APPLICATION CONTROLS B) Range check

C) Logic check
1.Which of the following is not a key feature of D) Echo check
input validation controls in CIS application Answer: D
controls?
A) Ensuring transactions are properly authorized 7. Which of the following is not one of the
before being processed by the computer. controls used in data transcription (batching and
B) Allowing transactions to be converted into converting) for input validation controls?
machine readable form and recorded in the A) Sequence check
computer data files. B) Visual verification
C) Preventing loss, addition, duplication, or C) Control totals
improper changes to transactions. D) Key verification requiring data to be entered
D) Rejecting incorrect transactions without twice.
correction. Answer: A
Answer: D
8. Which of the following is not one of the
2. What role do manual cross checks play in components of processing controls in CIS
processing controls for CIS application controls? application controls?
A) Checking the validity of transactions A) Manual cross checks
B) Structuring source documents and input B) Run-to-run totals
screens C) Field checks
C) Reconciling the work of another employee D) File and program changes
reconciliations and acknowledgments Answer: C
D) Computing control totals
Answer: C 9. What is the function of a self-checking digit in
data observation and recording?
3. How does the echo check contribute to the A) Enhancing document security
transmission of transaction data in CIS B) Ensuring data accuracy
application controls? C) Detecting transposition errors in document
A) Transmitting data back to the originating numbers
terminal for comparison D) Facilitating the use of scanners
B) Transmitting additional data for redundancy Answer: C
C) Verifying the completeness of transmitted
data 10. What is the primary objective of input
D) Checking the logic of input data validation controls?
Answer: A A) Preventing unauthorized access to the
application system
4. What does the field check in edit tests of B) Ensuring data entry is authorized, accurate,
transaction data validate within the CIS and complete
application controls? C) Facilitating efficient communication between
A) The validity of transactions or data entered applications
B) The types of characters accepted in specific D) Generating machine-readable forms for all
data fields transactions
C) The reasonableness and limit of entered Answer: B
amounts
D) The sequence order of input data 11. How do input validation controls handle
Answer: B incorrect transactions in the application system?
A) Incorrect transactions are intentionally added
5. All of the following are part of Input validation for testing purposes
controls, except: B) Incorrect transactions are corrected
A) Data observation and recording automatically during processing
B) Manual cross checks of transaction data C) Incorrect transactions are rejected, corrected,
C) Edit tests of transaction data and if necessary, resubmitted on a timely basis
D) Transmission of transaction data D) Incorrect transactions are ignored and left
Answer: B unprocessed
Answer: C
6. All of the following are considered types of
edit tests of transaction data, except:
A) Field size check
12. Among the following, what is the main B) Reconciliations
function of an echo check in the transmission of C) Acknowledgments
transaction data? D) Validating programs
A) Transmitting additional data for redundancy Answer: D
B) Verifying completeness of data
C) Transmitting data back to the originating 18. Which of the following is not a characteristic
terminal for comparison with the transmitted of run-to-run totals in processing controls?
data A) Batched data is controlled during processing
D) Detecting transposition errors runs
Answer: C B) No records are omitted
C) Programs are validated
13. What is the primary purpose of completeness D) Incorrect insertion into a transaction filed is
check in the transmission of transaction data? avoided
A) Verifying data accuracy Answer: C
B) Ensuring that all required data have been
entered and transmitted 19. Which of the following controls is a processing
C) Transmitting additional data for redundancy control designed to ensure the reliability and
D) Transmitting data back for comparison accuracy of data processing?
Answer: B a. Limit test
b. Validity check test
14. All of the following are components of data
observation and recording controls, except: A) Yes, yes.
A) Self-checking data B) No, no.
B) The use of pre-numbered and pre-printed C) No, yes.
documents D) Yes, no.
C) Keeping blank forms under lock and key Answer: A
D) Online computer systems offering menu
screens, preformatted screens, use of scanners 20. Which of the following processing controls
Answer: A would be most effective in assisting a store
manager to ascertain whether the payroll
15. Which of the following is not a role of input transaction data were processed in their entirety?
validation controls in CIS application controls? A) Payroll file header record
A) Ensuring data entry is authorized, accurate, B) Transaction identification codes
and complete C) Processing control totals
B) Preventing loss, addition, duplication, or D) Programmed exception reporting
improper changes to transactions Answer: C
C) Transactions are accurately converted into
machine readable form and recorded in the 21. CIS application controls include, except
computer data files A) Controls over input
D) Converting transactions into handwritten B) Controls over processing and computer data
forms files
Answer: D C) Controls over output
D) Controls over access to systems software and
16. Which of the following is incorrect regarding documentation
transmission of transaction data controls in CIS Answer: D
application controls?
A) Echo check involves transmitting data back 22. Statement 1: Accuracy tests and
for comparison completeness tests are examples of general
B) Visual verification ensures proper authorization controls.
of transactions Statement 2: Input controls is a category of
C) Completeness check verifies that all required application controls.
data have been entered and transmitted A) False; False
D) Redundancy data check is used for B) False: True
additional data in the verification process C) True; True
Answer: B D) True; False
Answer: B
17. Which of the following is not a function of
manual cross checks in processing controls? 23. Most errors within a CIS environment occur at
A) Checking the work of another employee this stage.
A) General Control B) Validity test
B) Input Control C) Application test
C) Process Control D) Completeness test
D) Output Control Answer: C
Answer: B
29. Statement 1. Testing whether transactions
24. Statement 1: Processing controls is a category submitted for processing are properly authorized
of general controls. can be achieved using standard forms & a
Statement 2: Output controls focus on detecting signature authority.
errors after processing is completed rather than Statement 2. Incorrect transactions are rejected,
preventing errors prior to processing. corrected & then resubmitted on a timely basis -
A) True; True relates to the accuracy of accounting reports.
B) True; False A) Only statement 1 is correct
C) False: True B) Both statements are correct
D) False; False C) Both statements are false
Answer: B D) Only statement 2 is correct
Answer: B
25. It relates to the completeness of input & takes
the form of sequence checks and control totals. 30. A count of the number of items or
A) Incorrect transactions are rejected, corrected transactions being input in a given batch
& then resubmitted on a timely basis A) Field check test
B) Transactions submitted for processing are B) Hash total
properly authorized C) Item (Record) count
C) Transactions are accurately converted into D) Financial total
machine-readable form & recorded into the Answer: C
computer files
D) Transactions are not lost, added, duplicated 31. What do General Controls apply to?
or improperly changed A. Individual business processes
Answer: D B. All computerized applications
C. Manual procedures only
26. Statement 1: No matter the source of the error, D. Data edits and error reporting
its circumstances should be investigated, Answer: B
corrected & resubmitted on a timely basis, in
accordance with proper procedures. 32. What is the primary objective of Application
Statement 2: Controls over Input are designed to Controls?
ensure that data entry is authorized, accurate & A. Ensure IT general controls are effective
complete. B. Maintain overall control environment
A) Only statement 1 is correct C. Ensure input data is accurate, complete, and
B) Only statement 2 is correct authorized
C) Both statements are false D. Benchmarking effectiveness year to year
D) Both statements are correct Answer: C
Answer: D
33. Which of the following is a benefit of
27. All of the following refers to the reasonable Application Controls?
assurance of controls over input, except: A. Reliability
A) Transactions are not lost, added, duplicated B. User Authentication
or improperly changed. C. General Controls
B) Transactions are accurately converted into D. Manual intervention
machine-readable form & recorded into the Answer: A
logbook.
C) Transactions submitted for processing are 34. Which type of Application Control checks the
properly authorized. integrity of data entered into a business
D) Incorrect transactions are rejected, corrected application?
& then resubmitted on a timely basis. A. Processing Controls
Answer: B B. Output Controls
C. Integrity Controls
28. Which of the following is not an example of D. User Control Activities
controls over input Answer: C
A) Limit test
35. What does User Authentication involve? A. Input Controls
A. Checking processing totals B. Processing Controls
B. Managing user accounts C. Output Controls
C. Verifying the identity of users D. Integrity Controls
D. Ensuring data is processed as intended Answer: C
Answer: C
43. What is the role of MANAGEMENT TRAIL in
36. Which User Control Activity involves defining Application Controls?
user privileges? A. Verify user identity
A. User Authentication B. Monitor data consistency
B. User Authorization C. Track the process of data from input to output
C. User Account Management D. Check processing totals
D. Secure User Administration Answer: C
Answer: B
44. What do APPLICATION CONTROLS specifically
37. What is the purpose of User Account address in computerized systems?
Management? A. Overall control environment
A. Verify user identity B. Separation of business functions
B. Secure management of user accounts C. User Authentication
C. Benchmarking user privileges D. User Authorization
D. Checking input data integrity Answer: B
Answer: B
45. What is the primary focus of GENERAL
38. Which type of Application Control ensures CONTROLS in a computerized environment?
processing is complete, accurate, and A. Data edits
authorized? B. Separation of business functions
A. Input Controls C. Benchmarking
B. Processing Controls D. Overall control environment
C. Output Controls Answer: D
D. Management Trail
Answer: B 46. What does USER AUTHORIZATION involve in
User Control Activities?
39. What is the primary purpose of Output A. Verifying user identity
Controls? B. Granting or denying access to specific actions
A. Monitoring data being processed or resources
B. Comparing output with input C. Managing user accounts
C. Ensuring data is stored correctly D. Monitoring data consistency
D. Benchmarking application controls Answer: B
Answer: B
47. Which type of Application Control ensures
40. Which aspect of User Control involves that processing is automated, accurate, and
enforcing security policies to protect against authorized?
unauthorized access or malicious activities? A. Input Controls
A. User Authentication B. Processing Controls
B. User Authorization C. Output Controls
C. Secure User Administration D. Integrity Controls
D. General Controls Answer: B
Answer: C
48. What is the primary benefit of APPLICATION
41. What is the primary objective of INPUT CONTROLS in terms of reliability?
CONTROLS in Application Controls? A. Benchmarking
A. Ensure IT general controls are effective B. Time and cost savings
B. Monitor data consistency C. Reducing errors due to manual intervention
C. Check the integrity of data entered D. Ensuring IT general controls effectiveness
D. Verify user identity Answer: C
Answer: C
49. Which User Control Activity involves creating,
42. Which type of Application Control involves maintaining, and controlling user accounts within
checking the output against the intended result? a computer system or network?
A. User Authentication 56. What is the primary purpose of OUTPUT
B. User Authorization CONTROLS ?
C. User Account Management A. Monitor data consistency
D. Secure User Administration B. Ensure data is processed as intended
Answer: C C. Compare output with input
D. Granting or denying user access
50. What is the primary purpose of OUTPUT Answer: C
CONTROLS in Application Controls?
A. Monitor data consistency 57. What is the key aspect of USER
B. Check the integrity of data entered AUTHENTICATION in User Control Activities?
C. Compare output results with intended results A. Verifying user identity
D. Granting or denying user access B. Defining user privileges
Answer: C C. Setting up user accounts
D. Monitoring data consistency
51. Which type of Application Control involves Answer: A
monitoring data being processed and in storage
to ensure consistency and correctness? 58. Which type of Application Control provides
A. Input Controls an automated means to ensure processing is
B. Processing Controls complete, accurate, and authorized?
C. Integrity Controls A. Input Controls
D. Output Controls B. Processing Controls
Answer: C C. Output Controls
D. Integrity Controls
52. What is the primary objective of Answer: B
MANAGEMENT TRAIL in Application Controls?
A. Verify user identity 59. What does GENERAL CONTROLS apply to in a
B. Monitor effectiveness of other controls computerized environment?
C. Track the process of data from input to output A. All computerized applications
D. Benchmarking application controls B. Separation of business functions
Answer: C C. User Authentication
D. Benchmarking
53. What does SECURE USER ADMINISTRATION Answer: A
involve in User Control Activities?
A. Checking processing totals 60. Which User Control Activity involves the
B. Setting up user accounts implementation of practices, policies, and
C. Verifying user identity technologies to ensure secure user account
D. Implementing practices to ensure secure user management?
account management A. User Authentication
Answer: D B. User Authorization
C. Secure User Administration
54. Which aspect of USER CONTROL ACTIVITIES D. User Account Management
refers to actions taken by individuals within an Answer: C
organization to ensure the effectiveness of
application controls? APPLICATION CONTROLS (3RDYR)
A. User Authentication
B. User Authorization 1. The four objectives of input controls are
C. Secure User Administration A. Validity, Completeness, Existence, Valuation
D. Overall control environment B. Completeness, Existence, Efficiency, Validity
Answer: D C. Efficiency, Validity, Completeness, Valuation
D. Valuation, Validity, Existence, Efficiency
55. What is the primary focus of INPUT CONTROLS ANSWER: C
in Application Controls?
A. Monitor data consistency 2. What is the only input control that underpins all
B. Check the integrity of data entered of the objectives of an input control?
C. Ensure processing is complete and authorized A. Completeness check
D. Verify user identity B. Validity Test
Answer: B C. Reasonableness Check
D. Closed loop verification
ANSWER: B
 ANSWER: C
3. This control provides automated means to
ensure processing is complete, accurate, and 9. For the accounting system of ACME
authorized. Company, the amounts of cash disbursements
A. Input Control entered into an EDP terminal are transmitted
B. Access Control to the computer that immediately transmits
C. Processing Control the amounts back to the terminal for display
D. Mandatory Control System on the terminal screen. This display enables the
Answer: C operator to
A. Establish the validity of the account
4. These are the domain of processing controls to number
ensure that input data has been processed B. Verify the amount was entered accurately
accurately and completely, except; C. Verify the authorization of the
A. Password administration disbursements
B. Audit trial and overrides D. Prevent the overpayment of the account
C. Data extraction, filtering, and reporting ANSWER: B
D. Automated functionality and aging 10. A finance application is processing a
Answer: A transaction. Which integrity control can help
confirm that the account number provided by
5. An unauthorized employee took computer the user is correct?
printouts from output bins accessible to all A. Closed Loop Verification
employees. Which of the following controls B. Reasonableness Check
would have prevented this occurrence? C. Check Digit
A. Output review control D. Key Verification
B. Storage/ retention control Answer: C
C. Report distribution control
D. Spooler file control 11. Limit Test is an application control that can
ANSWER: C be employed on
Input Process
6. Reconciling processing controls totals is an A. Yes ; No
example of B. Yes ; Yes
A. Processing control C. No ; Yes
B. Output control D. No ; No
C. Input control ANSWER: B
D. Both a and b
ANSWER: B 12. Computer information system application
controls include, except
A. Controls over input.
7. The following are the General Factors for B. Controls over processing and
Authenticating a subject, except; computer data files.
A. Something a person knows C. Controls over output.
B. Something a person needs D. Monitoring controls.
C. Something a person has ANSWER: D
D. Something a person is
ANSWER: B 13. Statement 1: Almost all of the input controls
can also serve as processing controls.
Statement 2: A record “key” is the group of
8. In the Access to program documentation values in a designated field that uniquely
objectives, the auditor should; identifies the record and no application process
A. Test to see that access to systems software is should be able to alter the data in these key
limited by terminal address. fields.
B. Interview the person responsible for access to A. Only Statement 1 is correct.
system software. B. Only Statement 2 is correct.
C. Observe the storage location of C. Both Statement 1 and Statement 2 are correct.
documentation if it is kept in printed form or D. Both Statement 1 and Statement 2 are
determine how access to on-line documentation incorrect.
is restricted. ANSWER: C
D. Test to see that there is a limit on the number
of unsuccessful attempts to sign on (or login).
14. Which of the following is not a possible test for
data extraction, filtering, and reporting in 18. Statement 1: Authorization is the method of
processing controls? controlling access of objects by the subject.
A. Review process to assess extracted data for Statement 2: Identification describes a method of
completeness and validity. ensuring that an object is the entity it claims to
B. Review access to set and amend configurable be.
parameters on interfaces. A. Only Statement 1 is True
C. Review supervisory assessment of output from B. Statement 2 is False
extract routine for evidence of regular review C. Both Statement 1 and Statement 2 are True
and challenges. D. Only Statement 2 is True
D. Review the design of the extract routine ANSWER: A
against the data files used.
ANSWER: B 19. Closed Loop Verification refers to
A. Presenting data for review before completing
15. Which of the following statement/s is/are the forms
correct? B. Tells the user that the account number that
I. Protection of information resources requires a has been input does not match.
well-designed set of controls. C. Present data for review after completing
II. Output controls establish that date are before submitting.
complete and accurate during the updating. D. Data is crossed reference to database.
III. All application controls are used in every ANSWER: C
information system.
IV. Some systems require more controls than 20. During data entry, the following are controls
others, depending on the importance of the that help the system verify the accuracy of a
data and nature of the application. product code entered by a user, except
A. I,II,III A. Reasonableness Check
B. I, III, IV B. Integrity Test or Validity Test
C. I only C. Closed Loop Verification
D. I and IV only D. Check Digit
ANSWER: D ANSWER: C

16. Which statement is incorrect regarding the 21. An employee in the receiving department
review of general CIS controls and CIS keyed in a shipment from a remote terminal and
application controls? inadvertently omitted the purchase order
A. The auditor should consider how these general number. What is the best input control to detect
CIS controls affect the CIS applications this error?
significant to the audit. A. Integrity test
B. General CIS controls that relate to some or B. Closed loop verification
all applications are typically interdependent C. Completeness test
controls in that their operation is often D. Reasonableness test
essential to the effectiveness of CIS ANSWER: C
application controls.
C. Control over input, processing, data files 22. In an automated payroll system, all
and output may be carried out by CIS personnel, employees in the finishing department were paid
by users of the system, by a separate control the rate of P75 per hour when the authorized
group, or may be programmed into application rate was P70 per hour. Which of the following
software. controls would have been most effective in
D. It may be more efficient to review the design preventing such an error?
of the application controls before reviewing A. Access controls which would restrict the
the general controls. personnel department’s access to the payroll
ANSWER: D master file data.
B. A review of all authorized pay rate changes by
17. Which of the following is an Access Control the personnel department.
Objective? C. The use of batch control totals by department.
A. Access to Security System D. A limit test that compares the pay rates per
B. Access to Product Documentation department with the maximum rate for all
C. Access to Program Production employees.
D. Access to On-line Systems ANSWER: D
ANSWER: D
23. Which of the following is an example of a Statament 2: Run control totals is both a
check digit? processing and output control.
A. An agreement of the total number of Statement 3: Control totals is an output control
employees to the total number of checks printed which refers to totals established beforehand for
by the computer. input and processing transactions.
B. An algebraically determined number A. Only 1 statement is correct
produced by the other digits of the employee B. Only 2 statements are correct.
number. C. All statements are correct.
C. A logic test that ensures all employee D. All statements are incorrect.
numbers are nine digits. ANSWER: B
D. An eight-digit combination that ends with the
number 7. 29. Which of the following statements is incorrect?
ANSWER: B A. General controls include all policies and
procedures an organization put in place.
24. An employee in the receiving department B. Specific controls are less effective at catching
keyed in a shipment from a remote terminal and errors than general controls.
inadvertently omitted the purchase order C. General controls serve as the foundation for
number. The best systems control to detect this the application controls.
error would be D. All statements are true.
A. Validity check ANSWER: B
B. Sequence test
C. Completeness test 30. Without the following documentation the
D. Reasonable test reviewer of the Access control may not be able
ANSWER: C to determine how access to systems software is
controlled, in what kind of restrictive area
25. A control that ensures that records are not systems software is kept, who are authorized to
added or lost during the processing runs. access and change systems software, and
A. Run-to-run total whether certain powerful utilities are being used
B. Error detection control to circumvent access controls to systems
C. Checkpoint restart capacity software, except;
D. Key Integrity A. Systems software
ANSWER: A B. Production programs and job control
language
26. Which of the following is not one of the main C. Security Camera footage
purposes of processing controls? D. Production data files
A. Prevention ANSWER: C
B. Detection
C. Correction 31. It is the least restrictive access control model
D. Authorization which allows multiple administrators to control
ANSWER: D access to a property.
A. Discretionary access control
27. The following are examples of output controls, B. Mandatory access control
except C. Discretionary Control System
A. Reconciling computer-produced output to D. Mandatory Control System
manual control totals ANSWER: A
B. Verifying dates and times of processing to
identify any out-of-sequence processing 32. Statement 1: Access controls are designed to
C. Reviewing process for validation and test allow unlimited access to documentation, files,
operation and programs.
D. Comparing a sample of transaction output to Statement 2: A weakness in or lack of access
input source documents controls decreases the opportunity for
ANSWER: C unauthorized modification to files and programs,
as well as misuse of the computer Hardware.
28. Which of the following statement/s is/are A. Statement 1 and Statement 2 are both correct
correct? B. Only Statement 1 is correct
Statement 1: Run control totals balance the total C. Only Statement 2 is correct
of transactions processed with total number of D. Both Statement 1 and Statement are incorrect
transactions input or output. ANSWER:D
33. Is Captcha, a program that tests users with vendor master file. A control which would
images, a form of integrity control? Select the prevent this error is a
best choice given. A. Validity check
A. No, because captcha only focuses on B. Range check
verifying that the user is a human and not C. Reasonableness test
automated bots. D. Limit check
B. No, because anyone can access captcha ANSWER: A
C. Yes, Because it can tell whether the user is a
robot or a human user. 38. In a computerized sales processing system,
D. None of the choices given. which of the following controls is most effective in
ANSWER: A preventing sales invoice pricing errors?
34. A manager’s password has been changed A. Sales invoices are reviewed by the product
due to numerous attempts by an unknown managers before being mailed to customers
person to gain access to his account. What B. Current sales prices are stored in the computer,
integrity control must be employed to prevent and, as stock numbers are entered from sales
the recurrence of the event? orders, the computer automatically prices the
A. Check Digit orders
B. Integrity Test or Validity Test C. Sales prices, as well as product numbers, are
C. Key Verification entered as sales orders are entered at remote
D. Closed Loop Verification terminal locations
ANSWER: C D. Sales prices are reviewed and updated on a
quarterly basis
35. In an e-commerce industry platform, a ANSWER: B
shipping address system was programmed to
employ an integrity control, focusing on 39. The following controls ensure that input data
reasonableness test. A customer ordered and has been processed accurately and completely,
the system indicated or has flagged the input which of the following is excluded?
address as being unusual. Given the situation, A. File extracts from debtors listing to provide
why might this control be essential to the industry? management with data on aged transactions.
A. To prevent users from entering invalid and B. Comparison of individual files to expected
fake addresses. dates, times, sizes, etc.
B. To cross reference addresses from a different C. Automated tracking and highlighting of
region. overrides to normal processes.
C. To validate the completeness of user profiles. D. All of the above are included
D. To ensure all addresses are from validated ANSWER: D
regions.
ANSWER: A 40. Which of the following statements is incorrect?
A. Test sample of listing transactions to validate
36. In the weekly computer run to prepare the appropriateness of aging processing.
payroll checks, a check was printed for an B. In the interface balancing, processes are
employee who had been terminated the reviewed to assess the extracted data for
previous week. Which of the following controls, if reasonableness and sequence.
properly utilized, would have been most effective C. Inspect evidence of match reports, checks,
in preventing the error or ensuring its prompt and error file processing to check balances on
detection? both systems match.
A. A control total for hours worked, prepared D. Access to override normal processes is
from time cards collected by the timekeeping reviewed for automated tracking and
department highlighting.
B. Requiring the treasurer's office to account ANSWER: B
for the number of the pre-numbered checks
issued to the CBIS department for the 41. It ensures that errors occurring in the
processing of the payroll individual transaction during the processing are
C. Use of a check digit for employee numbers rejected
D. Use of a header label for the payroll input A. Key verification
sheet B. Completeness check
ANSWER: A C. Error detection controls
D. Existence check
37. Accounts payable program posted a ANSWER: C
payable to a vendor not included in the on-line
42. Which of the following statements best D. A method of measuring that a subject is the
describes application controls? entity it claims to be
A. Application controls include automated ANSWER: C
procedures but not manual procedures.
B. Application controls include manual 48. A customer erroneously ordered Item No.
procedures but not automated procedures. 86321 rather than item No. 83621. When this
C. Application controls include both automated order is processed, the vendor’s system would
procedures and manual procedures. identify the error with what type of control?
D. None of the choices A. Key verification
ANSWER: C B. Closed loop verification
C. Checking digit
43. Which of the following is not used as a D. Item inspection
processing control? ANSWER: C
A. Control totals
B. Report distribution logs 49. An online banking system uses a check digit
C. Computer matching system as part of their security measures. How
D. Run control totals does this control contribute to the bank’s
ANSWER: A integrity controls?
A. To ensure the uniqueness of the client’s ID.
44. Which of the following examples illustrate B. To verify the correctness of the client’s
computer matching? account number.
A. Checking to make sure transactions are in the C. To cross check the client’s information with the
right format primary data.
B. Matching employee time cards with a payroll D. To review the necessary information needed
master file and report missing or duplicate time before submitting.
cards ANSWER: B
C. Balancing the total of transactions processed
with total number of transactions input or output 50. A customer is placing the information needed
D. Both b and c to complete an order form, what’s likely to occur
ANSWER: B after or when completing the form given integrity
controls are in place?
45. Which of the following is/are included as I. Reasonableness check is employed to verify
common access and security control? that the age entered is within the valid range.
I. Identification II. The completed form is presented for review
II. Authorization before the customer submits.
III. Verification III. The system flags the customer’s input due to
IV. Authentication an unidentified card number after making errors
A. I, II, & III placing account numbers.
B. II, III, & IV A. Only I
C. I, II, & IV B. Only I and II
D. I, II, IV, & IV C. All the given choices
ANSWER: C D. None of the choices given
ANSWER: C
46. Which of the following access control
model/design is best used for businesses that 51. Company A has recently converted its
emphasize security and confidentiality? manual payroll to a computer-based system.
A. Discretionary access control Under the old system, employees who had
B. Mandatory access control resigned or been terminated were occasionally
C. Role-Based Access Control kept on the payroll and their checks were
D. Rule-Based Access Control claimed and cashed by other employees, in
ANSWER: B collusion with shop foremen. The best control for
preventing this form of "payroll padding" would
47. Authentication is best described as, be to:
A. A method of ensuring that a subject is the A. Conduct exit interviews with all employees
entity it claims to be leaving the company, regardless of reason.
B. The method of controlling access of objects by B. Require foremen to obtain a signed receipt
the subject from each employee claiming a payroll check.
C. The method of proving the subject’s identity C. Require the human resources department to
authorize all hires and terminations, and to
forward a current computerized list of active C. Computer operations control include controls
employee numbers to payroll prior to processing. over the setup of computer processing jobs and
Program the computer to reject inactive computer operations and backup and recovery
employee numbers. procedures for processing that ends abnormally.
D. Install time clocks for use by all hourly D. Computer equipment should be specially
employees. protected against fires and extremes of
ANSWER: C temperature.
ANSWER: B
52. Computer based information system controls
are frequently classified as general controls and 56. The following are types of general controls,
application controls. Which of the following is an except
example of an application control? A. Software controls
A. Programmers may access the computer only B. Computer operation control
for testing and "debugging" programs C. Administrative controls
B. All program changes must be fully D. Run control totals
documented and approved by the information ANSWER: D
systems manager and the user department
authorizing the change 57. To review access controls, the reviewer does
C. A separate data control group is responsible not need to obtain copies of the automated logs
for distributing output, and also compares input or journals that record/monitor access to the
and output on a test basis following, except;
D. In processing sales orders, the computer A. Vault password
compares customer and product numbers with B. Production documentation and job control
internally stored lists language
ANSWER:D C. Production data files
D. Critical application controls
53. A checkpoint restart capacity control ANSWER: C
A. ensures transactions are in the correct order
B. ensures application processes are in place 58. Which of the following is not an example of
and cannot be altered. the general factors for authenticating a Subject?
C. allows to match the source documents for A. Biometric
verification B. Password
D. allows the job to restart from the point of C. Access Card
interruption. D. Paraphrase
Answer: D. ANSWER: D

54. Which of the following statements is incorrect? 59. Statement 1: Integrity controls are primarily
Statement 1: Table maintenance controls are concerned with maintaining the confidentiality
reviewed to determine who can change edits of sensitive information. Statement 2: Closed loop
and the tolerance level. verification is a type of integrity control
Statement 2: Input value and output values are A. Both statements are correct
compared for most of the scenarios by walk B. Only statement 1 is correct
through and re-performance C. Only statement 2 is correct
A. Only Statement 2 is correct. D. Both statements are correct
B. Only Statement 1 is correct. ANSWER: C
C. Both Statement 1 and Statement 2 are correct.
D. Both Statement 1 and Statement 2 are 60. Statement 1: Closed-Loop verification ensures
incorrect. that users can modify their responses after
Answer: B submitting a survey.
Statement 2: The primary purpose of closed loop
55. Which of the following statements is incorrect? verification is to present data for user review final
A. Software controls are used to monitor the use submission.
of system software and prevent unauthorized A. Statement 1 is correct
access of software programs, system software, B. Both Statement are correct
and computer programs. C. Statement 2 is correct
B. Data security controls ensure that valuable D. None of the statements are correct
business data files on either disk or tape are Answer: C
subject to unauthorized access, change, or
destruction while they are in use or in storage.
CAATTs 1. What is the purpose of parallel simulation in
Computer Assisted Audit Techniques ?
Introduction Questions a. To identify key features or processes of the
1. Which of the following least describes program under review
Computer Assisted Audit Techniques (CAATs)? b. To reprocess transactions that were previously
a. A software program used by auditors to processed by client's program
automate financial statements. c. To compare results obtained from the
b. A set of tools and techniques that auditors use simulation with the client's output
to collect and analyze data from computer d. To write a program that simulates the client's
systems. program
c. An advanced algorithm used to detect Answer: B
financial fraud.
d. A training program designed to teach auditors 2. The following are advantages of Parallel
how to use computers effectively. Simulation, except
Answer: D a. To emphasize exception helps auditor to focus
on items where there are differences
2. Computer Assisted Audit Techniques may be b. The size of the sample can be greatly
used in performing various auditing procedures, expanded at relatively little additional cost
except c. Significantly cost of audit programming if
a. Test of details of transactions and balances written uniquely for one client
b. Test of general controls d. Enables the valuation of effects of nonexistent
c. Analytical Procedures control procedures
d. Examination or Inspection of evidence Answer: C
Answer: D
3. This is a technique used for Program Analysis
3. What is the purpose of introducing Computer- a. Systems Control Audit Review Files (SCARF)
Assisted Audit Techniques (CAATs) in the auditing b. The Oracle
process? c. Parallel Simulation
a. To replace human auditors with automated d. Test Data
systems Answer: C
b. To improve the efficiency and effectiveness of
auditing procedures 4. Which of the following methods of testing
c. To eliminate the need for financial statements application controls utilizes a generalized audit
and reporting software package prepared by the auditors?
d. To increase the complexity of auditing a. Parallel simulation
procedures b. Integrated testing facility approach
Answer: B c. Test data approach
d. Exception report tests
4. When computerized accounting systems Answer: A
perform tasks for which no visible evidence is
available, what can auditors use to test these 5. The output of a parallel simulation should
tasks, especially when an entity uses advanced always be
CIS? a. Printed on a report.
a. Physical inspection b. Compared with actual results manually.
b. Manual reconciliation c. Compared with actual results using a
c. Computer Assisted Audit Techniques comparison program.
d. Analytical procedures d. Reconciled to actual processing output.
Answer: C Answer: B

5. What types of data can auditors use 6. What are some potential disadvantages or
Computer Assisted Audit Techniques to process limitations of using parallel simulation for auditing
as part of the audit procedures? computer systems?
a. Only transaction data a. It is time consuming to perform
b. Only data related to general controls b. Client and auditor software may be
c. Only data stored in the accounting system incompatible
d. Both transaction data and other types of data c. Tracing output differences to program
Answer: D differences is difficult
d. All of the above
Techniques for Program Analysis Answer: D
 Techniques for Program Testing
7. What are some of the main functions and uses 1. Program testing
of parallel simulation in auditing computer a. involves individual modules only, not the full
systems? system
a. To perform substantive testing of account b. requires creation of meaningful test data
balances c. need not be repeated once the system is
b. To gather evidence on client application implemented
control d. is primarily concerned with usability
c. To verify calculations like depreciation and Answer: B
interest
d. All of the above 2. An auditor used test data to verify the
Answer: D existence of controls in a certain computer
program. Even though the program performed
8. What auditing technique requires the auditor well on the test, the auditor may still have a
to write a program that simulates key aspects of concern that
the client's system? Transaction data is then a. The program tested is the same one used in
processed through both the auditor's simulation the regular production runs.
and the client system, and the outputs are b. Generalized audit software may have been a
compared. better tool to use.
a. Integrated test facility c. Data entry procedures may change and
b. Parallel simulation render the test useless.
c. Validation testing d. The test data will not be relevant in
d. Client simulation subsequent audit periods.
Answer: B Answer: A

9. What is the step-by-step involved in setting up 3. Increasing the effectiveness of auditing

a parallel simulation for auditing a computer software will
system? a. increase control risk.
a. The auditor writes a program simulating key b. increase detection risk.
processes, understands the application c. reduce detection risk.
functionality, identifies critical processes, creates d. reduce control risk.
the simulation, runs it on test data, and evaluates Answer: C
the results.
b. The auditor examines program code, designs 4. Which statement is incorrect regarding the
test data, traces data flow, compares output to evaluation of general CIS controls and CIS
expectations, documents controls, and writes application controls?
recommendations. a. The general CIS controls may have a
c. The auditor interviews IT staff, reviews user pervasive effect on the processing of
manuals, categorizes systems by risk level, transactions in application systems.
samples transactions, tests general controls, and b. If general CIS controls are not effective, there
writes an audit report. may be a risk that misstatements might occur
d. The auditor assesses infrastructure, catalogs and go undetected in the application systems.
databases, performs network penetration testing, c. Manual procedures exercised by users may
checks backup schedules, verifies encryption is provide effective control at the application level
enabled, and writes an audit memo. d. Weaknesses in general CIS controls cannot
Answer: A preclude testing certain CIS application controls.
Answer: D
10. In parallel simulation, the auditor writes a
program that simulates key aspects of the client's 5. After the preliminary phase of the review of a
system. Test data is run through both the auditor's client's EDP controls, an auditor may decide not
simulated program and the client's actual system. to perform tests of controls (compliance tests)
What does the auditor compare the outputs of related to the control procedures within the EDP
these two programs in order to evaluate? portion of the client's internal control structure.
a. System accessibility Which of the following would not be a valid
b. Network security reason for choosing to omit such tests?
c. Program reliability a. The controls duplicate operative controls
d. Backup readiness existing elsewhere in the structure.
Answer: C
b. There appear to be major weaknesses that b. Write a computer program that simulates the
would preclude reliance on the stated logic of the client's access control software.
procedure. c. Extract a random sample of processed
c. The time and costs of testing exceed the time transactions and ensure that the transactions
and costs in substantive testing if the tests of were appropriately authorized.
controls show the controls to be operative. d. Examine statements signed by employees
d. The controls appear adequate. stating that they have not divulged their user
Answer: D identifications and passwords to any other
person.
6. Which of the following client electronic data Answer: A
processing (EDP) systems generally can be
audited without examining or directly testing the 10. It is a computer program (a block of
EDP computer programs of the system? executable code) that attaches itself to a
a. A system that performs relatively legitimate program or data file and uses it as a
uncomplicated processes and produces transport mechanism to reproduce itself without
detailed output. the knowledge of the user.
b. A system that affects a number of essential a. Virus
master files and produces a limited output. b. Utility program
c. A system that updates a few essential master c. System management program
files and produces no printed output other than d. Encryption
final balances. Answer: A
d. A system that performs relatively complicated
processing and produces very little detailed Techniques for Continuous Testing
output. 1. Genesis, the auditor, sets an embedded audit
Answer: A module to record all credit transactions in excess
of P100,000 and store the data in an audit log.
7. Misstatements in a batch computer system Genesis is using
caused by incorrect programs or data may not a. An integrated test facility.
be detected immediately because b. The snapshot technique.
a. Errors in some transactions may cause c. A system control audit review file (SCARF).
rejection of other transactions in the batch. d. Audit hooks.
b. The identification of errors in input data Answer: C
typically is not part of the program.
c. There are time delays in processing 2. Cordova, the auditor, sets an embedded
transactions in a batch system. audit module to flag all credit transactions in
d. The processing of transactions in a batch excess of P100,000. The flag causes the system
system is not uniform. state to be recorded before and after each
Answer: C transaction is processed. Cordova is using
a. An integrated test facility.
8. Which of the following best describes a b. The snapshot technique.
fundamental control weakness often associated c. A system control audit review file (SCARF).
with electronic data processing systems? d. Audit hooks
a. EDP equipment is more subject to system error Answer: B
than manual processing is subject to human error.
b. Monitoring is not an adequate substitute for 3. In an organization, Auditor wants to collect
the use of test data. evidence based on system user profiles; which
c. EDP equipment processes and records similar CAATT can be used by the auditor to achieve
transactions in a similar manner. the objective
d. Functions that would normally be separated in a. CIS
a manual system are combined in the EDP b. Audit Hooks
system like the function of programmers and c. Audit Trails
operators. d. SCARF
Answer: D Answer: D

9. To obtain evidence that user identification and 4. What is the term for an embedded audit
password control procedures are functioning as facility in a computerized accounting system
designed, an auditor would most likely that consists of program code or data provided
a. Attempt to sign on to the system using invalid by an auditor? This designates certain files as
user identifications and passwords. sensitive, logs transactions above a threshold
value to a special audit file, and restricts
alteration of that file to external auditors. 4. When designing test data, there are several
a. Integrated test facility approaches the auditor can use. Which of the
b. SCARF following is NOT a recommended approach?
c. Threshold logging A) Using living data and checking controls and
d. External audit trail processing
Answer: B B) Using dummy data in normal production
5. What auditing technique involves capturing systems but not releasing output to live database
snapshot images of a transaction as it flows general ledger
through different processing stages in a C) Using dummy data in a special run on an
computer system? This allows auditors to image copy of the database
evaluate the various processes applied to the D) Using dummy data in normal production and
data. allowing output to update the live database
a. Integrated test facility general ledger
b. Transaction staging Answer: D
c. Snapshot
d. Process tracking 5. When designing test data for an integrated
Answer: C test facility, auditors can utilize different
approaches. What is the term for an all-inclusive
Techniques for Review of Operating Systems and set of test data meant to evaluate every possible
other Systems data and processing condition?
1. What auditing technique has an objective to A) Sample data set
determine whether a client's computer program B) Comprehensive data set
can properly process transactions with both valid C) Base case system evaluation (BCSE)
and invalid conditions as they arise? D) Integrated data set
a. Compliance testing Answer: C
b. Test data
c. Code inspection 6. What type of test data is used to perform an
d. Output review electronic walk through of an application's
Answer: B internal logic? This traces test data through all
processing steps and listings out all lines of code
2. In a test data, the auditor creates valid and executed.
invalid test data to run through the client's system. a. Comprehensive data set
The auditor compares the actual output to b. Base case system evaluation
predetermined expected output. If the actual c. Integrated data set
output matches the expected, what can the d. Tracing
auditor conclude? Answer: D
A) The program contains no logical errors
B) The output is accurately calculated 7. What technique integrates the processing of
C) The program is reliable in handling different fictitious test data transactions with actual client
conditions data transactions? This allows the auditor to
D) There are adequate input controls evaluate reliability without management's
Answer: C awareness. Output related to the fake entities is
compared to predetermined results.
3. Test data technique involves an auditor a. Test data
designing test data with valid and invalid b. Integrated test facility (ITF)
conditions to process through a client's computer c. Base case system evaluation (BCSE)
program. The objective is to evaluate the d. Process walkthrough
effectiveness of internal controls in the program Answer: B
to properly handle different conditions. The
auditor compares the program output to 8. The following are advantages of using
predetermined expected results. What should Integrated test facility (ITF), except
effective test data include? a. Testing can be unscheduled and unknown to
a. Possible input errors only other staff.
b. Logical processes only b. Economically tested without disrupting the
c. Irregularities only user's operations and without the intervention of
d. Possible input errors, logical process, and computer services personnel.
irregularity c. Supports continuous monitoring of controls.
Answer: D
d. The potential of corrupting data files with test c. Providing solutions for finance professionals
data that may end up in the financial reporting d. Focusing on tax authorities worldwide
process. Answer: B
Answer: D
5. How is the reporting format determined when
9. The following are some potential using Generalized Audit Software (GAS)?
disadvantages or limitations of using test data in a. Specified by the auditor
auditing computer systems, except b. Automatically generated by the software
a. It is expensive to construct and manually c. Randomly selected by the computer
predetermine output d. Not specified, left to the discretion of the
b. It only tests controls, not other areas software
c. Usually fairly simple to operate Answer: A
d. All of the above
Answer: C 6. How is the computer-assisted audit tool
commonly used in the audit process?
10. In an integrated test facility, the auditor a. Documenting audit evidence
creates fake entities or units in the client's live b. Identifying anomalies, errors, and omissions in
system and processes test data through them. data
What does the auditor then compare the output c. Creating custom storage media
for those dummy units to in order to evaluate the d. Developing on-the-fly audit techniques
system? Answer: B
a. Sample data output
b. Previous test data runs 7. What is Audit Command Language (ACL)?
c. Predetermined expected results a. A network security tool that performs
d. Other employee outputs penetration testing
Answer: C b. A data analysis software that can test 100% of
available data
Generalized Audit Softwares c. A database auditing tool that examines
1. What is the commonly used example of storage and access
generalized audit software? d. A scripting language for automating audit
a. CAAT procedures
b. IDEA Answer: B
c. COBIT
d. None of the above 8. What is Interactive Data Extraction and
Answer: A Analysis (IDEA) software used for in auditing?
a. Automating the extraction of data from
2. What is the primary purpose of audit databases and files for analysis
command language (ACL)? b. Reviewing network and system logs for security
a. Sample data for analysis issues
b. Remain current with changing technology c. Testing backup and recovery systems
c. Perform analysis and audit tests on 100% of d. Submitting audit reports to tax authorities
available data Answer: A
d. Identify potential fraud patterns through
random sampling 9. How does the Computer-Assisted Audit Tool
Answer: C (CAAT) assist IT Auditors in obtaining evidence?
a. By generating large quantities of data
3. Who are the main users of Interactive Data b. By maintaining application systems
Extraction & Analysis (IDEA)? c. By providing direct access to computerized
a. Only tax authorities records
b. Finance professionals d. By documenting evidence indirectly
c. Auditors and compliance professionals Answer: C
d. Industry practitioners and tax authorities
Answer: C 10. What type of software can auditors use to set
up parallel simulations?
4. In addition to audits, what is another significant a. Penetration testing tools
use of IDEA? b. Generalized audit software
a. Conducting random data analyses c. Network monitoring packages
b. Interrogating taxpayer transactions and d. IT operations analytics
system data Answer: B
 a. Auditors can learn the software in a short
Functions of GAS period of time.
1. Generalized audit software could not be used b. It can be applied to a variety of clients after
for the following audit task detailed customization.
a. Test calculations and make computations c. It can be applied to a variety of clients with
b. Evaluate control risk assessment minimal adjustments to the software.
c, Summarize, re-consequence and reformat d. It greatly accelerates audit testing over
data manual procedures.
d. Compare audit evidence from manual audit Answer: B
procedures to company needs
Answer: B 7. What is the primary function of GAS related to
file or database access?
2. The essential advantages of a generalized a. Performing arithmetic calculations
audit software package would not include b. Extracting data for further audit testing
a. Same software can be used in various client’s c. Generating reports
computer systems d. Conducting statistical analysis
b. Large number of GAS packages are currently Answer: B
available
c. Software packages are inexpensive 8. When is the function to compare data on
d. Ability to control and modify program to separate files useful?
auditor’s need Answer: C a. Examining records for correctness
b. Preparing various documents and reports
3. The use of generalized audit software c. Determining compatibility between
package information on separate files
a. Relieves an auditor of the typical tasks of d. Supporting various types of audit sampling
investigating exceptions, verifying sources of Answer: C
information, and evaluating reports.
b. Is a major aid in retrieving information from 9. Which of the following are common functions
computerized files. Generalized Audit Software (GAS) can perform
c. Overcomes the need for an auditor to learn to assist auditors?
much about computers. a. Arithmetic calculations on transactions and
d. Is a form of auditing around the computer. databases
Answer: B b. Statistical analysis like audit sampling methods
c. Generate customized audit reports
4. Test data, integrated test data and parallel d. All of the above
simulation each require an auditor to prepare Answer: D
data and computer programs. CPAs who lack
either the technical expertise or time to prepare 10. What is highlighted as a disadvantage of GAS
programs should request from the manufacturers in terms of verifying programming logic?
or EDP consultants for a. Reduced risk by testing entire populations
a. The program Code b. High initial cost of development
b. Flowchart checks c. Limited ability due to directed application to
c. Generalized audit software client files
d. Application controls Answer: C d. Involvement in auditing while data is being
processed
5. Which of the following tasks could not be Answer: C
performed when using a generalized audit
software package? CAATTs (3RDYR)
a. Selecting inventory items for observations.
b. Physical count of inventories. Techniques for Program Analysis Parallel
c. Comparison of inventory test counts with Simulation
perpetual records. 1. The following statements pertain to the audit
d. Summarizing inventory turnover statistics for objective and scope for entities that uses
obsolescence analysis. Computerized Information System.
Answer: B
I. The overall objective and scope of the audit
6. Which of the following is not seen as an changes when the audit client employs
advantage to using generalized audit software computers.
(GAS)?
II. The auditors' evaluation of the entity's internal D. Parallel simulation
controls as well as their substantive tests are Answer: B
affected when the audit client employs
computerized information system. 7. Which of the following statements is/are false?
A. Only statement I is correct Statement 1: The overall objectives and scope of
B. Only statement II is correct an audit do not change when an audit is
C. Both statements are correct conducted in a computer information
D. Both statements are incorrect technology (IT) environment.
Answer: B Statement 2: CAATs may improve the
effectiveness and efficiency of auditing
2. Computer programs and data that the auditor procedures.
may use as part of the audit procedures to A. Statement 1
process data of audit significance contained in B. Statement 2
an entity's information system are called: C. Both statements are correct
A. CAATs D. Both statements are incorrect
B. DEERS Answer: C
C. DOOGS
D. FUUDS 8. Which of the following is not one of the factors
Answer: A to consider in using CAAT?
A. Degree of technical competence in CIS
3. When forming necessary audit conclusions B. Availability of CAATs
regarding the impact of the computerized C. Impracticability of computerized tests
accounting system on the audit client, the D. Timing of tests
auditor can: Answer: C
A. Delegate its responsibility to the internal audit
team of the audit client so that the audit is done 9. Which of the following is not one of the
efficiently. common applications of CAATs?
B. Never delegate his responsibility. A. Testing large volumes of data accurately and
C. Ignore the impact of the computerized quickly
accounting system for as long as the financial B. Testing automated controls such as
records are available. configuration parameters, or general IT controls
D. All of the choices are incorrect. such as passwords
Answer: B C. Testing transactions and balance calculations
D. Testing the printouts from the system which
4. An auditor most likely would test for the could be incorrect
presence of unauthorized computer program Answer: D
changes by running a:
A. Black box approach 10. Which of the following statements is false?
B. Validation check Statement 1: In contrast to the test data and IFT
C. Source code comparison program techniques which require the auditor to create
D. Programs that compute the hash totals test inputs (data) and process these data using
Answer: C the client’s computer program, parallel
simulation requires the auditor to write a program
5. An entity has recently converted its payroll that simulates key features of the program under
system from a manual processing to an online, review.
real-time processing system. Which is the most Statement 2: Parallel simulation is then used to
probable result associated with the conversion to reprocess transactions that were previously
the new computerized processing system? processed by the auditor’s program, and
A. Less segregation of traditional duties. compares the results from the simulation.
B. Increase in processing time. Statement 3: If an entity’s control has been
C. Reduction of information risk. operating efficiently, the client’s software should
D. Increase in processing errors. generate the same expectations as the auditor’s
Answer: A software.
Statement 4: Program tracing is a technique in
6. Which of the following is not a common type of which the instruction executed is listed along with
white box approach? control information affecting that instruction.
A. Test data A. Statement 1
B. Auditing around the computer B. Statement 2
C. Integrated test facility C. Statement 3
D. Statement 4 A. Is more applicable to independent audits
Answer: B than internal audits.
B. Involves introducing simulated transactions
11. Which of the following statements is false? into the client’s actual application programs.
Statement 1: Program analysis allows the auditor C. Is a commonly used audit technique for
to gain an understanding of the client’s program. auditing around the computer.
Statement 2: Parallel simulations are relatively D. Should not involve the actual application
time-consuming and require a high level of programs the client uses throughout the year
computer expertise. Hence, they are infrequently since use of the actual programs would
used in financial statement audits. contaminate the client’s accounting data.
A. Only statement I is incorrect ANSWER: A
B. Only statement II is incorrect
C. Both statements are correct 16. An integrated text facility (ITF) would be
D. Both statements are incorrect appropriate when the auditor needs to
Answer: B A. Trace a complex logic path through an
application system.
12. Which of the following statements is/are false? B. Verify processing accuracy concurrently with
Statement 1: Snapshot involves actual analysis of processing.
the logic of the program’s processing routines. C. Monitor transactions in an application system
Statement 2: Comparison programs allow the continuously.
auditor to compare computerized files. D. Verify load module integrity for production
A. Statement 1 programs.
B. Statement 2 ANSWER: B.
C. Both statements are correct
D. Both statements are incorrect 17. A primary reason auditors are reluctant to use
Answer: A an ITF is that it requires them to
A. Reserve specific master file records and
Techniques for Program Testing process them at regular intervals
13. It involves the application of auditing B. Collect transaction and master file records in a
procedures using the computer as an audit tool. separate file
This includes computer programs and data the C. Notify user personnel so they can make
auditor uses as part of the audit procedures to manual adjustments to output
process data of audit significance contained in D. Identify and reverse the fictitious entries to
an entity's information systems. avoid contamination of the master file
A. Test data approach ANSWER: D.
B. Computer-assisted audit techniques
C. Generalized audit software 18. TMSP Corporation has numerous customers. A
D. Auditing around the computer customer file is kept on disk storage. Each
ANSWER: B. account in the customer file contains name,
address, credit limit, and account balance. The
14. Which of the following best describes the test auditor wishes to test this file to determine
data approach? whether credit limits are being exceeded. The
A. Auditors process their own data using the best procedure for the auditor to follow would
client’s computer system and application be to:
program. A. Develop test data that would cause some
B. Auditors process their own test data using their account balance to exceed the credit limit and
own computers that simulate the client’s determine if the system properly detects such
computer system. situations.
C. Auditors use auditor-controlled software to do B. Develop a program to compare credit limits
the same operations that the client’s software with account balance sand print out the details
does, using the same data files. of any account with a balance exceeding its
D. Auditors use client-controlled software to do credit limit.
the same operations that the client’s software C. Require a printout of all account balances so
does, using auditor created data files. they can be manually checked against the
ANSWER: A. credit limits.
D. Request a printout of a sample of account
15. When auditing a computerized system, an balance so they can be individually checked
auditor may use the test data approach as an against the credit limits.
audit tool. This technique ANSWER: B.
 C. Data entry procedures may change and
19. Which of the following is a disadvantage of render the test useless.
the integrated test facility approach? D. The test data will not be relevant in
A. In establishing fictitious entities, the auditor subsequent audit periods
may be compromising audit independence. ANSWER: A.
B. Removing the fictitious transactions from the
system is somewhat difficult and, if not done 24. The test data method is used by auditors to
carefully, may contaminate the client’s files. test the
C. ITF is simply an automated version of auditing 25. A. Accuracy of the input data
“around” the computer. B. Validity of the output
D. The auditor may not always have a current C. Procedures contained within the programs
copy of the authorized version of the client’s D. Normalcy pf distribution of test data.
program. ANSWER: C.
ANSWER: B.
Techniques for Continuous Testing
20. Which of the following statements is not true 25. Snapshots help in continuous testing by
to the test data approach when testing a A. Automating data analysis
computerized accounting system? B. Identifying behavioral anomalies in users
A. The test needs to consist of only those valid C. Assess authenticity of processing
and invalid conditions which interest the auditor. D. Generating compliance reports
B. Only one transaction of each type need be Answer: C
tested.
C. The test date must consist of all possible valid 26. The computer process whereby data
and invalid conditions. processing is performed concurrently with a
D. Test data are processed by the client’s particular activity and the results are available
computed programs under the auditor’s control. soon enough to influence the course of action
ANSWER: C. being taken or the decision being made is
called:
21. When an auditor test a computerized A. Random access sampling
accounting system, which if the following is true B. On-line, real-time system
of the test data approach? C. Integrated data processing
A. Several transactions of each type must be D. Batch processing system
tested. Answer: B
B. Test data must consist of all possible valid and
invalid conditions. 27. Which of the following computer-assisted
C. The program tested is different from the audit techniques inserts an audit module in the
program used throughout the year by the client. client’s application system to identify specific
D. Test data should include data that the client’s types of transactions?
system should accept or reject. A. Parallel Simulation testing
ANSWER: D. B. Test Data approach
C. Embedded Audit Module
22. Which of the following is NOT a common type D. Generalized Audit Software testing
of white box approach? Answer: C
A. Test data
B. Auditing around the computer 28. What does the auditor use to continuously
C. Integrated test facility monitor the system and collect audit evidence
D. Parallel simulation while live data are being processed?
ANSWER: B. A. Analysis of program logic
B. Concurrent auditing techniques
23. An auditor used test data to verify the C. Test data processing
existence of controls in a certain computer D. Micro-computer-aided auditing approach
program. Even though the program performed Answer: B
well on the test, the auditor may still have a
concern that 29. Audit automation would least likely include
A. The program tested is the same one used A. Expert systems
in the regular production runs. B. Tools to evaluate a client’s risk management
B. Generalized audit software may have been a procedures
better tool to use. C. Corporate and financial modeling programs
for use as predictive audit tests
D. Manual working papers 35. Which of the following is not one of the three
Answer: D categories of testing strategies when auditing
through the computer?
30. Which statement is incorrect regarding A. Test data approach
CAATs? B. Parallel simulation
A. CAATs are often an efficient means of testing C. Pilot simulation
a large number of transactions or controls over D. Embedded audit module
large populations. Answer: C
B. To ensure appropriate control procedures,
the presence of the auditor is not necessarily 36. On-line real-time systems and electronic
required at the computer facility during the data interchange systems have the advantages
running of a CAAT. of providing more timely information and
C. The general principles outlined in PAPS 1009 reducing the quantity of documents
apply in small entity IT environments. associated with less automated systems. The
D. Where smaller volumes of data are advantages, however, may create some
processed, the use of CAATs is more cost problems for the auditor. Which of the following
effective. characteristics of these systems does not create
Answer: D an audit problem?
A. The lack of traditional documentation of
31. Which of the following is not an example transactions creates a need for greater
of a computer-assisted audit technique attention to programmed controls at the point
A. Disk operating systems of transaction input
B. Integrated test data B. Hard copy may not be retained by the client
C. Audit modules for long periods of time, thereby necessitating
D. Audit hooks more frequent visits by the auditor
Answer: A C. Control testing may be more difficult given
the increased vulnerability of the client's files to
32. Embedded audit modules are segments of destruction during the testing process
program code that D. Consistent on-line processing of recurring
A. perform audit functions data increases the incidence of error
B. store transaction data Answer: D
C. generate reports
D. all of the above Techniques for Review of Operating Systems and
Answer: D Other Systems
37. An integrated group of programs that
33. Continuous and Intermittent Simulation supports the applications and facilitates their
embeds an audit module in a access to specified resources is called a(n)
A. database management system A. Operating system
B. application system B. Database management system
C. transaction log C. Utility system
D. all of the above D. Facility system
Answer: A Answer: A.

34. Which of the following statements is false? 38. The following are microcomputer-based
A. Continuous testing can improve data quality access control packages except
but not significantly reduce the risk of fraud I. TRAQNET 2000
B. Continuous testing can lead to more efficient II. STOPLOCK IV
use of resources but may increase audit costs III. RACF
initially IV. ACF2
C. Continuous testing can reduce the workload A. I
of traditional auditors but not eliminate the need B. I and II
for their expertise C. II and III
D. Continuous testing can provide real-time D. III and IV
insights and proactive risk mitigation but not Answer: D.
significantly improve detection of past errors
Answer: A 39. Which of the following best describes system
software?
A. Systems software provides programmed 43. What is the widely used logging function
services that perform management and control which is IBM’s log for the OS system?
functions for the computer system as a whole. A. Data Management Facility
B. Systems software provides programmed B. Systems Management Facility
operations and services that perform C. Electronic System Management Facility
management and control functions for the D. Electronic Data Management System Facility
computer system as a whole. Answer: B.
C. Systems software provides programmed
services that perform management, organization, 44. Depending on the type of job accounting
and control functions for the computer system as software and how it is implemented at the
a whole. location under review, the auditor can?
D. Systems software provides programmed and I. review the reports produced by the client in
secured services that perform management and normal processing
control functions for the computer system as a II. use the software to generate special reports
whole. directly
Answer: A. III. use the software to create a file of requested
utilization data that can be analyzed selectively
40. Which of the following statements is true? IV. use the software to produce consolidated
A. The auditor may wish to review the structure of reports that will be used to evaluate client’s
the systems software in use throughout the control procedures
period under review to gain an understanding of A. I only
the operating (and thus the potential control) B. I and II
environment represented by the encoded and C. I, II, and III
programmed systems. D. I, II, III, and IV
B. Restricted access to systems-changing utilities Answer: C.
and privileged operations modes is not essential
at all. 45. Analysis of the job accounting files may be
C. Review of systems logs and scanning program aided by the use of the following except
libraries for unexplained changes are not A. generalized audit software
computerized techniques. B. specific audit procedure software
D. Adequate segregation of duties between C. specialized audit programs
systems programming and other elements of the D. additional software packages developed
EDP (Electronic Data Processing) environment specifically for this purpose
(operations and application programming) is an Answer: B.
important protection against unauthorized
changes to the operating system. 46. Which of the following statements is true?
Answer: D. I.The operating systems provide routines to
manage, organize, control, and log the activities
41. This can be used by the auditor as a software for these libraries.
tool to review operating systems' performance II. The ZAP utility is a project within an operating
and interrogate operating systems files and system that can be used to change data or
libraries. programs directly, bypassing normal controls
A. CA-EXAMINE over program or data file changes.
B. FOCUS III. At a minimum, the library management
C. BASIC software should log all changes to programs,
D. SQL program modules, and job control language.
Answer: A. A. Statement I only
B. Statement II only
42. These monitoring programs retrieve and C. Statement III only
analyze system parameters and control D. None of the above
information that allow the auditor to assess the Answer: C.
control functions incorporated within the
operating system, except 47. What are the packages that provide
A. FOCUS functions such as logging code changes and
B. SAS maintaining copies of various versions of
C. CA-EXAMINE programs?
D. COBOL A. JCL and ZAP utility
Answer: D. B. CA-Librarian and Pan Valet
C. SQL and C++
D. CA-Examine and SMF 52. What kind of samples can be selected from
Answer: B. data files using Generalized Audit Software (GAS)?
A. Stratified statistical samples
48. Which of the following statements is false? B. Non-representative samples
I.Access and security software supplements the C. Random samples only
physical security and control measures in use in D. Extreme value samples
an installation. Answer: A.
II.Access control and security software is
designed to restrict access to systems resources 53. Which of the following shows a correct flow of
to authorized personnel. using GAS in accessing complex file structure?
III. Most programmed access/security provisions A. Flat file → GAS → transaction list
depend on some form of password or user B. Database records → DBMS utility program →
identification, usually implemented on a GAS → Flat file → transaction list
nonhierarchic basis. C. Database records → DBMS utility program →
A. Statement I Flat file → GAS → transaction list
B. Statement II D. Database records → GAS → DBMS utility
C. Statement III program → Flat file → transaction list
D. None of the above Answer: C.
Answer: C.
54. Which of the following statements is true
Generalized Audit Software about the use of GAS in accessing simple
49. What is the most widely used CAATT for IS structures?
auditing? I.GAS selects the sample records from a flat file
A. Parallel simulation and prepares a report containing the needed
B. Generalized Audit Software information
C. Embedded Audit Module II.A flat file is produced by a database
D. Mainframe system management system utility features
Answer: B. III. Auditor determines selection criteria and key
fields to be retrieved by GAS from a flat file
50. Which of the following shows some common A. I only
uses for Generalized Audit Software (GAS)? B. I and II
I.Comparing multiple files and identifying any C. I and III
differences D. All of the above
II. Footing and balancing entire files or selected Answer: C.
data items
III. Printing confirmations in either standardized or 55. What is the primary problem for the auditor
special wording when using GAS to access complex structures?
IV.Selecting and reporting detailed data A. Not all GAS products on the market may be
contained in files capable of accessing every type of file structure
A. I, II B. Limited knowledge and experience of auditors
B. I, II, IV for accessing complex structure
C. I, II, III C. GAS languages are complex to use, thus it
D. All of the above require substantial computer background on the
Answer: D. part of the auditor
D. Dependence on the client’s computer service
51. The widespread popularity of GAS is due to staff for performing tests
the following factors, except: Answer: A.
A. GAS languages are easy to use and require
little computer background on the part of the 56. What is the best course of action might
auditor auditors take if the GAS they are using cannot
B. Many GAS products can be used on both access a complex file structure?
mainframe and PC systems A. Ignore the data and proceed with the audit
C. Auditors can perform their tests dependent of without it
the client’s computer service staff B. Appeal to systems professionals to write a
D. GAS can be used to audit the data stored in special program to convert the structure into a
most file structures and formats flat-file format
Answer: C. C. Request additional training on using GAS to
widen auditor’s computer background and
technical expertise
D. Both B and C
Answer: B.

57. In accessing an inventory flat file, the

following are the key information needed for the
audit that GAS can extract, except:
A. Warehouse employee salaries
B. Warehouse location
C. Quantity on hand
D. Dollar value
Answer: A.

58. An entity needs to extract data and integrate

in a hierarchical arrangement from its three
related files, namely: customer, sales invoice,
and line item. Which of the following is correct?
A. It eliminates the need for auditors to employ
flattening process
B. Alternative files should be used instead
C. There is no need to extract data from these
files
D. Extracting audit evidence using GAS may be
difficult
Answer: D.

59. Which of the following statements is/are

correct?
I. The auditor must never rely on computer
services personnel to produce a flat file from the
complex file structures.
II. Risk of data integrity should not be a concern
for an entity in the procedure of creating the flat
file.
A. I only
B. II only
C. Both I and II
D. None of the above
Answer: D.

60. In the creation of flat files, certain fraudulent

accounts in the complex structure may be
intentionally omitted making the samples drawn
unreliable. How can auditors avoid this risk?
A. Auditors can do nothing about it
B. Write their own data extraction routines
C. Outsource the task to third-party vendors
D. Conduct manual data entry for accuracy
assurance
Answer: B