CHAPTER 1 c. another word for information.

d. quantitative facts that are not

qualitative by nature.
1. A set of two or more interrelated components
7. Which of the following statements below shows
that interact to achieve a goal is:
the contrast between data and information?
a. A system
a. Data is the output of an AIS.
b. An accounting information system
b. Information is the primary output of an
c. Data
AIS.
d. Mandatory information
c. Data is more useful in decision-making
2. This results when a subsystem achieves its goals
than information.
while contributing to the organization's overall
d. Data and information are the same.
goal.
a. Goal conflict 8. Information is
b. Goal congruence a. basically the same as data.
c. Value of information b. raw facts about transactions.
d. Systems congruence c. potentially useful facts when processed
3. Goal conflict may result when in a timely manner.
a. A decision or action of a subsystem is d. data that has been organized and
inconsistent with the system as a processed so that it's meaningful
whole. 9. Humans can absorb and process only so much
b. A subsystem achieves its goals while information. Information __________ occurs
contributing to the organization's when those limits are passed.
overall goal.
a. Overload
c. Duplicate recording, storage and
b. Excess
processes are eliminated.
c. Anxiety
d. The data exceeds the amount the
human mind can absorb and process. d. discretion
4. Facts that are collected, recorded, stored and 10. The value of information can best be defined as
processed by an information system a. how useful it is to decision makers.
a. Information b. the benefits produced by possessing
b. Data and using the information minus the
c. Systems cost of producing it.
d. Mandatory information c. how relevant it is.
5. Information is d. the extent to which it maximizes the
a. What happens when the data exceeds value chain.
the amount the human mind can 11. The benefit produced by the information minus
absorb. the cost of producing it.
b. The benefit produced by the a) Goal congruence
information minus the cost of b) Information
producing it. c) Information overload
c. Facts that are collected, recorded, d) Value of information
stored, and processed by an 12. An accounting information system (AIS)
information system. processes __________ to provide users with
d. Data that have been organized and __________.
processed to provide meaning to a a) data; information
user. b) data; transactions
6. Data are c) information; data
a. facts entered, stored, and processed by d) data; benefits
an information system. 13. How many components are found in an AIS?
b. processed output that is useful to a) three
decision makers. b) four
 c) five 20. The primary consideration when producing this
d) six type of information is that its benefits exceeds
14. An accounting information system in part its costs.
consists of a. Discretionary information
a. People, hardware and programs. b. Essential information
b. Information, programs and computers. c. Mandatory information
d. Value of information
c. People, procedures, data, software and
21. An AIS is a system of six interrelated
information technology infrastructure.
components that interact to achieve a goal. One
d. Internal controls and accounting of these components, which includes both
records. manual and automated activities that involve
15. Information that reduces uncertainty, improves collecting, processing, and storing data, is
decision makers' ability to make predictions, or known as
confirms or corrects their prior expectations, is a. Information or data
said to be b. Procedures and instructions
a. Complete c. Software
b. Relevant d. Information technology infrastructure
c. Reliable 22. An accounting information system must be able
d. Timely to perform which of the following tasks?
a. collect transaction data
16. Information that is free from error or bias and
b. process transaction data
accurately represents the events or activities of
c. provide adequate controls
the organization is
d. all of the above
a. Relevant 23. Which of the following is not an example of a
b. Reliable common activity in an AIS?
c. Verifiable a. buy and pay for goods and services
d. Timely b. sell goods and services and collect cash
17. Information that does not omit important c. summarize and report results to
aspects of the underlying events or activities interested parties
that it measures is d. recording of sales calls for marketing
a. Complete purposes
b. Accessible
c. Relevant 24. Which of the following is not one of the
d. Timely components of an AIS?
18. When two knowledgeable people acting a) Internal controls and security measures
independently each produce the same b) People
information, this information is said to be c) Procedures and instructions
a. Complete d) Software and hardware
b. Relevant
c. Reliable 25. An AIS must be able to fulfill three important
d. Verifiable functions in any organization. One such function
19. Data must be converted into information to be is the collecting and storing of data about
considered useful and meaningful for decision- activities performed by the organization. One
making. There are six characteristics that make group that relies on both the adequate
information both useful and meaningful. If collection and transformation of data for
information is free from error or bias and decision-making purposes for an organization is
accurately represents the events or activities of a) management.
the organization, it is representative of the b) interested outsiders.
characteristic of c) competitors.
a. Relevancy d) the government.
b. Timeliness
c. Understandability
d. Reliability
26. The primary objective of accounting is to
a) implement strong internal controls.
b) provide useful information to decision
makers.
c) prepare financial statements.
d) ensure the profitability of an organization.
27. The Financial Accounting Standards Board
(FASB), in its Statement of Financial Accounting
Concepts No. 2, has defined accounting as
a) an information identification, development,
measurement, and communication process.
b) a way to provide adequate controls to
safeguard an organization's assets.
c) being an information system.
d) a way to collect and transform data into
useful information.
28. Which activity below would not be considered
to be a "top" accountant work activity?
a) process improvement
b) input into future product marketing
initiatives
c) long-term strategic planning
d) computer systems and operations
29. The American Institute of Certified Public
Accountants (AICPA) has recognized the
importance of AIS and the major impact
information technology has on the area of
accounting. To recognize individual CPAs who
have met educational and experiential
requirements in this area, the group formally
created the designation known as
a) the Certified Management Accountant.
b) the Certified Information Technology
Professional.
c) the Certified Internal Auditor.
d) the Certified Data Processing Professional.
30. An analysis conducted by the Institute of
Management Accountants shows that the most
important activities performed by corporate
accountants relate to
a) customer and product profitability.
b) internal consulting.
c) process improvement.
d) accounting systems and financial reporting.
31. 31. The primary focus of an AIS course, as
opposed to other IS courses, is on
a) application of information technology.
b) use of accounting software.
c) understanding how information technology
can be used to improve AIS processes.
d) preparation of financial statements.
32. The AIS must include controls to ensure
a) safety and availability of data.
b) marketing initiatives match corporate goals.
c) information produced from data is accurate.
d) both A and C
33. A change in the AIS that makes information
more easily accessible and widely available
within an organization is most likely to first
influence the
a) organizational culture.
b) customer base.
c) external financial statement users.
d) production activity.
34. The process of creating value for customers is
the result of nine activities (five primary and
four support) that taken together form a
a) value chain.
b) profitable operation.
c) successful business.
d) support system.
35. The value chain concept is composed of two
types of activities known as
a) primary and support.
b) primary and secondary.
c) support and value.
d) technology and support.
36. Which of the following is a primary activity in
the value chain?
a) infrastructure
b) technology
c) purchasing
d) marketing and sales
37. In value chain analysis, what is the activity of
arranging the delivery of products to customers
called?
a) outbound logistics
b) inbound logistics
c) shipping
d) delivery
38. An AIS provides value by
a) improving products or services through
information that increases quality and reduces
costs.
 b) providing timely and reliable information to
decision makers.
c) creating new products.
d) both A and B
39. In Chapter 1, Figure 1-2 shows the factors that
influence the design of AIS. The diagram shows
a bi-directional arrow between the
organizational culture and the AIS. The reason
for this two-way interchange between
organizational culture and AIS is
a) that the AIS should not influence the values
of the organizational culture.
b) because the organization's culture
influences the AIS, and likewise the AIS
influences the organization's culture by
controlling the flow of information within the
organization.
c) due to the transfer of managers between the
two corporate elements.
d) the AIS impacts the organization's key
strategies.
40. The objective of the majority of organizations is
to provide value to their customers. The
activities that support such an objective can be
conceptualized as forming a value chain. Within
this value chain, logistics plays an important
role. Logistics is both inbound and outbound in
nature. An example of inbound logistics would
consist of
a) the activities that transform inputs into final
products or services.
b) the activities that help customers to buy the
organization's products or services.
c) the activities that provide post-sale support
to customers.
d) the activities that consist of receiving,
storing, and distributing the materials used as
inputs by the organization to create goods
and/or services it sells.
41. A good example of how an AIS is used to share
knowledge within an organization is
a) the use of an expert system to help staff
identify the relevant experts who can help
with a particular client.
b) the use of laptop computers to access a
network for messaging worldwide.
c) the monitoring of production equipment to
watch for defects.
d) the use of point-of-sale data to determine
hot-selling items.
42. Within the value chain conceptual framework,
organizations also perform a number of other
support activities that enable the five primary
value chain activities to be performed efficiently
and effectively. One such support activity is
research and development. This activity can be
identified as a
a) firm infrastructure activity.
b) human resources activity.
c) technology activity.
d) purchasing activity.
43. Within the value chain conceptual framework,
AIS is shown as a support activity. The AIS is of
value to an organization when it provides
accurate and timely information to help support
the five primary value chain activities. When the
AIS provides information in a timely and
accurate manner, it stands as an example of
a) improved decision making.
b) improving the quality and reducing the costs
of products or services.
c) improving efficiency.
d) All of the above
44. A decision situation that is non-routine and for
which no established framework exists for
making the decision is called a(n) __________
decision.
a) structured
b) semistructured
c) unstructured
d) strategic
45. A decision that is repetitive, routine and well
understood is
a) structured
b) semistructured
c) unstructured
d) strategic
46. Which of the following is an example of a
strategic planning decision?
a) setting financial and accounting policies
b) conducting a performance evaluation
c) budgeting
d) developing human resource practices
47. Decisions about the effective and efficient
execution of specific tasks are concerned with
a) operational control.
b) management control.
 c) strategic planning.
d) tactical planning.
48. Budgeting and human resource practices are
examples of
a) operational control
b) management control
c) strategic planning
d) tactical planning
49. Accounting information plays major roles in
managerial decision making by
a) identifying situations requiring management
action.
b) reducing uncertainty.
c) providing a basis for choosing among
alternative actions.
d) all of the above
50. Business activities that pertain to product
pricing, discount and credit terms, and
identifying the most and least profitable items
are part of the __________ activity in the
organization's value chain.
a) service
b) marketing and sales
c) operations
d) inbound logistics
51. A principal focus of AIS is to assist with the
decision-making function of an organization.
The degree of support AIS can provide depends
on the type of decision being made. Decisions
are categorized in terms of the degree of
existing structure or the effect of their scope.
From the items below, select the description
that is an example of a semi-structured
decision.
a) selecting basic research projects to undertake
b) setting a marketing budget for a new
product
c) extending credit to an established customer
d) hiring a senior manager
52. Regarding decision scope, which statement
below is true?
a) Operational control is concerned with the
effective and efficient use of resources for
accomplishing organizational objectives.
b) Management control is concerned with the
effective and efficient performance of specific
tasks.
c) Strategic planning is concerned with
establishing organizational objectives and
policies for accomplishing those objectives.
d) There is no real correlation between a
manager's level in an organization and his or
her decision-making responsibilities.
53. A well-designed AIS can improve the decision-
making function within the organization. Which
statement below would describe a limitation,
rather than a benefit, of an efficient AIS?
a) An AIS reduces uncertainty, and therefore
accounting information can provide a basis for
choosing among alternative courses of action.
b) An AIS identifies situations requiring
management action.
c) An AIS provides to its users an abundance of
information without any filtering or
condensing of such information.
d) An AIS provides information about the results
of previous decisions which provides decision
makers with feedback that can be used in future
decision making.
54. A strategic position is important to the success
and growth of any organization. Harvard
professor Michael Porter has identified three
basic strategic positions. Which statement
below is false regarding these basic strategic
positions?
a) The three basic strategic positions are
mutually exclusive of each other.
b) Part of a needs-based strategic position is to
identify a target market.
c) An access-based strategic position involves
serving a subset of customers who differ from
other customers in terms of geographic location
or size.
d) A variety-based strategic position involves
producing or providing a subset of the
industry's products or services
55. A strategic position is important to the success
and growth of any organization. Harvard
professor Michael Porter has identified two
basic business strategies. Which statement
below is false regarding these basic strategies?
a) A product differentiation strategy entails
adding features or services not provided by
competitors to a product so customers can be
charged a premium price.
b) A low-cost strategy entails striving to be the
most efficient producer of a product or service.
c) Sometimes a company can succeed in both
 producing a better product and achieving low
costs.
d) The two basic strategic positions are
mutually exclusive.
56. According to Michael Porter, to be successful in
the long run, a company must
a) deliver greater value to customers and/or
create comparable value at a lower cost.
b) maximize profits.
c) maximize shareholder value.
d) both B and C
57. A variety-based strategic position involves
a) trying to serve most or all of the needs of a
particular group of customers.
b) serving a subset of customers who differ
from other customers.
c) providing a subset of the industry's products
or services.
d) serving all needs of all customers.
58. A needs-based strategic position involves
a) trying to serve most or all of the needs of a
particular group of customers.
b) serving a subset of customers who differ
from other customers.
c) providing a subset of the industry's products
or services.
d) serving all needs of all customers
59. An access-based strategic position involves
a) trying to serve most or all of the needs of a
particular group of customers.
b) serving a subset of customers who differ
from other customers.
c) providing a subset of the industry's products
or services.
d) serving all needs of all customers.
60. The Internet has changed the way many
processes are performed in business today. The
Internet has had a material effect on the five
primary characteristics in the value chain and
on the strategy adopted by businesses that
incorporate use of the Web into their business
systems. Which statement below is true
regarding the Internet relative to a strategic
position that a business may adopt?
a) Use of the Internet has reduced the power of
buyers.
b) The Internet has increased the barriers to
entry in many industries.
c) Use of the Internet reduces pressure to
compete on price.
d) The most important effect of the
development of the Internet in business is the
increased importance of adopting a viable
business strategy
CHAPTER 2
1. What usually initiates data input into a system?
a. The transaction system automatically
checks each hour to see if any new data
is available for input and processing.
b. The performance of some business
activity generally serves as the trigger
for data input.
c. A general ledger program is queried to
produce a trial balance at the end of an
accounting period.
d. Data is only input when a source
document is submitted to the
accounting department.
2. An ERP system might facilitate the purchase of
direct materials by all of the following except
a. selecting the best supplier by
comparing bids.
b. preparing a purchase order when
inventory falls to reorder point.
c. routing a purchase order to a
purchasing agent for approval.
d. communicating a purchase order to a
supplier.
3. Which of the following is not true about the
accounts receivable subsidiary ledger?
a. Debits and credits in the subsidiary
ledger must always equal.
b. Every credit sale is entered individually
into the subsidiary ledger.
c. The total of the subsidiary ledgers must
equal the control account.
d. The subsidiary ledgers play an
important role in maintaining the
accuracy of the data stored in the AIS.
4. Changing an employee's hourly wage rate
would be recorded in which file
a. Employee master file
b. Employee transaction file
c. Payroll master file
d. Payroll transaction file
5. A typical source document could be
A) in some paper form.
 B) a computer data entry screen.
C) a notepad entry.
D) both A and B
6. Which step below is not considered to be part
of the data processing cycle?
A) data input
B) feedback from external sources
C) data storage
D) data processing
7. Common source documents for the revenue
cycle include all of the following except
A) sales order.
B) receiving report.
C) delivery ticket.
D) credit memo.
8. Which of the following documents would be
found in the expenditure cycle?
A) delivery ticket
B) time card
C) credit memo
D) purchase order
9. Documents that are sent to customers or
suppliers and then sent back to the company in
the course of a business transaction are known
as
A) turnaround documents.
B) source documents.
C) source data automation.
D) transaction documents.
10. Which of the following is an example of source
data automation?
A) a utility bill
B) POS (point-of-sale) scanners in retail stores
C) a bill of lading
D) a subsidiary ledger
11. Pre-numbering of source documents helps to
verify that
A) all transactions have been recorded since
the numerical sequence serves as a control.
B) source data automation was used to capture
data.
C) documents have been used in order.
D) company policies were followed.
12. Source documents generally help to improve
accuracy in transaction processing because
A) they specify which information to collect.
B) logically related data can be grouped in the
same area of the document.
C) they provide directions and steps for
completing the form.
D) All of the above are correct.
13. When the sum of all entries in the subsidiary
ledger equals the balance in the corresponding
general ledger account, it is assumed that
A) the recording processes were accurate.
B) all source documents were recorded.
C) adjusting entries are not required.
D) no errors exist in the subsidiary ledger.
14. The general ledger account that corresponds to
a subsidiary ledger account is known as a
A) dependent account.
B) attribute account.
C) entity account.
D) control account.
15. Pre-numbered checks, invoices, and purchase
orders are examples of
A) sequence codes.
B) block codes.
C) group codes.
D) mnemonic codes.
16. A general journal
A) would be used to record monthly
depreciation entries.
B) simplifies the process of recording large
numbers of repetitive transactions.
C) records all detailed data for any general
ledger account that has individual sub-accounts.
D) contains summary-level data for every
account of the organization.
17. The general ledger
A) is used to record infrequent or non-routine
transactions.
B) simplifies the process of recording large
numbers of repetitive transactions.
C) records all detailed data for any general
ledger account that has individual sub-accounts.
D) contains summary-level data for every
account of the organization.
18. A subsidiary ledger
A) is used to record infrequent or non-routine
transactions.
B) simplifies the process of recording large
numbers of repetitive transactions.
C) records all detailed data for any general
 ledger account that has individual sub-
accounts.
D) contains summary-level data for every
account of the organization.
19. An audit trail
A) provides the means to check the accuracy
and validity of ledger postings.
B) begins with the general journal.
C) is automatically created in every computer-
based information system.
D) is a summary of recorded transactions.
20. Concerning a master file, which of the following
statements is false?
A) A master file is conceptually similar to a
ledger in a manual AIS.
B) A master file stores cumulative information.
C) A master file exists across fiscal periods.
D) A master file's individual records are rarely,
if ever, changed.
21. Which of the following is conceptually similar to
a journal in a manual AIS?
A) database
B) master file
C) record
D) transaction file
22. Which of the following statements is true?
A) Batch processing ensures that stored
information is always current.
B) Batch input is more accurate than on-line
data entry.
C) On-line batch processing is a combination of
real-time and batch processing.
D) Batch processing not frequently used.
23. The data processing method used by FedEx to
track packages is an example of
A) real-time processing.
B) batch processing.
C) online batch processing.
D) real-time batch processing.
24. Which statement below regarding the AIS is
false?
A) The AIS must be able to provide managers
with detailed and operational information
about the organization's performance.
B) Both traditional financial measures and
operational data are required for proper and
complete evaluation of performance.
C) The AIS was often just one of the information
systems used by an organization to collect and
process financial and nonfinancial data.
D) Traditionally, most AIS have been designed
so that both financial and operational data are
stored in a manner that facilitates their
integration in reports.
25. Callow Youth Clothing (CYC) is a boutique
retailer located in Estes Park, Colorado. During
the peak tourist season, it has average daily
cash and credit card sales in excess of $5,000.
What is the best way for CYC to ensure that
sales data entry is efficient and accurate?
A) Well-designed paper forms
B) Source data automation
C) Turnaround documents
D) Sequentially numbered sales invoices
26. In Petaluma, California, electric power is
provided to consumers by the Power To The
People Electrical Company (PTTP), a local co-op.
Each month PTTP mails bills to 70,000
households and then processes payments as
they are received. What is the best way for this
business to ensure that payment data entry is
efficient and accurate?
A) Well-designed paper forms
B) Source data automation
C) Turnaround documents
D) Sequentially numbered bills
27. The premier buyer and seller of vintage action
figures in the San Francisco Bay area is Vini Vidi
Geeky. Since 1996, the owner, Glamdring
Elfthrall, has leveraged computer technology to
provide a superior level of customer service. In
particular, the store's database system was
designed to make detailed information about
each individual action figure's characteristics
easily accessible. Price information and
condition are also provided for each inventory
item. In this database, the price of figures is
a(an)
A) entity.
B) attribute.
C) field.
D) record.
28. The premier buyer and seller of vintage action
figures in the San Francisco Bay area is Vini Vidi
Geeky. Since 1996, the owner, Glamdring
Elfthrall, has leveraged computer technology to
 provide a superior level of customer service. In
particular, the store's database system was
designed to make detailed information about
each individual action figure's characteristics
easily accessible. Price information and
condition are also provided for each inventory
item. In this database, the data about an
individual figure is a(an)
A) entity.
B) attribute.
C) field.
D) record.
29. The premier buyer and seller of vintage action
figures in the San Francisco Bay area is Vini Vidi
Geeky. Since 1996, the owner, Glamdring
Elfthrall, has leveraged computer technology to
provide a superior level of customer service. In
particular, the store's database system was
designed to make detailed information about
each individual action figure's characteristics
easily accessible. Price information and
condition are also provided for each inventory
item. In this database, action figures
(collectively) are a(an)
A) entity.
B) attribute.
C) field.
D) record.
30. The premier buyer and seller of vintage action
figures in the San Francisco Bay area is Vini Vidi
Geeky. Since 1996, the owner, Glamdring
Elfthrall, has leveraged computer technology to
provide a superior level of customer service. In
particular, the store's database system was
designed to make detailed information about
each individual action figure's characteristics
easily accessible. Price information and
condition are also provided for each inventory
item. In this database, the data about an
individual figure's price is stored in a(an)
A) entity.
B) attribute.
C) field.
D) record.
31. Hector Sanchez works in the accounting
department of a multinational manufacturing
company. His job includes updating accounts
payable based on purchase orders and checks.
His responsibilities are part of the company's
A) revenue cycle.
B) expenditure cycle.
C) financing cycle.
D) production cycle.
32. The Cape Fear Rocket Club heads out to the
dunes of Kittyhawk, North Carolina every
August to pierce the sky with their fiery
projectiles. An enterprising seller of t-shirts has
devised a series of designs that capture the
spirit of the event in silk-screened splendor. His
employees can be found on many of the major
intersections hawking his wares out of the
backs of station wagons and pickup trucks.
What is the best way for this business to ensure
that sales data entry is efficient and accurate?
A) Well-designed paper forms
B) Source data automation
C) Turnaround documents
D) Sequentially numbered forms
33. Which of the following information would most
likely be reviewed by management on an
exception report?
A) Monthly cash budget
B) Quality control system failures
C) Unit sales by territory and salesperson
D) Income statement
34. All of the following situations would likely be
communicated in an exception report except
A) production stoppages.
B) weekly credit and cash sales comparison.
C) low inventory level.
D) expense variances outside acceptable range.
35. Changing an employee's hourly wage rate
would be recorded where?
A) Employee master file
B) Employee transaction file
C) Special journal
D) Employee update file
36. Which of the following statements is not
correct?
A) The audit trail is intended to verify the
validity and accuracy of transaction recording.
B) The audit trail consists of records stored
sequentially in an audit file.
C) The audit trail provides the means for
locating and examining source documents.
D) The audit trail is created with document
numbers and posting references.
37. Data about which of the following facets of a C) Controls over access to data
business activity is most likely to be recorded in D) Appropriate disposal of hard copy reports
a transaction file?
A) Business activity
B) Resources affected by the business activity CHAPTER 3
C) People who participate in the business
activity
D) Place the business activity occurs

38. Data about all of the following facets of a

business activity are most likely to be recorded
in a master file except the
A) business activity.
B) resources affected by the business activity.
C) people who participate in the business
1. The correct label for Shape 1 in the flowchart:
activity.
A) Purchase Order 2
D) place the business activity occurs.
B) Purchase Requisition 1
C) Accounts Payable Trial Balance
39. Which of the following statements about data
D) 2
processing methods is true?
A) Online real-time processing does not store
2. The correct label for Shape 2 in the flowchart
data in a temporary file.
A) 1
B) Batch processing cannot be used to update a
B) Purchase Requisition 1
master file.
C) Receiving Report 1
C) Control totals are used to verify accurate
D) 2
processing in both batch and online batch
processing.
3. The correct label for Shape 3 in the flowchart
D) Online real-time processing is only possible
A) Purchase Order 4
with source data automation.
B) Purchase Requisition 1
C) Vendor
40. In an ERP system, the module used to record
D) 4
data about transactions in the revenue cycle is
called
4. The correct shape for the triangle labeled
A) order to cash.
"Supplier" in the flowchart
B) purchase to pay.
A) magnetic disk
C) financial.
B) terminal
D) customer relationship management.
C) manual process
D) off-page connector
41. A delivery of inventory from a vendor, with
whom a credit line is already established, would
5. The Sarbanes-Oxley Act requires independent
be initially recorded in which type of accounting
auditors to
record and as part of what transaction cycle?
A) create flowcharts using specialized software.
A) purchases journal; expenditure cycle
B) establish and maintain adequate controls in
B) general journal; expenditure cycle
the client's information system.
C) general ledger; expenditure cycle
C) understand a client's system of internal
D) cash disbursements journal; production cycle
controls.
D) prepare and understand all types of system
42. Implementation of an ERP system requires
documentation.
increased focus on all except which of the
following controls ?
A) Segregation of duties between custody,
authorization, and recording 6. The passage of the Sarbanes Oxley Act
B) Data entry controls on validity and accuracy A) made documentation skills even more
important.
 B) requires public companies to prepare an
annual internal control report.
C) mandates that auditors must be able to
prepare, evaluate and read documentation
tools such as flowcharts.
D) all of the above
11. Which symbol would be used in a flowchart to
7. A data flow diagram represent a computer process?
A) is a graphical description of the source and A) #1
destination of data that shows how data flow B) #2
within an organization. C) #5
B) is a graphical description of the flow of D) #15
documents and information between 12. Which symbol would be used in a flowchart to
departments or areas of responsibility. represent a decision?
C) is a graphical description of the relationship A) #10
among the input, processing, and output in an B) #16
information system. C) #9
D) is a graphical description of the sequence of D) #6
logical operations that a computer performs as 13. Which symbol would be used in a flowchart to
it executes a program. represent an invoice sent to a customer?
A) #2
B) #6
8. Most processes on a DFD can be identified by C) #1
A) data in-flows only. D) #15
B) data out-flows only. 14. Which symbol would be used in a flowchart to
C) data flows both into or out of a process. represent a general ledger?
D) always being followed by a data store. A) #2
B) #1
9. A DFD created at the highest-level or summary C) #3
view is referred to as a D) #5
A) process diagram. 15. Which symbol would be used in a flowchart to
B) overview diagram. represent a manual process?
C) content diagram. A) #5
D) context diagram. B) #6
C) #10
10. In a payroll processing DFD, the "prepare D) #11
reports" activity will be represented by 16. Which symbol would be used in a flowchart to
________, the "employee payroll file" will be represent a file of paper documents?
represented by ________, and the A) #7
"management" will be represented by B) #8
________. C) #9
A) a circle; two horizontal lines; a square D) #15
B) a circle; two horizontal lines; two horizontal 17. Which symbol would be used in a flowchart to
lines represent a general ledger master file kept on
C) a rectangle; a square; a circle magnetic disk?
D) a square; two horizontal lines; a circle A) #2
B) #5
C) #7
D) #8

18. Which symbol would be used in a flowchart to

represent a general ledger master file kept on
magnetic disk?
 A) #2 destinations. The documentation tool that he
B) #5 should employ for this purpose is a
C) #7 A) data flow diagram.
D) #8 B) document flowchart.
19. Which symbol would be used in a flowchart to C) system flowchart.
represent employee time cards sent by D) program flowchart.
department managers to the payroll
department? 26. Chas Mulligan has been hired by Yardley
A) #1 Security as an assistant to the internal auditor.
B) #4 He has been asked to document the existing
C) #11 accounting information system, and focus on
D) #16 the activities and flow of data between
20. Which symbol would be used in a flowchart to activities. He decides to begin with a summary
represent the display of a report on a computer description of the sources and uses of data in
screen? the organization and how they are processed by
A) #1 the system. The documentation tool that he
B) #2 should employ for this purpose is a
C) #3 A) data flow diagram.
D) #11 B) document flowchart.
21. Which symbol would be used in a flowchart to C) system flowchart.
represent a payroll master file kept on magnetic D) program flowchart.
tape?
A) #4
B) #7 27. Chas Mulligan has been hired by Yardley
C) #8 Security as an assistant to the internal auditor.
D) #9 He has been asked to thoroughly document the
22. Which symbol would be used in a flowchart to existing accounting information system in
represent a communication link? preparation for making recommendations for
A) #12 improvements. He decides to begin by meeting
B) #13 with the information technology staff in order
C) #14 to develop an understanding of the overall
D) #15 operation of the AIS, including data entry,
23. A flowchart that depicts the relationships storage, and output. The documentation tool
among the input, processing, and output of an that he should employ for this purpose is a
AIS is A) data flow diagram.
A) an internal control flowchart. B) document flowchart.
B) a document flowchart. C) system flowchart.
C) a system flowchart. D) program flowchart.
D) a program flowchart.
24. In a program flowchart, branching to alternative CHAPTER 4
paths is represented by
A) a terminal.
B) data/information flow. 1. Which of the items below would not be
C) computer operation. considered a possible common exposure for a
D) decision diamond. corporation?
25. Chas Mulligan has been hired by Yardley A) Excessive prices are paid for goods for use in
Security as an assistant to the internal auditor. the organization.
He has been asked to thoroughly document the B) The corporation never was billed for a sale of
existing accounting information system in merchandise shipped to a customer.
preparation for making recommendations for C) A flash flood destroys the merchandise
improvements to internal controls. He decides contained in a warehouse.
to begin with a description of the information D) Certain equipment was accidentally
stored in paper records, their sources, and their misplaced and not depreciated.
2. Intentional or reckless conduct, whether
intentional or not, and which results in
materially misleading financial statements, is
called
A) fraudulent financial reporting.
B) corporate crime.
C) management fraud.
D) None of these answers are correct.
3. DWB Corporation suffered a loss due to the
spoilage of certain raw materials used in the
manufacturing of its products. The business
transaction cycle in which this loss occurred is
the
A) revenue cycle.
B) expenditure cycle.
C) finance cycle.
D) production cycle.
4. Which of the objectives listed below is not
considered part of the internal control process?
A) Compliance with applicable laws and
regulations
B) The prevention of fraud and embezzlement
C) Effectiveness and efficiency of operations
D) Reliability of financial reporting
5. "Amounts due to vendors should be accurately
and promptly classified, summarized, and
reported" is a representative control objective
of the
A) revenue cycle.
B) finance cycle.
C) production cycle.
D) expenditure cycle.
6. The internal control premise that concerns the
relative costs and benefits of controls is known
as
A) responsibility.
B) risk.
C) reasonable assurance.
D) exposure.
7. Section 102 of the Federal Foreign Corrupt
Practices Act of 1977 (FCPA) applies to
A) all public and privately held U.S.-based
companies.
B) all companies subject to the Securities
Exchange Act of 1934.
C) any publicly held company, whether it is a
for-profit or non-profit entity.
D) all foreign-owned companies currently
operating in the United States.
8. The Omnibus Trade and Competitiveness Act of
1988 (OTCA) amends the
A) Securities Exchange Act of 1934.
B) accounting provisions of the FCPA.
C) antibribery provisions of the FCPA.
D) accounting and antibribery provisions of the
FCPA.
9. The Sarbanes-Oxley Act of 2002 imposes certain
requirements and restrictions on
A) management.
B) auditors.
C) audit committees.
D) All of these answers are correct.
10. The Sarbanes-Oxley Act of 2002 explicitly deals
with the non-audit services which auditors can
provide to their audit clients. Certain non-audit
services may be permissible, without prior
approval of a company's audit committee, if the
non-audit services
A) constitute less than 5% of the audit fees for
the corporation.
B) constitute less than 5% of the audit fees for
the corporation and are not specifically
identified as being barred by SOA 2002.
C) constitute less than 20% of the audit fees for
the corporation.
D) Auditors are barred from any and all non-
audit services for their audit clients according to
SOA 2002
11. The component of internal control that is the
foundation for all other components is
A) risk assessment.
B) information and communication.
C) control activities.
D) control environment.
12. One way in which a company can produce a
corporate culture that supports ethical behavior
is through
A) emphasis on sales quotas and deadlines.
B) emphasis on short-run goals and objectives.
C) a cultural audit to bring to light the
corporation's true culture and ethical behavior.
D) All of these answers are correct.
13. The formal communications patterns within an
organization can be communicated using
 A) a specific, precise management philosophy.
B) an organizational chart.
C) a cultural audit.
D) an ethical code of conduct.
14. Assets fraudulently appropriated for one's own
use from an organization is considered
A) fraud.
B) theft.
C) embezzlement.
D) a corporate loan.
15. An interesting aspect of white-collar crime is
that
A) it often seems to be victimless.
B) it usually amounts to less than $1,000 per
organization per year on average.
C) internal controls almost never reveal the
perpetrators of such crimes.
D) None of these answers are correct.
16. Many aspects of computer processing tend to
significantly
A) decrease an organization's exposure to
undesirable events.
B) strengthen the corporate culture's ethical
behavior in the long-term analysis.
C) increase employee productivity through the
use of monitoring software.
D) increase an organization's exposure to
undesirable events.
17. The department or division of larger
organizations which is responsible for
monitoring and evaluating controls on an
ongoing basis is
A) internal auditing.
B) external auditing.
C) internal affairs.
D) division monitoring.
18. The two broad categories of transaction control
are
A) general controls and specific controls.
B) general controls and application controls.
C) general controls and basic controls.
D) basic controls and application controls.
19. Application controls are often classified as
A) general, processing, and specific.
B) basic, specific, and accounting.
C) general, application, and output.
D) input, processing, and output.
20. An agreement or conspiracy among two or
more people to commit fraud is known as
A) embezzlement.
B) misappropriation.
C) collusion.
D) misrepresentation.
21. An analytical technique commonly used to
analyze and examine an internal control process
is known as a(n)
A) control flowchart.
B) internal control questionnaire.
C) exposure checklist.
D) segregation of duties.
22. An exposure is
A) synonymous with risk.
B) equal to risk multiplied by the likelihood of
detection.
C) equal to risk multiplied by the financial
consequences.
D) not possible with a good system of internal
controls in place.
23. Fraudulent financial reporting
A) involves intentional or reckless conduct.
B) may be due to an act of omission or
commission.
C) results in misleading financial statements.
D) All of these answers are correct.
24. Internal control is affected by an organization's
A) board of directors, management, and other
personnel.
B) management and internal auditors.
C) management and external auditors.
D) board of directors, management, and
shareholders
25. Management's philosophy and operating style
are part of which component of internal
control?
A) Control activities
B) Control environment
C) Information and communication
D) Monitoring
26. Organizational structure is part of which
component of internal control?
A) Control activities
 B) Control environment C) blocking.
C) Information and communication D) endorsement.
D) Monitoring
33. The general term for any type of control total or
27. An audit committee is required by count applied to a number of transaction
A) the AICPA. documents is
B) the Securities and Exchange Commission. A) amount control total.
C) generally accepted accounting principles. B) line control total.
D) both the New York Stock Exchange and the C) hash total.
Sarbanes-Oxley Act of 2002. D) batch control total.

28. Which of the following are examples of risks 34. Totals of homogeneous amounts for a group of
that are relevant to the financial reporting transactions or records, usually expressed in
process? dollars or quantities, is known as a(n)
A) Changes in the operating environment A) batch control total.
B) Changes in personnel B) hash total.
C) Changes in the information system C) amount control total.
D) All of these answers are correct. D) line total.

29. The three types of functions that normally 35. The reentry of transaction data with machine
should be segregated to promote internal comparison of the initial entry to the second
control are entry to detect errors is called
A) recording transactions, authorizing A) batch balancing.
transactions, and approval. B) key verification.
B) authorizing transactions, approving C) validity checking.
transactions, and custody of assets. D) a run-to-run comparison.
C) authorizing transactions, recording
transactions, and custody of assets. 36. A repetition of processing and an accompanying
D) authorizing transactions, inputting data, and comparison of individual results for equality is
outputting data. called
A) redundant processing.
30. A computer-produced document that is B) matching.
intended for resubmission into the system, such C) run-to-run comparison.
as the part of the utility bill that the customer D) readback.
returns with payment, is a(n)
A) invoice. 37. The identification and analysis of differences
B) dual-submit document. between the values contained in two
C) turnaround document. substantially identical files or between a detail
D) automated input document. file and a control file is
A) validity checking.
31. The marking of a form or document to direct or B) verification.
restrict its further processing is called C) reconciliation.
A) an endorsement. D) clearing.
B) a restriction.
C) blocking. 38. The identification of unprocessed or retained
D) a cancellation. items in files according to their date, usually the
transaction date, is
32. Identifying transaction documents to prevent A) clearing.
their further or repeated use after they have B) aging.
performed their function is known as C) periodic auditing.
A) cancellation. D) summary processing.
B) restriction. 39. Research indicates that the most frequent type
of fraud is
 A) misappropriation of funds.
B) check forgery.
C) false invoices.
D) credit card fraud.
40. Research indicates that the most expensive type
of fraud is
A) patent infringement.
B) false financial statements.
C) credit card fraud.
D) All of these types of fraud are equally
expensive.
41. An audit committee
A) is composed only of an organization's
shareholders.
B) should be primarily composed of only
external board members (a NYSE
requirement).
C) ideally should be composed only of members
who are also high-level executives in the
organization.
D) ideally should report directly to the
controller.
42. The FCPA requires that a system of internal
accounting controls
A) guarantee that profits are correctly stated in
a firm's audited financial statements.
B) provide absolute assurance that transactions
are executed only in accordance with
management's authorization.
C) provide reasonable assurance that access to
assets is permitted only in accordance with
management's authorization.
D) ensure the long-run profitability of an
organization.
43. If the treasury and controller functions are
independent, which of the following should be
assigned to the controller to maintain effective
control?
A) Approval of disbursements
B) Responsibility for check signing
C) Custody of short-term investment securities
D) Authorization of write-offs of accounts
receivable
44. A clerk accidentally posts a prenumbered sales
invoice of $625 as $265 to a customer's
account. What control would detect this error?
A) A hash total of the invoice numbers
B) A sequence check of the numbers of the
invoices which are to be posted
C) A document count of the invoices
D) A control total of the amounts to be posted
45. Which of the following would impair the
effectiveness of the separation of incompatible
functions in an organization?
A) The personnel director reports to the vice
president for administration.
B) The controller reports to the vice president
of sales.
C) The cashier reports to the treasurer.
D) The director of budgeting reports to the
controller.
46. A well planned system of internal accounting
control normally would include procedures that
are designed to provide reasonable assurance
that
A) employees act with integrity when
performing their assigned tasks.
B) decisions leading to management's
authorization of transactions are sound.
C) collusive activities would be detected by
segregation of employee duties.
D) transactions are executed in accordance
with management's general or specific
authorization.
47. Monitoring, the fifth component of internal
control, involves
A) assessing the quality of internal controls
over time and taking corrective actions if
necessary.
B) studying the methods used and records
established to identify, assemble, analyze,
classify, record, and report the organization's
transactions.
C) maintaining accountability for the financial
structure (i.e., assets and liabilities) of the
organization.
D) assessing and managing the risks that affect
the organization's objectives.
48. ERM contains eight components. Which one of
the following is not a component of ERM?
A) Internal environment
B) Risk assessment
C) Risk response
D) Risk elimination
49. Which one of the following is not an element of
the internal control process?
A) Control environment
 B) Risk assessment
C) Risk response
D) Monitoring
50. Guidance for Section 404 compliance can be
found in
A) COSO reports.
B) ISO 27002.
C) the United States Federal Sentencing
Guidelines.
D) Guidance can be found in all of the above.
51. COSO's Guidance on Monitoring Internal
Control Systems includes the following phases
except
A) establishing a foundation for monitoring.
B) designing and executing monitoring
procedures that are based on risk.
C) developing the objectives for the level of
risk that can be tolerated by management.
D) assessing and reporting the results.
52. The problems small businesses encounter with
internal control that are addressed by COSO
include the following except
A) effective boards of directors.
B) limited segregation of duties and increased
focus on monitoring.
C) compensating for limitations in information
technology.
D) outsourcing increased reporting
requirements.
53. Small and large companies can gain cost
efficiencies in internal control by
A) focusing financial items that have changed
the most from period to period.
B) managing reporting objectives.
C) effectively managing the amount and types
of documentation on adequate controls.
D) All of the above will enable small companies
to gain cost efficiencies.
CHAPTER 5
1. Perhaps the most striking fact about natural
disasters in relation to AIS controls is that
A) many companies in one location can be
seriously affected at one time by a disaster.
B) losses are absolutely unpreventable.
C) there are a large number of major disasters
every year.
D) disaster planning has largely been ignored in
the literature.
2. Which of the following is the greatest risk to
information systems and causes the greatest
dollar losses?
A) human errors and omissions
B) physical threats such as natural disasters
C) dishonest employees
D) fraud and embezzlement
3. Identify the threat below that is not one of the
four types of threats faced by accounting
information systems.
A) natural and political disasters
B) software errors and equipment malfunctions
C) unintentional acts
D) system inefficiency
4. A power outage is an example of a(n) ________
threat.
A) natural and political disasters
B) software errors and equipment
malfunctions
C) unintentional acts
D) system inefficiency
5. Excessive heat is an example of a(n) ________
threat.
A) natural and political disasters
B) software errors and equipment malfunctions
C) unintentional acts
D) system inefficiency
6. What was the first known cyber-attack intended
to harm a real-world physical target?
A) Sasser
B) Stuxnet
C) Michelangelo
D) Doomsday
7. What agency did the United States create to use
cyber weapons and to defend against cyber
attacks?
A) U.S. Cyber Command
B) Department of Network Security
C) Department of Cyber Defense
D) Department of Technology Strategy
8. Which type of threat causes the greatest dollar
losses?
A) software errors and equipment malfunctions
B) unintentional acts
 C) intentional acts
D) system inefficiency
9. Logic errors are an example of which type of
threat?
A) natural and political disasters
B) software errors and equipment malfunctions
C) unintentional acts
D) system inefficiency
10. Seble wants to open a floral shop in a
downtown business district. She doesn't have
funds enough to purchase inventory and pay six
months'' rent up front. Seble approaches a good
friend, Zhou, to discuss the possibility of Zhou
investing funds and becoming a 25% partner in
the business. After a lengthy discussion Zhou
agrees to invest. Eight months later, Zhou and
Seble have a major argument. In order for Zhou
to sue Seble for fraud, all the following must be
true except:
A) Zhou's decision to invest was primarily based
on Seble's assertion that she had prior floral
retail experience.
B) Seble told Zhou she had worked at a floral
shop for several years, when in fact she did not
have any prior experience in floral retail.
C) before Zhou invested, Seble prepared a
detailed business plan and sales forecasts, and
provided Zhou with copies.
D) Zhou's 25% share of the business is worth
substantially less than her initial investment.
11. Perpetrators do not typically
A) attempt to return or pay back stolen
amounts soon after the initial theft, but find
they are unable to make full restitution.
B) use trickery or lies to gain the confidence and
trust of others at the organization they defraud.
C) become bolder and more greedy the longer
the theft remains undetected.
D) begin to rely on stolen amounts as part of
their income.
12. "Cooking the books" is typically accomplished
by all the following except
A) overstating inventory.
B) accelerating recognition of revenue.
C) inflating accounts payable.
D) delaying recording of expenses.
13. SAS No. 99 requires that auditors
A) plan audits based on an analysis of fraud
risk.
B) detect all material fraud.
C) alert the Securities and Exchange
Commission of any fraud detected.
D) take all of the above actions.
14. Intentional or reckless conduct that results in
materially misleading financial statements is
called
A) financial fraud.
B) misstatement fraud.
C) fraudulent financial reporting.
D) audit failure fraud.
15. Which of the following is not an example of one
of the basic types of fraud?
A) While straightening the store at the end of
the day, a shoe store employee finds and
keeps an expensive pair of sunglasses left by a
customer.
B) An executive devised and implemented a
plan to accelerate revenue recognition on a
long-term contract, which will allow the
company to forestall filing for bankruptcy. The
executive does not own any stock, stock options
or grants, and will not receive a bonus or perk
because of the overstated revenue.
C) A purchasing agent places a large order at
higher-than-normal unit prices with a vendor
that gave the agent tickets to several football
games.
D) A salesperson approves a large sales discount
on an order from a company owned partially by
the salesperson's sister.
16. All of the following are required for an act to be
legally classified as fraudulent except
A) a falsehood is made.
B) about a material fact.
C) to inflict pain.
D) resulting in a financial loss.
17. Misappropriation of assets is a fraudulent act
that involves
A) dishonest conduct by those in power.
B) misrepresenting facts to promote an
investment.
C) using computer technology to perpetrate.
D) theft of company property.
18. Lapping is best described as the process of
A) applying cash receipts to a different
customer's account in an attempt to conceal
 previous thefts of cash receipts.
B) inflating bank balances by transferring money
among different bank accounts.
C) stealing small amounts of cash, many times
over a period of time.
D) increasing expenses to conceal that an asset
was stolen
19. Which of the following is not an example of the
fraud triangle characteristic concerned with
rationalization?
A) revenge against the company
B) intent to repay "borrowed" funds in the
future
C) sense of entitlement as compensation for
receiving a lower than average raise
D) belief that the company won't suffer because
an insurance company will reimburse losses
20. Insiders are frequently the ones who commit
fraud because
A) they are more dishonest than outsiders.
B) they need money more than outsiders.
C) they are less likely to get caught than
outsiders.
D) they know more about the system and its
weaknesses than outsiders.
21. Which of the following is not a management
characteristic that increases pressure to commit
fraudulent financial reporting?
A) close relationship with the current audit
engagement partner and manager
B) pay for performance incentives based on
short-term performance measures
C) high management and employee turnover
D) highly optimistic earnings projections
22. Researchers have compared the psychological
and demographic characteristics of white-collar
criminals, violent criminals, and the general
public. They found that
A) few differences exist between white-collar
criminals and the general public.
B) white-collar criminals eventually become
violent criminals.
C) most white-collar criminals invest their illegal
income rather than spend it.
D) most white-collar criminals are older and not
technologically proficient.
23. Identify the opportunity below that could
enable an employee to commit fraud.
A) An employee's spouse loses her job.
B) An employee has a close association with
suppliers or customers.
C) An employee suddenly acquires lots of credit
cards.
D) An employee is upset that he was passed
over for a promotion.
24. Which of the following is a financial pressure
that could cause an employee to commit fraud?
A) a feeling of not being appreciated
B) failing to receive a deserved promotion
C) believing that their pay is too low relative to
others around them
D) having a spouse injured in a car accident
and in the hospital for several weeks
25. Which of the following fraudulent acts generally
takes most time and effort?
A) lapping accounts receivable
B) selling stolen inventory to get cash
C) stealing inventory from the warehouse
D) creating false journal entries to overstate
revenue
26. In many cases of fraud, the ________ takes
more time and effort than the ________.
A) concealment; theft
B) theft; concealment
C) conversion; theft
D) conversion; concealment
27. Which of the following is the best way to hide
theft of assets?
A) creating "cash" through the transfer of
money between banks
B) conversion of stolen assets into cash
C) stealing cash from customer A and then using
customer B's balance to pay customer A's
accounts receivable
D) charging the stolen asset to an expense
account
28. Which fraud scheme involves stealing customer
receipts and applying subsequent customer
cash payments to cover the theft?
A) kiting
B) laundering
C) lapping
D) bogus expense
29. One fraudulent scheme covers up a theft by
creating cash through the transfer of money
 between banks. This is known as
A) lapping.
B) misappropriation of assets.
C) kiting.
D) concealment.
30. Which characteristic of the fraud triangle often
stems from a lack of internal controls within an
organization?
A) pressure
B) opportunity
C) rationalization
D) concealment
31. Which situation below makes it easy for
someone to commit a fraud?
A) placing excessive trust in key employees
B) inadequate staffing within the organization
C) unclear company policies
D) All of the above situations make it easy for
someone to commit a fraud.
32. What is the most prevalent opportunity within
most companies to commit fraud?
A) lack of any internal controls
B) failure to enforce the internal controls
C) loopholes in the design of internal controls
D) management's failure to believe employees
would commit fraud
33. This component of the fraud triangle explains
how perpetrators justify their (illegal) behavior.
A) pressure
B) rationalization
C) concealment
D) opportunity
34. The most efficient way to conceal asset
misappropriation is to
A) write-off a customer receivable as bad debt.
B) alter monthly bank statements before
reconciliation.
C) alter monthly physical inventory counts to
reconcile to perpetual inventory records.
D) record phony payments to vendors.
35. Which of the following is least likely to result in
computer fraud?
A) releasing data to unauthorized users
B) allowing computer users to test software
upgrades
C) allowing computer operators full access to
the computer room
D) storing backup tapes in a location where they
can be quickly accessed
36. How does the U.S. Justice Department define
computer fraud?
A) as any crime in which a computer is used
B) as any act in which cash is stolen using a
computer
C) as an illegal act in which a computer is an
integral part of the crime
D) as an illegal act in which knowledge of
computer technology is essential
37. Why is computer fraud often much more
difficult to detect than other types of fraud?
A) because massive fraud can be committed in
only seconds, leaving little-to-no evidence
B) because most perpetrators invest their illegal
income rather than spend it, concealing key
evidence
C) because most computer criminals are older
and more cunning than perpetrators of other
types of fraud
D) because perpetrators usually only steal very
small amounts of money at a time, requiring a
long period of time to pass before discovery
38. Why is computer fraud often more difficult to
detect than other types of fraud?
A) Rarely is cash stolen in computer fraud.
B) The fraud may leave little or no evidence it
ever happened.
C) Computers provide more opportunities for
fraud.
D) Computer fraud perpetrators are just more
clever than other types of criminals.
39. Why do many fraud cases go unreported and
unprosecuted?
A) Major fraud is a public relations nightmare.
B) Fraud is difficult, costly, and time-consuming
to investigate and prosecute.
C) Law enforcement and the courts are often so
busy with violent crimes that little time is left
for fraud cases.
D) all of the above
40. The fraud that requires the least computer
knowledge or skill involves
A) altering or falsifying source data.
B) unauthorized use of computers.
 C) tampering with or copying software.
D) forging documents like paychecks.
41. The simplest and most common way to commit
a computer fraud is to
A) alter computer input.
B) alter computer output.
C) modify the processing.
D) corrupt the database.
42. Downloading a master list of customers and
selling it to a competitor is an example of
A) data fraud.
B) output theft.
C) download fraud.
D) fraudulent financial reporting.
43. Most frauds are detected by
A) external auditors.
B) hotline tip.
C) internal auditors.
D) the police.
44. Which of the following will not reduce the
likelihood of an occurrence of fraud?
A) encryption of data and programs
B) use of forensic accountants
C) adequate insurance coverage
D) required vacations and rotation of duties
45. On Tuesday morning, Chen Lee, Chief
Information Officer at American Trading
Corporation (ATC), got some bad news. The
hard drive use to store system data backups
was lost while it was being transported to an
offsite storage location. Chen called a meeting
of her technical staff to discuss the implications
of the loss. Which of the following is most likely
to relieve her concerns over the potential cost
of the loss?
A) ATC has a comprehensive disaster recovery
plan.
B) The hard drive was encrypted and password
protected.
C) The shipper has insurance that will reimburse
ATC for the cost of the hard drive.
D) ATC has a copy of the hard drive onsite, so a
new copy for storage offsite can easily be
prepared.
46. ________ is a simple, yet effective, method for
catching or preventing many types of employee
fraud.
A) Requiring all employees to take annual
vacations
B) Monitoring employee bank accounts and net
worth
C) Monitoring employee behavior using video
cameras
D) Explaining that fraud is illegal and will be
severely punished to employees
47. Which of the following is not a way to make
fraud less likely to occur?
A) Adopt an organizational structure that
minimizes the likelihood of fraud.
B) Create an organizational culture that stresses
integrity and commitment to ethical values.
C) Create an audit trail so individual
transactions can be traced.
D) Effectively supervise employees.
48. Which of the following is not a way to reduce
fraud losses?
A) Conduct periodic external and internal
audits.
B) Maintain adequate insurance.
C) Use software to monitor system activity.
D) Store backup copies of program and data
files.
49. Which of the following is not a way to improve
fraud detection?
A) Install fraud detection software.
B) Implement a fraud hotline.
C) Employ a computer security officer.
D) Implement computer-based controls over
input, processing, storage, and output
activities.
CHAPTER 6
1. A significant benefit of the quantitative
approach to risk assessment is that
A) often the most likely threat to occur is not
the one with the largest exposure.
B) the relevant cost of the loss's occurrence is
an estimate.
C) the likelihood of a given failure requires
predicting the future.
D) the approach estimates the costs and
benefits to the perpetrators of attacks.
2. When the qualitative approach to risk
assessment is used, costs might be estimated
 using
A) replacement costs.
B) service denial costs.
C) business interruption costs.
D) All of these answers are correct.
3. An extremely risk-seeking perpetrator
A) will offer his or her services to the "highest
bidder."
B) will take very large risks for a small reward.
C) is almost always a terminated employee of
the organization he or she attacks.
D) will take small risks for small rewards.
4. A weakness in an information security system is
A) a threat.
B) computer sabotage.
C) a vulnerability.
D) a system fault.
5. Information security is an international
problem. Which countries below have set
criminal penalties of up to 10 years for
fraudulent use of computer services or the
intentional changing of a data processing record
with the intent of enrichment?
A) Canada and Finland
B) Switzerland and Canada
C) Denmark and Finland
D) France and Germany
6. Which group of people listed below would not
pose a high degree of threat to an
organization's information system?
A) Systems personnel
B) Users
C) Intruders
D) External auditors
7. Which individual listed below is placed in a
position of great trust, normally having access
to security secrets, files and programs?
A) Systems supervisor
B) Programmer
C) Computer maintenance person
D) Data control clerk
8. An intruder who intercepts legitimate
information and replaces it with fraudulent
information is known as a
A) hacker.
B) wiretapper.
C) piggybacker.
D) spy.
9. The method used in most cases of computer
fraud is
A) program alteration.
B) input manipulation.
C) data theft.
D) sabotage.
10. A defrauder substitutes his own version of a
company's master file for the real one. This
method of computer fraud is known as
A) direct file alteration.
B) data theft.
C) misappropriation of information resources.
D) Answers B and C above are both correct.
11. Sometimes computer programs are used to
commit acts of sabotage. A destructive program
masquerading as a legitimate one is called a
A) logic bomb.
B) worm.
C) virus.
D) Trojan horse.
12. Sometimes computer programs are used to
commit acts of sabotage. A computer program
that actually grows in size as it infects more and
more computers in a network is known as a
A) Trojan horse.
B) logic bomb.
C) virus.
D) worm.
13. In an information security system, security
measures focus on
A) correcting the effects of threats.
B) preventing and detecting threats.
C) management philosophy and operating style.
D) the internal audit function.
14. A form of sabotage in which very large numbers
of requests flood a Web server within a short
time interval is known as a
A) denial of service attack.
B) logic bomb.
C) macro virus.
D) grid overload.
15. The most important personnel policy and
practice regarding information systems security
is that
A) there should be adequate supervision of
 personnel at all times.
B) employees should be required to rotate jobs.
C) the duties of computer users and computer
systems personnel should be segregated.
D) employees should be required to take
vacations.
16. The primary way to prevent active threats
concerning fraud and sabotage is to implement
successive layers of access controls. The second
step behind the layered approach to access
control is to
A) prevent unauthorized access to both data
and program files.
B) physically separate unauthorized individuals
from computer resources.
C) classify all data and equipment according to
their importance and vulnerability.
D) keep unauthorized users from using the
system.
17. The primary way to prevent active threats
concerning fraud and sabotage is to implement
successive layers of access controls.
Withholding administrative rights from
individual PC users is an example of a
A) file access control.
B) system access control.
C) site access control.
D) None of these answers are correct.
18. The primary way to prevent active threats
concerning fraud and sabotage is to implement
successive layers of access controls. Such an
approach involves erecting multiple layers of
controls that separate the would-be perpetrator
from his or her potential targets. One file-access
control system that will prevent unauthorized
access is (are)
A) a password management system.
B) biometric hardware authentication.
C) locked files.
D) a firewall.
19. Controls can be designed to provide a defense
from both active and passive threats. An
example of a passive threat is
A) a rolling blackout.
B) a Trojan horse.
C) an unhappy employee.
D) a password which has been compromised.
20. What is an example of fault tolerance applied at
the transaction level?
A) Consensus-based protocols
B) Read-after-write checks
C) Database shadowing
D) Flagging
21. Disk shadowing is an example of a fault
tolerance applied at what level?
A) Network communications
B) DASD
C) Transaction
D) CPU processor
22. An example of a fault tolerance at the network
communications level is
A) a watchdog processor.
B) disk mirroring.
C) rollback processing.
D) an uninterruptable power supply.
23. Since many personal computer users do not
properly back up their files, a system that
centralizes the backup process is essential. A
backup of all files on a given disk is known as
a(n)
A) full backup.
B) differential backup.
C) incremental backup.
D) emergency backup.
24. The type of backup which avoids the problems
which arise from restoring incremental backups
is a(n)
A) full backup.
B) partial backup.
C) archive restoration.
D) differential backup.
25. One Internet security problem arises from
configuration problems in the area of
configuring permissions for directories. This is
an example of
A) an operating system vulnerability.
B) a Web server vulnerability.
C) a private network vulnerability.
D) server program vulnerability.
26. A Trojan horse program placed on one
computer with the objective of attacking
another computer is an example of which
Internet security vulnerability?
A) A Web server and its configuration
 B) An operating system and its configuration
C) A private network and its configuration
D) A general security procedure
27. The primary way to prevent active threats
concerning fraud and sabotage is to implement
successive layers of access controls. However,
the widespread adoption and use of the
Internet has made it impossible to completely
implement which layer of the layered-access
approach to security?
A) Site-access
B) System-access
C) File-access
D) None of these answers is correct.
28. The best general security procedure is
A) to use advanced information security system
software.
B) for system administrators to enforce system
security policies that already exist.
C) to isolate computer facilities from the rest of
the company.
D) to eliminate access privileges to all remote
users.
29. General security procedures are essential in
Internet security. One especially important
weakness that hackers may attempt to exploit
in this area is to
A) guess at passwords.
B) rewrite computer source code.
C) alter log files to "cover their tracks."
D) steal the hard drives of personal computers
used as Web servers.
30. Which item listed below is a weakness of using
a firewall for Internet security?
A) IP addresses can be spoofed.
B) Firewalls can block incoming access on
computer networks.
C) Firewalls can block outgoing access on
computer networks.
D) Firewalls can be set to only allow limited
outgoing access to particular programs or
servers.
31. Disaster risk management is concerned with
A) the prevention of disasters.
B) the layered-access approach to security.
C) contingency planning.
D) Answers A and C are both correct.
32. The first step in managing disaster risk is
A) to obtain business interruption insurance.
B) disaster prevention.
C) contingency planning.
D) to analyze and list recovery priorities.
33. Which of the following causes of disasters
occurs less than any other cause?
A) Natural disasters
B) Human errors
C) Deliberate actions
D) Passive threats
34. A disaster recovery plan should include
A) a list of priorities for recovery.
B) an evaluation of a company's needs in the
event of a disaster.
C) a set of recovery strategies and procedures.
D) All of these answers are correct.
35. One recovery strategy in the event of a disaster
is an alternative processing arrangement. An
arrangement between two companies in which
each company agrees to help the other if the
need arises is a(n)
A) commercial vendor arrangement.
B) computer service bureau agreement.
C) shared contingency arrangement.
D) alternate site center.
36. A company which specializes in processing the
data of other companies, but not its own, is a(n)
A) computer service bureau.
B) commercial vendor of disaster services.
C) emergency response center.
D) flying-start site.
37. The possibility of losing employees to a disaster
should be addressed in
A) a salvage plan.
B) an alternative processing arrangement.
C) the personnel replacement plan.
D) the personnel relocation plan.
38. One recovery strategy in the event of a disaster
is an alternative processing arrangement using a
backup site. A site which contains the wiring for
computers and also having the equipment is a
A) cold site.
B) hot site.
C) flying-start site.
D) service bureau.
39. Which of the following is an ideal password?
A) ABC123
B) DOG&bone
C) sky&CAT
D) 2s&Ytc8x
40. If users are permitted to choose their own
passwords, the best procedure is to
A) forbid users from choosing certain "easy-to-
guess" passwords.
B) forbid users to change their passwords later.
C) allow users to choose passwords they can
easily remember.
D) allow users to choose the appropriate
expiration date for their passwords.
41. A flying-start site
A) is the most commonly adopted option for
companies with disaster recovery plans.
B) usually cannot be made operational within
24 hours.
C) involves mirroring of transactions at the
primary site, followed by transmission of data
to the backup site.
D) is arranged through a service bureau.
42. After a planning committee has been appointed
and the support of senior management has
been obtained, the first step in designing a
disaster recovery plan is
A) determining what computer-related
resources are critical.
B) naming an emergency response team.
C) finding a suitable alternative processing site
to use in an emergency.
D) listing the company's recovery priorities.
43. Sandra Johnson is her company's chief security
officer. She is interested in obtaining fault
tolerance at the direct-access storage device
level. Which of the following methods would be
of most interest to her?
A) Rollback processing
B) Disk mirroring
C) Consensus-based protocols
D) Database shadowing
44. The best way to test the integrity of a computer
system is to
A) review all system output thoroughly.
B) review all system input thoroughly.
C) sample the system's actual transactions.
D) process hypothetical transactions through
the system.
45. To detect unauthorized direct changes to
master files, the auditor traces these changes
back to the underlying
A) transaction files.
B) source documents.
C) hypothetical transactions.
D) control account balances.
46. A type of processing that writes a transaction to
disk only if it has been completed successfully is
A) rollback processing.
B) disk mirroring.
C) fault-tolerant processing.
D) read-after-write checking.
47. The most basic security procedure in system-
access controls is the
A) sign-countersign system.
B) identification of the user's ID, time, and date
of each entry.
C) user's responsibility to protect his or her
password.
D) system's assignment of the user ID and
password.
48. Jennifer Nguyen is interested in archiving
several data files. She should
A) use a full backup for each file.
B) use an incremental backup for each file.
C) store the data files on media suitable for
long-term storage.
D) use a differential backup for each file and
restore each file.
49. The ________ makes it a federal felony for
anyone other than law enforcement or
intelligence officers to pretext phone records.
A) Computer Fraud and Abuse Act of 1986
B) Telephone Records and Privacy Protection
Act of 2006
C) Gramm-Leach-Bliley Act
D) Health Insurance Portability and
Accountability Act
50. The three objectives of information security
include
A) confidentiality, integrity, and availability.
B) protection, responsibility, and continuity.
C) confidentiality, protection, and continuity.
D) responsibility, integrity, and availability.
51. The information security management system B) spyware.
life cycle includes analysis, design, C) malware.
implementation, and D) exploits.
A) operation, evaluation, and management.
B) operation, evaluation, and control. 59. The ________ makes it a federal crime, with a
C) operation, management, and continuity. mandatory prison sentence, to pretext any kind
D) operation, control, and continuity. of information that relates to a relationship
between a consumer and a financial institution.
52. Guidelines and standards that are important to A) Computer Fraud and Abuse Act of 1986
Information Security Management Systems B) Telephone Records and Privacy Protection
include all the following except Act of 2006
A) COSO. C) Gramm-Leach-Bliley Act
B) COBIT. D) Health Insurance Portability and
C) ERM. Accountability Act
D) ISO 27000 series.
60. When a hacker takes advantage of a
53. The ISO series number that defines a code of vulnerability to access the software, hardware,
best practices for ISMSs is or data in an unauthorized manner a(n)
A) 27000. ________ has occurred.
B) 27001. A) exploit
C) 27002. B) vector
D) 27003. C) exposure
D) virtualization
54. The ISO series numbers that define
implementation, measuring performance, and 61. In general, ________ arise from improperly
risk management for ISMSs include installed or configured software and from
A) 27000-27002. unforeseen defects or deficiencies in the
B) 27003-27005. software.
C) 27006-27008. A) exploits
B) virtualizations
55. Hackers can be categorized as white, black, or C) vulnerabilities
________ hat hackers. D) exposures
A) gray
B) green 62. Sabotage is a(n) ________ threat.
C) top A) active
D) None of these answers is correct. B) passive
C) direct
56. Hacker methods include all of the following D) second layer
except
A) social engineering. 63. Input ________ is an example of a system
B) direct observation. attack method.
C) electronic interception. A) vector
D) continuity prevention. B) manipulation
C) hacking
57. Examples of social engineering include D) buffer
A) pretexting and phishing.
B) pretexting and direct observation. 64. ________ involves running multiple operating
C) phishing and direct observation. systems, or multiple copies of the same
D) pretexting, phishing, and direct observation. operating system, all on the same machine.
A) Hypervisor
58. Viruses and denial of service attacks are B) Business continuity planning
examples of C) Virtualization
A) electronic interception. D) Subscriber Identity Module (SIM)
65. All software and data is stored by the SaaS features
provider in the A) biometric hardware authentication
A) hypervisor. B) dumpster diving
B) cloud. C) vulnerability scanner
C) stars. D) code injection
D) grid.
73. Commonly used in backup systems to indicate
66. ________ computing involves clusters of whether a file has been altered
interlinked computers that share common A) archive bit
workloads. B) pretexting
A) Grid C) phishing
B) Cloud D) spyware
C) Networked
D) Malware 74. A portion of the computer program that allows
someone to access a system while bypassing
67. Which of the following forms of social normal security procedures
engineering involves impersonation? A) trapdoor
A) Contexting B) botnet
B) Phishing C) spyware
C) Hypervising D) adware
D) Pretexting
75. This type of system requires an odd number of
68. Botnets are normally used for which of the processors
following? A) consensus-based protocol
A) Grid computing B) system-access controls
B) Denial of service attacks C) control for passive threats
C) Continuity planning D) file-access control
D) Cloud computing
76. A type of intruder or attacker
69. Adware is a type of A) botnet
A) virus. B) spyware
B) logic bomb. C) hacker
C) spyware. D) viruses
D) Trojan horse.
77. The concept that if one part of the computer
70. On the local workstation, cloud computing fails, a redundant part is available to take over
A) complicates security considerations. A) fault tolerance
B) simplifies security considerations. B) input manipulation
C) is not involved with security considerations. C) program alteration
D) affects security minimally but still must be D) site-access controls
considered under ISO 27000.
78. A program can be run but not looked at or
71. In the following, which source of information altered
security frameworks or standards targets A) locked files
managers rather than IP professionals? B) fault-tolerance
A) COSO C) database shadowing
B) ISMS D) file-access controls
C) COBIT
D) ISO 79. A company that provides data processing
services to other companies for a fee
72. Systems that automatically identify individuals A) cold site
based on their fingerprints, hand sizes, retina B) service bureau
patterns, voice patterns, and other personal
 C) reciprocal disaster agreement 87. The copying and distributing of copyrighted
D) compliance standards software or files without permission
A) grid computing
80. This would include hard disk crashes, power B) piracy
failures, or printer jams C) risk management
A) system fault D) virtualization
B) vulnerability
C) threat 88. All files whose archive bit is set to 1 are backed
D) hypervisor up
A) full backup
81. A duplicate of all transactions is automatically B) differential backup
recorded C) incremental backup
A) database shadowing D) continual backup
B) full backup
C) file-access controls 89. The interception of legitimate information and
D) hypervisor substitution of fraudulent information in its
place
82. A dormant piece of code placed in a computer A) database shadowing
program for later activation by a later event B) piggybacking
A) software piracy C) grid computing
B) logic bomb D) virtualization
C) layered approach
D) access control 90. One who will take risks "just because," without
significant monetary gain
83. The subsystem of the organization that controls A) hacker
these risks B) risk-seeing perpetrator
A) emergency response center C) trojan horse
B) escalation procedures D) viruses
C) information security system
D) service bureau
CHAPTER 7
84. The process of assessing and controlling
computer system risks 1. Fundamental controls over data transfer
A) virtualization between user departments and data processing
B) hypervisor include
C) risk management A) batch control totals
D) escalation
B) data transfer registers
C) acitivity file totals
85. Prevents unauthorized access to both data and
program controls D) A and B are both correct
A) organizational structure 2. Input data should be accompanied by the
B) board of directors completion of a(n)
C) program alteration
A) data transfer log
D) file-access controls
B) input document control form
86. These separate unauthorized individuals from C) data transfer register
computer resources D) key verification control procedure
A) site-access controls 3. Errors in the keying operation can be detected
B) compliance standards
using
C) disaster risk management
A) a key verification control procedure
D) general security procedures
B) a data transfer control register
 C) program data editing A) fields
D) none of these is correct B) records
C) files
4. In a manual input system, batch controls are
D) all of these answers are correct
prepared initially by the
A) EDP department 11. A data editing routine that compares data with
B) computer software acceptable values is a
C) user department A) limit test
D) general ledger department B) table lookup
C) financial total check
5. A software-based control procedure that checks
D) valid code check
for some errors as they are being input is called
A) input verification 12. A data editing routine that compares numeric
B) key verification data input within a range is a(n)
C) input control testing A) table lookup
D) transcription checking B) hash total check
C) limit test
6. Key verification is often used
D) internal label test
A) to verify only selected essential fields
B) to verify essential and nonessential numeric 13. An extra digit addded to a code number verified
fields by applying mathematical calculations to
C) to verify all input fields, both alpha and individual code number characters is a
numeric A) control digit
D) when two or more people key input data in B) has digit
unison C) check digit
D) verification digit
7. As a control procedure, key verification requires
that 14. Check digits are especially effective at detecting
A) user departments key all of their own data A) transposition errors
B) input fields are visually verified B) accidental keying mistakes
C) key mismatches are electronically corrected C) incorrect account numbers
D) each source document key-transcribed a D) customer accounts that were never assigned
second time
15. The use of check digits
8. Key verification control procedures A) is highly unusual in today's EDP environment
A) edit data B) is very common because of the high
b) do not use batch totals reliability of this procedure
C) do not edit data C) eliminates using key verification as a control
D) electronically replace incorrect data with procedures
data from an existing database D) eliminates using data editing routines as a
method to detect errors
9. Program data editing is a software technique
that should 16. Electronic data entry
A) be used in addition to verification A) requires no human intervention
B) be used in place of verification B) is sequentially processed
C) be applied only to characters within input C) is always manually entered
fields D) is on-line
D) only be used after visual verification has
17. An essential input field that should contain data
detected errors in the in put
is empty. The data edit control that would
10. Program data editing techniques may be detect this error is a
applied to A) limit check
 B) completeness check 24. In an electronic input system requiring human
C) sequence check intervention, the main processing phases and
D) hash total check their proper sequence are
A) dat input and data editing
18. The "amount due" field of a bill is checked to
B) data editing and data input
ensure that the sign is positive. This is an
C) data input and editing, and transfer to the
example of a field
host application system
A) sign check
D) data input, transfer to the host application
B) length check
system, and data editing
C) format check
D) type check 25. A customer pumps gas at a local convenience
store. The customer pays for the gasoline by
19. During input, a data entry clerk incorrectly
inserting a credit card into the gasoline pump.
keyed produce code "ABXY" as "BAXY". Both
This is an example of a(n)
ABXY and BAXY are valid codes. Which of the
A) networked vending machine
following controls would prevent this situation?
B) point-of-sale system
A) a table-lookup procedure
C) automatic identification system
B) a check digit test
D) electronic data interface system
C) key verification
D) limit test 26. A batch processing system would work best
when processing
20. The compensating control for loss of
A) inventory
segregation duties in an electronic input system
B) payroll
is
C) accounts receivable
A) supervision and review
D) accounts payable
B) input document control forms
C) prneumbered documents 27. The first step in a batch-processing environment
D) transaction logs using sequential file updating is
A) Preparing general ledger reports
21. Three technologies make extended supply-chain
B) updating the master file
systems feasible. Which of the below is not
C) preparing the transaction file
one?
D) updating the general ledger
A) XML-type data generation
B) POS system 28. In a system using batch processing with
C) Bar coding for automatic identification sequential file updating, at what point is the
D) EDI ordering system general ledger updated?
A) after all master files are updated
22. A transaction log that is "tagged" means that
B) After each transaction batch is entered
A) it has been catalogued in the EDP library
C) after all transactions are entered
B) it is full and cannot hold any more
D) after each transaction batch is edited
information
C) it has been key verified and data edited 29. When preparing the transaction file in a batch
D) additional, audit-oriented information is processing with sequential file system, the edit
included with original transaction data program
A) builds a transaction file rom processed batch
23. Sue Pang enters salse data into the computer-
input
input program using a keyboard. The type of
B) performs batch balancing procedures
system Sue is using is a(n)
C) ensures all documents are accounted for
A) automatic identification system
prior to processing
B) manual data entry system
D) accumulates revised batch-control totals for
C) point-of-sale system
the input data
D) electronic data interchange system
30. When a system sorts edited data immediately
before a master file update in a batch-oriented
system, the operation sequence for editing and
sorting is called
A) sort and edit
B) edit and sort
C) sort and update
D) edit and update
31. Alberta Products Company updates their
accounts receivable master file each day. The
EDP departments uses the son-father-
grandfather retention of master files. A
computer operator accidentally destroyed the
most recent accounts receivable master file by
using the purchase transaction file to update it.
The operator now has today's correct
transaction file. How can the operator
reconstruct the accounts receivable master file
for the update?
A) Process yesterday's son against today's
transaction file
B) process yesterday's grandfather agains
yesterday's transaction file
C) process yesterday's father against
yesterday's transaction file
D) process yesterday's son against yesterday's
transaction file
32. The master file in a computer system is
equivalent to which one of the following
manual systems features?
A) subsidiary ledger
B) journal
C) register
D) log
33. For a general ledger accounting system to be
properly maintained, data must be
A) collected
B) recorded
C) properly classified and entered into
appropriate records for further summations
D) all of these answers are correct
34. In a general ledger file update, all entries into
the general ledger are
A) first documented using a journal voucher
B) updated by each user department as
necessary
C) dumped and not processed if any invalid data
is found in any entry
D) first documented using a journal voucher,
then are used to build a journal voucher file
35. Computer Processing of accounting data is
typically composed of
A) producing preliminary reports and then final
listings after submission of corrections
B) five steps which occur in four separate and
distinct cycles
C) sevens steps (following the typical accounting
cycle)
D) a series of mathematical algorithms
36. In a general ledger accounting system, the link
created between the general ledger accounts
and the reports in which they appear is called
A) a line locator
B) line coding
C) soft coding
D) hard coding
37. The type of file updating which should be used
in a DBMS system using batch processing is
A) random-access
B) sequential-access
C) automatic
D) peer-to-peer
38. In a cash remittance processing, the open-items
accounts receivable file serves as the
A) billing data
B) credit sales journal
C) accounts receivable control account
D) subsidiary accounts receivable ledger
39. An electronic processing system can be used
A) only in a batch environment
B) with real-tim on-line processing
C) In either a batch or real-time, on-line
processing environment
D) in situations where documentation is not a
priority
40. The type of OLRS system in which users do not
input, but only request information, is a(n)
A) data entry system
B) inquiry/response system
C) file processing system
D) transaction processing system
41. Which application would not be ideally suited to CHAPTER 8
processing by an OLRS system?
A) Payroll
B) on-line reservations
C) inventory control
D) customer accounts
42. A technology that is not typically used in a real-
time sales system is
A) bar coding
B) sequential file processing
C) a POS system
D an EDI ordering system
43. A retail sales Point-of-Sale terminal
A) records cash and charge sales
B) updates inventory records
C) provides data for posting to daily sales
records
D) all of the above
44. Automatic identification of products is greatly
enhanced by
A) using UPC as a base
B) employing JIT processing
C) manually prepared price tags affixed by
receiving personnel upon delivery
D) transaction tagging using each
manufacturer's unique inventory control
numbers
45. In real time sales system, which transaction-
processing step below would not be performed
entirely by using EDI?
A) Receiving and translating an incoming
customer order
B) Sending an acknowledgement of the
incoming order
C) sending the customer a three-ring bound
catalogue using the U.S. mail
D) transmitting an advanced shipping notice to
the customer
46. Output systems can be manual, electronic, or
something in between. Irrespective of the
media used in an output system, output
distribution should be controlled using a
A) distribution register
B) transaction register
C) check register
D) POS terminal
1. Which of the following activities is optional in
the customer order business management
process?
A) Order entry
B) Contract creation
C) Shipping
D) Billing
2. The customer order business management
process begins when a
A) customer order is entered into the system.
B) customer order is shipped.
C) customer invoice is generated and sent to
the customer.
D) potential customer makes an inquiry or
requests a quotation.
3. A document sent to an outside firm to inform
them of product prices, availability, and delivery
information is known as a(n)
A) inquiry.
B) blanket order.
C) quotation.
D) sales order
4. An outline detailing the goods or services to be
provided to a customer is a(n)
A) contract.
B) inquiry.
C) quotation.
D) sales order.
5. The document prepared when a customer is
requesting the delivery of goods that are
detailed in a contract is called a
A) sales order.
B) release order.
C) call-off.
D) Answers B and C are both correct.
6. A customer has placed an order. The customer's
credit has been checked and is satisfactory.
When the availability of the goods is checked, it
is found that some items are in stock and the
vendor has backordered other items. At this
point the customer
A) may cancel the order.
B) may request the order be held until all goods
can be shipped.
C) may request partial shipment of the goods
 currently in. C) unloading points.
D) All of these answers are correct. D) initial.

7. A warehouse employee uses a document to 14. In the SAP ERP system, if a company wishes to
fulfill a customer order. The employee is most initiate a dunning procedure against a
likely using a customer, input will be made in the
A) picking list. A) account management screen.
B) packing list. B) payment transactions screen.
C) bill of lading. C) correspondence screen.
D) shipping advice. D) control data screen.

8. In the billing stage of the customer order 15. A company that uses the SAP ERP system wants
business management process, the ERP uses to identify the areas within their company that
much of the data from a customer's sales order have responsibility to a certain customer. The
to create the screen that should be used to enter this
A) goods issued notice. information is
B) invoice. A) correspondence.
C) delivery. B) sales.
D) packing list. C) billing.
D) initial.
9. In the SAP ERP system, how many types of
customer records must be created and 16. Input concerning whether manual invoicing is
maintained? required or if a customer is entitled to rebates
A) Four in the SAP ERP system can be found in the
B) One A) billing screen.
C) Six B) sales screen.
D) Two C) payment transactions screen.
D) account management screen.
10. In the SAP ERP system, all of the different
master records are created when the 17. The final input screen in the "create customer"
A) payee customer record is created. function of the SAP ERP system is the
B) ship-to-customer record is created. A) billing screen.
C) sold-to-customer record is created. B) taxes screen.
D) bill-to-customer record is created. C) partner functions screen.
D) output screen.
11. Hierarchy assignment includes a customer's
A) distribution channel. 18. The SAP ERP system requires a customer master
B) geographical location. record for each customer. A one-time customer
C) credit approval. of the company
D) All of these answers are correct. A) can be passed through the system by using a
"dummy" customer master record.
12. The first screen used to create a customer in a B) should be manually billed using a 30-day
SAP ERP system is account, thus bypassing the SAP ERP system.
A) control data. C) must pay cash and pick up the goods from
B) contact person. the company's shipping dock.
C) initial. D) must be set up using detailed records in the
D) account management. SAP ERP system like any other customer.

13. In the SAP ERP system, the "create customer" 19. When a "sold-to" customer record is created in
screen, which is used to input statistical and the SAP ERP system, other master records are
demographic data, is automatically created using the same
A) control data. information. The input screen in which these
B) marketing. records are associated with each other is the
 A) output screen.
B) billing screen.
C) account management screen.
D) partner functions screen.
20. Which input field listed below is not mandatory
when creating a sales order in the "initial"
screen of the SAP ERP system?
A) Sales organization field
B) Sales group
C) Distribution channel field
D) Division code field
21. Which of the screens listed below in SAP ERP
system is not optional when a company records
information relating to a sale?
A) Pricing
B) Create sales order
C) Business data header
D) Scheduling
22. The prices entered on sales orders should be
independent of the sales order function. To
achieve this transaction cycle control, the
company's ordering system should use
A) an independently prepared master price list
authorized by management.
B) prices found in the order database.
C) prices listed by the sales representative who
initiated the order.
D) All of these answers are correct.
23. A sales order is
A) the same as the purchase order.
B) an external use document.
C) an internal use document.
D) optional when selling to established
customers.
24. As part of adequate transaction cycle controls in
order processing, after the finished goods
department has picked a customer's order
according to a delivery document, the records
which should be updated to reflect actual
quantities picked are found in the
A) order database.
B) credit files.
C) master price list.
D) inventory database.
25. What documents typically accompany the
physical shipment of goods to a customer?
A) The picking list and purchase order
B) Packing and picking lists
C) The packing list and a bill of lading
D) The sales order and an invoice
26. To maintain an adequate separation of duties,
various functions within the customer order
process should be independent of each other.
An example of this is
A) that billing does not have access to the
accounts receivable ledger.
B) that shipping only accepts goods from
finished goods that are identified on an
independently prepared packing list.
C) Answers A and B are both correct.
D) None of these answers is correct
27. There are various approaches to an accounts
receivable application. The approach in which a
customer's remittances are applied against a
customer's total outstanding balance is called
A) aging schedule processing.
B) balance-forward processing.
C) open-item processing.
D) None of these answers is correct.
28. To maintain adequate separation of functions,
accounts receivable should not have access to
A) cash received from customers.
B) checks received from customers.
C) invoices and credit memos.
D) Answers A and B are both correct.
29. One process, which is transparent to customers
and has a beneficial effect on the company's
cash flow, is to
A) implement a cycle billing plan.
B) factor accounts receivable.
C) decrease the amount of time in which
customers have to pay their monthly invoices.
D) Answers B and C are both correct.
30. To provide an adequate separation of functions
in the accounts receivable business process,
maintaining the subsidiary accounts receivable
ledger should be the responsibility of
A) billing.
B) accounts receivable.
C) cash receipts.
D) general ledger.
31. To provide an adequate separation of functions
in the accounts receivable business process,
maintaining the accounts receivable control
 account should be the responsibility of
A) billing.
B) accounts receivable.
C) cash receipts.
D) general ledger.
32. A sales return occurs when a customer actually
returns goods that have been shipped. The
departments involved with processing this
transaction up to the point of issuing a credit
memo are the
A) shipping, receiving, and billing departments.
B) receiving, billing, and accounts receivable
departments.
C) shipping, receiving, and credit departments.
D) receiving, credit, and billing departments.
33. The Bad Luck Fortune Cookie Company has a
360-day past-due balance of $1,300.00. After
repeated attempts at collection, the account is
deemed worthless. The departments involved
with processing this transaction up to the point
of issuing an approved write-off memo are the
A) credit and accounts receivable departments.
B) treasurer, billing, and accounts receivable
departments.
C) credit, treasurer, accounts receivable, and
internal audit departments.
D) credit, treasurer, cash receipts, and internal
audit departments.
34. The business process used when there is an
existing customer account balance is
A) accounts receivable.
B) cash-received-on-account.
C) cash sales.
D) aged trial balance.
35. In the cash-received-on-account process, the
remittance list is used to post the
A) cash receipts journal.
B) accounts receivable ledger.
C) Answers A and B are both correct.
D) None of these answers is correct.
36. The amount of cash receipts for August 12 is
$6,389.42. For general ledger to post this
amount, it must receive
A) a journal voucher from cash receipts.
B) the deposit slip from the bank for August 12
showing $6,389.42 as a deposit.
C) a control total from accounts receivable.
D) a journal voucher from cash receipts and a
control total from accounts receivable.
37. To control incoming cash from the mail and
ensure an accurate accounting, the department
which should have complete control over the
transaction is the
A) mailroom.
B) cash receipts.
C) accounts receivable.
D) No one department should have complete
control over incoming cash
38. A turnaround document that is used to enhance
internal control and promote the accuracy of
incoming cash receipts is the
A) journal voucher.
B) remittance advice.
C) bank deposit slip.
D) remittance list.
39. Using a lock-box system
A) expedites the cash flow for a company.
B) helps to reduce interest income lost due to
delays in depositing out-of-state-checks.
C) promotes the segregation of duties because a
third-party handles cash receipts.
D) All of these answers are correct.
40. A company located in Delaware has customers
nationwide. The most effective system to deal
with the issue of float is to
A) use one lock-box collection system located in
the Midwest.
B) have customers send their remittances to the
company's corporate office in Delaware.
C) use several regional lock-box systems
located geographically around clusters of
customers.
D) factor its accounts receivable to a collection
agency.
41. A significant difference between a cash sales
business process and a cash-received-on-
account business process is that
A) no previous customer account balance
exists in a cash sales business process.
B) the float is shorter in a cash-received-on-
account business process.
C) more direct supervision is required in a cash-
received-on-account business process.
D) There is no significant difference between
the two business processes.
42. A grocery store customer will be given a gallon
of ice cream if his or her receipt has a red star
stamped on it. The idea behind this technique
from an accounting control standpoint is to
A) promote the dairy industry's "Got Milk"
campaign.
B) have the customer audit his or her cash
receipt.
C) keep the customer happy.
D) Answers A and C are both correct.
43. Which illustration is not an example of a
customer audit technique?
A) Providing a customer with a remittance
advice that must be returned with payment
B) Pricing items at $1.00 rather than 99 cents
so the customer does not expect change
C) Entering the customer in a prize contest if he
or she calls a number and provides feedback
about the purchase
D) All of these answers are correct.
44. Which illustration is not an example of a
supervision technique?
A) Using professional shoppers in a retail
environment
B) Using a test package for a bank teller or cash
counter
C) Having a cash register make sound when it is
opened in the presence of a customer
D) All of these answers above are correct.
47. Effective internal control provides ________
assurance regarding the reliability of financial
reporting and the preparation of financial
statements for external purposes.
A) little
B) adequate
C) total
D) reasonable
48. Auditing standard No. 5 describes a ________
approach to selecting controls to be tested.
A) hybrid
B) bottom-up
C) top-down
D) This standard does not discuss the selection
of controls to be tested.
49. Risk assessment should evaluate whether
controls sufficiently address identified risks of
material misstatements due to fraud and
A) controls specifically designed to prevent
fraud.
B) controls intended to address the risk of
collusion.
C) controls intended to address the risk of
management override of these controls.
D) controls specifically designed to prevent
material misstatements.

45. Sarbanes-Oxley Act of 2002 requires companies

maintain an adequate ________ structure over
the business processes that support financial
reporting.
A) risk assessment
B) internal control
C) assurance assessment
D) reliability process

46. The SEC Interpretive Guidance "Management's

Report on Internal Control Over Financial
Reporting" approved in 2007, focuses
management on internal controls that best
protect against risk of material ________ in
financial statements.
A) fraud
B) misstatements
C) negligence
D) mistakes