Accounting information systems controls processes 3rd edition turner test bank

Accounting Information Systems Controls Processes 3rd Edition Turner Test Bank Visit to download the full and correct content document: https://testbankdeal.com/dow nload/accounting-information-systems-controls-processes-3rd-edition-turner-test-ban k/

ACCOUNTING INFORMATION SYSTEMS/3e TURNER / WEICKGENANNT/COPELAND Test Bank: CHAPTER 7: Auditing Information Technology – Bases Processes

NOTE: All new or adjusted questions are in red. New questions are identified by the letter A as part of the question number; adjusted questions are identified by the letter X as part of the question number.

End of Chapter Questions: 1. Which of the following types of audits is most likely to be conducted for the purpose of identifying areas for cost savings?

A. Financial Statement Audits B. Operational Audits C. Regulatory Audits D. Compliance Audits 2. Financial statement audits are required to be performed by: A. Governmental Auditors B. CPAs C. Internal Auditors D. IT Auditors 3. Which of the following is not considered a cause for information risk?

A. Management’s geographic location is far from the source of the information needed to make effective decisions.

B. The information is collected and prepared by persons who use the information for very different purposes.

C. The information relates to business activities that are not well understood by those who collect and summarize the information for decision makers.

D. The information has been tested by internal auditors and a CPA firm.

4. Which of the following is not a part of general accepted auditing standards?

A. General Standards B. Standards of Fieldwork C. Standards of Information Systems D. Standards of Reporting 5. Which of the following best describes what is meant by the term “generally accepted auditing standards”?

A. Procedures used to gather evidence to support the accuracy of a client’s financial statements.

B. Measures of the quality of an auditor’s conduct carrying out professional responsibilities.

C. Professional pronouncements issued by the Auditing Standards Board.

D. Rules acknowledged by the accounting profession because of their widespread application.

Ch 7 Test bank – 3e

Page 1 of 32

6. In an audit of financial statement in accordance with generally accepted auditing standards, an auditor is required to: A. Document the auditor’s understanding of the client company’s internal controls.

B. Search for weaknesses in the operation of the client company’s internal controls.

C. Perform tests of controls to evaluate the effectiveness of the client company’s internal controls.

D. Determine whether controls are appropriately operating to prevent or detect material misstatements.

7. Auditors should develop a written audit program so that: A. All material transactions will be included in substantive testing.

B. Substantive testing performed prior to year end will be minimized.

C. The procedures will achieve specific audit objectives related to specific management assertions.

D. Each account balance will be tested under either a substantive test or a test of controls.

8. Which of the following audit objectives relates to the management assertion of existence?

A. A transaction is recorded in the proper period.

B. A transaction actually occurred (i.e., it is real) C. A transaction is properly presented in the financial statements.

D. A transaction is supported by detailed evidence.

9. Which of the following statements regarding an audit program is true?

A. An audit program should be standardized so that it may be used on any client engagement.

B. The audit program should be completed by the client company before the audit planning stage begins.

C. An audit program should be developed by the internal auditor during the audit’s completion/reporting phase.

D. An audit program establishes responsibility for each audit test by requiring the signature or initials of the auditor who performed the test.

10. Risk assessment is a process designed to: A. Identify possible circumstances and events that may affect the business.

B. Establish policies and procedures to carry out internal controls.

C. Identify and capture information in a timely manner.

D. Review the quality of internal controls throughout the year.

11. Which of the following audit procedures is most likely to be performed during the planning phase of the audit?

A. Obtain an understanding of the client’s risk assessment process.

B. Identify specific internal control activities that are designed to prevent fraud.

C. Evaluate the reasonableness of the client’s accounting estimates.

D. Test the timely cutoff of cash payments and collections.

Ch 7 Test bank – 3e

Page 2 of 32

12. Which of the following is the most significant disadvantage of auditing around the computer rather than through the computer?

A. The time involved in testing processing controls is significant.

B. The cost involved in testing processing controls is significant.

C. A portion of the audit trail is not tested.

D. The technical expertise required to test processing controls is extensive.

13. The primary objective of compliance testing in a financial statement audit is to determine whether: A. Procedures have been updated regularly.

B. Financial statement amounts are accurately stated.

C. Internal controls are functioning as designed.

D. Collusion is taking place.

14. Which of the following computer assisted auditing techniques processes actual client input data (or a copy of the real data) on a controlled program under the auditor’s control to periodically test controls in the client’s computer system?

A. Test data method B. Embedded audit module C. Integrated test facility D. Parallel simulation 15. Which of the following computer assisted auditing techniques allows fictitious and real transactions to be processed together without client personnel being aware of the testing process?

A. Test data method B. Embedded audit module C. Integrated test facility D. Parallel simulation 16. Which of the following is a general control to test for external access to a client’s computerized systems?

A. Penetration tests B. Hash totals C. Field checks D. Program tracing 17. Suppose that during the planning phase of an audit, the auditor determines that weaknesses exist in the client’s computerized systems. These weaknesses make the client company susceptible to the risk of an unauthorized break-in. Which type of audit procedures should be emphasized in the remaining phases of this audit?

A. Tests of controls B. Penetration tests C. Substantive tests D. Rounding errors tests

Ch 7 Test bank – 3e

Page 3 of 32

18. Generalized audit software can be used to: A. Examine the consistency of data maintained on computer files.

B. Perform audit tests of multiple computer files concurrently.

C. Verify the processing logic of operating system software.

D. Process test data against master files that contain both real and fictitious data.

19. Independent auditors are generally actively involved in each of the following tasks except: A. Preparation of a client’s financial statements and accompanying notes.

B. Advising client management as to the applicability of a new accounting standard.

C. Proposing adjustments to a client’s financial statements.

D. Advising client management about the presentation of the financial statements.

20. Which of the following is most likely to be an attribute unique to the financial statement audit work of CPAs, compared with work performed by attorneys or practitioners of other business professions?

A. Due professional care B. Competence C. Independence D. A complex underlying body of professional knowledge 21. Which of the following terms in not associated with a financial statement auditor’s requirement to maintain independence?

A. Objectivity B. Neutrality C. Professional Skepticism D. Competence TEST BANK - CHAPTER 7 - MULTIPLE CHOICE 1. Accounting services that improve the quality of information provided to the decision maker, an audit being the most common type of this service, is called: A. Compliance Services B. Assurance Services C. Substantive Services D. Operational Services 2. A type of assurance services that involves accumulating and analyzing support for the information provided by management is called an: A. Audit B. Investigation C. Financial Statement Examination D. Control Test 3. The main purpose of an audit is to assure users of the financial information about the: A. Effectiveness of the internal controls of the company.

B. Selection of the proper GAAP when preparing financial statements.

C. Proper application of GAAS during the examination.

D. Accuracy and completeness of the information.

Ch 7 Test bank – 3e

Page 4 of 32

4. Which of the following is not one of the three primary types of audits?

A. Compliance Audits B. Financial Statement Audits C. IT Audits D. Operational Audits 5. This type of audit is completed in order to determine whether a company has adhered to the regulations and policies established by contractual agreements, governmental agencies, or some other high authority.

A. Compliance Audit B. Operational Audit C. Information Audit D. Financial Statement Audit 6. This type of audit is completed to assess the operating policies and procedures of a client for efficiency and effectiveness.

A. Efficiency Audit B. Effectiveness Audit C. Compliance Audit D. Operational Audit 7. This type of audit is completed to determine whether or not the client has prepared and presented its financial statements fairly, in accordance with established financial accounting criteria.

A. GAAP Audit B. Financial Statement Audit C. Compliance Audit D. Fair Application Audit 8. Financial statement audits are performed by _________ who have extensive knowledge of generally accepted accounting principles (GAAP) in the US and/or International Financial Reporting Standards (IFRS).

A. Public Auditors B. Governmental Auditors C. Certified Public Accountants D. Internal Auditors 9. This type of auditor is an employee of the company he / she audits.

A. IT Auditor B. Government Auditor C. Certified Public Accountant D. Internal Auditor

Ch 7 Test bank – 3e

Page 5 of 32

10. This type of auditor specializes in the information systems assurance, control, and security.

They may work for CPA firms, government agencies, or with the internal audit group.

A. IT Auditor B. Government Auditor C. Certified Public Accountant D. Internal Auditor 11. This type of auditor conducts audits of government agencies or income tax returns.

A. IT Auditor B. Government Auditor C. Certified Public Accountant D. Internal Auditor 12. An important requirement of CPA firms is that they must be ________ with regard to the company being audited. The requirement allows CPA firms to provide a completely unbiased opinion on the information it audits.

A. Neutral B. Well-informed C. Materially invested D. All of the above 13. This type of audit is performed by independent auditors who are objective and neutral with respect to the company and the information being audited.

A. Compliance Audit B. Operational Audit C. Internal Audit D. External Audit 14. Which of the following scenarios does NOT impair the independence of a CPA firm from its client?

A. The lead audit partner is the sister-in-law of the client’s VP of Accounting B. One of the auditors owns stock in a competitor of the client C. One of the auditors is the golf partner of the client’s CEO D. The lead audit partner owns stock in the client 15. The independence of a CPA could be impaired by: A. Having no knowledge of the company or the company management B. By owning stock of a similar company C. Having the ability to influence the client’s decisions D. Being married to a stockbroker

Ch 7 Test bank – 3e

Page 6 of 32

16. Decision makers are typically forced to rely on others for information. When the source of the information is removed from the decision maker, the information stands a greater chance of being misstated. A decision maker may become detached from the source of information due to geography, organizational layers, or other factors. This describes which cause of information risk?

A. The lack of CPA independence B. The volume and complexity of underlying data C. The motive of the preparer D. The remoteness of information 17. The IT environment plays a key role in how auditors conduct their work in all but which of the following areas: A. Consideration of Risk B. Consideration of Information Fairness C. Design and Performance of Audit Tests D. Audit Procedures Used 18. The chance that information used by decision makers may be inaccurate is referred to as: A. Sample Risk B. Data Risk C. Audit Trail Risk D. Information Risk 19. Which of the following is not one of the identified causes of information risk?

A. Audited information B. Remote information C. Complexity of data D. Preparer motive 20. The main reasons that it is necessary to study information-based processing and the related audit function include: A. Information users often do not have the time or ability to verify information themselves.

B. It may be difficult for decision makers to verify information contained in a computerized accounting system.

C. Both of the above.

D. Neither of the above.

21. The existence of IT-based business processes often result in details of transactions being entered directly into the computer system, results in a lack of physical evidence to visibly view.

This situation is referred to as: A. Physical Evidence Risk B. Loss of Audit Trail Visibility C. Transaction Summary Chart D. Lack of Evidence View

Ch 7 Test bank – 3e

Page 7 of 32

22. The existence of IT-based business processes, that result in the details of the transactions being entered directly into the computer system, increases the likelihood of the loss or alternation of data due to all of the following, except: A. System Failure B. Database Destruction C. Programmer Incompetence D. Environmental Damage 23. The advantages of using IT-based accounting systems, where the details of transactions are entered directly into the computer include: A. Computer controls can compensate for the lack of manual controls B. Loss of audit trail view C. Increased internal controls risks D. Fewer opportunities to authorize and review transactions 24. The ten standards that provide broad guidelines for an auditor’s professional responsibilities are referred to as: A. Generally accepted accounting standards B. General accounting and auditing practices C. Generally accepted auditing practices D. Generally accepted auditing standards 25. The generally accepted auditing standards are divided into three groups. Which of the following is not one of those groups?

A. General Standards B. Basic Standards C. Standards of Fieldwork D. Standards of Reporting 26. GAAS, generally accepted auditing standards, provide a general framework for conducting quality audits, but the specific standards - or detailed guidance - are provided by all of the following groups, except: A. Public Company Accounting Oversight Board B. Auditing Standards Board C. Certified Fraud Examiners D. International Auditing and Assurance Standards Board 27. This organization, established by the Sarbanes-Oxley Act, was organized in 2003 for the purpose of establishing auditing standards for public companies.

A. Auditing Standards Board B. Public Company Accounting Oversight Board C. International Audit Practices Committee D. Information Systems Audit and Control Association

Ch 7 Test bank – 3e

Page 8 of 32

28. This organization is part of the AICPA and was the group responsible for issuing Statements on Auditing Standards which were historically widely used in practice.

A. Auditing Standards Board B. Public Company Accounting Oversight Board C. International Audit Practices Committee D. Information Systems Audit and Control Association 29. This organization was established by the IFAC to set International Standards on Auditing (ISAs) that contribute to the uniform application of auditing practices on a worldwide basis.

A. International Systems Audit and Control Association B. Auditing Standards Board C. Public Company Accounting Oversight Board D. International Auditing and Assurance Standards Board (IAASB) 30. This organization issues guidelines for conducting the IT audit. The standards issued address practices related to control and security of the IT system.

A. Auditing Standards Board B. Public Company Accounting Oversight Board C. International Audit Practices Committee D. Information Systems Audit and Control Association 31. The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor. This is one of the generally accepted auditing standards that is part of the: A. General Standards B. Operating Standards C. Fieldwork Standards D. Reporting Standards 32. Independence in mental attitude is to be maintained in all matters related to the audit engagement. This is one of the generally accepted auditing standards that is part of the: A. General Standards B. Operating Standards C. Fieldwork Standards D. Reporting Standards 33. The general guidelines, known as the generally accepted auditing standards, which include the concepts of adequate planning and supervision, internal control, and evidence relate to the: A. General Standards B. Operating Standards C. Fieldwork Standards D. Reporting Standards

Ch 7 Test bank – 3e

Page 9 of 32

34. The general guidelines, known as the generally accepted auditing standards, which include the concepts of presentation in accordance with the established criteria, the consistent application of established principles, adequate disclosure, and the expression of an opinion, relate to the: A. General Standards B. Operating Standards C. Fieldwork Standards D. Reporting Standards 35. The role of the auditors is to analyze the underlying facts to decide whether information provided by management is fairly presented. Auditors design ____1_____ to analyze information in order to determine whether ____2_____ is/are valid.

A. 1=audit objectives; 2=management’s assertions B. 1=audit tests; 2=audit objectives C. 1=audit tests; 2=audit evidence D. 1=audit tests; 2=management’s assertions 36. Although there are a number of organizations that provide detailed guidance, it is still necessary for auditors to rely on other direction regarding the types of audit tests to use and the manner in which the conclusions are drawn. These sources of information include: A. Industry Guidelines B. PCAOB C. ASB D. ASACA 37. Claims regarding the condition of the business organization and in terms of its operations, financial results, and compliance with laws and regulations, are referred to as: A. Financial Statements B. Management Assertions C. External Audit D. Presentation and Disclosure 38. Which management assertion determines that transactions and related asset accounts balances are actually owned and that liability account balances represent actual obligations?

A. Valuation and Allocation B. Existence C. Rights and Obligations D. Classification and Presentation 39. Audit tests developed for an audit client are documented in a(n): A. Audit Program B. Audit Objective C. Management Assertion D. General Objectives

Ch 7 Test bank – 3e

Page 10 of 32

40. The management assertion related to valuation of transactions and account balances would include all of the following, except: A. Accurate in terms of dollar amounts and quantities B. Supported by detailed evidence C. Real D. Correctly summarized 41. There are four primary phases of the IT audit. Which of the following is not one of those phases?

A. Planning B. Evidence Audit C. Tests of Controls D. Substantive Tests 42. The main difference between substantive testing and controls testing is: A. Substantive testing verifies whether information is correct, whereas control tests determine whether the information is managed under a system that promotes correctness.

B. Substantive testing determines whether the information is managed under a system that promotes correctness, whereas Control testing verifies whether information is correct.

C. Substantive testing goes further in depth into the internal controls of a company, whereas controls testing just identifies which controls need further review.

D. Substantive testing identifies which controls need further review, whereas controls testing goes further in depth into the internal controls of a company.

43. During substantive testing, if material misstatements have been found to exist, which of the following actions should be taken next?

A. Proceed to the audit completion in the reporting phase B. Re-evaluate the audit risk in the planning phase C. Re-perform detailed tests of balances D. Re-perform an internal controls systems analysis 44. The proof of the fairness of the financial information is: A. Tests of Controls B. Substantive Tests C. Audit Completion D. Audit Evidence 45. Techniques used for gathering evidence include all of the following, except: A. Physical examination of assets or supporting documentation B. Observing activities C. Adequate planning and supervision D. Analyzing financial relationships

Ch 7 Test bank – 3e

Page 11 of 32

46. During this phase of the audit, the auditor must gain a thorough understanding of the client’s business and financial reporting systems. When completing this phase, the auditors review and assess the risks and controls related to the business.

A. Tests of Controls B. Substantive Tests C. Audit Completion / Reporting D. Audit Planning 47. During the planning phase of the audit, auditors estimate the monetary amounts that are large enough to make a difference in decision making. This amount is referred to as: A. Risk B. Materiality C. Substantive D. Sampling 48. The likelihood that errors or fraud may occur is referred to as: A. Risk B. Materiality C. Control Tests D. Sampling 49. A large part of the work performed by an auditor in the audit planning process is the gathering of evidence about the company’s internal controls. This can be completed in any of the following ways, except: A. Interviewing key members of the accounting and IT staff.

B. Observing policies and procedures C. Review IT user manuals and systems D. Preparing memos to summarize their findings 50. Auditing standards address the importance of understanding both the automated and manual procedures that make up an organization’s internal controls and consider how misstatements may occur, including all of the following, except: A. How transactions are entered into the computer B. How financial statement are printed from the computer C. How nonstandard journal entries and adjusting entries are initiated, recorded, and processed.

D. How standard journal entries are initiated, recorded, and processed.

51. IT auditors may need to be called in to: A. Consider the effects of computer processing on the audit.

B. To assist in testing the automated processes.

C. Both of the above.

D. None of the above.

Ch 7 Test bank – 3e

Page 12 of 32

52. Many companies design their IT system so that all documents and reports can be retrieved from the system in readable form. Auditors can then compare the documents used to input the data into the system with reports generated from the system, without gaining any extensive knowledge of the computer system and does not require the evaluation of computer controls.

This process is referred to as: A. Auditing through the system B. Auditing around the system C. Computer assisted audit techniques D. Auditing with the computer 53. The audit practice of “auditing around the computer” is also referred to as: A. The white box approach B. The black box approach C. Computer-assisted audit techniques (CAATs) D. The gray box approach 54. Which of the following is the most effective way of auditing the internal controls of an IT system?

A. Auditing with the Computer B. Auditing through the computer C. Auditing around the computer D. Auditing in the computer 55. This approach, referred to as the whitebox approach, requires auditors to evaluate IT controls and processing so that they can determine whether the information generated from the system is reliable.

A. Auditing through the system B. Auditing around the system C. Computer assisted audit techniques D. Auditing with the computer 56. The IT auditing approach referred to as “Auditing through the system” is necessary under which of the following conditions?

A. Supporting documents are available in both electronic and paper form.

B. The auditor does not require evaluation of computer controls.

C. The auditor wants to test computer controls as a basis for evaluating risk and reducing the amount of substantive audit testing required.

D. The use of the IT system has a low impact on the conduct of the audit.

57. Audit procedures designed to evaluate both general controls and application controls are referred to as: A. Substantive Tests B. Audit Planning C. IT Auditing D. Test of Controls

Ch 7 Test bank – 3e

Page 13 of 32

58. The automated controls that affect all computer applications are referred to as: A. General Controls B. Specific Controls C. Input Controls D. Application Controls 59. Which of the following describes a mathematical sum of data that is meaningless to the financial statements but useful for controlling the data and detecting possible missing items?

A. Hash Total B. Batch Total C. Validation Check D. Sequence Verification total 60. The two broad categories of general controls that relate to IT systems include which of the following: A. IT systems documentation B. IT administration and the related operating systems development and maintenance processes C. Authenticity table D. Computer security and virus protection 61. Related audit tests to review the existence and communication of company policies regarding important aspects of IT administrative control include all of the following, except: A. Personal accountability and segregation of incompatible responsibilities B. Job description and clear lines of authority C. Prevention of unauthorized access D. IT systems documentation 62. Auditors may send text messages through a company’s system to find out whether encryption of private information is occurring properly. In addition, special software programs are available to help auditors identify weak points in a company’s security measures. These are examples of: A. Penetration tests B. Authenticity tests C. Vulnerability assessments D. Access log reviews 63. Controls meant to prevent the destruction of information as the result of unauthorized access to the IT system are referred to as: A. IT administration B. System controls C. Information administration D. Security controls

Ch 7 Test bank – 3e

Page 14 of 32

64. In addition to testing system documentation, auditors should test the three main functions of computer applications. Which of the following is not one of these functions?

A. Output B. Input C. Processing D. Data Storage 65. All of the following are examples of security controls except for?

A. Biometric access controls B. Swipe Key access controls C. Online firewall protection controls D. All of the Above are examples of security controls 66. Auditors should perform this type of test to determine the valid use of the company’s computer system, according to the authority tables.

A. Authenticity tests B. Penetration tests C. Vulnerability assessments D. IT systems documentation 67. These tests of the security controls involve various methods of entering the company’s system to determine whether controls are working as intended.

A. Authenticity tests B. Penetration tests C. Vulnerability assessments D. IT systems documentation 68. These tests of security controls analyze a company’s control environment for possible weaknesses. Special software programs are available to help auditors identify weak points in their company’s security measures.

A. Authenticity tests B. Penetration tests C. Vulnerability assessments D. IT systems documentation 69. One of the most effective ways a client can protect its computer system is to place physical controls in the computer center. Physical controls include all of the following, except: A. Proper temperature control B. Locks C. Security guards D. Cameras 70. One of the most effective ways a client can protect its computer system is to place environmental controls in the computer center. Environmental controls include: A. Card keys B. Emergency power supply C. Alarms D. Security guards

Ch 7 Test bank – 3e

Page 15 of 32

71. This type of application control is performed to verify the correctness of information entered into software programs. Auditors are concerned about whether errors are being prevented and detected during this stage of data processing.

A. Security controls B. Processing controls C. Input controls D. Output controls 72. IT audit procedures typically include a combination of data accuracy tests where the data processed by computer applications are reviewed for correct dollar amounts or other numerical values. These procedures are referred to as: A. Security controls B. Processing controls C. Input controls D. Output controls 73. This type of processing control test involves a comparison of different items that are expected to have the same values, such as comparing two batches or comparing actual data against a predetermined control total.

A. Validation Checks B. Batch Totals C. Run-to-Run Totals D. Balancing Tests 74. This law, also known as the first-digit law, was named after a physicist who discovered a specific, but non-uniform pattern in the frequency of digits occurring as the first number in a list of numbers: A. Number-up Law B. Benford’s Law C. Adams’ Digit Law D. Jackson First Digit Law 75. This is one of the computer-assisted audit techniques related to processing controls that involves processing company data through a controlled program designed to resemble the company’s application. This test is run to find out whether the same results are achieved under different systems.

A. Integrated Test Facility B. Embedded Audit Module C. Parallel Simulation D. Test Data Method 76. Regardless of whether the results are printed or retained electronically, auditors may perform all of the following procedures to test application outputs, except: A. Integrated Tests B. Reasonableness Tests C. Audit Trail Tests D. Rounding Errors Tests

Ch 7 Test bank – 3e

Page 16 of 32

77. The auditor’s test of the accuracy of monetary amounts of transactions and account balances is known as: A. Testing of controls B. Substantive tests C. Compliance tests D. Application tests 78. A process of constant evidence gathering and analysis to provide assurance on the information as soon as it occurs, or shortly thereafter, is referred to as: A. Real-time auditing B. Virtual auditing C. E-auditing D. Continuous auditing 79. This phase of auditing occurs when the auditors evaluate all the evidence that has been accumulated and makes a conclusion based on that evidence.

A. Tests of Controls B. Audit Planning C. Audit Completion / Reporting D. Substantive Testing 80. This piece of audit evidence is often considered to be the most important because it is a signed acknowledgment of management’s responsibility for the fair presentation of the financial statements and a declaration that they have provided complete and accurate information to the auditors during all phases of the audit.

A. Letter of Representation B. Audit Report C. Encounter Statement D. Auditors Contract 81. Which of the following is a proper description of an auditor report?

A. Unqualified opinion - identifies certain exceptions to the clean opinion.

B. Adverse opinion - notes that there are material misstatements presented.

C. Qualified opinion - states that the auditors believe the financial statements are fairly and consistently presented in accordance with GAAP. D. Unqualified opinion - states that the auditors were not able to reach a conclusion.

82. When PCs are used for accounting instead of mainframes or client-server system, they face a greater risk of loss due to which of the following: A. Authorized access B. Segregation of duties C. Lack of backup control D. All of the above

Ch 7 Test bank – 3e

Page 17 of 32

83. When companies rely on external, independent computer service centers to handle all or part of their IT needs it is referred to as: A. External Processing B. WAN Processing C. Database Management System D. IT Outsourcing 84. Because it is not possible to test all transactions and balances, auditors rely on this to choose and test a limited number of items and transactions and then make conclusions about the balance as a whole.

A. Sampling B. Materiality C. Compliance D. Substance 85. All types of auditors must follow guidelines promoting ethical conduct. For financial statement auditors, the PCAOB/AICPA has established a Code of Professional Conduct, commonly called the Code of Ethics, which consists of two sections. Which of the following correctly states the two sections?

A. Integrity and responsibility B. Principles and rules C. Objectivity and independence D. Scope and nature 86. The rule in the PCAOB/AICPA Code of Professional Conduct that is referred to as Responsibilities, can be stated as: A. CPAs should act in a way that will serve the public interest, honor the public trust, and demonstrate commitment to professionalism.

B. To maintain and broaden public confidence, CPAs should perform their professional duties with the highest sense of integrity.

C. In carrying out their professional duties, CPAs should exercise sensitive professional and moral judgments in all their activities.

D. CPAs in public practice should observe the principles of the Code of Professional Conduct in determining the scope and nature of services to be provided.

87. This concept means that the auditors should not automatically assume that their clients are honest, but that they (the auditors) must have a questioning mind and a persistent approach to evaluating evidence for possible misstatements.

A. Independence B. Integrity C. Due Care D. Professional Skepticism

Ch 7 Test bank – 3e

Page 18 of 32

TEST BANK - CHAPTER 7 - TRUE / FALSE 1. All users of financial data - business managers, investors, creditors, and government agencies have an enormous amount of data to use to make decisions. Due to the use of IT systems, it is easy to verify the accuracy and completeness of the information.

FALSE 2.

In order to properly carry out an audit, accountants collect and evaluate proof of procedures, transactions, and / or account balances, and compare the information with established criteria.

TRUE

3.

The only person who can perform a financial statement audit of a publicly traded company is a government auditor who has extensive knowledge of generally accepted accounting principles.

FALSE

4.

Any professionally trained accountant is able to perform an operational audit.

TRUE

5.

An important requirement for CPA firms is that they must be personally involved with the management of the firm that is being audited.

FALSE

6.

The most common type of audit service is the operating audit performed by internal auditors.

FALSE

7.

All types of auditors should have knowledge about technology-based systems so that they can properly audit IT systems.

TRUE

8.

A financial statement audit is part of the IT audit.

FALSE

9.

Auditors do not need to be experts on the intricacies of computer systems but they do need to understand the impact of IT on their clients’ accounting systems and internal controls.

TRUE

10.

An internal auditor is not allowed to assist in the performance of a financial statement audit.

FALSE

11.

A financial statement audit is conducted in order for an opinion to be expressed on the fair presentation of financial statements. This goal is affected by the presence or absence of IT accounting systems.

FALSE

Ch 7 Test bank – 3e

Page 19 of 32

12. Information risk is the chance that information used by decision makers may be inaccurate.

TRUE 13. As a business grows, the volume and complexity of its transactions increase. At the same timed, there is a decrease in the chance that misstated information may exist undetected.

FALSE

14.

The remoteness of information, one of the causes of information risk, can relate to geographic distance or organizational layers.

TRUE

15.

The most common method for decision makers to reduce information risk is to rely on information that has been audited by an independent party.

TRUE

16.

Auditors have the primary responsibility to make sure that they comply with international standards in all cases.

FALSE

17.

There is not much room for professional judgement when performing audits, as a result of the detailed guidance provided by organizations, such as the PCAOB. FALSE

18. The responsibility for operations, compliance, and financial reporting lies with the auditors.

FALSE 19.

The role of the auditor is to analyze the underlying facts to decide whether information provided by management is fairly presented.

TRUE

20.

Management assertions relate to the actual existence and proper valuation of transactions and account balances.

TRUE

21.

The same audit tests would test for completeness of a liability or an asset.

FALSE

22.

Auditing testing for any single general auditing objective would involve the same testing techniques even though there are different types of information collected to support different accounts and transactions.

FALSE

23.

Auditors must think about how the features of a company’s IT systems influence its management assertions and the general audit objectives even though these matters have little or no impact on the choice of audit methodologies used.

FALSE Risk can be inherent in the company’s business, due to things such as the nature of

24.

Ch 7 Test bank – 3e

Page 20 of 32

operations, or may be caused by weak internal controls.

TRUE 25.

The audit planning process is unlikely to vary if the company has adopted IFRS, or is in the process of convergence.

FALSE

26.

Adapting to fair value measures in the preparation of IFRS-based financial statements will likely cause auditors to evaluate supporting evidence differently than if US GAAP was used.

TRUE

27.

IFRS does not allow as much use of judgment as is allowed under GAAP. FALSE

28.

Auditors do not need to concern themselves with risks unless there is an indication that there is an internal control weakness.

FALSE

29.

The auditor’s understanding of internal controls provides the basis for designing appropriate audit tests to be used in the remaining phases of the audit.

TRUE

30.

The process of evaluating internal controls and designing meaningful audit tests is more complex for manual systems than for automated systems.

FALSE

31.

Computer-assisted audit techniques are useful audit tools because they make it possible for auditors to use computers to audit large amounts of evidence in less time.

TRUE

32.

In order to enhance controls, reconciliations should be performed by company personnel who are independent from the tasks of initiating or recording the transactions with the accounts being reconciled.

TRUE

33. Substantive tests are also referred to as compliance tests.

FALSE 34.

General controls relate to specific software and application controls relate to all aspects of the IT environment.

FALSE

35. General controls must be tested before application controls.

TRUE

Ch 7 Test bank – 3e

Page 21 of 32

36.

Systems operators and users should not have access to the IT documentation containing details about the internal logic of computer systems.

TRUE

37.

Control tests verify whether financial information is accurate, where substantive tests determine whether the financial information is managed under a system that promotes accuracy.

FALSE

38. Regardless of the results of the control testing, some level of substantive testing must take place.

TRUE 39.

The use of generalized audit software is especially useful when there are large volumes of data and when there is a need for accurate information.

TRUE

40.

All of the risks and audit procedures that apply to a PC environment may also exist in networks, but the risk of loss of much lower.

FALSE

41.

Network operations typically involve a large number of computers, many users, and a high volume of data transfers, so any lack of network controls could cause widespread damage.

Because of this, it is necessary for auditors to apply strict tests to a representative sample of the network.

FALSE

42.

When audit clients use a database system, the relating data is organized in a consistent manner which tends to make it easier for auditors to select items for testing.

TRUE

43.

When a client company is using IT outsourcing, and that service center has its own auditors who report on internal control, the third-party report (from the independent auditors) cannot be used as audit evidence without the auditor performing an adequate amount of compliance testing.

FALSE

44.

Risk assessment in cloud computing is particularly challenging because the threats to a company’s data are uncontrolled, and often unforeseen, by the company.

TRUE

45.

Within the cloud computing environment, the service provider is responsible to make sure that all relevant risks have been identified and controlled. Because of this, the company using the cloud computing does not need to repeat that evaluation.

FALSE

Ch 7 Test bank – 3e

Page 22 of 32

46.

Because there is no such thing as a standard cloud, it is not possible to standardize a risk assessment process and audit procedures for a cloud computing environment.

TRUE

47.

When an auditor is engaged to audit a company that uses cloud computing, the auditor must rely on the SOC reports provided by the service company’s auditors.

FALSE

48.

When a client changes the type of hardware or software used or in other ways modifies its IT environment, the auditors need to test only the new system in order to determine the effectiveness of the controls.

FALSE

49.

When a client plans to implement new computerized systems, auditors will find it advantageous to review the new system before it is placed in use.

TRUE

50.

A sample is random when each item in the population has an equal chance of being chosen.

TRUE

51.

Of all the principles applicable to auditors, the one that generally receives the most attention is the requirement that financial statement auditors maintain integrity.

FALSE

52.

The Sarbanes-Oxley Act has placed restrictions on auditors by prohibiting certain types of services historically performed by auditors for their clients.

TRUE

53.

The Sarbanes-Oxley Act decreased management’s responsibilities regarding the fair presentation of the financial statements.

FALSE

54.

The responsibility of the auditor to search for fraud is less than the responsibility to search for errors.

FALSE

55.

Management fraud is the intentional misstatement of financial information and may be difficult for auditors to find because the perpetrator will attempt to hide the fraud.

TRUE

56.

The PCAOB/AICPA Code of Professional Conduct is made up of two sections. One section, the rules, are the foundations for the honorable behavior expected of CPAs while performing professional duties.

FALSE

FOR SHORT ANSWER AND ESSAY QUESTIONS REFER TO THE NEXT PAGE. ALL SHORT ANSWER AND ESSAY QUESTIONS ARE NEW IN THIS EDITION

Ch 7 Test bank – 3e

Page 23 of 32

Question 1.

SO2

Types of Audits Main purpose of an audit is to assure users of financial information about the accuracy and completeness of the information. Identify and describe the three primary types of audits, discussed in the text and class.

Type of Audit

Explanation

1.

2.

3.

Answer: TYPES OF AUDITS (SO 2) Three primary types of audits include ◆ compliance audits, ◆ operational audits, and ◆ financial statement audits.

The main purpose of the audit is to assure users of financial information about the accuracy and completeness of the information. To carry out an audit, accountants collect and evaluate proof of procedures, transactions, and/or account balances and compare the information with established criteria. The three primary types of audits include: • compliance audits, • operational audits, and • financial statement audits Compliance audits determine whether the company has complied with regulations and policies established by contractual agreements, governmental agencies, company management, or other high authority.

Operational audits assess operating policies and procedures for efficiency and effectiveness Financial statement audits determine whether the company has prepared and presented its financial statements fairly, and in accordance with established financial accounting criteria.

• financial statement audits are performed by certified public accountants who have extensive knowledge of generally accepted accounting principles (GAAP) in the United States and/or International Financial Reporting Standards (IFRS)

Ch 7 Test bank – 3e

Page 24 of 32

Question 2.

SO6

Four Primary Phases of an IT Audit

Identify and explain, in order of occurrence, the four primary phases to an IT audit Phase

Explanation

1.

2.

3.

4.

Answer: Steps in an IT audit are the same four steps in a traditional audit.

PHASES OF AN IT AUDIT (STUDY OBJECTIVE 6) There are four primary phases of the audit: • planning, • tests of controls, • substantive tests, and • audit completion/reporting

Ch 7 Test bank – 3e

Page 25 of 32

Through each phase of an audit, evidence is accumulated as a basis for supporting the conclusions reached by the auditors. Audit evidence is proof of the fairness of financial information. The techniques used for gathering evidence include the following: • • • • • •

Physically examining or inspecting assets or supporting documentation Obtaining written confirmation from an independent source Reperforming tasks or recalculating information Observing the underlying activities Making inquiries of company personnel Analyzing financial relationships and making comparisons to determine reasonableness

During the planning phase of an audit, the auditor must gain a thorough under- standing of the company’s business and financial reporting systems. In doing so, auditors review and assess the risks and controls related to the business, establish materiality guidelines, and develop relevant tests addressing the assertions and objectives • tasks of assessing materiality and audit risk are very subjective and are therefore typically performed by experienced auditors • Determining materiality, auditors estimate the monetary amounts that are large enough to make a difference in decision making • Materiality estimates are then assigned to account balances so that auditors can decide how much evidence is needed • Below materiality limits are often considered insignificant • Some accounts with immaterial balances may still be audited, though, especially if they are considered areas of high risk • Risk- refers to the likelihood that errors or fraud may occur • Risk can be inherit or it may be caused by weak internal controls A big part of the audit planning process is the gathering of evidence about the company’s internal controls • Auditors typically gain an understanding of internal controls by interviewing key members of management and the IT staff • They observe policies and procedures and review IT user manuals and system flowcharts • They often prepare narratives or memos to summarize the results of their findings • Company personnel generally complete a questionnaire about the company’s accounting systems, including its IT implementation and operations, the types of hardware and software used, and control of computer resources • The understanding of internal controls provides the basis for designing appropriate audit tests to be used in the remaining phases of the audit TESTS OF C O N T R O L S (STUDY O B J E C T I V E 8) The tests of controls involve audit procedures designed to evaluate both general controls and application controls. During audit planning, auditors must learn about the types of controls that exist within their client’s IT environment. Then they may test those controls to determine whether they are reliable as a means of reducing risk. Tests of controls are sometimes referred to as “compliance tests,”

because they are designed to determine whether the controls are functioning in compliance with management’s intentions.

Ch 7 Test bank – 3e

Page 26 of 32

TESTS OF T R A N S A C T I O N S AND TESTS OF B A LA N C E S (STUDY O B J E C T I V E 9) Audit tests of the accuracy of monetary amounts of transactions and account balances are known as substantive testing.

• Substantive tests verify whether information is correct, whereas control tests determine whether the information is managed under a system that promotes correctness • Some level of substantive testing is required regardless of the results of control testing.

• If weak internal controls exist or if important controls are missing, extensive substantive testing will be required.

• If controls are found to be effective, the amount of substantive testing required is significantly lower, because there is less chance of error in the underlying records Most auditors use generalized audit software (GAS) or data analysis soft- ware (DAS) to perform audit tests on electronic data files taken from commonly used database systems. These computerized auditing tools make it possible for auditors to be much more efficient in performing routine audit tests such as the following: • • • • • •

Mathematical and statistical calculations Data queries Identification of missing items in a sequence Stratification and comparison of data items Selection of items of interest from the data files Summarization of testing results into a useful format for decision making

GAS and DAS are evolving to handle larger and more diverse data sets, which allow auditors to use more types of unstructured data evidence and to perform more creative analytical procedures and predictive analyses.

A U D I T COMPLETION/REPORTING ( S T UDY O B J E C T I V E 10) After the tests of controls and substantive audit tests have been completed, auditors evaluate all the evidence that has been accumulated and draw conclusions based on this evidence. This phase is the audit completion/reporting phase.

The completion phase includes many tasks that are needed to wrap up the audit. For many types of audits, the most important task is obtaining a letter of representations from company management.

The letter of representations is often considered the most significant single piece of audit evidence, because it is a signed acknowledgment of management’s responsibility for the reported information. In this letter, management must declare that it has provided complete and accurate information to its auditors during all phases of the audit.

Four types of reports that are issued: 1. Unqualified opinion, which states that the auditors believe the financial statements are fairly and consistently presented in accordance with GAAP or IFRS 2. Qualified opinion, which identifies certain exceptions to an unqualified opinion 3. Adverse opinion, which notes that there are material misstatements presented 4. Disclaimer of opinion, which states that the auditors are unable to reach a conclusion.

Ch 7 Test bank – 3e

Page 27 of 32

Question 3.

SO

Primary objectives of compliance testing The primary objective of compliance testing in a financial statement audit of a company with an automated AIS or ERP system is to determine whether _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________ _______________________________________________________________________

The purpose of compliance testing in a financial statement audit of a company with an automated AIS or ERP system is to determine whether internal controls are in place and functioning as designed.

Question 4.

SO7

Computers User in Audits The text identifies three ways in which computers are used in audits.

IE Auditing __________ the computer. Identify, explain and provide examples of each of the ways in which computers are used in audits.

Way in which used Auditing

Explanation

____________ the computer Auditing ____________ the computer

Auditing ____________ the computer

Ch 7 Test bank – 3e

Page 28 of 32

ANSWER ➢ Use of Computers in Audits. The audit planning tasks of evaluating internal controls and designing meaningful audit tests is more complex for automated accounting systems than for manual systems.

In recognition of the fact that accounting records and files often exists in both paper and electronic form, auditing standards address the importance of understanding both the automated and manual procedures that make up an organization’s internal control. Misstatements may occur through the data entry and processing functions of the system. Auditors must consider the effects of such computer processing on the audit. Three options may exist for the auditor in deciding upon a testing approach for a client’s automated process, including auditing around the computer, auditing through the computer, and auditing with the computer.

•

•

•

Auditing around the computer is commonly known as the “black box” approach because auditors are not required to gain detailed knowledge about the company’s computer system; rather, documents used to input data into the system can be compared with reports generated from the system. Computer controls are not considered.

Auditing through the computer is commonly known as the “white box” approach because it involves directly testing the internal controls within the IT system. It requires the auditors to understand the computer system logic and related IT controls. Auditing through the computer is necessary when the auditor wants to test computer controls as a basis for reducing the amount of substantive testing required, when the auditor is required to report on internal controls of a public company, and when supporting documents are available only in electronic form.

Auditing with the computer involves the auditors’ use of their own computer systems and audit software to perform audit testing. A variety of computer assisted audit techniques (CAATs) are available for auditing with the computer.

USE OF COMPUTERS IN A U D I T S ( S T U DY O B J E C T I V E 7) If the use of IT systems does not have a great impact on the conduct of the audit, since the auditor can perform audit testing in the same manner as would be done for a manual system the practice is referred to as auditing around the computer because it does not require evaluation of computer controls.

• Auditing around the computer merely uses and tests output of the computer system in the same manner as the audit would be conducted if the information had been generated manually • Because this approach does not consider the effectiveness of computer controls, auditing around the computer has limited usefulness.

Auditing through the computer involves directly testing the internal controls within the IT system, whereas auditing around the computer does not • sometimes referred to as “the white box approach,” because it requires auditors to understand the computer system logic • This approach requires auditors to evaluate IT controls and processing so that they can determine whether the information generated from the system is reliable • Auditing through the computer is necessary under the following conditions: o The auditor wants to test computer controls as a basis for evaluating risk and reducing the amount of substantive audit testing required. o The author is required to report on internal controls in connection with a financial statement audit of a public company. o Supporting documents are available only in electronic form.

Ch 7 Test bank – 3e

Page 29 of 32

Auditors can use their own computer systems and audit software to help conduct the audit. This approach is known as auditing with the computer.

• A variety of computer-assisted audit techniques (CAATs) are available for auditing with the computer • CAATs are useful audit tools because they make it possible for auditors to use computers to test more evidence in less time.

Question 5.

SO8

Compliance and Substantive Testing

Keperlsky and Bennuchi, and audit firm was auditing EDJ consulting. EDJ is a large consulting firm that has consistently had very strong internal controls over IT functions at the company. The company uses SAP, a sophisticated, Tier 1 ERP system that has not been customized. Keperlsky and Bennuchi’s audit team has reviewed and tested the internal controls and concluded that the controls are very effective (strong) and they can be relied upon. Mr Keperlsky, a partner, has said that it is not necessary to complete substantive testing in this case, given the strength of the internal controls and strong ERP system. Is Mr Keperlsky’s conclusion correct?

Answer:

Yes

No

(Circle one)

Provide justification for your answer: _____________________________________________________________________________________ ____________________________________________________________________________________ _____________________________________________________________________________________ _____________________________________________________________________________________ ____________________________________________________________________________________ _____________________________________________________________________________________ _____________________________________________________________________________________ ____________________________________________________________________________________ _____________________________________________________________________________________ _____________________________________________________________________________________ ____________________________________________________________________________________ _____________________________________________________________________________________ Answer: No Mr Keperlsky is not correct. It is ALWAYS necessary to complete substantive testing. Compliance testing tests if internal controls are in place and functioning. Substantive test verify the accuracy of financial amounts. If controls are in place and functioning, su

Ch 7 Test bank – 3e

Page 30 of 32

Question 6.

SO7

Computer Assisted Audit Techniques (CAATs)

The text discusses several computer assisted audit techniques (CAAT’s). Lists 4 of the 5 CAAT’s and describe the technique.

Technique 1.

Description of Computer Assisted Audit Technique

2.

3.

4.

Ch 7 Test bank – 3e

Page 31 of 32

SOLUTION

Ch 7 Test bank – 3e

Page 32 of 32