AUDIT [IF IT GENERAL CONTROL Computer Operations and Access to Programs and Data Requirement: True and False 1.) To the extent possible. IT systems should be installed in locations away from any location likely to be affected by natural disasters. 2.) It is not necessary to control the humidity and temperature in the location where the computer system is housed. 3.) Disaster recovery planning is a proactive plan to protect IT systems and the related data. 4.)!1'. disaster recovery plan is a comprehensive statement of all actions to be taken after a disaster. 5.} Library procedures should assure that only authorized persons receive les, programs, or documents. and that these persons acknowledge their responsibility at the time of each issuance. 6.) The entire focus of disaster recovery could be summed up with a oneword definition: rebuilding T. :I The approach to any risk should be to try to remove the threat by considering business locations. building materials and duplication of key functions at remote sites. AUDIT DF II' GENERAL CONTROL Computer Operations and Access to Programs and Data Requirement: True and False 1.) BOP should be supported by a formal executive policy that states the organization's overall target for recovery and empowers those involved in developing, testing and maintaining the plans. 2.) The purpose of an IT auditor is to provide ad hoc assistance to business users. 3.) To increase the effectiveness of login restrictions. user Ids must be unique for each user. 4.) Biometric devises use unique physical characteristics to identify users. The most common method used is retina scans. 5.) Once an organization has set up an effective system to prevent unauthorized access to the IT system. it is not necessary to continually monitor the vulnerability of that system. 6.) Employees who hack into computer networks are often more dangerous because of their knowledge of company operations. T.) Controlling access to the operating system is critical because that access opens access to any data or program within the system. 8.) An organization must maintain procedures to protect the output from unauthorized access in the form of written guidelines and procedures for output distribution