Risk Management and Information Systems Control Exam Review
Course Introduction
Risk Management and Information Systems Control explores the methods and strategies organizations use to identify, assess, and mitigate risks associated with their information systems. The course covers frameworks and best practices for developing and implementing risk management plans, with a focus on regulatory compliance, information security governance, and operational risk. Students learn how to evaluate threats and vulnerabilities, apply control measures, and design effective monitoring and reporting systems to protect critical assets. Emphasis is placed on real-world case studies and the practical application of standards such as COBIT, ISO 27001, and NIST, preparing students to make informed decisions in protecting information systems within complex organizational environments.
Recommended Textbook
Information Technology Auditing 3rd Edition by James A. Hall
Available Study Resources on Quizplus
12 Chapters
1295 Verified Questions
1295 Flashcards
Source URL: https://quizplus.com/study-set/351 Page 2
Chapter 1: Auditing and Internal Control
Available Study Resources on Quizplus for this Chatper
103 Verified Questions
103 Flashcards
Source URL: https://quizplus.com/quiz/5812
Sample Questions
Q1) Both the SEC and the PCAOB require management to use the COBIT framework for assessing internal control adequacy.
A)True
B)False
Answer: False
Q2) An IT auditor expresses an opinion on the fairness of the financial statements.
A)True
B)False
Answer: False
Q3) Advisory services is an emerging field that goes beyond the auditor's traditional attestation function.
A)True
B)False
Answer: True
Q4) The decision to extend credit beyond the normal credit limit is an example of A) independent verification
B) authorization
C) segregation of functions
D) supervision
Answer: B
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Auditing IT Governance Controls
Available Study Resources on Quizplus for this Chatper
99 Verified Questions
99 Flashcards
Source URL: https://quizplus.com/quiz/5813
Sample Questions
Q1) Which of the following is NOT a potential threat to computer hardware and peripherals?
A)low humidity
B)high humidity
C)carbon dioxide fire extinguishers
D)water sprinkler fire extinguishers
Answer: C
Q2) What is a mirrored data center?
Answer: A mirrored data center duplicates programs and data onto a computer at a separate location.Mirroring is performed for backup purposes.
Q3) What is a disaster recovery plan? What are the key features?
Answer: A disaster recovery plan is a comprehensive statement of all actions to be taken before,during,and after a disaster,along with documented,tested procedures that will ensure the continuity of operations.The essential features are: providing second site backup,identifying critical applications,backup and off-site storage procedures,creating a disaster recovery team,and testing the disaster recovery plan.
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Security Part I: Auditing Operating Systems and Networks
Available Study Resources on Quizplus for this Chatper
143 Verified Questions
143 Flashcards
Source URL: https://quizplus.com/quiz/5814
Sample Questions
Q1) IP spoofing is a form of masquerading to gain unauthorized access to a Web server.
A)True
B)False
Answer: True
Q2) Polling is one technique used to control data collisions.
A)True
B)False
Answer: True
Q3) When auditors examine and test the call-back feature,they are testing which audit objective?
A) incompatible functions have been segregated
B) application programs are protected from unauthorized access
C) physical security measures are adequate to protect the organization from natural disaster
D) illegal access to the system is prevented and detected
Answer: D
Q4) Briefly define an operating system.
Answer: An integrated group of programs that supports the applications and facilitates their access to specified resources.
Page 5
To view all questions and flashcards with answers, click on the resource link above.
Chapter 4: IT Security Part II: Auditing Database Systems
Available Study Resources on Quizplus for this Chatper
101 Verified Questions
101 Flashcards
Source URL: https://quizplus.com/quiz/5815
Sample Questions
Q1) There is more than one conceptual view of the database.
A)True
B)False
Q2) Which of the following is not a common form of conceptual database model?
A) hierarchical
B) network
C) sequential
D) relational
Q3) In the database method of data management,access authority is maintained by systems programming.
A)True
B)False
Q4) In the relational database model
A) relationships are explicit
B) the user perceives that files are linked using pointers
C) data is represented on two-dimensional tables
D) data is represented as a tree structure
Q5) _________________________ occurs when a specific file is reproduced for each user who needs access to the file.
Q6) Describe an environment in which a firm should use a partitioned database.
Page 6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Systems Development and Program Change
Activities
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/5816
Sample Questions
Q1) When the nature of the project and the needs of the user permit,most organizations will seek a pre-coded commercial software package rather than develop a system in-house.
A)True
B)False
Q2) Explain the five stages of the systems development life cycle?
Q3) Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.
Q4) Which control ensures that production files cannot be accessed without specific permission?
A) Database Management System
B) Recovery Operations Function
C) Source Program Library Management System
D) Computer Services Function
Q5) During the detailed feasibility study of the project,the systems professional who proposed the project should be involved in performing the study.
A)True
B)False
Q6) Outline the six controllable activities that relate to new systems development
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Overview of Transaction Processing and Financial Reporting Systems
Available Study Resources on Quizplus for this Chatper
143 Verified Questions
143 Flashcards
Source URL: https://quizplus.com/quiz/5817
Sample Questions
Q1) The most important advantage of sequential coding is that A) missing or unrecorded documents can be identified
B) the code itself lacks informational content
C) items cannot be inserted
D) deletions affect the sequence
Q2) The block code is the coding scheme most appropriate for a chart of accounts.
A)True
B)False
Q3) . Explain two types of coding schemes and give examples of their use.
Q4) Individuals with access authority to general ledger accounts should not prepare journal vouchers.
A)True
B)False
Q5) Discuss three audit implications of XBRL
Q6) Resource use is one characteristic used to distinguish between batch and real-time systems.Explain.
Page 8
Q7) Real-time processing in systems that handle large volumes of transactions each day can create operational inefficiencies.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above.
Page 9
Chapter 7: Computer-Assisted Audit Tools and Techniques
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/5818
Sample Questions
Q1) Incorrectly recording sales order number 123456 as 124356 is an example of a transcription error
A)True
B)False
Q2) The white box tests of program controls are also known as auditing through the computer.
A)True
B)False
Q3) The three groups of application controls are batch controls,run-to-run controls,and audit trail controls.
A)True
B)False
Q4) Describe parallel simulation.
Q5) A __________________________ fraud affects a large number of victims but the harm to each appears to be very small.
Q6) The black box approach to testing computer program controls is also known as auditing around the computer.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 8: Data Structures and CAATTs for Data Extraction
Available Study Resources on Quizplus for this Chatper
89 Verified Questions
89 Flashcards
Source URL: https://quizplus.com/quiz/5819
Sample Questions
Q1) An entity is any physical thing about which the organization wishes to capture data.
A)True
B)False
Q2) Give an advantage and a disadvantage of the sequential data structure
Q3) A table is in third normal form when it is
A) free of repeating group data
B) free of transitive dependencies
C) free of partial dependencies
D) free of deletion anomalies
E) none of the above.
Q4) All of the following are advantages of a partitioned database except A) increased user control by having the data stored locally
B) deadlocks are eliminated
C) transaction processing response time is improved
D) partitioning can reduce losses in case of disaster
Q5) Logical database design is the foundation of the conceptual design.
A)True
B)False
Q6) How does the database approach solve the problem of data redundancy?
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Auditing the Revenue Cycle
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/5820
Sample Questions
Q1) If a customer submits a written purchase order,there is no need to prepare a sales order.
A)True
B)False
Q2) In a computerized accounting system,segregation of functions refers to inventory control,accounts receivable,billing,and general ledger tasks.
A)True
B)False
Q3) With regard to segregation of duties,rule one is that transaction authorization and transaction processing should be separated.What does this require in the revenue cycle?
Q4) The stock release document is prepared by the shipping department to provide evidence that the goods have been released to the customer.
A)True
B)False
Q5) For each of the following documents,describe its purpose,the functional area preparing it,and the key data included: remittance advice,remittance list,deposit slip.
Q6) What function does the receiving department serve in the revenue cycle?
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Auditing the Expenditure Cycle
Available Study Resources on Quizplus for this Chatper
144 Verified Questions
144 Flashcards
Source URL: https://quizplus.com/quiz/5821
Sample Questions
Q1) The documents in a voucher packet include all of the following except
A) a check
B) a purchase order
C) a receiving report
D) a supplier's invoice
Q2) List specific jobs that should be segregated in the cash disbursements system.
Q3) In a merchandising firm,authorization for the payment of inventory is the responsibility of
A) inventory control
B) purchasing
C) accounts payable
D) cash disbursements
Q4) Goods received are inspected and counted to
A) determine that the goods are in good condition
B) determine the quantity of goods received
C) preclude payment for goods not received or received in poor condition
D) all of the above
Q5) Why does the payroll process lend itself to batch processing?
Q6) What is a blind copy of a purchase order and what is its purpose?
Q7) What is a vouchers payable system and why is it used?
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Business Ethics, Fraud, and Fraud Detection
Available Study Resources on Quizplus for this Chatper
85 Verified Questions
85 Flashcards
Source URL: https://quizplus.com/quiz/5822
Sample Questions
Q1) __________________________ are intentional mistakes while __________________________ are unintentional mistakes.
Q2) Since all fraud involves some form of financial misstatement,how is Fraudulent Statement fraud different?
Q3) Explain the pass through fraud.
Q4) Define database management fraud.
Q5) The importance to the accounting profession of the Sarbanes-Oxley Act of 2002 is that
a.bribery will be eliminated.
b.management will not be able to override the company's internal controls.
c.firms are required to have an effective internal control system.
d.firms will not be exposed to lawsuits.
Q6) For an action to be called fraudulent,all of the following conditions are required except
A) poor judgment
B) false representation
C) intent to deceive
D) injury or loss
Q7) What are the six broad classes of physical control activities defined by SAS 78?
Page 14
Q8) Name three types of program fraud.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Enterprise Resource Planning Systems
Available Study Resources on Quizplus for this Chatper
92 Verified Questions
92 Flashcards
Source URL: https://quizplus.com/quiz/5823
Sample Questions
Q1) Which statement about ERP installation is least accurate?
A) For the ERP to be successful, process reengineering must occur.
B) ERP fails because some important business process is not supported.
C) When a business is diversified, little is gained from ERP installation.
D) The phased-in approach is more suited to diversified businesses.
Q2) Goals of ERP include all of the following except
A) improved customer service
B) improvements of legacy systems
C) reduced production time
D) increased production
Q3) The primary goal of installing an ERP system is achieving business process reengineering to improve customer service,reduce production time,increase productivity,and improve decision-making.
A)True
B)False
Q4) Which of the following is usually not part of an ERP's core applications?
A) OLTP applications
B) sales and distribution applications
C) business planning applications
D) OLAP applications
To view all questions and flashcards with answers, click on the resource link above. Page 15