Accounting Information Systems, 8e—Test Bank, Chapter 17
Chapter 17—IT Controls Part III: Systems Development, Program Changes, and
Application Controls
TRUE/FALSE
1. Users need to be activity involved in the systems development process.
2. All systems should be informally approved to ensure economic justification and feasibility.
3. The technical design activities translate a set of detailed technical specifications for a system into user
specifications.
4. All program modules must be thoroughly tested before they are implemented.
5. Meaningful test data is relatively easy to create.
6. To verify the module’s internal logic, the programmer compares the actual results obtained from the
test with the predetermined results.
7. The user test and acceptance procedure is the last point at which the user can determine the system’s
acceptability prior to it going into service.
8. To support future audit needs, test data prepared during systems implementation should be preserved.
9. Maintenance access to systems increases the risk that logic will be corrupted either by the accident or
intent to defraud.
10. One of the auditor’s objectives relating to systems development is to authorize development projects.
11. The longest period in the SDLC is the maintenance phase.
12. Source program library controls should prevent and detect unauthorized access to application
programs.
13. The presence of a SPLMS effectively guarantees program integrity.
14. Programs in their compiled state are very susceptible to the threat of unauthorized modification.
15. When using the test data method, the presence of multiple error messages indicates a flaw in the
preparation of test transactions.
16. The black box approach to testing computer applications allows the auditor to explicitly review
program logic.
17. A salami fraud affects a large number of victims, but the harm to each appears to be very small.
18. The black box approach to testing computer program controls is also known as auditing around the
computer.
19. The base case system evaluation is a variation of the test data method.
20. Tracing is a method used to verify the logical operations executed by a computer application.
21. Generalized audit software packages are used to assist the auditor in performing substantive tests.
22. The results of a parallel simulation are compared to the results of a production run in order to judge the
quality of the application processes and controls.
Accounting Information Systems, 8e—Test Bank, Chapter 17
23. Firms with an independent internal audit staff may conduct tests of the system development life cycle
on an ongoing basis.
24. The programmer’s authority table will specify the libraries a programmer may access.
25. Use of the integrated test facility poses no threat to organizational data files.
MULTIPLE CHOICE
1. Which of the following statements is NOT true?
a.
All systems should be properly authorized to ensure their economic justification and
feasibility.
b.
Users need not be actively involved in the systems development process.
c.
All program modules must be thoroughly tested before they are implemented.
d.
The task of creating meaningful test data is time-consuming.
2. Which control is not associated with new systems development activities?
a.
reconciling program version numbers
b.
program testing
c.
user involvement
d.
internal audit participation
3. Routine maintenance activities require all of the following controls except
a.
documentation updates
b.
testing
c.
formal authorization
d.
internal audit approval
4. Which statement is correct?
a.
compiled programs are very susceptible to unauthorized modification
b.
the source program library stores application programs in source code form
c.
modifications are made to programs in machine code language
d.
the source program library management system increases operating efficiency
5. Which control is not a part of the source program library management system?
a.
using passwords to limit access to application programs
Accounting Information Systems, 8e—Test Bank, Chapter 17
b.
assigning a test name to all programs undergoing maintenance
c.
combining access to the development and maintenance test libraries
d.
assigning version numbers to programs to record program modifications
6. Which control ensures that production files cannot be accessed without specific permission?
a.
Database Management System
b.
Recovery Operations Function
c.
Source Program Library Management System
d.
Computer Services Function
7. Program testing
a.
involves individual modules only, not the full system
b.
requires creation of meaningful test data
c.
need not be repeated once the system is implemented
d.
is primarily concerned with usability
8. To meet the governance-related expectations of management under SOX, an organization’s internal
audit department needs to be
a.
independent
b.
objective
c.
technically qualified
d.
All of the above are true.
9. Which test of controls will provide evidence that the system as originally implemented was free from
material errors and free from fraud? Review of the documentation indicates that
a.
a cost-benefit analysis was conducted
b.
the detailed design was an appropriate solution to the user’s problem
c.
tests were conducted at the individual module and total system levels prior to
implementation
d.
problems detected during the conversion period were corrected in the maintenance phase
10. Which statement is not true?
a.
An audit objective for systems maintenance is to detect unauthorized access to application
databases.
b.
An audit objective for systems maintenance is to ensure that applications are free from
errors.
c.
An audit objective for systems maintenance is to verify that user requests for maintenance
reconcile to program version numbers.
d.
An audit objective for systems maintenance is to ensure that the production libraries are
protected from unauthorized access.
11. When the auditor reconciles the program version numbers, which audit objective is being tested?
Accounting Information Systems, 8e—Test Bank, Chapter 17
a.
protect applications from unauthorized changes
b.
ensure applications are free from error
c.
protect production libraries from unauthorized access
d.
ensure incompatible functions have been identified and segregated
12. When auditors do not rely on a detailed knowledge of the application’s internal logic, they are
performing
a.
black box tests of program controls
b.
white box tests of program controls
c.
substantive testing
d.
intuitive testing
13. All of the following concepts are associated with the black box approach to auditing computer
applications except
a.
the application need not be removed from service and tested directly
b.
auditors do not rely on a detailed knowledge of the application’s internal logic
c.
the auditor reconciles previously produced output results with production input
transactions
d.
this approach is used for complex transactions that receive input from many sources
14. Which test is not an example of a white box test?
a.
determining the fair value of inventory
b.
ensuring that passwords are valid
c.
verifying that all pay rates are within a specified range
d.
reconciling control totals
15. When analyzing the results of the test data method, the auditor would spend the least amount of time
reviewing
a.
the test transactions
b.
error reports
c.
updated master files
d.
output reports
16. All of the following are advantages of the test data technique except
a.
auditors need minimal computer expertise to use this method
b.
this method causes minimal disruption to the firm’s operations
c.
the test data is easily compiled
d.
the auditor obtains explicit evidence concerning application functions
17. All of the following are disadvantages of the test data technique except
a.
the test data technique requires extensive computer expertise on the part of the auditor
Accounting Information Systems, 8e—Test Bank, Chapter 17
b.
the auditor cannot be sure that the application being tested is a copy of the current
application used by computer services personnel
c.
the auditor cannot be sure that the application being tested is the same application used
throughout the entire year
d.
preparation of the test data is time-consuming
18. All of the following statements are true about the integrated test facility (ITF) except
a.
production reports are affected by ITF transactions
b.
ITF databases contain “dummy” records integrated with legitimate records
c.
ITF permits ongoing application auditing
d.
ITF does not disrupt operations or require the intervention of computer services personnel
19. Which statement is not true? Embedded audit modules
a.
can be turned on and off by the auditor.
b.
reduce operating efficiency.
c.
may lose their viability in an environment where programs are modified frequently.
d.
identify transactions to be analyzed using white box tests.
20. Generalized audit software packages perform all of the following tasks except
a.
recalculate data fields
b.
compare files and identify differences
c.
stratify statistical samples
d.
analyze results and form opinions
SHORT ANSWER
1. Contrast the source program library (SPL) management system to the database management system
(DBMS).
2. Describe two methods used to control the source program library.
3. New system development activity controls must focus on the authorization, development, and
implementation of new systems and its maintenance. Discuss at least five control activities that are
found in an effective system development life cycle.
Accounting Information Systems, 8e—Test Bank, Chapter 17
4. A __________________________ fraud affects a large number of victims but the harm to each
appears to be very small.
5. Describe a test of controls that would provide evidence that only authorized program maintenance is
occurring.
6. Auditors do not rely on detailed knowledge of the application’s internal logic when they use the
__________________________ approach to auditing computer applications.
7. Describe parallel simulation.
8. What is meant by auditing around the computer versus auditing through the computer? Why is this so
important?
9. What is an embedded audit module?
10. What are the audit’s objectives relating to systems development?
11. What are program version numbers and how are the used?
12. Identify six controllable activities that distinguish an effective systems development process.
13. What are CAATS? Identify five of them.
Accounting Information Systems, 8e—Test Bank, Chapter 17
14. What is ITF?
15. What is GAS? Identify two examples of GAS products.
ESSAY
1. Outline the six controllable activities that relate to new systems development
2. Describe two tests of controls the auditor can use confirm that authorization procedures for program
changes.
3. Describe and contrast the test data method with the integrated test facility.
4. Contrast embedded audit modules with generalized audit software.
5. What is the purpose of the auditor’s review of SDLC documentation?
6. Explain how application version numbers can be used as a audit toll for assessing program change
controls.
Accounting Information Systems, 8e—Test Bank, Chapter 17
7. Contrast the black box approach to IT auditing and the through-the-computer audit approach. Which is
preferred?