Which of the following is not a condition that the internal auditor should be alert for when testing for fraud in an e-commerce audit?
Answer(s): A
According to the outline of a possible e-commerce audit protocol for key areas given in PA 2100-6, the internal auditor should be alert for the following conditions with respect to fraud:· Unauthorized movement of money e.g., transfers to jurisdictions where the recovery of funds would be difficult).· Duplication of payments.· Denial of orders placed or received, goods received, or payments made. · Exception reports and procedures and effectiveness of the follow-up. · Digital signatures: Are they used for all transactions? Who authorizes them? Who has access to them?· Protections against viruses and hacking activities history file, use of tools). · Access rights: Are they reviewed regularly? Are they promptly revised when staff members are changed? History of interception of transactions by unauthorized persons.
An internal auditor is evaluating project management reviews of individual initiatives and development projects and system development life cycle reviews.When performing this service, the internal auditor is addressing which key e-commerce audit area?
Answer(s): C
According to the outline of a possible e-commerce audit protocol for key areas given in PA 2100-6, the internal auditor should evaluate how well business units are managing the e-commerce when addressing the possible key audit area of management issues. The following is a list of some relevant topics that the internal auditor should review when doing their evaluation:· Project management reviews of individual initiatives and development projects.· System development life cycle reviews.· Vendor selection, vendor capabilities, employee confidentiality, and bonding. · Post-implementation economic reviews: Are anticipated benefits being achieved? What metrics are being used to measure success?· Post-implementation process reviews: Are new processes in place and working effectively?
Management has implemented such controls as firewalls, password management, independent reconciliation, and audit trails. These controls should be reviewed and evaluated by the internal auditor when doing testing for which key e-commerce audit area?
Answer(s): D
An outline of a possible e-commerce audit protocol for key areas is given in PA 2100-6. In the outline, authentication is given as a possible key audit area, and to test for authentication, the internal auditor should review the policies for authenticating transactions and evaluating controls. Tools that management should have in place include firewalls, password management, independent reconciliation, and audit trails.
What risk element is management seeking to identify by asking the following question:What could happen that would adversely affect the organization's ability to achieve its objectives and execute its strategies?
PA 2100-6 poses seven key questions that can identify organizational risk and target potential ways to control or mitigate the exposures. Each question is associated with a risk element. The threat events element is associated with the given question.
The e-commerce project that an auditor is most likely to assess as having the lowest risk is one that:
The following are a few issues that an internal auditor should consider when undertaking an e- commerce engagement and assessing risks:· Is there a business plan for the e-commerce project or program? · Does the plan cover the integration of the planning, design, and implementation of the commerce system with the strategies of the organization?· Have governmental and regulatory requirements been analyzed and considered? · How secure is the hardware and software, and will they prevent or detect unauthorized access, inappropriate use, and other harmful effects and losses? · Will transaction processing be current, accurate, complete, and indisputable? . Does the risk assessment include internal and external forces?· If outside vendors are used, has a "going concern" evaluation been conducted by a trusted third party who is qualified to certify the vendor?· If vendors provide hosting services, do they have a tested business contingency plan? Have they provided a recent SAS-70 report? Also, have privacy issues been resolved? Based on how well the e-commerce project addresses these questions, the project likely to receive the lowest risk assessment is one that has a business plan that covers the integration of the planning, design, and implementation of the e-commerce system with the strategies of the organization.
Post your Comments and Discuss IIA IIA-CIA-PART3-3P exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the IIA-CIA-PART3-3P content, but please register or login to continue.