Auditing Systems Development, Acquisition and Maintenance

1. Auditing Systems Development, Acquisition and Maintenance Review Questions with Answers

2. Question 1 • When testing program change management, how should the sample be selected? • A. Change management documents should be selected at random and examined for appropriateness. • B. Changes to production code should be sampled and traced to appropriate authorizing documentation. ** • C. Change management documents should be selected based on system criticality and examined for appropriateness. • D. Changes to production code should be sampled and traced back to system-produced logs indicating the date and time of the change.

3. Question 2 • To assist in testing a core banking system being acquired, an organization has provided the vendor with sensitive data from its existing production system. An IS auditor’s PRIMARY concern is that the data should be: • sanitized. ** • complete. • representative. • current.

4. Question 3 • An IS auditor is performing a project review to identify whether a new application has met business objectives. Which of the following test reports offers the MOST assurance that business objectives are met? • User acceptance ** • Performance • Sociability • Penetration

5. Question 4 • A hash total of employee numbers is part of the input to a payroll master file update program. The program compares the hash total with the corresponding control total. What is the purpose of this procedure? • Verify that employee numbers are valid • Verify that only authorized employees are • paid • C. Detect errors in payroll calculations • D. Detect the erroneous update of records **

6. Question 5 • During the review, if the auditor detects that the transaction authorization control objective cannot be met due to a lack of clearly defined roles and privileges in the application, the auditor should FIRST: • A. review the authorization on a sample of transactions.** • B. immediately report this finding to upper management. • C. request that auditee management review the appropriateness of access rights for all users. • D. use a generalized audit software to check the integrity of the database.

7. Question 6 • An organization decides to purchase a package instead of developing it. In such a case, the design and development phases of a traditional software development life cycle (SDLC) would be replaced with: • selection and configuration phases. ** • feasibility and requirements phases. • implementation and testing phases. • nothing; replacement is not required.

8. Question 7 • When a complete segregation of duties cannot be achieved in an online system environment, which of the following functions should be separated from the others? • A. Origination • B. Authorization** • C. Recording • D. Correction

9. Question 8 • In a small organization, where segregation of duties is not practical, an employee performs the function of computer operator and application programmer. Which of the following controls should an IS auditor recommend? • A. Automated logging of changes to development libraries • B. Additional staff to provide segregation of duties • C. Procedures that verify that only approved program changes are implemented**

10. Question 9 • Which of the following is the MOST effective method for an IS auditor to use in testing the program change management process? • Trace from system-generated information to the change management documentation.** • Examine change management documentation for evidence of accuracy. • Trace from the change management documentation to a system-generated audit trail. • Examine change management documentation for evidence of completeness.