15. The fundamental difference between internal and external auditing is that a. internal auditors represent the interests of the organization and external auditors represent outsiders b. internal auditors perform IT audits and external auditors perform financial statement audits c. internal auditors focus on financial statement audits and external auditors focus on operational audits and financial statement audits d. external auditors assist internal auditors but internal auditors cannot assist external auditors 16. Which of the following is not a test of access controls? a. biometric controls b. encryption controls c. backup controls d. inference controls 17. All of the following are steps in an IT audit except a. substantive testing b. tests of controls c. post-audit testing d. audit planning 18. When planning the audit, information is gathered by all of the following methods except a. completing questionnaires b. interviewing management c. observing activities d. confirming accounts receivable 19. Segregation of duties in the computer-based information system includes a. separating the programmer from the computer operator b. preventing management override c. separating the inventory process from the billing process d. performing independent verifications by the computer operator 20.Adequate backups will protect against all of the following except a. natural disasters such as fires b. unauthorized access c. data corruption caused by program errors d. system crashes 21.Systems development is separated from data processing activities because failure to do so a. weakens database access security b. allows programmers access to make unauthorized changes to applications during execution c. results in inadequate documentation d. results in master files being inadvertently erased 22. Which organizational structure is most likely to result in good documentation procedures? a. separate systems development from systems maintenance b. separate systems analysis from application programming c. separate systems development from data processing d. separate database administrator from data processing