Utah State University

ACCT 610

Chapter 17-IT Controls Part III: Systems Development, Program Changes, and Application Controls

TRUE/FALSE

1)Programs in their compiled state are very susceptible to the threat of unauthorized modification.

2. Maintenance access to systems increases the risk that logic will be corrupted either by the accident or intent to defraud.

3. Source program library controls should prevent and detect unauthorized access to application programs.

4. A check digit is a method of detecting data coding errors.

5. Input controls are intended to detect errors in transaction data after processing.

6. A header label is an internal, machine-readable label.

7. The user test and acceptance procedure is the last point at which the user can determine the system’s acceptability prior to it going into service.

8. A run-to-run control is an example of an output control.

9. Shredding computer printouts is an example of an output control.

10. In a CBIS environment, all input controls are implemented after data is input.

11. Achieving batch control objectives requires grouping similar types of input transactions (such as sales orders) together in batches and then controlling the batches throughout data processing.

12. The "white box" tests of program controls are also known as auditing through the computer.

13. The presence of a SPLMS effectively guarantees program integrity.

14. When using the test data method, the presence of multiple error messages indicates a flaw in the preparation of test transactions.

15. The Base Case System Evaluation is a variation of the test data method.

16. Tracing is a method used to verify the logical operations executed by a computer application.

17. Generalized audit software packages are used to assist the auditor in performing substantive tests.

18. The results of a parallel simulation are compared to the results of a production run in order to judge the quality of the application processes and controls.

19. Firms with an independent internal audit staff may conduct tests of the system development life cycle on an ongoing basis.

20. The programmer’s authority table will specify the libraries a programmer may access.

21. Use of the integrated test facility poses no threat to organizational data files.

MULTIPLE CHOICE

1. Which statement is not correct? The audit trail in a computerized environment

2. Which control is not associated with new systems development activities?

3. Routine maintenance activities require all of the following controls except

4. Which statement is correct?

5. Which control is not a part of the source program library management system?

6. Which control ensures that production files cannot be accessed without specific permission?

7. Program testing

8. The correct purchase order number, 123456, was incorrectly recorded as shown in the solutions. All of the following are transcription errors except

9. Which of the following is correct?

10. Which statement is not correct? The goal of batch controls is to ensure that during processing

11. An example of a hash total is

12. Which statement is not true? A batch control record

ANS: E

13. Which of the following is not an example of a processing control?

14. Which of the following is an example of input control test?

15. Which input control check would detect a payment made to a nonexistent vendor?

16. The employee entered "40" in the "hours worked per day" field. Which check would detect this unintentional error?

17. An inventory record indicates that 12 items of a specific product are on hand. A customer purchased two of the items, but when recording the order, the data entry clerk mistakenly entered 20 items sold. Which check could detect this error?

18. Which check is not an input control?

19. A computer operator was in a hurry and accidentally used the wrong master file to process a transaction file. As a result, the accounts receivable master file was erased. Which control would prevent this from happening?

20. Run-to-run control totals can be used for all of the following except

21. Methods used to maintain an audit trail in a computerized environment include all of the following except

22. Risk exposures associated with creating an output file as an intermediate step in the printing process (spooling) include all of the following actions by a computer criminal except

23. Which statement is not correct?

24. Input controls include all of the following except

25. Which of the following is an example of an input error correction technique?

26. Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud? Review of the documentation indicates that

27. Which statement is not true?

28. When the auditor reconciles the program version numbers, which audit objective is being tested?

29. When auditors do not rely on a detailed knowledge of the application's internal logic, they are performing

30. All of the following concepts are associated with the black box approach to auditing computer applications except

31. Which test is not an example of a white box test?

32. When analyzing the results of the test data method, the auditor would spend the least amount of time reviewing

33. All of the following are advantages of the test data technique except

34. All of the following are disadvantages of the test data technique except

35. All of the following statements are true about the integrated test facility (ITF) except

36. Which statement is not true? Embedded audit modules

37. Generalized audit software packages perform all of the following tasks except

SHORT ANSWER

1. Contrast the source program library (SPL) management system to the database management system (DBMS).

2. Describe two methods used to control the source program library.

3. New system development activity controls must focus on the authorization, development, and implementation of new systems and its maintenance. Discuss at least five control activities that are found in an effective system development life cycle.

4. What are the three broad categories of application controls?

5. How does privacy relate to output control?

6. What are the three categories of processing control?

7. What control issue is related to reentering corrected error records into a batch processing system? What are the two methods for doing this?

8. Output controls ensure that output is not lost, misdirected, or corrupted and that privacy is not violated. What are some output exposures or situations where output is at risk?

9. Input controls are programmed procedures (routines) that perform tests on transaction

data to ensure they are free from errors. Name four input controls and describe what they test

.

10. A                                                                   fraud affects a large number of victims but the harm to each appears to be very small.

11. Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

12. Auditors do not rely on detailed knowledge of the application's internal logic when they use the

                                                                 approach to auditing computer applications.

13. Describe parallel simulation.

14. What is meant by auditing around the computer versus auditing through the computer? Why is this so important?

15. What is an embedded audit module?

16. What are the audit’s objectives relating to systems development?