14) A plan of action before, during, and after a catastrophic event best describes: a. Internal control auditing b. IT Governance C. Disaster relief plan d. All of the above 15) Section 302 of SOX addresses: a. Requires executives to certify financial information included in reports furnished by the company. b. Requires executives to confirm that fraud has not occurred C. Requires auditors to certify financial information included in reports furnished by the company. d. Requires auditors to confirm that fraud has not occurred 16) Section 404 of SOX addresses: a. The completeness of financial statements b. Validity of internal controls C. The absence of fraud d. Auditors opinion of the internal control environment 17) Which of the following is an element of the testing of internal controls? a. Determine the degree and reliance of internal controls b. The issuance of the auditor report C. Testing of account balances d. All of the above 18) SSAE 16 reporting is required when: a. Fraud is discovered during a financial statement audit b. Internal controls are found to be insufficient C. The requirements of SOX are not followed d. Third party vendors supply key IT services 19) Which of the following is part of the planning phase of the audit? a. Performance of Substantive Testing b. Review General Controls and Application Controls C. Completion of the tests of controls d. All of the above 20) Which of the following is a control concern in a distributed data processing environment? a. Redundancy b. Hiring qualified professionals C. Incompatibility d. All of the above