small sample set of documents: