1. An IT auditor is evaluating their company's system development and change management process. Which of the following would provide the GREATEST concern to the IT auditor?

i. The project was over budget by 9%.

ii. User acceptance testing only lasted ½ hour and the results were not documented.

iii. User requirements and objectives related to the change were not met.

iv. User manuals and related operational documentation have not been updated.

2. During an application audit, the IT auditor determines that a significant number of exceptions are generated each day during the data transfer process to the company's data warehouse. Which of the following recommendations to management would MOST likely address the root cause related to these exceptions?

i. Designing edits checks related to data input.

ii. Documenting the procedures to follow-up on the exceptions.

iii. Designing validity checks regarding the data output.

iv. Developing a data flow diagram.

3. An IT auditor is conducting data analysis procedures on an employee expense report file and notices several expenses for $24.99 from the same individual. The company's policy requires that any expenses that are under $25.00 do not require a receipt. The IT auditor should (SELECT ALL THAT APPLY):

i. Maintain professional skepticism and investigate these transactions further.

ii. Pass on investigating these items further, focusing on higher dollar amounts.

iii. Evaluate the business process approval controls, and related procedures.

iv. Discuss fraud awareness and detection programs with management to gain an understanding of management's commitment to fraud prevention.

4. The Chief Information Officer (CIO) reviews a weekly report that summarizes compliance with the company's change management policy. This is an example of a control.

i. Soft, detective

ii. Soft, preventive

iii. Hard, monitoring

iv. Hard, preventive