Chapter 12 Take Home Quiz

|1. Typical controls developed for manual systems which are still important in IT systems include: |
|a. proper authorization of transactions. |
|b. competent and honest personnel. |
|c. careful and complete preparation of source documents. |
|d. all of the above. |
| |

|2. ______ controls prevent and detect errors while transaction data are processed. |
|a. Software |
|b. Application |
|c. Processing |
|d. Transaction |
| |

|3. Which of the following statements is correct? |
|a. Auditors should evaluate application controls before evaluating general controls. |
|b. Auditors should evaluate application controls and general controls simultaneously. |
|c. Auditors should evaluate general controls before evaluating application controls. |
|d. None of these statements is correct. |
| |

|4. Auditors should evaluate the ________ before evaluating application controls because of the potential for |
|pervasive effects. |
|a. input controls |
|b. control environment |
|c. processing controls |
|d. general controls |

|5. Which of the following is not an example of an applications control? |
|a. An equipment failure causes system downtime. |
|b. There is a preprocessing authorization of the sales transactions. |
|c. There are reasonableness tests for the unit selling price of a sale. |
|d. After processing, all sales transactions are reviewed by the sales department. |
| |

|6. Auditors usually evaluate the effectiveness of: |
|a. hardware controls before general controls. |
|b. sales-cycle controls before application controls. |
|c. general controls before applications controls. |
|d. applications controls before the control environment. |
| |

|7. In an IT-intensive environment, most processing controls are: |
|a. input controls. |
|b. operator controls. |
|c. programmed controls. |
|d. documentation controls. |
| |

| |
| |
|8. Auditors usually obtain information about general and application controls through: |
|a. interviews with IT personnel. |
|b. examination of systems documentation. |
|c. reading program change requests. |
|d. all of the above methods. |
| |

|9. The auditor’s objective to determine whether the client’s computer programs can correctly handle valid and |
|invalid transactions as they arise is accomplished through the: |
|a. test data approach. |
|b. generalized audit software approach. |
|c. microcomputer-aided auditing approach. |
|d. generally accepted auditing standards. |
| |

|10. Internal control is ineffective when computer personnel: |
|a. participate in computer software acquisition decisions. |
|b. design flowcharts and narratives for computerized systems. |
|c. originate changes in customer master files. |
|d. provide physical security over program files. |
| |

11. Identify the three categories of application controls, and give one example of each.

Application controls fall into three categories: • Input controls. Key verification and check digits are examples of input controls. • Processing controls. One example is a reasonableness test for the unit selling price of a sale. • Output controls. One example is post-processing review of sales transactions by the sales department.
12. Discuss what is meant by the term “auditing around the computer.”

“Auditing around the computer” occurs when the auditor considers only the non-IT controls when assessing control risk. Under this approach, the auditor obtains an understanding of internal control and performs tests of controls, substantive tests of transactions, and account balance verification procedures in the same manner as in manual systems. However, there is no attempt to test, or rely on, the client’s IT controls.