AUDITING IN A COMPUTERIZED ENVIRONMENT

1. Which statement is incorrect when auditing in d. Significance

a CIS environment?
a. A CIS environment exists when a 5. Which of the following least likely indicates a
computer of any type or size is complexity of computer processing?
involved in the processing by the entity a. Transactions are exchanged
of financial information of significance electronically with other organizations
to the audit, whether that computer is without manual review of their
operated by the entity or by a third propriety.
party. b. The volume of the transactions is such
b. The auditor should consider how a that users would find it difficult to
CIS environment affects the audit. identify and correct errors in
c. The use of a computer changes the processing.
processing, storage and c. The computer automatically generates
communication of financial information material transactions or entries directly
and may affect the accounting and to another applications.
internal control systems employed by d. The system generates a daily
the entity. exception report
d. A CIS environment changes the
overall objective and scope of an 6. The nature of the risks and the internal
audit. characteristics in CIS environment that the
auditors are mostly concerned include the
2. Which of the following standards or group of following except:
standards is mostly affected by a a. Lack of segregation of functions.
computerized information system b. Lack of transaction trails.
environment? c. Dependence of other control over
a. General standards computer processing.
b. Reporting standards d. Cost-benefit ratio.
c. Second standard of field work
d. Standards of fieldwork 7. Which of the following is least likely a risk
characteristic associated with CIS
3. Which of the following is least considered if environment?
the auditor has to determine whether a. Errors embedded in an application’s
specialized CIS skills are needed in an audit? program logic maybe difficult to
a. The auditor needs to obtain a manually detect on a timely basis.
sufficient understanding of the b. Many control procedures that would
accounting and internal control system ordinarily be performed by separate
affected by the CIS environment. individuals in manual system maybe
b. The auditor needs to determine the concentrated in CIS.
effect of the CIS environment on the c. The potential unauthorized access to
assessment of overall risk and of risk data or to alter them without visible
at the account balance and class of evidence maybe greater.
transactions level. d. Initiation of changes in the master file
c. Design and perform appropriate tests is exclusively handled by respective
of controls and substantive users.
procedures.
d. The need of the auditor to make 8. Which of the following significance and
analytical procedures during the complexity of the CIS activities should an
completion stage of audit. auditor least understand?
4. It relates to materiality of the financial a. The organizational structure of the
statement assertions affected by the client’s CIS activities.
computer processing. b. Lack of transaction trails.
a. Threshold c. The significance and complexity of
b. Relevance computer processing in each
c. Complexity significant accounting application.

0
0
 d. The use of software packages instead b. They are relatively expensive.
of customized software. c. They can be placed in operation
quickly.
9. Which statement is correct regarding personal d. The operating system software is less
computer systems? comprehensive than that found in
a. Personal computers or PCs are larger computer environments.
economical yet powerful self-
contained general purpose computers 13. Which of the following is an inherent
consisting typically of a central characteristic of software package?
processing unit (CPU), memory, a. They are typically used without
monitor, disk drives, printer cables and modifications of the programs.
modems. b. The programs are tailored-made
b. Programs and data are stored only on according to the specific needs of the
non-removable storage media. user.
c. Personal computers cannot be used to c. They are developed by software
process accounting transactions and manufacturer according to a particular
produce reports that are essential to user’s specifications.
the preparation of financial d. It takes a longer time of
statements. implementation.
d. Generally, CIS environments in which 14. Which of the following is not normally a
personal computers are used are the removable storage media?
same with other CIS environments. a. Compact disk
b. Tapes
10. A personal computer can be used in various c. Diskettes
configurations, including d. Hard disk
a. A stand-alone workstation operated by
a single user or a number of users at 15. It is a computer program (a block of
different times. executable code) that attaches itself to a
b. A workstation which is part of a local legitimate program or data file and uses itself
area network of personal computers. as a transport mechanism to reproduce itself
c. A workstation connected to a server. without the knowledge of the user.
d. All of the above. a. Virus
b. System management program
11. Which statement is incorrect regarding c. Utility program
personal computer configurations? d. Encryption
a. The stand-alone workstation can be
operated by a single user or a number 16. Which statement is incorrect regarding
of users at different times accessing internal control in personal computer
the same or different programs. environment?
b. A stand-alone workstation may be a. Generally, the CIS environment in
referred to as a distributed system. which personal computers are used is
c. A local area network is an less structured than a centrally-
arrangement where two or more controlled CIS environment.
personal computers are linked b. Controls over the system
together through the use of special development process and operations
software and communication lines. may not be viewed by the developer,
d. Personal computers can be linked to the user or management as being as
servers and used as part of such important or cost-effective.
systems, for example, as an intelligent c. In almost all commercially available
on-line workstation or as part of a operating systems, the built-in security
distributed accounting system. provided has gradually increased over
the years.
12. Which of the following is the least likely d. In a typical personal computer
characteristic of personal computers? environment, the distinction between
a. They are small enough to be general CIS controls and CIS
transportable.

0
0
 application controls is easily 21. The effect of personal computers on the
ascertained. accounting system and the associated risks
will least likely depend on
17. Personal computers are susceptible to theft, a. The extent to which the personal
physical damage, unauthorized access or computer is being used to process
misuse of equipment. Which of the following accounting applications.
is least likely a physical security to restrict b. The type and significance of financial
access to personal computers when not in transactions being processed.
use? c. The nature of files and programs
a. Using door locks or other security utilized in the applications.
protection during non-business hours. d. The cost of personal computers.
b. Fastening the personal computer to a
table using security cables. 22. The auditor may often assume that control
c. Locking the personal computer in a risk is high in personal computer systems
protective cabinet or shell. since, it may not be practicable or cost-
d. Using anti-virus software programs. effective for management to implement
sufficient controls to reduce the risks of
18. Which of the following is not likely a control undetected errors to a minimum level. This
over removable storage media to prevent least likely entail
misplacement, alteration without authorization a. More physical examination and
or destruction? confirmation of assets.
a. Using cryptography, which is the b. More analytical procedures than tests
process of transforming programs and of details.
information into an unintelligible form. c. Larger sample sizes.
b. Placing responsibility for such media d. Greater use of computer-assisted
under personnel whose audit techniques, where appropriate.
responsibilities include duties of
software custodians or librarians. 23. Computer systems that enable users to
c. Using a program and data file check-in access data and programs directly through
and check-out system and locking the workstations are referred to as
designated storage locations. a. On-line computer systems
d. Keeping current copies of diskettes, b. Personal computer systems
compact disks or back-up tapes and c. Database management systems
hard disks in a fireproof container, (DBMS)
either on-site, off-site or both. d. Database systems

19. 19. Which of the following least likely protects 24. On-line systems allow users to initiate various
critical and sensitive information from functions directly. Such functions include:
unauthorized access in a personal computer I. Entering transactions
environment? II. Requesting reports
a. Using secret file names and hiding the III. Making inquiries
files. IV. Updating master files
b. Keeping of back up copies offsite. a. I, II, III and IV
c. Employing passwords. b. I and II
d. Segregating data into files organized c. I, II and III
under separate file directories. d. I and IV

20. It refers to plans made by the entity to obtain 25. Many different types of workstations may be
access to comparable hardware, software used in on-line computer systems. The
and data in the event of their failure, loss or functions performed by these workstations
destruction. least likely depend on their
a. Back-up a. Logic
b. Encryption b. Transmission
c. Anti-virus c. Storage
d. Wide Area Network (WAN) d. Cost

0
0
26. Types of workstations include General 31. It combines on-line/real time processing and
Purpose Terminals and Special Purpose on-line/batch processing.
Terminals. Special Purpose Terminals a. On-Line/Memo Update (and
include Subsequent Processing)
a. Basic keyboard and monitor b. On-Line Downloading/Uploading
b. Point of sale devices Processing
c. Intelligent terminal c. On-Line/Inquiry
d. Personal computers d. On-Line/Combined Processing

27. Special Purpose Terminal used to initiate, 32. It is a communication system that enables
validate, record, transmit and complete computer users to share computer
various banking transactions equipment, application software, data and
a. Automated teller machines voice and video transmissions.
b. Intelligent terminal a. Network
c. Point of sale devices b. File server
d. Personal computers c. Host
d. Client
28. Which statement is incorrect regarding
workstations? 33. A type of network that multiple buildings are
a. Workstations may be located either close enough to create a campus, but the
locally or at remote sites. space between the buildings is not under the
b. Local workstations are connected control of the company is
directly to the computer through a. Local Area Network (LAN)
cables. b. Metropolitan Area Network (MAN)
c. Remote workstations require the use c. Wide Area Network (WAN)
of telecommunications to link them to d. World Wide Web (WWW)
the computer.
d. Workstations cannot be used by many 34. Which of the following is least likely a
users, for different purposes, in characteristic of Wide Area Network (WAN)?
different locations all at the same time. a. Created to connect two or more
29. On-line computer systems may be classified geographically separated LANs.
according to b. Typically involves one or more long-
a. How information is entered into the distance providers, such as a
system. telephone company to provide the
b. How it is processed. connections.
c. When the results are available to the c. WAN connections tend to be faster
user. than LAN.
d. All of the above. d. Usually more expensive than LAN.
30. In an on-line/real time processing system
a. Individual transactions are entered at 35. Gateway is
workstations, validated and used to a. A hardware and software solution that
update related computer files enables communications between two
immediately. dissimilar networking systems or
b. Individual transactions are entered at protocols.
a workstation, subjected to certain b. A device that forwards frames based
validation checks and added to a on destination addresses.
transaction file that contains other c. A device that connects and passes
transactions entered during the period. packets between two network
c. Individual transactions immediately segments that use the same
update a memo file containing communication protocol.
information which has been extracted d. A device that regenerates and
from the most recent version of the retransmits the signal on a network.
master file.
d. The master files are updated by other 36. A device that works to control the flow of data
systems. between two or more network segments
a. Bridge

0
0
 b. Router d. On-line access to data and programs
c. Repeater through telecommunications may
d. Switch provide greater opportunity for access
to data and programs by unauthorized
37. The undesirable characteristics of on-line persons.
computer systems least likely include
a. Data are usually subjected to 41. Risk of fraud or error in on-line computer
immediate validation checks. systems may be increased for the following
b. Unlimited access of users to all of the reasons, except
functions in a particular application. a. If workstations are located throughout
c. Possible lack of visible transaction the entity, the opportunity for
trail. unauthorized use of a workstation and
d. Potential programmer access to the the entry of unauthorized transactions
system. may increase.
b. Workstations may provide the
opportunity for unauthorized uses
such as modification of previously
entered transactions or balances.
38. Certain general CIS controls that are c. If on-line processing is interrupted for
particularly important to on-line processing any reason, for example, due to faulty
least likely include telecommunications, there may be a
a. Access controls. greater chance that transactions or
b. System development and files may be lost and that the recovery
maintenance controls. may not be accurate and complete.
c. Edit, reasonableness and other d. If transactions are processed
validation tests. immediately on-line, there is less risk
d. Use of anti-virus software program. that they will be processed in the
wrong accounting period.
39. Certain CIS application controls that are
particularly important to on-line processing 42. 42. The following matters are of particular
least likely include importance to the auditor in an on-line
a. Pre-processing authorization. computer system, except
b. Transaction logs. a. Authorization, completeness and
c. Cut-off procedures. accuracy of on-line transactions.
d. Balancing. b. Integrity of records and processing,
due to on-line access to the system by
40. Risk of fraud or error in on-line systems may many users and programmers.
be reduced in the following circumstances, c. Changes in the performance of audit
except procedures including the use of
a. If on-line data entry is performed at or CAAT's.
near the point where transactions d. Cost-benefit ratio of installing on-line
originate, there is less risk that the computer system.
transactions will not be recorded.
b. If invalid transactions are corrected 43. A collection of data that is shared and used
and re-entered immediately, there is by a number of different users for different
less risk that such transactions will not purposes.
be corrected and re-submitted on a a. Database
timely basis. b. Information file
c. If data entry is performed on-line by c. Master file
individuals who understand the nature d. Transaction file
of the transactions involved, the data
entry process may be less prone to
errors than when it is performed by
individuals unfamiliar with the nature
of the transactions.

0
0
 b. Several data owners should be
assigned responsibility for defining
access and security rules, such as
44. Which of the following is least likely a who can use the data (access) and
characteristic of a database system? what functions they can perform
a. Individual applications share the data (security).
in the database for different purposes. c. User access to the database can be
b. Separate data files are maintained for restricted through the use of
each application and similar data used passwords.
by several applications may be d. Responsibilities for performing the
repeated on several different files. various activities required to design,
c. A software facility is required to keep implement and operate a database are
track of the location of the data in the divided among technical, design,
database. administrative and user personnel.
d. Coordination is usually performed by a
group of individuals whose 48. These require a database administrator to
responsibility is typically referred to as assign security attributes to data that cannot
"database administration." be changed by database users.
a. Discretionary access controls
45. Database administration tasks typically b. Name-dependent restrictions
include c. Mandatory access controls
I. Defining the database structure. d. Content-dependent restrictions.
II. Maintaining data integrity, security and
completeness. 49. A discretionary access control wherein users
III. Coordinating computer operations are permitted or denied access to data
related to the database. resource depending on the time series of
IV. Monitoring system performance. accesses to and actions they have
V. Providing administrative support. undertaken on data resources.
a. All of the above a. Name-dependent restrictions
b. All except I b. Context-dependent restriction
c. II and V only c. Content-dependent restriction
d. II, III and V only d. History-dependent restriction

46. Due to data sharing, data independence and

other characteristics of database systems
a. General CIS controls normally have a
greater influence than CIS application 50. The effect of a database system on the
controls on database systems. accounting system and the associated risks
b. CIS application controls normally have will least likely depend on:
a greater influence than general CIS a. The extent to which databases are
controls on database systems. being used by accounting applications.
c. General CIS controls normally have an b. The type and significance of financial
equal influence with CIS application transactions being processed.
controls on database systems. c. The nature of the database, the
d. CIS application controls normally have DBMS, the database administration
no influence on database systems. tasks and the applications.
d. The CIS application controls.
47. Which statement is incorrect regarding the
general CIS controls of particular importance 51. Audit procedures in a database environment
in a database environment? will be affected principally by
a. Since data are shared by many users, a. The extent to which the data in the
control may be enhanced when a database are used by the accounting
standard approach is used for system.
developing each new application b. The type and significance of financial
program and for application program transactions being processed.
modification.

0
0
 c. The nature of the database, the a. Manual and computer control
DBMS, the database administration procedures comprise the overall
tasks and the applications. controls affecting the CIS environment
d. The general CIS controls which are (general CIS controls) and the specific
particularly important in a database controls over the accounting
environment. applications (CIS application controls).
b. The purpose of general CIS controls is
52. Which statement is incorrect regarding the to establish a framework of overall
characteristics of a CIS organizational control over the CIS activities and to
structure? provide a reasonable level of
a. Certain data processing personnel assurance that the overall objectives
may be the only ones with a detailed of internal control are achieved.
knowledge of the interrelationship c. The purpose of CIS application
between the source of data, how it is controls is to establish specific control
processed and the distribution and use procedures over the application
of the output. systems in order to provide
b. Many conventional controls based on reasonable assurance that all
adequate segregation of incompatible transactions are authorized and
functions may not exist, or in the recorded, and are processed
absence of access and other controls, completely, accurately and on a timely
may be less effective. basis.
c. Transaction and master file data are
often concentrated, usually in
machine-readable form, either in one d. The internal controls over computer
computer installation located centrally processing, which help to achieve the
or in a number of installations overall objectives of internal control,
distributed throughout an entity. include only the procedures designed
d. Systems employing CIS methods do into computer programs.
not include manual operations since
the number of persons involved in the 56. General CIS controls may include, except:
processing of financial information is a. Organization and management
significantly reduced. controls.
b. Delivery and support controls.
53. System characteristics that may result from c. Development and maintenance
the nature of CIS processing include, except controls.
a. Absence of input documents. d. Controls over computer data files.
b. Lack of visible transaction trail.
c. Lack of visible output. 57. 57. CIS application controls include, except
d. Difficulty of access to data and a. Controls over input.
computer programs. b. Controls over processing and
computer data files.
54. The development of CIS will generally result c. Controls over output.
in design and procedural characteristics that d. Monitoring controls.
are different from those found in manual
systems. These different design and 58. Which statement is incorrect regarding the
procedural aspectsof CIS include, except: review of general CIS controls and CIS
a. Consistency of performance. application controls?
b. Programmed control procedures. a. The auditor should consider how these
c. Vulnerability of data and program general CIS controls affect the CIS
storage media applications significant to the audit.
d. Multiple transaction update of multiple b. General CIS controls that relate to
computer files or databases. some or all applications are typically
interdependent controls in that their
55. Which statement is incorrect regarding operation is often essential to the
internal controls in a CIS environment? effectiveness of CIS application
controls.

0
0
 c. Control over input, processing, data c. Customized or purpose-written
files and output may be carried out by programs
CIS personnel, by users of the system, d. System management programs
by a separate control group, or may be
programmed into application software.
d. It may be more efficient to review the
design of the application controls
before reviewing the general controls.
63. Audit automation least likely include
59. Which statement is incorrect regarding the a. Expert systems.
evaluation of general CIS controls and CIS b. Tools to evaluate a client’s risk
application controls? management procedures.
a. The general CIS controls may have a c. Manual working papers.
pervasive effect on the processing of d. Corporate and financial modeling
transactions in application systems. programs for use as predictive audit
b. If general CIS controls are not tests.
effective, there may be a risk that
misstatements might occur and go 64. An internal auditor noted the following points
undetected in the application systems. when conducting a preliminary survey in
c. Manual procedures exercised by users connection with the audit of an EDP
may provide effective control at the department. Which of the following would be
application level. considered a safeguard in the control system
d. Weaknesses in general CIS controls on which the auditor might rely?
cannot preclude testing certain CIS a. Programmers and computer operators
application controls. correct daily processing problems as
they arise.
60. The applications of auditing procedures using b. The control group works with user
the computer as an audit tool refer to organizations to correct rejected input.
a. Integrated test facility c. New systems are documented as
b. Auditing through the computer soon as possible after they begin
c. Data-based management system processing live data.
d. Computer assisted audit techniques d. The average tenure of employees
working in the EDP department is ten
61. Which statement is incorrect regarding months.
CAATs?
a. CAATs are often an efficient means of 65. An on-line access control that checks whether
testing a large number of transactions the user’s code number is authorized to
or controls over large populations. initiate a specific type of transaction or inquiry
b. To ensure appropriate control is referred to as
procedures, the presence of the a. Password
auditor is not necessarily required at b. Compatibility test
the computer facility during the c. Limit check
running of a CAAT. d. Reasonableness test
c. The general principles outlined in
PAPS 1009 apply in small entity IT 66. A control procedure that could be used in an
environments. on-line system to provide an immediate check
d. Where smaller volumes of data are on whether an account number has been
processed, the use of CAATs is more entered on a terminal accurately is a
cost effective. a. Compatibility test
b. Record count
62. Consists of generalized computer programs c. Hash total
designed to perform common audit tasks or d. Self-checking digit
standardized data processing functions.
a. Package or generalized audit software 67. A control designed to catch errors at the point
b. Utility programs of data entry is
a. Batch total

0
0
 b. Self-checking digit 72. Which one of the following represents a lack
c. Record count of internal control in a computer-based
d. Checkpoints information system?
a. The design and implementation is
68. Program documentation is a control designed performed in accordance with
primarily to ensure that management’s specific authorization.
a. Programmers have access to the tape b. Any and all changes in application
library or information on disk files. programs have the authorization and
b. Programs do not make mathematical approval of management.
errors. c. Provisions exist to protect data files
c. Programs are kept up to date and from unauthorized access,
perform as intended. modification, or destruction.
d. Data have been entered and d. Both computer operators and
processed. programmers have unlimited access to
the programs and data files.
69. Some of the more important controls that
relate to automated accounting information 73. In an automated payroll processing
systems are validity checks, limit checks, field environment, a department manager
checks, and sign tests. These are classified substituted the time card for a terminated
as employee with a time card for a fictitious
a. Control total validation routines employee. The fictitious employee had the
b. Output controls same pay rate and hours worked as the
c. Hash totaling terminated employee. The best control
d. Input validation routines technique to detect this action using
employee identification numbers would be a
70. Most of today’s computer systems have a. Batch total
hardware controls that are built in by the b. Hash total
computer manufacturer. Common hardware c. Record count
controls are d. Subsequent check
a. Duplicate circuitry, echo check, and
internal header labels 74. An employee in the receiving department
b. Tape file protection, cryptographic keyed in a shipment from a remote terminal
protection, and limit checks and inadvertently omitted the purchase order
c. Duplicate circuitry, echo check, and number. The best systems control to detect
dual reading this error would be
d. Duplicate circuitry, echo check, tape a. Batch total
file protection, and internal header b. Sequence check
labels c. Completeness test
d. Reasonableness test

75. The reporting of accounting information plays

a central role in the regulation of business
operations. Preventive controls are an integral
part of virtually all accounting processing
71. Computer manufacturers are now installing systems, and much of the information
software programs permanently inside the generated by the accounting system is used
computer as part of its main memory to for preventive control purposes. Which one of
provide protection from erasure or loss if there the following is not an essential element of a
is interrupted electrical power. This concept is sound preventive control system?
known as a. Separation of responsibilities for the
a. File integrity recording, custodial, and authorization
b. Random access memory (RAM) functions.
c. Software control b. Sound personnel policies.
d. Firmware c. Documentation of policies and
procedures.

0
0
 d. Implementation of state-of-the-art a. Computer processing virtually
software and hardware. eliminates the occurrence of
computational error normally
76. The most critical aspect regarding separation associated with manual processing.
of duties within information systems is b. Errors or irregularities in computer
between processing will be detected soon after
a. Project leaders and programmers their occurrences.
b. Programmers and systems analysts c. The potential for systematic error is
c. Programmers and computer operators ordinarily greater in manual
d. Data control and file librarians processing than in computerized
processing.
77. Whether or not a real time program contains d. Most computer systems are designed
adequate controls is most effectively so that transaction trails useful for
determined by the use of audit do not exist.
a. Audit software
b. A tracing routine 82. Which of the following most likely represents
c. An integrated test facility a significant deficiency in the internal control
d. A traditional test deck structure?
a. The systems analyst review
78. Compatibility tests are sometimes employed applications of data processing and
to determine whether an acceptable user is maintains systems documentation.
allowed to proceed. In order to perform b. The systems programmer designs
compatibility tests, the system must maintain systems for computerized applications
an access control matrix. The one item that is and maintains output controls.
not part of an access control matrix is a c. The control clerk establishes control
a. List of all authorized user code over data received by the EDP
numbers and passwords. department and reconciles control
b. List of all files maintained on the totals after processing
system. d. The accounts payable clerk prepares
c. Record of the type of access to which data for computer processing and
each user is entitled. enters the data into the computer.
d. Limit on the number of transaction
inquiries that can be made by each 83. Which of the following activities would most
user in a specified time period. likely be performed in the EDP Department?
a. Initiation of changes to master
79. Which one of the following input validation records.
routines is not likely to be appropriate in a real b. Conversion of information to machine-
time operation? readable form.
a. Field check c. Correction of transactional errors.
b. Sequence check d. Initiation of changes to existing
c. Sign check applications.
d. Redundant data check
84. For control purposes, which of the following
80. Which of the following controls is a processing should be organizationally segregated from
control designed to ensure the reliability and the computer operations function?
accuracy of data processing? a. Data conversion
b. Systems development
Limit test Validity check test c. Surveillance of CRT messages
a. Yes Yes d. Minor maintenance according to a
b. No No schedule
c. No Yes
d. Yes No 85. Which of the following is not a major reason
for maintaining an audit trail for a computer
81. Which of the following characteristics system?
distinguishes computer processing from a. Deterrent to irregularities
manual processing? b. Analytical procedures

0
0
 c. Monitoring purposes
d. Query answering 90. When EDP programs or files can be accessed
from terminals, users should be required to
86. In an automated payroll system, all enter a(an)
employees in the finishing department were a. Parity check
paid the rate of P75 per hour when the b. Self-diagnostic test
authorized rate was P70 per hour. Which of c. Personal identification code
the following controls would have been most d. Echo check
effective in preventing such an error?
a. Access controls which would restrict 91. The possibility of erasing a large amount of
the personnel department’s access to information stored on magnetic tape most
the payroll master file data. likely would be reduced by the use of
b. A review of all authorized pay rate a. File protection ring
changes by the personnel department. b. Completeness tests
c. The use of batch control totals by c. Check digits
department. d. Conversion verification
d. A limit test that compares the pay
rates per department with the 92. Which of the following controls most likely
maximum rate for all employees. would assure that an entity can reconstruct its
financial records?
87. Which of the following errors would be a. Hardware controls are built into the
detected by batch controls? computer by the computer
a. A fictitious employee as added to the manufacturer.
processing of the weekly time cards by b. Backup diskettes or tapes of files are
the computer operator. stored away from originals.
b. An employee who worked only 5 hours c. Personnel who are independent of
in the week was paid for 50 hours. data input perform parallel simulations.
c. The time card for one employee was d. System flowcharts provide accurate
not processed because it was lost in descriptions of input and output
transit between the payroll department operations.
and the data entry function.
d. All of the above. 93. Mill Co. uses a batch processing method to
process its sales transactions. Data on Mill’s
88. The use of a header label in conjunction with sales transaction tape are electronically
magnetic tape is most likely to prevent errors sorted by customer number and are subject to
by the programmed edit checks in preparing its
a. Computer operator invoices, sales journals, and updated
b. Computer programmer customer account balances. One of the direct
c. Keypunch operator outputs of the creation of this tape most likely
d. Maintenance technician would be a
a. Report showing exceptions and
89. For the accounting system of ACME control totals.
Company, the amounts of cash b. Printout of the updated inventory
disbursements entered into an EDP terminal records.
are transmitted to the computer that c. Report showing overdue accounts
immediately transmits the amounts back to receivable.
the terminal for display on the terminal d. Printout of the sales price master file.
screen. This display enables the operator to
a. Establish the validity of the account 94. Using microcomputers in auditing may affect
number the methods used to review the work of staff
b. Verify the amount was entered assistants because
accurately a. The audit field work standards for
c. Verify the authorization of the supervision may differ.
disbursements b. Documenting the supervisory review
d. Prevent the overpayment of the may require assistance of consulting
account services personnel.

0
0
 98. Computer systems are typically supported by
c. Supervisory personnel may not have a variety of utility software packages that are
an understanding of the capabilities important to an auditor because they
and limitations of microcomputers. a. May enable unauthorized changes to
d. Working paper documentation may not data files if not properly controlled.
contain readily observable details of b. Are very versatile programs that can
calculations. be used on hardware of many
manufacturers.
95. An auditor anticipates assessing control risk c. May be significant components of a
at a low level in a computerized environment. client’s application programs.
Under these circumstances, on which of the d. Are written specifically to enable
following procedures would the auditor initially auditors to extract and sort data.
focus?
a. Programmed control procedures 99. To obtain evidence that online access
b. Output control procedures controls are properly functioning, an auditor
c. Application control procedures most likely would
d. General control procedures a. Create checkpoints at periodic
intervals after live data processing to
96. After the preliminary phase of the review of a test for unauthorized use of the
client’s EDP controls, an auditor may decide system.
not to perform tests of controls (compliance b. Examine the transaction log to
tests) related to the control procedures within discover whether any transactions
the EDP portion of the client’s internal control were lost or entered twice due to a
structure. Which of the following would not be system malfunction
a valid reason for choosing to omit such c. Enter invalid identification numbers or
tests? passwords to ascertain whether the
a. The controls duplicate operative system rejects them.
controls existing elsewhere in the d. Vouch a random sample of processed
structure. transactions to assure proper
b. There appear to be major weaknesses authorization
that would preclude reliance on the
stated procedure. 100. Which of the following statements
c. The time and costs of testing exceed most likely represents a disadvantage for an
the time and costs in substantive entity that keeps microcomputer-prepared
testing if the tests of controls show the data files rather than manually prepared files?
controls to be operative. a. Attention is focused on the accuracy of
d. The controls appear adequate. the programming process rather than
errors in individual transactions.
97. Which of the following client electronic data b. It is usually easier for unauthorized
processing (EDP) systems generally can be persons to access and alter the files.
audited without examining or directly testing c. Random error associated with
the EDP computer programs of the system? processing similar transactions in
a. A system that performs relatively different ways is usually greater.
uncomplicated processes and d. It is usually more difficult to compare
produces detailed output. recorded accountability with physical
b. A system that affects a number of count of assets.
essential master files and produces a
limited output. 101. An auditor would least likely use
c. A system that updates a few essential computer software to
master files and produces no printed a. Access client data files
output other than final balances. b. Assess EDP controls
d. A system that performs relatively c. Prepare spreadsheets
complicated processing and produces d. Construct parallel simulations
very little detailed output.
102. A primary advantage of using
generalized audit software packages to audit

0
0
 the financial statements of a client that uses b. Is a major aid in retrieving information
an EDP system is that the auditor may from computerized files.
a. Consider increasing the use of c. Overcomes the need for an auditor to
substantive tests of transactions in learn much about computers.
place of analytical procedures. d. Is a form of auditing around the
b. Substantiate the accuracy of data computer.
through self-checking digits and hash
totals. 106. An auditor used test data to verify the
c. Reduce the level of required tests of existence of controls in a certain computer
controls to a relatively small amount. program. Even though the program performed
d. Access information stored on well on the test, the auditor may still have a
computer files while having a limited concern that
understanding of the client’s hardware a. The program tested is the same one
and software features. used in the regular production runs.
b. Generalized audit software may have
103. Auditors often make use of computer been a better tool to use.
programs that perform routine processing c. Data entry procedures may change
functions such as sorting and merging. These and render the test useless.
programs are made available by electronic d. The test data will not be relevant in
data processing companies and others and subsequent audit periods.
are specifically referred to as
a. Compiler programs 107. An auditor most likely would introduce
b. Utility programs test data into a computerized payroll system
c. Supervisory programs to test internal controls related to the
d. User programs a. Existence of unclaimed payroll checks
held by supervisors.
104. Smith Corporation has numerous b. Early cashing of payroll checks by
customers. A customer file is kept on disk employees.
storage. Each customer file contains name, c. Discovery of invalid employee I.D.
address, credit limit, and account balance. numbers.
The auditor wishes to test this file to d. Proper approval of overtime by
determine whether the credit limits are being supervisors.
exceeded. The best procedure for the auditor
to follow would be to 108. When an auditor tests a computerized
a. Develop test data that would cause accounting system, which of the following is
some account balances to exceed the true of the test data approach?
credit limit and determine if the system a. Test data must consist of all possible
properly detects such situations. valid and invalid conditions.
b. Develop a program to compare credit b. The program tested is different from
limits with account balances and print the program used throughout the year
out the details of any account with a by the client.
balance exceeding its credit limit. c. Several transactions of each type
c. Request a printout of all account must be tested.
balances so they can be manually d. Test data are processed by the client’s
checked against the credit limits. computer programs under the
d. Request a printout of a sample of auditor’s control.
account balances so they can be
individually checked against the credit 109. Which of the following statements is
limits. not true to the test data approach when
testing a computerized accounting system?
105. The use of generalized audit software a. The test need consist of only those
package valid and invalid conditions which
a. Relieves an auditor of the typical tasks interest the auditor
of investigating exceptions, verifying b. Only one transaction of each type
sources of information, and evaluating need be tested.
reports.

0
0
 c. The test data must consist of all a. Parallel simulation
possible valid and invalid conditions. b. Test data approach
d. Test data are processed by the client’s c. Integrated testing facility approach
computer programs under the d. Exception report tests
auditor’s control.
115. Misstatements in a batch computer
110. Which of the following is not among system caused by incorrect programs or data
the errors that an auditor might include in the may not be detected immediately because
test data when auditing a client’s EDP a. Errors in some transactions may
system? cause rejection of other transactions in
a. Numeric characters in alphanumeric the batch.
fields. b. The identification of errors in input
b. Authorized code. data typically is not part of the
c. Differences in description of units of program.
measure. c. There are time delays in processing
d. Illogical entries in fields whose logic is transactions in a batch system.
tested by programmed consistency d. The processing of transactions in a
checks. batch system is not uniform.

111. An auditor who is testing EDP controls 116. Which of the following is not a
in a payroll system would most likely use test characteristic of a batch processed computer
data that contain conditions such as system?
a. Deductions not authorized by a. The collection of like transactions
employees. which are sorted and processed
b. Overtime not approved by supervisors. sequentially against a master file.
c. Time tickets with invalid job numbers. b. Keypunching of transactions, followed
d. Payroll checks with unauthorized by machine processing.
signatures. c. The production of numerous printouts.
d. The posting of a transaction, as it
112. Auditing by testing the input and occurs, to several files, without
output of an EDP system instead of the immediate printouts.
computer program itself will
a. Not detect program errors which do 117. Where disk files are used, the
not show up in the output sampled. grandfather-father-son updating backup
b. Detect all program errors, regardless concept is relatively
of the nature of the output. 118. difficult to implement because the
c. Provide the auditor with the same type a. Location of information points on disks
of evidence. is an extremely time consuming task.
d. Not provide the auditor with b. Magnetic fields and other
confidence in the results of the environmental factors cause off-site
auditing procedures. storage to be impractical.
c. Information must be dumped in the
113. Which of the following computer- form of hard copy if it is to be reviewed
assisted auditing techniques allows fictitious before used in
and real transactions to be processed d. Process of updating old records is
together without client operating personnel destructive.
being aware of the testing process?
a. Integrated test facility 119. An auditor would most likely be
b. Parallel simulation concerned with which of the following controls
c. Input controls matrix in a distributed data processing system?
d. Data entry monitor a. Hardware controls
b. Access controls
114. Which of the following methods of c. Systems documentation controls
testing application controls utilizes a d. Disaster recovery controls
generalized audit software package prepared
by the auditors?

0
0
120. If a control total were computed on department would identify the error with what
each of the following data items, which would type of control?
best be identified as a hash total for a payroll a. Key verifying
EDP application? b. Batch total
a. Total debits and total credits c. Self-checking digit
b. Department numbers d. Item inspection
c. Net pay
d. Hours worked 126. The computer process whereby data
processing is performed concurrently with a
121. Which of the following is a computer particular activity and the results are available
test made to ascertain whether a given soon enough to influence the course of action
characteristic belongs to the group? being taken or the decision being made is
a. Parity check called:
b. Echo check a. Random access sampling
c. Validity check b. On-line, real-time system
d. Limit check c. Integrated data processing
d. Batch processing system
122. A control feature in an electronic data
processing system requires the central 127. Internal control is ineffective when
processing unit (CPU) to send signals to the computer department personnel
printer to activate the print mechanism for a. Participate in computer software
each character. The print mechanism, just acquisition decisions.
prior to printing, sends a signal back to the b. Design documentation for
CPU verifying that the proper print position computerized systems.
has been activated. This type of hardware c. Originate changes in master file.
control is referred to as d. Provide physical security for program
a. Echo check files.
b. Signal control
c. Validity control 128. Test data, integrated test data and
d. Check digit control parallel simulation each require an auditor to
prepare data and computer programs. CPAs
123. Which of the following is an example who lack either the technical expertise or time
of a check digit? to prepare programs should request from the
a. An agreement of the total number of manufacturers or EDP consultants for
employees to the total number of a. The program Code
checks printed by the computer. b. Generalized audit software
b. An algebraically determined number c. Flowchart checks
produced by the other digits of the d. Application controls
employee number
c. A logic test that ensures all employee 129. Which of the following best describes
numbers are nine digits. a fundamental control weakness often
d. A limit check that an employee’s hours associated with electronic data processing
do not exceed 50 hours per work system?
week. a. EDP equipment is more subject to
system error than manual processing
124. In a computerized system, procedure is subject to human error.
or problem-oriented language is converted to b. Monitoring is not an adequate
machine language through a(an) substitute for the use of test data.
a. Interpreter c. EDP equipment processes and
b. Verifier records similar transactions in a
c. Compiler similar manner.
d. Converter d. Functions that would normally be
separated in a manual system are
125. A customer erroneously ordered Item combined in the EDP system like the
No. 86321 rather than item No. 83621. When function of programmers and
this order is processed, the vendor’s EDP operators.

0
0
 a. The systems analyst and the
130. Which of the following tasks could not programmer functions.
be performed when using a generalized audit b. The computer operator and
software package? programmer functions.
a. Selecting inventory items for c. The computer operator and the user
observations. functions.
b. Physical count of inventories. d. The applications programmer and the
c. Comparison of inventory test counts systems programmer.
with perpetual records.
d. Summarizing inventory turnover 136. To obtain evidence that user
statistics for obsolescence analysis. identification and password control
procedures are functioning as designed, an
131. All of the following are <auditing auditor would most likely
through the computer= techniques except a. Attempt to sign on to the system using
a. Reviewing source code invalid user identifications and
b. Automated tracking and mapping passwords.
c. Test-decking b. Write a computer program that
d. Integrated test facility simulates the logic of the client’s
access control software.
132. The output of a parallel simulation c. Extract a random sample of processed
should always be transactions and ensure that the
a. Printed on a report. transactions were appropriately
b. Compared with actual results authorized. Examine statements
manually. signed by employees stating that they
c. Compared with actual results using a have not divulged their user
comparison program. identifications and passwords to any
d. Reconciled to actual processing other person.
output.
137. In considering a client's internal
133. Generalized audit software is a control structure in a computer environment,
computer-assisted audit technique. It is one of the auditor will encounter general controls
the widely used technique for auditing and application controls. Which of the
computer application systems. Generalized following is an application control?
audit software is most often used to a. Organization charts.
a. Verify computer processing. b. Hash total.
b. Process data fields under the control c. Systems flowcharts.
of the operation manager. d. Control over program changes
c. Independently analyze data files.
d. Both a and b. 138. Auditing by testing the input and
output of a computer system--i.e., auditing
"around" the computer--instead of the
computer software itself will
134. From an audit viewpoint, which of the a. Not detect program errors that do not
following represents a potential disadvantage appear in the output sampled.
associated with the widespread use of b. Detect all program errors, regardless
microcomputers? of the nature of the output.
a. Their portability. c. Provide the auditor with the same type
b. Their ease of access by novice users. of evidence.
c. Their easily developed programs using d. Not provide the auditor with
spreadsheets which do not have to be confidence in the results of the
documented. auditing procedures.
d. All of the above.
139. Smith Corporation has numerous
135. Which of the following functions would customers. A customer file is kept on disk.
have the least effect on an audit if it was not Each customer file contains the name,
properly segregated? address, credit limit, and account balance.

0
0
 The auditor wishes to test this file to test–data approach, the sample should
determine whether credit limits are being include:
exceeded. The best procedure for the auditor a. Approximately 1,000 test items.
to follow would be to b. A number of test items determined by
a. Develop test data that would cause the auditor to be sufficient under the
some account balances to exceed the circumstances.
credit limit and determine if the system c. A number of test items determined by
properly detects such situations. the auditor's reference to the
b. Develop a program to compare credit appropriate sampling tables.
limits with account balances and print d. One transaction.
out the details of any account with a
balance exceeding its credit limit. 144. PC DOS, MS DOS, and AppleDOS
c. Request a printout of all account are examples of
balances so they can be manually a. Application software.
checked against the credit limits. b. Generalized audit software.
d. Request a printout of a sample of c. Database management systems.
account balances so they can be d. Operating software.
individually checked against the credit
limits. 145. Which of the following is not an
example of a computer-assisted audit
140. Which of the following methods of technique?
testing application controls utilizes software a. Integrated test data.
prepared by the auditors and applied to the b. Audit modules.
client's data? c. Disk operating systems.
a. Parallel simulation. d. Audit hooks.
b. Integrated test facility.
c. Test data. 146. Which of the following statements
d. Exception report tests. most likely represents a disadvantage for an
entity that maintains computer data files
141. The test–data method is used by rather than manual files?
auditors to test the a. It's usually more difficult to detect
a. Accuracy of input data. transposition errors.
b. Validity of the output. b. Transactions are usually authorized
c. Procedures contained within the before they are executed and
program. recorded.
d. Normalcy of distribution of test data. c. It's usually easier for unauthorized
persons to access and alter the files.
142. Which of the following is true of d. Random error is more common when
generalized audit software? similar transactions are processed in
a. They can be used only in auditing on- different ways.
line computer systems.
b. They can be used on any computer 147. Which of the following statements best
without modification. describes a weakness often associated with
c. They each have their own computers?
characteristics, which the auditor must a. Computer equipment is more subject
carefully consider before using in a to systems error than manual
given audit situation. processing is subject to human error.
d. They enable the auditor to perform all b. Computer equipment processes and
manual compliance test procedures records similar transactions in a
less expensively. similar manner.
c. Control activities for detecting invalid
143. Assume that an auditor estimated that and unusual transactions are less
10,000 checks were issued during the effective than manual control activities.
accounting period. If an application control d. Functions that would normally be
that performs a limit check for each check separated in a manual system are
request is to be subjected to the auditor's combined in a computer system.

0
0
 numbered checks issued to the CBIS
148. Accounting functions that are normally department for the processing of the
considered incompatible in a manual system payroll
are often combined by computer software. c. Use of a check digit for employee
This necessitates an application control that numbers
prevents unapproved d. Use of a header label for the payroll
a. Access to the computer library. input sheet
b. Revisions to existing software.
c. Usage of software. 153. An auditor is preparing test data for
d. Testing of modified software. use in the audit of a computer based
accounts receivable application. Which of the
149. When software or files can be following items would be appropriate to
accessed from on-line servers, users should include as an item in the test data?
be required to enter a. A transaction record which contains an
a. A parity check. incorrect master file control total
b. A personal identification code. b. A master file record which contains an
c. A self-diagnosis test. invalid customer identification number
d. An echo check. c. A master file record which contains an
incorrect master file control total
150. An auditor's consideration of a d. A transaction record which contains an
company's computer control activities has invalid customer identification number.
disclosed the following four circumstances.
Indicate which circumstance constitutes a 154. Unauthorized alteration of on-line
significant deficiency in internal control. records can be prevented by employing:
a. Computer operators do not have a. Key verification
access to the complete software b. Computer sequence checks
support documentation. c. Computer matching
b. Computer operators are closely d. Data base access controls
supervised by programmers.
c. Programmers are not authorized to 155. In auditing through a computer, the
operate computers. test data method is used by auditors to
d. Only one generation of backup files is test the
stored in an off-premises location. a. Accuracy of input data
b. Validity of the output
151. In a computer system, hardware c. Procedures contained within the
controls are designed to program
a. Arrange data in a logical sequence for d. Normalcy of distribution of test data.
processing.
b. Correct errors in software. 156. In the preliminary survey the auditor
c. Monitor and detect errors in source learns that a department has several
documents. microcomputers. Which of the following is
d. Detect and control errors arising from usually true and should be considered in
use of equipment. planning the audit?
a. Microcomputers, though small, are
152. In the weekly computer run to prepare capable of processing financial
payroll checks, a check was printed for an information, and physical security is a
employee who had been terminated the control concern
previous week. Which of the following b. Microcomputers are limited to
controls, if properly utilized, would applications such as worksheet
have been most effective in preventing the generation and do not present a
error or ensuring its prompt detection? significant audit risk
a. A control total for hours worked, c. Microcomputers are generally under
prepared from time cards collected by the control of the data processing
the timekeeping department. department and use the same control
b. Requiring the treasurer's office to features
account for the number of the pre-

0
0
 d. Microcomputers are too small to b. Check digits
contain any built-in control features. c. Completeness tests
Therefore, other controls must be d. Conversion verification
relied upon.
157. The primary reason for internal 162. An integrated test facility (ITF) would
auditing's involvement in the development of be appropriate when the auditor needs to
new computer-based sysstems is to: a. Trace a complex logic path through an
a. Plan post-implementation reviews application system
b. Promote adequate controls b. Verify processing accuracy
c. Train auditors in CBIS techniques concurrently with processing
d. Reduce overall audit effort. c. Monitor transactions in an application
system continuously
158. Which of the following is an advantage d. Verify load module integrity for
of generalized computer audit packages? production programs
a. They are all written in one identical
computer language 163. Where computer processing is used in
b. They can be used for audits of clients significant accounting applications, internal
that use differing CBIS equipment and accounting control procedures may be
file formats defined by classifying control procedures into
c. They have reduced the need for the two types: general and
auditor to study input controls for CBIS a. Administrative
related procedures b. Specific
d. Their use can be substituted for a c. Application
relatively large part of the required d. Authorization
control testing
164. The increased presence of the
159. Processing simulated file data microcomputer in the workplace has resulted
provides the auditor with information about in an increasing number of persons having
the reliability of controls from evidence that access to the computer. A control that is
exists in simulated files. One of the often used to prevent unauthorized access to
techniques involved in this approach makes sensitive programs is:
use of a. Backup copies of the diskettes
a. Controlled reprocessing b. Passwords for each of the users
b. Program code checking c. Disaster-recovery procedures
c. Printout reviews d. Record counts of the number of input
d. Integrated test facility transactions in a batch being
processed
160. Which of the following statements
most likely represents a disadvantage for an 165. Checklists, systems development
entity that keeps microcomputer-prepared methodology, and staff hiring are examples of
data files rather than manually prepared files? what type of controls?
a. It is usually more difficult to detect a. Detective
transposition errors b. Preventive
b. Transactions are usually authorized c. Subjective
before they are executed and d. Corrective
recorded
c. It is usually easier for unauthorized 166. When an on-line, real-time (OLRT)
persons to access and alter the files computer-based processing system is in use,
d. Random error associated with internal control can be strengthened by
processing similar transactions in a. Providing for the separation of duties
different ways is usually greater between keypunching and error listing
operations
161. The possibility of losing a large b. Attaching plastic file protection rings to
amount of information stored in computer files reels of magnetic tape before new
most likely would be reduced by the use of data can be entered on the file
a. Back-up files

0
0
 c. Making a validity check of an
identification number before a user 170. What type of computer-based system
can obtain access to the computer is characterized by data that are assembled
files from more than one location and records that
d. Preparing batch totals to provide are updated immediately?
assurance that file updates are made a. Microcomputer system
for the entire input b. Minicomputer system
c. Batch processing system
167. When auditing "around" the computer, d. Online real-time system
the independent auditor focuses solely upon
the source documents and 171. Company A has recently converted its
a. Test data manual payroll to a computer-based system.
b. CBIS processing Under the old system, employees who had
c. Control techniques resigned or been terminated were
d. CBIS output occasionally kept on the payroll and their
checks were claimed and cashed by other
168. One of the features that distinguishes employees, in collusion with shop foremen.
computer processing from manual processing The controller is concerned that this practice
is not be allowed to continue under the new
a. Computer processing virtually system. The best control for preventing this
eliminates the occurrence of form of "payroll padding" would be to
computational error normally a. Conduct exit interviews with all
associated with manual processing employees leaving the company,
b. Errors or fraud in computer processing regardless of reason.
will be detected soon after their b. Require foremen to obtain a signed
occurrences receipt from each employee claiming a
c. The potential for systematic error is payroll check.
ordinarily greater in manual c. Require the human resources
processing than in computerized department to authorize all hires and
processing terminations, and to forward a current
d. Most computer systems are designed computerized list of active employee
so that transaction trails useful for numbers to payroll prior to processing.
audit purposes do not exist Program the computer to reject
inactive employee numbers.
169. Given the increasing use of d. Install time clocks for use by all hourly
microcomputers as a means for accessing employees.
data bases, along with on-line real-time 172. Compared to a manual system, a
processing, companies face a serious CBIS generally
challenge relating to data security. Which of 1) Reduces segregation of duties
the following is not an appropriate means for 2) Increases segregation of duties
meeting this challenge? 3) Decreases manual inspection of
a. Institute a policy of strict identification processing results
and password controls housed in the 4) Increases manual inspection of
computer software that permit only processing results.
specified individuals to access the a. 1 and 3
computer files and perform a given b. 1 and 4
function. c. 2 and 3
b. Limit terminals to perform only certain d. 2 and 4
transactions.
c. Program software to produce a log of 173. One of the major problems in a CBIS
transactions showing date, time, type is that incompatible functions may be
of transaction, and operator. performed by the same individual. One
d. Prohibit the networking of compensating control for this is the use of
microcomputers and do not permit a. Echo checks
users to access centralized data b. A self-checking digit system
bases. c. Computer generated hash totals

0
0
 d. A computer log 179. Totals of amounts in computer-record
data fields which are not usually added for
174. Which of the following processing other purposes but are used only for data
controls would be most effective in assisting a processing control purposes are called
store manager to ascertain whether the a. Record totals
payroll transaction data were processed in b. Hash totals
their entirety? c. Processing data totals
a. Payroll file header record d. Field totals
b. Transaction identification codes
c. Processing control totals 180. A hash total of employee numbers is
d. Programmed exception reporting part of the input to a payroll master file update
program. The program compares the hash
175. An organizational control over CBIS total to the total computed for transactions
operations is applied to the master file. The
a. Run-to-run balancing of control totals purpose of this procedure is to:
b. Check digit verification of unique a. Verify that employee numbers are
identifiers valid
c. Separation of operating and b. Verify that only authorized employees
programming functions are paid
d. Maintenance of output distribution logs c. Detect errors in payroll calculations
d. Detect the omission of transaction
176. Which of the following methods of processing
testing application controls utilizes a
generalized audit software package prepared
by the auditors? 181. Matthews Corp. has changed from a
a. Parallel simulation system of recording time worked on clock
b. Integrated testing facility approach cards to a computerized payroll system in
c. Test data approach which employees record time in and out with
d. Exception report tests magnetic cards. The CBIS automatically
updates all payroll records. Because of this
177. An unauthorized employee took change
computer printouts from output bins a. A generalized computer audit program
accessible to all employees. A control which must be used
would have prevented this occurrence is b. Part of the audit trail is altered
a. A storage/retention control c. The potential for payroll related fraud
b. A spooler file control is diminished
c. An output review control d. Transactions must be processed in
d. A report distribution control batches

178. Which of the following is a 182. Generalized audit software is of

disadvantage of the integrated test facility primary interest to the auditor in terms of its
approach? capability to
a. In establishing fictitious entities, the a. Access information stored on
auditor may be compromising audit computer files
independence. b. Select a sample of items for testing
b. Removing the fictitious transactions c. Evaluate sample test results
from the system is somewhat difficult d. Test the accuracy of the client's
and, if not done carefully, may calculations
contaminate the client's files.
c. ITF is simply an automated version of 183. Accounts payable program posted a
auditing "around" the computer. payable to a vendor not included in the on-
d. The auditor may not always have a line vendor master file. A control which would
current copy of the authorized version prevent this error is a
of the client's program. a. Validity check
b. Range check
c. Reasonableness test

0
0
 d. Parity check c. Observation of client personnel
d. Confirmation with outside parties
184. In a computerized sales processing
system, which of the following controls is most 188. Adequate technical training and
effective in preventing sales invoice pricing proficiency as an auditor encompasses an
errors? ability to understand a CBIS sufficiently to
a. Sales invoices are reviewed by the identify and evaluate
product managers before being mailed a. The processing and imparting of
to customers information
b. Current sales prices are stored in the b. Essential accounting control features
computer, and, as stock numbers are c. All accounting control features
entered from sales orders, the d. The degree to which programming
computer automatically prices the conforms with application of generally
orders accepted accounting principles.
c. Sales prices, as well as product
numbers, are entered as sales orders
are entered at remote terminal 189. Which of the following is not a major
locations reason why an accounting audit trail should
d. Sales prices are reviewed and be maintained for a computer system?
updated on a quarterly basis a. Query answering
b. Deterrent to fraud
185. Which of the following is likely to be of c. Monitoring purposes
least importance to an auditor in reviewing the d. Analytical review
internal control in a company with a CBIS?
a. The segregation of duties within the 190. Adequate control over access to data
data processing center. processing is required to
b. The control over source documents a. Prevent improper use or manipulation
c. The documentation maintained for of data files and programs
accounting applications. b. Ensure that only console operators
d. The cost/benefit ratio of data have access to program
processing operations documentation
c. Minimize the need for backup data
186. For the accounting system of Acme files
Company, the amounts of cash d. Ensure that hardware controls are
disbursements entered into an CBIS terminal operating effectively and as designed
are transmitted to the computer that by the computer manufacturer
immediately transmits the amounts back to
the terminal for display on the terminal 191. When testing a computerized
screen. This display enables the operator to accounting system, which of the following is
a. Establish the validity of the account not true of the test data approach?
number a. The test data need consist of only
b. Verify the amount was entered those valid and invalid conditions in
accurately which the auditor is interested
c. Verify the authorization of the b. Only one transaction of each type
disbursement need be tested
d. Prevent the overpayment of the c. Test data are processed by the client's
account computer programs under the
auditor's control
187. Which of the following audit d. The test data must consist of all
techniques most likely would provide an possible valid and invalid conditions
auditor with the most assurance about the
effectiveness of the operation of an internal 192. In studying a client's internal controls,
control procedure? an auditor must be able to distinguish
a. Inquiry of client personnel between prevention controls and detection
b. Recomputation of account balance controls. Of the following data processing
amounts controls, which is the best detection control?

0
0
 a. Use of data encryption techniques 196. When the auditor encounters
b. Review of machine utilization logs sophisticated computer-based systems, he or
c. Policy requiring password security she may need to modify the audit approach.
d. Backup and recovery procedure Of the following conditions, which one is not a
valid reason for modifying the audit
193. Which of the following procedures is approach?
an example of auditing "around" the a. More advanced computer systems
computer? produce less documentation, thus
a. The auditor traces adding machine reducing the visibility of the audit trail
tapes of sales order batch totals to a b. In complex comuter-based systems,
computer printout of the sales journal computer verification of data at the
b. The auditor develops a set of point of input replaces the manual
hypothetical sales transactions and, verification found in less sophisticated
using the client's computer program, data processing systems
enters the transactions into the system c. Integrated data processing has
and observes the processing flow replaced the more traditional
c. The auditor enters hypothetical separation of duties that existed in
transactions into the client's manual and batch processing
processing system during client systems.
processing of live" data d. Real-time processing of transactions
d. The auditor observes client personnel has enabled the auditor to concentrate
as they process the biweekly payroll. less on the completeness assertion
The auditor is primarily concerned with
computer rejection of data that fails to 197. If a control total were to be computed
meet reasonableness limits on each of the following data items, which
would best be identified as a hash total for a
194. Auditing by testing the input and payroll CBIS application?
output of a computer-based system instead a. Net pay
of the computer program itself will b. Department numbers
a. Not detect program errors which do c. Hours worked
not show up in the output sampled d. Total debits and total credits
b. Detect all program errors, regardless
of the nature of the output 198. In a distributed data base (DDB)
c. Provide the auditor with the same type environment, control tests for access control
of evidence administration can be designed which focus
d. Not provide the auditor with on
confidence in the results of the a. Reconciliation of batch control totals
auditing procedures b. Examination of logged activity
c. Prohibition of random access
195. Which of the following is an d. Analysis of system generated core
acknowledged risk of using test data when dumps
auditing CBIS records?
a. The test data may not include all 199. A control to verify that the dollar
possible types of transactions amounts for all debits and credits for incoming
b. The computer may not process a transactions are posted to a receivables
simulated transaction in the same way master file is the:
it would an identical actual transaction a. Generation number check
c. The method cannot be used with b. Master reference check
simulated master records c. Hash total
d. Test data may be useful in verifying d. Control total
the correctness of account balances,
but not in determining the presence 200. The program flowcharting symbol
of processing controls representing a decision is a
a. Triangle
b. Circle
c. Rectangle

0
0
 d. Diamond a. The programmer designing the
change adequately test the revised
201. An update program for bank account program
balances calculates check digits for b. All program changes be supervised by
account numbers. This is an example of the CBIS control group
a. An input control c. Superseded portions of programs be
b. A file management control deleted from the program run
c. Access control manual to avoid confusion
d. An output control d. All proposed changes be approved in
writing by a responsible individual.
202. CBIS controls are frequently classified
as to general controls and application 205. Which of the following is not a
controls. Which of the following is an technique for testing data processing
example of an application control? controls?
a. Programmers may access the a. The auditor develops a set of payroll
computer only for testing and test data that contain numerous errors.
"debugging" programs The auditor plans to enter these
b. All program changes must be fully transactions into the client's system
documented and approved by the and observe whether the computer
information systems manager and the detects and properly responds to the
user department authorizing the error conditions
change b. The auditor utilizes the computer to
c. A separate data control group is randomly select customer accounts for
responsible for distributing output, and confirmation
also compares input and output on a c. The auditor creates a set of fictitious
test basis custom accounts and introduces
d. In processing sales orders, the hypothetical sales transactions, as
computer compares customer and well as sales returns and allowances,
product numbers with internally stored simultaneously with the client's live
lists data processing
d. At the auditor's request, the client has
203. After a preliminary phase of the review modified its payroll processing
of a client's CBIS controls, an auditor may program so as to separately record
decide not to perform further tests related to any weekly payroll entry consisting of
the control procedures within the CBIS portion 60 hours or more. These separately
of the client's internal control system. Which recorded ("marked") entries are locked
of the following would not be a valid reason into the system and are available only
for choosing to omit further testing? to the auditor
a. The auditor wishes to further reduce
assessed risk 206. Which of the following would lessen
b. The controls duplicate operative internal control in a CBIS?
controls existing elsewhere in the a. The computer librarian maintains
system custody of computer program
c. There appear to be major weaknesses instructions and detailed listings
that would preclude reliance on the b. Computer operators have access to
stated procedures operator instructions and detailed
d. The time and dollar costs of testing program listings
exceed the time and dollar savings in c. The control group is solely responsible
substantive testing if the controls are for the distribution of all computer
tested for compliance output
d. Computer programmers write and
204. For good internal control over debug programs which perform
computer program changes, a policy should routines designed by the systems
be established requiring that analyst

0
0
207. Access control in an on-line CBIS can a. Check digits
best be provided in most circumstances by b. Control totals
a. An adequate librarianship function c. Validity tests
controlling access to files d. Process tracing data
b. A label affixed to the outside of a file
medium holder that identifies the 213. Which of the following controls would
contents be most efficient in reducing common
c. Batch processing of all input through a data input errors?
centralized, well-guarded facility a. Keystroke verification
d. User and terminal identification b. A set of well-designed edit checks
controls, such as passwords c. Balancing and reconciliation
d. Batch totals
208. While entering data into a cash
receipts transaction file, an employee 214. On-line real-time systems and
transposed two numbers in a customer code. electronic data interchange systems have the
Which of the following controls could prevent advantages of providing more timely
input of this type of error? information and reducing the quantity of
a. Sequence check documents associated with less automated
b. Record check systems. The advantages, however, may
c. Self-checking digit create some problems for the auditor. Which
d. Field-size check of the following characteristics of these
systems does not create an audit problem?
209. What is the computer process called a. The lack of traditional documentation
when data processing is performed of transactions creates a need for
concurrently with a particular activity and the greater attention to programmed
results are available soon enough to influence controls at the point of transaction
the particular course of action being taken or input
the decision being made? b. Hard copy may not be retained by the
a. Batch processing client for long periods of time, thereby
b. Real time processing necessitating more frequent visits by
c. Integrated data processing the auditor
d. Random access processing c. Control testing may be more difficult
given the increased vulnerability of the
210. Reconciling processing control totals client's files to destruction during the
is an example of testing process
a. An input control d. Consistent on-line processing of
b. An output control recurring data increases the incidence
c. A processing control of errors
d. A file management control
215. Creating simulated transactions that
211. Disadvantage of auditing around the are processed through a system to generate
computer is that it results that are compared with predetermined
a. Permits no assessment of actual results, is an auditing procedure referred to as
processing a. Desk checking
b. Requires highly skilled auditors b. Use of test data
c. Demands intensive use of machine c. Completing outstanding jobs
resources d. Parallel simulation
d. Interacts actively with auditee
applications 216. To obtain evidential matter about
control risk, an auditor ordinarily selects tests
212. The completeness of computer- from a variety of techniques, including
generated sales figures can be tested by a. Analysis
comparing the number of items listed on the b. Confirmations
daily sales report with the number of items c. Reprocessing
billed on the actual invoices. This process d. Comparison
uses

0
0
217. A major exposure associated with the
rapidly expanding use of microcomputers is
the absence of:
a. Adequate size of main memory and
disk storage
b. Compatible operating systems
c. Formalized procedures for purchase
justification
d. Physical, data file, and program
security

218. To ensure that goods received are the

same as those shown on the purchase
invoice, a computerized system should:
a. Match selected fields of the purchase
invoice to goods received
b. Maintain control totals of inventory
value
c. Calculate batch totals for each input
d. Use check digits in account numbers

219. Errors in data processed in a batch

computer system may not be detected
immediately because
a. Transaction trails in a batch system
are available only for a limited period
of time
b. There are time delays in processing
transactions in a batch system
c. Errors in some transactions cause
rejection of other transactions in the
batch
d. Random errors are more likely in a
batch system than in an on-line
system

220. Which of the following is a computer

test made to ascertain whether a given
characteristic belongs to the group?
a. Parity check
b. Validity check
c. Echo check
d. Limit check.

0
0