DISA Review Questions, Answers Manual
KEY C
C is correct -
ERP Application: These have been created a separate category of business
application systems, due to their importance for an organisation. These software called
as enterprise resource planning software are used by entities to manage resources
optimally and to maximize E^3 i.e. economy, efficiency and effectiveness of business
operations.
A is incorrect -
Accounting Applications: Applications like TALLY, TATA EX, UDYOG, used by
business entities for purpose of accounting for day to day transactions, generation of
financial information like balance sheet, profit and loss account, cash flow statements,
are classified as accounting applications.
B is incorrect –
Banking Application: Today all public sector banks, private sector banks, and
including regional rural banks have shifted to core banking business applications
(referred to as CBS). Reserve Bank of India guidelines mandating all co-operative
banks also to shift to core banking applications by December 013, means 95% plus
Indian banks use CBS. CBS used by Indian banks include, FINACLE (by Infosys
Technologies Ltd.), FLEXCUBE (By Oracle Financial Services Software Limited,
formerly called i-flex Solutions Limited), TCS BaNCS (By TCS Limited), and many more
CBS.
D is incorrect –
Payroll Application: Many companies across the world are outsourcing these activities
to professionals. In India also many CA firms are doing good job on payroll outsourcing.
TALLY has a payroll application built into it. ICAI, has made available for its members a
payroll application.
925. Key business requirements for information specify ‘integrity’ as a parameter that
needs to be present in information generated. By integrety we mean:
A. protection of sensitive information from unauthorised disclosure
B. accuracy and completeness of information as well as its validity
C. information being available when required
D. information being delivered in a timely, correct, consistent and usable manner
KEY B
B is correct - Integrity: Relates to the accuracy and completeness of information as
well as to its validity in accordance with business values and expectations
396
Business Application Software Audit
A is incorrect – Confidentiality: Concerns the protection of sensitive information from
unauthorised disclosure
C is incorrect - Availability: Relates to information being available when required by
the process now and in the future. It also concerns the safeguarding of necessary
resources and associated capabilities.
D is incorrect – Effectiveness: Deals with information being relevant and pertinent to
the process as well as being delivered in a timely, correct, consistent and usable
manner
926. COBIT defines six control objectives for application controls. Under which of the
following objectives does validating input data classify?
A. Data collection and entry
B. Completeness and Authenticity checks
C. Processing integrity and validity
D. Transaction Authentication and Integrity
KEY B
B is correct - Accuracy, Completeness and Authenticity Checks: Ensure that
transactions are accurate, complete and valid. Validate data that were input, and edit or
send back for correction as close to the point of origination as possible.
A is incorrect - Source Data Collection and Entry: Ensure that data input is performed
in a timely manner by authorised and qualified staff. Correction and resubmission of
data that were erroneously input should be performed without compromising original
transaction authorisation levels. Where appropriate for reconstruction, retain original
source documents for the appropriate amount of time.
C is incorrect - Processing Integrity and Validity: Maintain the integrity and validity of
data throughout the processing cycle. Detection of erroneous transactions does not
disrupt the processing of valid transactions.
D is incorrect – Transaction Authentication and Integrity: Before passing transaction
data between internal applications and business/operational functions (within or outside
the enterprise), check the data for proper addressing, authenticity of origin and integrity
of content. Maintain authenticity and integrity during transmission or transport
927. Neural Networks and Fuzzy Logics are classified under which category of
Artificial intelligence?
A. Cognitive Science
B. Robotics
397
DISA Review Questions, Answers Manual
C. Natural Sciences
D. Virtual Reality
KEY A
A is correct - Cognitive Science: This is an area based on research in disciplines such
as biology, neurology, psychology, mathematics and allied disciplines. It focuses on
how human brain works and how humans think and learn. Applications of AI in the
cognitive science are Expert Systems, Learning Systems, Neural Networks, Intelligent
Agents and Fuzzy Logic
B, C and D are incorrect – Robotics: This technology produces robot machines with
computer intelligence and human-like physical capabilities. This area includes
applications that give robots visual perception, capabilities to feel by touch, dexterity
and locomotion.
iii. Natural Languages.
Being able to 'converse' with computers in human languages is the goal of research in
this area. Interactive voice response and natural programming languages, closer to
human conversation, are some of the applications. Virtual reality is another important
application that can be classified under natural interfaces.
928. What are decision support systems (DSS)?
A. System used for getting valuable information for making management decisions
B. systems that provide interactive information support to managers with analytical
models
C. system which allows buying and selling goods on the internet and involves
information sharing, payment, fulfillment, service and support
D. system intended to capture data at the time and place of a transaction
KEY B
B is correct - DSS are information systems that provide interactive information support
to managers with analytical models. DSS are designed to be ad hoc systems for
specific decisions by individual-managers. These systems answer queries that are not
answered by the transactions processing systems.
A, C and D are incorrect – Data warehousing system is used for getting valuable
information for making management decisions.
Other than buying and selling goods on the Internet, E Commerce (Electronic
Commerce) involves information sharing, payment, fulfillment and service and support.
a PoS is intended to capture data at the time and place of transaction which is being
initiated by a business user. It is often attached to scanners to read bar codes and
magnetic cards for credit card payment and electronic sales.
398
Business Application Software Audit
929. Which of the following should an IS auditor consider while auditing data
warehousing systems?
A. Network capacity for speedy access
B. Accuracy and correctness of outputs generated
C. Validation of receivers details for correctness and completeness
D. Review of exceptional transaction logs
KEY A
A is correct - IS Auditor should consider the following while auditing data warehouse:
1. Credibility of the source data
2. Accuracy of the source data
3. Complexity of the source data structure
4. Accuracy of extraction and transformation process
5. Access control rules
6. Network capacity for speedy access
B is incorrect – IS Auditors role with respect to Decision Support System:
1. Credibility of the source data
2. Accuracy of the source data
3. Accuracy of extraction and transformation process
4. Accuracy and correctness of the output generated
5. Access control rules
C is incorrect – The IS Auditors role with respect to EFT will be with respect to:
1. Authorisation of payment.
2. Validation of receivers details, for correctness and completeness.
3. Verifying the payment made.
4. Getting acknowledgement from the receiver, or alternatively from bank about the
payment made.
5. Checking whether the obligation against which the payment was made has been
fulfilled.
D is incorrect – IS Auditors role for PoS systems:
1. In case there is batch processing, the IS auditor should evaluate the batch
controls implemented by the organization.
399
DISA Review Questions, Answers Manual
2. Check if they are in operation,
3. Review exceptional transaction logs.
4. Whether the internal control system is sufficient to ensure the accuracy and
completeness of the transaction batch before updating?
5. The relevance of controls is more In the case of online updating system, the IS
auditor will have to evaluate the controls for accuracy and completeness of
transactions.
930. Why is IS Audit performed?
A. It safeguards assets, maintains data integrity and achieves the organisations
goals and objectives
B. To ensure that the organisations computer systems are available for the business
at all times when required
C. Business processes have been integrated into system and decisions are being
taken through this integrated system
D. To ensure that the information provided by the system is accurate, reliable and
timely
KEY C
C is correct - IS Audit is necessary in today’s business environment as business
processes have been integrated into system and lot of decision is being taken through
these integrated system.
A, B and D are incorrect – These are the agenda to be followed for an IS Audit
931. While performing an IS audit which of the following comes under risk assessment
and planning?
A. conclusions on objective(s), scope, timeline and deliverables, compliance with
applicable laws and professional auditing standards
B. provide supervision to IS audit staff for whom they have supervisory
responsibility, to accomplish audit objectives
C. use an appropriate risk assessment approach and supporting methodology to
develop the overall IS audit plan
D. obtain sufficient and appropriate evidence to achieve the audit objectives.
KEY C
C is correct - Risk Assessment in Planning: The IS audit and assurance function shall
use an appropriate risk assessment approach and supporting methodology to develop
the overall IS audit plan and determine priorities for the effective allocation of IS audit
400
Business Application Software Audit
resources. IS audit and assurance professionals shall identify and assess risk relevant
to the area under review, when planning individual engagements. IS audit and
assurance professionals shall consider subject matter risk, audit risk and related
exposure to the enterprise.
A, B and D are incorrect –
Engagement Planning: This includes conclusions on objective(s), scope, timeline and
deliverables, compliance with applicable laws and professional auditing standards, use
of a risk-based approach, where appropriate, engagement-specific issues,
documentation and reporting requirements.
Performance and Supervision: IS audit and assurance professionals shall conduct the
work in accordance with the approved IS audit plan to cover identified risk and within
the agreed-on schedule. IS audit and assurance professionals shall provide supervision
to IS audit staff for whom they have supervisory responsibility, to accomplish audit
objectives and meet applicable professional audit standards. IS audit and assurance
professionals shall accept only tasks that are within their knowledge and skills or for
which they have a reasonable expectation of either acquiring the skills during the
engagement or achieving the task under supervision. IS audit and assurance
professionals shall obtain sufficient and appropriate evidence to achieve the audit
objectives. The audit findings and conclusions shall be supported by appropriate
analysis and interpretation of this evidence. IS audit and assurance professionals shall
document the audit process, describing the audit work and the audit evidence that
supports findings and conclusions. IS audit and assurance professionals shall identify
and conclude on findings.
Evidence: IS audit and assurance professionals shall obtain sufficient and appropriate
evidence to draw reasonable conclusions on which to base the engagement results. IS
audit and assurance professionals shall evaluate the sufficiency of evidence obtained to
support conclusions and achieve engagement objectives.
932. The type of CAAT which is written for special audit purposes or targeting
specialized IT environments is known as:
A. Specialised Audit Software
B. Generalised Audit Software
C. Utility Software
D. Computer Audit Software
KEY A
A is correct - Specialised Audit software, unlike GAS, is written for special audit
purposes or targeting specialized IT environments.
401
DISA Review Questions, Answers Manual
B, C and D are incorrect – Generalised Audit software refers to generalized computer
programs designed to perform data processing functions such as reading data,
selecting and analyzing information, performing calculations, creating data files and
reporting in a format specified by the auditor.
Utility software or utilities though not developed or sold specifically for audit are often
extremely useful and handy for conducting audits.
Computer audit software is also known as Generalised Audit Programs (GAS)
933. Which of the following pertains to an operation using GAS?
A. Testing for UNIX controls
B. Comparing an input file with a processed file
C. Production of circularisation letters
D. Random sampling plan
KEY D
D is correct - Typical operations using GAS include:
a. Sampling Items are selected following a value based or random sampling plan.
b. Extraction Items that meet the selection criteria are reported individually.
c. Totaling the total value and number of items meeting selection criteria are
reported.
d. Ageing Data is aged by reference to a base date
e. Calculation Input data is manipulated prior to applying selection criteria
A, B and C are incorrect – Specialised Audit software, unlike GAS, is written for special
audit purposes or targeting specialized IT environments. The objective of these
software to achieve special audit procedures which may be specific to the type of
business, transaction or IT environment e.g. testing for NPAs, testing for UNIX controls,
testing for overnight deals in a Forex Application software etc. Such software may be
either developed by the auditee or embedded as part of the client’s mission critical
application software. Such software may also be developed by the auditor
independently. Before using the organisation’s specialized audit software, the auditor
should take care to get an assurance on the integrity and security of the software
developed by the client...
Utility software or utilities though not developed or sold specifically for audit are often
extremely useful and handy for conducting audits. These utilities usually come as part
of office automation software, operating systems, and database management systems
or may even come separately. Utilities are useful in performing specific system
402
Business Application Software Audit
command sequences and are also useful in performing common data analysis functions
such as searching, sorting, appending, joining, analysis etc. Utilities are extensively
used in design, development, testing and auditing of application software, operating
systems parameters, security software parameters, security testing, debugging etc.
a. File comparison: A current version of a file for example, is compared with the
previous year’s version, or an input file is compared with a processed file.
b. Production of circularisation letters.
934. What is continuous auditing?
A. Process of obtaining evidence directly on the quality of the records produced and
maintained in the system.
B. Process of reviewing the computer logs generated at various points to build an
audit trail
C. Process through which an auditor evaluates the particular system(s) and thereby
generates audit reports on real time basis.
D. Process of reviewing transactions as they are processed and select items
according to audit criteria specified in the resident code
KEY C
C is correct - Continuous auditing is a process through which an auditor evaluates the
particular system(s) and thereby generates audit reports on real time basis. Continuous
auditing approach may be required to be used in various environments. Such
environments usually involve systems that are 4*7 mission critical systems.
A is correct – This forms part of selecting, implementing and using CAAT’s
B and D are incorrect – These are different techniques of continuous auditing
935. Procedure of continuous auditing whereby digital pictures of procedures are
saved and stored in the memory:
A. Snapshot
B. Integrated Test facility
C. System activity file interrogation
D. Embedded audit facilities
KEY A
A is correct - Most applications follow a standard procedure whereby, after taking in the
user input they process it to generate the corresponding output. Snapshots are digital
pictures of procedures of the console that are saved and stored in the memory.
Procedures of the console refer to the application procedures that take input from the
403
DISA Review Questions, Answers Manual
console i.e. from the keyboard or the mouse. These procedures serve as references for
subsequent output generations in the future. Typically, snapshots are implemented for
tracing application software and mapping it. The user provides inputs through the
console for processing the data. Snapshots are means through which each step of data
processing (after the user gives the input through) is stored and recalled.
B is incorrect - Integrated Test Facility (ITF) is a system in which a test pack is pushed
through the production system affecting “dummy” entities. Hence this requires dummy
entities to be created in the production software. For example, the auditor would
introduce test transactions that affect targeting dummy customer accounts and dummy
items created earlier for this testing purpose.
C is incorrect – Most computer operating systems provide the capability of producing a
log of every event occurring in the system, both user and computer initiated. This
information is usually written to a file and can be printed out periodically. As part of
audit testing of general controls, it may be useful for the auditor to review the computer
logs generated at various points to build an audit trail. Wherever possible, unauthorised
or anomalous activity would need to be identified for further investigation.
D is incorrect – Embedded audit facilities consist of program audit procedures, which
are inserted into the client’s application programs and executed simultaneously. The
technique helps review transactions as they are processed and select items according
to audit criteria specified in the resident code, and automatically write details of these
items to an output file for subsequent audit examination.
936. Compliance testing helps an auditor:
A. substantiate the integrity of actual processing and the outcome of compliance
testing
B. to test for monetary errors directly affecting financial statement balances
C. To obtain evidence of the validity and propriety of accounting treatment of
transactions
D. Determine that controls are applied in a manner that complies with policies and
procedures
KEY D
D is correct - Compliance tests are used to help determine the extent of substantive
testing to be performed, as stated in Statement of Auditing Standards. Such tests are
necessary if the prescribed procedures are to be relied upon in determining the nature,
time or extent of substantive tests of particular classes of transactions or balances.
Once the KEY control points are identified, the auditor seeks to develop a preliminary
understanding of the controls to ensure their existence and effectiveness.
B, C and D are incorrect – These are the features of Substantive Testing
404
Business Application Software Audit
937. While reviewing authorisation procedure before creating user rights, an IS auditor
has to:
A. Evaluate how the user rights have been granted and monitored
B. Check who triggers the request for user rights creation
C. Check Whether there is a proper cross check mechanism to validate the user
rights
D. Check Whether user right alteration process is linked to the job profile of the
individual
KEY B
B is correct - Authorisation procedure before creating user rights?
IS Auditor needs to check whether there is a formal user rights approval
form/document. The question that need to be answered being
a. Who triggers the request for user rights creation? Ideally this request has to be
generated through HR department.
b. Whether the form contains all relevant information for the specific user?
c. Whether the form has been properly filled?
d. Whether the form has valid authorisation?
e. Whether forms are marked once user rights are created in system?
A is incorrect – Who has the authority to create user rights?
IS auditor is also concerned to know the person who has the authority to create users in
system. IS auditor needs to evaluate the rights of persons doing this job and how these
rights have been granted and monitored.
C is incorrect - Validation of user rights created in system?
IS Auditor needs to evaluate the process how user rights created at step (ii) are
validated once they have been put in system. IS Auditor may seek answers to the
following questions.
a. Whether there is a proper cross check mechanism build in organisation to
validate the user rights of employee once they have been created?
b. Whether there is timely validation of user rights and user job profiles? For
example this is a cyclical process to be done once each year to see whether the
job profile of individual is appropriately reflected in his/her user rights?
D is incorrect - Process of alteration of user rights?
IS Auditor is concerned with the process of alteration of rights. The IS Auditor seeks
answers to the following questions.
405
DISA Review Questions, Answers Manual
a. Whether the user right alteration process is linked to job profile of individual?
b. Who triggers the request for user rights alteration?
938. This is the highest level of database abstraction which is of concern to the users
is:
A. Conceptual or global view
B. Physical view
C. Internal view
D. External or user view
KEY D
D is correct - External or user view: It is at the highest level of the database
abstraction. It includes only that portion of database or application programs which is of
concern to the users. It is defined by the users or written by the programmers. It is
described by the external schema.
A is incorrect – Conceptual or global view: This is reflection of a database is viewed
by database administrator. Single view represents the entire database. It describes all
records, relationships and constraints or boundaries. Data description to render it
independent of the physical representation. It is defined by the conceptual schema,
B and C are incorrect – Physical or internal view: It is at the lowest level of database
abstraction. It is closest to the physical storage method. It indicates how data will be
stored, describes data structure, and the access methods. It is expressed by internal
schema.
939. What control does a ‘view’ function offer with respect to database security?
A. Segregation of duties
B. Addresses conflicts relating to simultaneous access
C. Enables data access limitations
D. Ability to create and reuse SQL code
KEY C
C is correct - Views: Views enable data access limitations. A view is a content or
context dependent subset of one or more tables.
A, B and D are incorrect – Database Roles and Permissions
• Segregation of duties
• Roles & Permissions allow control of operations that a user can perform on
database,
406
