1. An auditor anticipates assessing control risk at a low level in a computerized environment. Under these circumstances, on which of the following controls would the auditor initially focus?

Multiple Choice

• Programmed controls.
• Application controls.
• Output controls.
• General controls.

2. An auditor may decide not to perform tests of controls related to the client's IT system. Which of the following would not be a valid reason for choosing to omit such test?

Multiple Choice

• The controls duplicate operative controls existing elsewhere.
• There appear to be major weaknesses that would preclude reliance on the stated procedure.
• The time and dollar costs of testing exceed the time and dollar savings in substantive testing if the tests show the controls to be operative.
• The controls appear adequate.

3. Which of the following computer related employees should not be allowed access to program listings of application programs?

Multiple Choice

• The systems analyst.
• The programmer.
• The operator.
• The librarian.

4. Which of the following personnel is responsible for the proper functioning of the security features built into the operating system?

Multiple Choice

• The systems programmer.
• The application programmer.
• The computer operator.
• The telecommunications specialist.

5. When erroneous data are detected by computer program controls, such data may be excluded from processing and printed on an exception report. The exception report should most probably be reviewed and followed up on by the:

Multiple Choice

• Supervisor of computer operations.
• Systems analyst.
• Data control group.
• Computer programmer.

6.

Consider the following computer applications:

(1) At a catalog sales firm, as phone orders are entered into their computer, both inventory and credit are immediately checked.

(2) A manufacturer's computer sends the coming week's production schedule and parts orders to a supplier's computer.

Which statement below is true for these applications?

Multiple Choice

• Both applications are examples of electronic data interchange (EDI).
• Both applications are examples of online real-time processing.
• The first application is an example of electronic data interchange (EDI) and the second is an example of online real-time.
• The first application is an example of online real-time and the second is an example of electronic data interchange (EDI).

7. Various computing devices (example: desktops, laptops, tablets, phones) have resulted in a(n):

Multiple Choice

• Decentralization of data processing activities.
• Decreased concern over the accuracy of computerized processing.
• Decrease in the number of local area networks.
• Increase for general computer control activities.

8. Which of the following testing techniques is more commonly used by internal auditors than by independent auditors?

Multiple Choice

• Integrated test facilities.
• Test data.
• Controlled programs.
• Tagging and tracing transactions.

9. Which of the following is not a problem associated with the use of test data for computer-audit purposes?

Multiple Choice

• Auditing through the computer is more difficult than auditing around the computer.
• It is difficult to design test data that incorporate all potential variations in transactions.
• Test data may be commingled with live data causing operating problems for the client.
• The program with which the test data are processed may differ from the one used in actual operations.

10. Which of the following employees normally would be responsible for designing the information system?

Multiple Choice

• Computer programmer.
• Data processing manager.
• Systems analyst.
• Internal auditor.

11. A bank wants to reject erroneous account numbers to avoid invalid input. Management of the bank was told that there is a method that involves adding another number at the end of the account numbers and subjecting the other numbers to an algorithm to compare with the extra numbers. What technique is this?

Multiple Choice

• Optical character recognition (OCR) software.
• Self-checking number.
• Validity check.
• Field (format) check.

12. The best method of achieving internal control over advanced information technology (IT) systems is through the use of:

Multiple Choice

• Batch controls.
• Controls written into the computer system.
• Equipment controls.
• Documentation controls.