Which of the following is a program evaluation review technique that considers different scenarios
for planning and control projects?

If an IS auditor observes that an IS department fails to use formal documented methodologies,
policies, and standards, what should the auditor do? Choose the BEST answer.

What often results in project scope creep when functional requirements are not defined as well as
they could be?

Fourth-Generation Languages (4GLs) are most appropriate for designing the application’s
graphical user interface (GUI). They are inappropriate for designing any intensive data-calculation
procedures. True or false?

Run-to-run totals can verify data through which stage(s) of application processing?

________________ (fill in the blank) is/are are ultimately accountable for the functionality,
reliability, and security within IT governance. Choose the BEST answer.

What can be used to help identify and investigate unauthorized transactions? Choose the BEST
answer.

Network environments often add to the complexity of program-to-program communication, making
the implementation and maintenance of application systems more difficult. True or false?

______________ risk analysis is not always possible because the IS auditor is attempting to
calculate risk using nonquantifiable threats and potential losses. In this event, a ______________
risk assessment is more appropriate. Fill in the blanks.

What must an IS auditor understand before performing an application audit? Choose the BEST
answer.