IT Audit and Assurance
Question Bank
Course Introduction
IT Audit and Assurance focuses on the principles, practices, and standards necessary to evaluate and ensure the effectiveness, reliability, and security of information technology systems within organizations. The course covers risk assessment, control frameworks (such as COBIT and ISO standards), audit planning, fieldwork techniques, and reporting processes specific to IT environments. Emphasis is placed on identifying vulnerabilities, ensuring compliance with regulations, evaluating internal controls, and recommending improvements to safeguard digital assets. Students will develop a critical understanding of the auditor's role in assuring data integrity, confidentiality, and availability, as well as strategies for assessing emerging technologies and handling fraud risks in a rapidly evolving digital landscape.
Recommended Textbook
Accounting Information Systems 14th GLOBAL Edition by Marshall B. Romney
Available Study Resources on Quizplus
22 Chapters
2238 Verified Questions
2238 Flashcards
Source URL: https://quizplus.com/study-set/3338
Page 2
Chapter 1: Conceptual Foundations of Accounting Information Systems
Available Study Resources on Quizplus for this Chatper
115 Verified Questions
115 Flashcards
Source URL: https://quizplus.com/quiz/66342
Sample Questions
Q1) Who of the following would not be involved in the expenditure cycle?
A)Accounts payable clerk.
B)Receiving clerk.
C)Cashier.
D)Requisition manager.
Answer: C
Q2) Clemente Santiago has formed a business that sells carved gourmet coconuts.He has hired five employees.The most senior is Mary,who manages the carving process.Jane is the newest employee.She collects the coconuts.Joe takes calls from unhappy customers.Tom tosses finished coconuts into the sea,sending them to the wholesaler.Annie sends letters to the wholesaler extolling the virtues of the latest production run of nuts that are drifting across the bay. Which of the following functions in the value chain is Tom performing?
A)Inbound logistics
B)Operations
C)Outbound logistics
D)Marketing and sales
E)Service
Answer: C
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Overview of Transaction Processing and Enterprise Resource Planning Systems
Available Study Resources on Quizplus for this Chatper
107 Verified Questions
107 Flashcards
Source URL: https://quizplus.com/quiz/66331
Sample Questions
Q1) Which of the following statements about data processing methods is true?
A)Online real-time processing does not store data in a temporary file.
B)Batch processing cannot be used to update a master file.
C)Control totals are used to verify accurate processing in both batch and online batch processing.
D)Online real-time processing is only possible with source data automation.
Answer: A
Q2) Build Smarts is a supplier of building materials to more than 150 builders in the state of Illinois.What is the best way for Build Smarts to ensure that all sales are recorded?
A)well-designed paper forms
B)source data automation
C)turnaround documents
D)sequentially numbered sales invoices
Answer: D
Q3) The existence of relevant data guarantees the data are useful.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Systems Documentation Techniques
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/66327
Sample Questions
Q1) Discuss the ways in which information professionals interact with documentation tools and the various levels of understanding necessary.
Answer: At a minimum,a professional should be able to read documentation.A professional may also be called upon to evaluate internal control system documentation in order to identify control strengths and weaknesses or recommend improvements.A professional may be engaged to prepare documentation,which requires the greatest amount of skill and understanding of a particular system.
Q2) Which symbol would be used in a flowchart to represent a connection to another part of the flowchart on a different page?
A)#4
B)#9
C)#14
D)#15
Answer: D
Q3) What is a Business Process Diagram (BPD)?
Answer: A Business Process Diagram (BPD)is a visual way to describe the different steps or activities in a business process.
To view all questions and flashcards with answers, click on the resource link above.
5
Chapter 4: Relational Databases
Available Study Resources on Quizplus for this Chatper
113 Verified Questions
113 Flashcards
Source URL: https://quizplus.com/quiz/66326
Sample Questions
Q1) A set of individual user views of the database is called the
A)conceptual-level schema.
B)internal-level schema.
C)external-level schema.
D)meta-schema.
Q2) Identify one potential outcome of the delete anomaly.
A)inconsistent data
B)inability to add new data
C)unintentional loss of data
D)none of the above
Q3) Using the database depicted above,in the Sales table,"Customer #" is best described as
A)an attribute.
B)a primary key.
C)a foreign key.
D)A, B, and C
Q4) Discuss redundancy as it applies to database design.
Q5) Describe a data dictionary.
Q6) Describe the different schemas involved in a database structure.What is the role of accountants in development of schemas?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Computer Fraud
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/66325
Sample Questions
Q1) Fraud perpetrators do not typically
A)attempt to return or pay back stolen amounts soon after the initial theft, but find they are unable to make full restitution.
B)use trickery or lies to gain the confidence and trust of others at the organization they defraud.
C)become bolder and more greedy the longer the theft remains undetected.
D)begin to rely on stolen amounts as part of their income.
Q2) Which of the following is not one of the components of the fraud triangle?
A)Incentive
B)Rationalization
C)Susceptibility
D)Opportunity
Q3) Which characteristic of the fraud triangle often stems from the belief that "the rules do not apply to me" within an organization?
A)Pressure
B)Opportunity
C)Rationalization
D)Concealment
Q4) Describe two kinds of fraud.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Computer Fraud and Abuse Techniques
Available Study Resources on Quizplus for this Chatper
96 Verified Questions
96 Flashcards
Source URL: https://quizplus.com/quiz/66324
Sample Questions
Q1) A fraud technique that allows a perpetrator to bypass normal system controls and enter a secured system is called
A)superzapping.
B)data diddling.
C)using a trap door.
D)piggybacking.
Q2) What is a buffer overflow attack?
A)It is an attack when the perpetrator is inserting malicious query in input such that it is passed to and executed by an application program.
B)It is an attack when the perpetrator is inputting so much data that the input buffer overflows. The overflow contains code that takes control of the company's computer.
C)It is an attack when the perpetrator uses software to guess company's addresses, send employees blank e-mails, and add unreturned messages to spammer e-mail list.
D)It is an attacked when the perpetrator sends hundreds of messages from randomly generated false addresses, overloading an Internet service provider's e-mail server.
Q3) Describe at least six computer attacks and abuse techniques.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Control and Accounting Information Systems
Available Study Resources on Quizplus for this Chatper
132 Verified Questions
132 Flashcards
Source URL: https://quizplus.com/quiz/66323
Sample Questions
Q1) A(n)________ helps top-level managers with high-level activities that demand frequent and regular attention.
A)boundary system
B)diagnostic control system
C)interactive control system
D)belief system
Q2) According to the COSO Enterprise Risk Management Framework,the risk assessment process incorporates all of the following components except
A)reporting potential risks to auditors.
B)identifying events that could impact the enterprise.
C)evaluating the impact of potential events on achievement of objectives.
D)establishing objectives for the enterprise.
Q3) Which internal control framework is widely accepted as the authority on internal controls?
A)COBIT.
B)ISACA framework.
C)COSO Integrated Control.
D)Sarbanes-Oxley control framework.
Q4) Why are most fraud not being reported or prosecuted?
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Controls for Information Security
Available Study Resources on Quizplus for this Chatper
100 Verified Questions
100 Flashcards
Source URL: https://quizplus.com/quiz/66322
Sample Questions
Q1) Describe what a man-trap is and how it contributes to information security.
Q2) A special purpose hardware device or software running on a general purpose computer,which filters information that is allowed to enter and leave the organization's information system,is known as a(n)
A)demilitarized zone.
B)intrusion detection system.
C)intrusion prevention system.
D)firewall.
Q3) A separate network located outside the organization's internal information system that permits controlled access from the Internet to selected resources is known as a(n)
A)demilitarized zone.
B)intrusion detection system.
C)intrusion prevention system.
D)firewall.
Q4) Security is a technology issue and not just a management issue.
A)True
B)False
Q5) Describe the security risks associated with virtualization and cloud computing.
Q6) Explain the value of penetration testing.
Page 10
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Confidentiality and Privacy Controls
Available Study Resources on Quizplus for this Chatper
61 Verified Questions
61 Flashcards
Source URL: https://quizplus.com/quiz/66321
Sample Questions
Q1) A process that takes plaintext of any length and transforms it into a short code is called
A)asymmetric encryption.
B)encryption.
C)hashing.
D)symmetric encryption.
Q2) You are assisting a manager from your company's headquarters in New York.The manager needs to interact online in real time with one of your company's affiliate overseas.The manager wants to make sure that her communications with the overseas affiliate won't be intercepted.What should you suggest to the manager?
A)A virtual private network connection.
B)A multifactor authentication network connection.
C)A private cloud network connection.
D)An asymmetric encryption system with digital signatures connection.
Q3) What confidentiality and security risk does using VoIP present to organizations?
A)Internet e-mail communications can be intercepted.
B)Internet photographs can be intercepted.
C)Internet video can be intercepted.
D)Internet voice conversations can be intercepted.
To view all questions and flashcards with answers, click on the resource link above.
Page 11
Chapter 10: Processing Integrity and Availability Controls
Available Study Resources on Quizplus for this Chatper
95 Verified Questions
95 Flashcards
Source URL: https://quizplus.com/quiz/66341
Sample Questions
Q1) Sequentially prenumbered forms are an example of a(n)
A)data entry control.
B)data transmission control.
C)processing control.
D)input control.
Q2) ________ is a data entry input control that involves checking the accuracy of input data by using it to retrieve and display other related information.
A)Validity check
B)Duplicate data check
C)Closed-loop verification
D)Check digit verification
Q3) Data matching is an example of a(n)
A)data entry control.
B)data transmission control.
C)processing control.
D)input control.
Q4) Training can also reduce the risk of system downtime.
A)True
B)False
Q5) Discuss ways that can help ensure the processing integrity of electronic voting.
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Auditing Computer-Based Information Systems
Available Study Resources on Quizplus for this Chatper
116 Verified Questions
116 Flashcards
Source URL: https://quizplus.com/quiz/66340
Sample Questions
Q1) What is the primary purpose of computer audit software?
A)To eliminate auditor judgment errors.
B)To assist the auditor in retrieving and reviewing information.
C)To help auditors detect unauthorized modifications to system program code.
D)To help auditors recheck all mathematical calculations, cross-foot, reprocess financial statements and compare to originals.
Q2) ________ is one tool used to document source data controls.
A)An input control matrix
B)A flowchart generator program
C)A program algorithm matrix
D)A mapping program
Q3) Auditors have the ability to change inherent risk.
A)True
B)False
Q4) An auditor might use ________ to examining large data files.
A)Excel
B)Access
C)IDEA
D)SQL
Q5) How is a financial audit different from an information systems audit?
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: The Revenue Cycle: Sales to Cash Collections
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/66339
Sample Questions
Q1) A monthly statement sent to customers serves a control purpose by
A)providing an opportunity for customers to verify the balance owed and activity on the account.
B)triggering the process to record a customer payment.
C)summarizing invoices and amounts due for customers.
D)reminding customers of the balance due and due date.
Q2) A method for tracking accounts receivable that matches specific invoices and payments from the customer is called a(n)________ method.
A)specific identification
B)balance forward
C)cycle billing
D)open-invoice
Q3) Which of the decisions below is not ordinarily found as part of the revenue cycle?
A)What credit terms should be offered?
B)How often should accounts receivable be subjected to audit?
C)How can customer payments be processed to maximize cash flows?
D)What are the optimal prices for each product or service?
Q4) What is RFID tags and how do companies use them to improve their shipping process?
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 13: The Expenditure Cycle: Purchasing to Cash Disbursements
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/66338
Sample Questions
Q1) ________ attempts to minimize or eliminate carrying and stockout costs.
A)Just-in-time inventory
B)Materials requirements planning
C)Economic order quantity
D)Evaluated receipt settlement
Q2) Restricting access to the approved supplier list can
A)help reduce the risk of fraudulent disbursements.
B)cause purchase order approval delays.
C)eliminate the risk of duplicate payment.
D)improve the efficiency of the expenditure cycle.
Q3) Which control would best prevent payments made to fictitious vendors?
A)Allow payments only to approved vendors.
B)Restrict access to any payment or approval documents.
C)Have an independent bank reconciliation.
D)Make sure all documents are in order before approving payments.
Q4) Identify the item below that is the biggest purchasing function cost driver.
A)the number of purchase requisitions processed
B)the number of suppliers used
C)the number of purchase orders processed
D)the quantity of items ordered
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 14: The Production Cycle
Available Study Resources on Quizplus for this Chatper
95 Verified Questions
95 Flashcards
Source URL: https://quizplus.com/quiz/66337
Sample Questions
Q1) The expenses associated with the use of clean rooms in the production of computer hard drives are ________ costs.
A)prevention
B)inspection
C)internal failure
D)external failure
Q2) The threat of loss of data exposes the company to
A)the loss of assets.
B)ineffective decision making.
C)inefficient manufacturing.
D)All of the above are correct.
Q3) Which type of information below should not be maintained by the AIS in accounting for fixed assets?
A)Identification/serial number .
B)Cost.
C)Improvements.
D)Market value.
Q4) What is PLM and how management can use it to improve product design?
Q5) What is a RFP and how can management use it to improve its production operations?
To view all questions and flashcards with answers, click on the resource link above. Page 16
Chapter 15: The Human Resources Management and Payroll Cycle
Available Study Resources on Quizplus for this Chatper
86 Verified Questions
86 Flashcards
Source URL: https://quizplus.com/quiz/66336
Sample Questions
Q1) The purpose of a general ledger payroll clearing account is
A)to check the accuracy and completeness of payroll recording and its allocation to cost centers.
B)to make the bank reconciliation easier.
C)to make sure that all employees are paid correctly each week.
D)to prevent the cashier from having complete control of the payroll cycle.
Q2) Which type of payroll report includes the details of the current paycheck and deductions as well as year-to-date totals?
A)Payroll register.
B)Deduction register.
C)Employee earnings statement.
D)Federal W-4 form.
Q3) Companies that specialize in processing payroll are known as
A)paycheck distribution companies.
B)payroll service bureaus.
C)professional employer organizations.
D)semi-governmental organizations.
Q4) Discuss the various types and sources of input into the HRM/payroll cycle.
Page 17
Q5) Identify the two types of payroll deductions and give two examples of each type.
Q6) Describe benefits and threats of incentive and bonus programs.
To view all questions and flashcards with answers, click on the resource link above.
Page 18
Chapter 16: General Ledger and Reporting System
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/66335
Sample Questions
Q1) A major way in which IFRS differs from GAAP that will affect the design of a company's general ledger and reporting system is an IFRS principle known as A)componentization.
B)monetization.
C)securitization.
D)centralization.
Q2) The balanced scorecard attempts to solve what major issue associated with traditional accounting reports?
A)Traditional accounting reports focus too narrowly on financial performance.
B)Traditional accounting reports are not easily understood by non-accountants.
C)Traditional accounting reports are expensive to produce.
D)Traditional accounting reports are produced too slowly to provide value.
Q3) Which of the following controls can minimize the threat of inaccurate or invalid general ledger data?
A)Training and experience in applying IFRS and XBRL.
B)Responsibility accounting.
C)Backup and disaster recovery procedures.
D)Restriction of access to general ledger.
Q4) How is an audit trail used in the general ledger and reporting system?
To view all questions and flashcards with answers, click on the resource link above. Page 19
Chapter 17: Database Design Using the Rea Data Model
Available Study Resources on Quizplus for this Chatper
90 Verified Questions
90 Flashcards
Source URL: https://quizplus.com/quiz/66334
Sample Questions
Q1) In which stage(s)of the database design process does data modeling occur?
A)During the systems analysis stage.
B)During the design stage.
C)During both the systems analysis and design stages.
D)After the design stage.
Q2) An entity-relationship diagram represents entities as ________ and the relationships between them as lines and ________.
A)circles; squares
B)squares; diamonds
C)rectangles; diamonds
D)rectangles; circles
Q3) The choice of cardinalities is often arbitrary to reflect facts about the organization being modeled and its business practices.
A)True
B)False
Q4) What is Cardinalities?
Q5) E-R diagrams can be used to represent the contents of any kind of database. A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 20
Chapter 18: Implementing an Rea Model in a Relational Database
Available Study Resources on Quizplus for this Chatper
98 Verified Questions
98 Flashcards
Source URL: https://quizplus.com/quiz/66333
Sample Questions
Q1) When using an REA diagram to develop a database,a many-to-many relationship must be
A)broken into two, one-to-one relationships.
B)combined into a single one-to-one relationship.
C)combined into a one-to-many relationship.
D)broken into two, one-to-many relationships.
Q2) Rebus Fashions provides haircuts to men and women.Rebus uses an REA database to record information that is important to the firm.Rebus has an M:N table named "Customer-Sale" where it keeps information about customer sales.Identify the attribute below that most likely does not belong in the Customer-Sale table.
A)Date of sale.
B)Time hair cut was started.
C)Name of customer.
D)All of the above are appropriate attributes for the Customer table.
Q3) Concatenated keys are
A)used when combining two or more REA diagrams.
B)foreign keys used to implement 1:N or 1:1 relationships.
C)multiple attribute keys used to implement 1:M relationships.
D)used to implement M:N relationships.
To view all questions and flashcards with answers, click on the resource link above. Page 21
Q4) What are the advantages of the REA data model over the traditional AIS model?
Chapter 19: Special Topics in Rea Modeling
Available Study Resources on Quizplus for this Chatper
98 Verified Questions
98 Flashcards
Source URL: https://quizplus.com/quiz/66332
Sample Questions
Q1) Using an REA database design,which is the most likely primary key for the Inventory-Request_Goods table?
A)Product number.
B)Product number - Purchase order number.
C)Product number - Purchase requisition number.
D)Purchase order number.
Q2) Picking ticket number is most likely to be a primary key in which entity of an expanded revenue cycle REA diagram?
A)Call on Customers.
B)Fill Customer Order.
C)Ship Order.
D)Take Customer Order.
Q3) In which entity would information about depreciation formula(s)and assumption(s)be stored in an REA model?
A)Resource.
B)Event.
C)Agent.
D)Both resource and agent.
Q4) Why might an REA diagram show relationships between agents?
To view all questions and flashcards with answers, click on the resource link above. Page 22
Chapter 20: Introduction to Systems Development and Systems Analysis
Available Study Resources on Quizplus for this Chatper
124 Verified Questions
124 Flashcards
Source URL: https://quizplus.com/quiz/66330
Sample Questions
Q1) One disadvantage of a Gantt chart is the fact that
A)it does not show the entire schedule for a project.
B)it does not show project progress.
C)it does not show relationships among project activities.
D)it does not permit an individual to quickly determine which activities are behind schedule.
Q2) Identify the main reasons why companies change existing systems?
Q3) All of the elements of the system come together in which step of the systems development life cycle?
A)Conceptual design.
B)Implementation and conversion.
C)Physical design.
D)Systems analysis.
Q4) The system objective concerned that system should be able to accommodate reasonable requirement changes is known as A)flexibility.
B)reliability.
C)timeliness.
D)usefulness.
23
Q5) Describe the four strategies used to determine AIS requirements.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 21: Ais Development Strategies
Available Study Resources on Quizplus for this Chatper
117 Verified Questions
117 Flashcards
Source URL: https://quizplus.com/quiz/66329
Sample Questions
Q1) Describe the advantages and disadvantages of outsourcing.
Q2) Firms should consider preparing a software prototype if the application
A)will be used for a critical function like inventory management.
B)automates a structured task.
C)can be produced using outside developers.
D)inputs and outputs are not clearly defined.
Q3) Why are end-user created systems often poorly documented?
A)Users often do not know how to document systems properly.
B)Users often consider systems documentation to be unimportant.
C)Users often believe it is too expensive to properly document systems.
D)Users are often unaware they need to properly document systems.
Q4) Identify one major drawback that is frequently associated with canned software.
A)A commercial software development company develops it.
B)Canned software is sold on the open market to a broad range of users with similar requirements.
C)Canned software may not meet all of a company's information or data processing needs.
D)Canned software may offer easy availability and lower costs.
Q5) Describe the important characteristics of extreme programming (XP).
Q6) Describe the difficulties that could be encountered when developing an AIS.
Page 24
To view all questions and flashcards with answers, click on the resource link above.
Chapter 22: Systems Design, implementation, and Operation
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/66328
Sample Questions
Q1) Yasin,a professional in information technology services,sent an e-mail to Mauqwa in the Purchasing department.The e-mail read "Mauqwa,the system just generated a stock-out report.I just wanted to give you a heads up.I'm sending it right over.Best regards,Yasin" What type of report is Yasin providing to Mauqwa?
A)Scheduled report.
B)Special-purpose analysis report.
C)Triggered exception report.
D)Demand report.
Q2) Flowcharts,record layouts,and decision tables are all often part of A)determining user needs.
B)documenting the program.
C)testing the program.
D)training program users.
Q3) If developers took the time to find and correct every program flaw,they would risk not getting the system completed on time.
A)True
B)False
Q4) Describe the eight basic steps in program design.
Q5) Describe the different methods of testing a system.
To view all questions and flashcards with answers, click on the resource link above. Page 25