An Internal Auditor Is Assigned to Conduct an Audit of Security

question 227

Multiple Choice

An internal auditor is assigned to conduct an audit of security for a local area network (LAN) in the finance department of the organization. Investment decisions, including the use of hedging strategies and financial derivatives, use data and financial models which run on the LAN. The LAN is also used to download data from the mainframe to assist in decisions. Which of the following should be considered outside the scope of this security audit engagement?

• A) Investigation of the physical security over access to the components of the LAN.
• B) The ability of the LAN application to identify data items at the field or record level and implement user access security at that level.
• C) Interviews with users to determine their assessment of the level of security in the system and the vulnerability of the system to compromise.
• D) The level of security of other LANs in the company which also utilize sensitive data.

---

Definitions:

Cumulative Preferred Stock

A type of preferred stock that accrues dividends if they are not paid as scheduled, with these unpaid dividends to be paid out before common shareholders can receive dividends.

Unearned Interest

Interest that has been collected on a loan by the lender but not yet earned, often because the loan may be paid off early.

Estimated Property Taxes

An approximation of the property taxes due on real estate, often used for budgeting or accounting purposes before the actual tax bill is received.

Modified Cash Basis

An accounting method that combines elements of both accrual and cash basis accounting, recording some transactions on an accrual basis and others on a cash basis.