- An issuer is audited under PCAOB standards. The auditor identifies that the company lacks a formal process to review and approve changes to key reports used in controls over financial reporting, including a cash reconciliation report generated from the ERP. Management asserts the report is unchanged from prior years. Which audit response is most appropriate to address the risk related to IT general controls over report changes?
Answer: Test report logic and parameters, and evaluate change management controls over report modifications to support reliance on the report used in the control
PCAOB AS 2201 requires testing ITGCs over changes to reports used in ICFR controls. The key facts include lacking formal processes for report changes, with management asserting stability for the cash reconciliation report. Option A aligns with AS 2201 by testing logic, parameters, and change controls to support reliance. Option B is incorrect as assertions require corroboration, and Option C violates evidence needs in AS 2301. Option D is wrong as SOC 2 covers vendor controls, not company-specific. A transferable framework is to validate report integrity by inspecting configurations against change risks. Professional judgment should assess the impact on dependent manual controls.
- An issuer is audited under PCAOB standards. The auditor identifies that the company's database backups for the financial reporting system are performed nightly, but backup restoration testing has not been performed for two years. A recent system outage required manual reconstruction of certain subledger activity. Based on the circumstances, which IT control is most critical for ensuring data integrity?
Answer: Periodic backup restoration testing and documented evidence that restored data are complete and accurate for financial reporting purposes
PCAOB AS 2201 emphasizes controls over data availability and integrity, including backup testing. The key facts involve nightly backups without restoration testing for two years, with a recent outage requiring reconstruction. Option A aligns with COBIT by requiring periodic testing for completeness and accuracy. Option B is irrelevant, and Option C is high-level without IT focus, per AS 2201. Option D lacks validation. A transferable decision rule is to assess backup controls by verifying restorability. Professional judgment should prioritize testing in outage-prone environments.
- A nonissuer manufacturing company is undergoing a financial statement audit under AICPA standards. During the year, management implemented a new enterprise resource planning (ERP) system that automatically posts sales invoices from the order-entry module to the general ledger, and the legacy system is now read-only for reference. The auditor identifies a risk that unauthorized users could create or modify customer master data and sales prices, resulting in misstated revenue. Which control should the auditor evaluate to address the risk of unauthorized access?
Answer: Role-based access provisioning with documented approvals, periodic user access recertifications, and timely removal of terminated users from the ERP
The COSO framework emphasizes the importance of control activities, including information technology general controls (ITGCs) such as logical access controls to mitigate risks in financial reporting systems. In this scenario, the key facts involve the implementation of a new ERP system with automated posting of sales invoices and the identified risk of unauthorized modifications to customer master data and sales prices, which could lead to revenue misstatements. Option B aligns with authoritative guidance from COBIT, which recommends role-based access controls, approvals, recertifications, and timely user terminations to prevent unauthorized access and ensure data integrity. Option A is incorrect because it represents a monitoring control rather than a preventive access control, and Option C is flawed as post-implementation reviews should occur timely, not delayed until after annual statements, per audit standards like AU-C 315. Option D is inappropriate because a general cybersecurity model without integration into audit evidence does not directly address access control testing, as per PCAOB AS 2201. A transferable professional judgment framework involves assessing the design and operation of access controls by evaluating provisioning processes against the principle of least privilege. Auditors should also consider the precision of controls in mitigating specific risks, balancing preventive and detective measures for effective risk response.
- An issuer is audited under PCAOB standards. The company relies on a service organization to process payroll, and payroll expense is material; the service organization provides a SOC 1 Type 2 report covering relevant controls. Management did not implement user access reviews over the payroll portal used to submit payroll changes to the service organization. Which control should the auditor evaluate to address the risk of unauthorized access?
Answer: A user access review control over the payroll portal, including periodic review of users with change capabilities and prompt removal of departed employees
PCAOB AS 2601 addresses reliance on service organizations, requiring evaluation of user entity controls when noted in SOC reports. The key facts include material payroll processed by a service organization with a SOC 1 report, but lacking user access reviews over the portal. Option B aligns with AS 2601 by emphasizing access reviews and removal to prevent unauthorized changes. Option A is incorrect as budget reconciliations do not address access, and Option C is wrong because SOC 1 covers provider controls, not user entity, per standards. Option D is inadequate as SOC 2 focuses on non-ICFR criteria, not substituting for user controls. A transferable framework involves assessing complementary user controls by verifying their design and operation against SOC considerations. Professional judgment should integrate these with overall ICFR testing for completeness.
- An issuer is undergoing an audit under PCAOB standards. During the year, the company experienced a cybersecurity incident involving compromised credentials for a privileged IT administrator account; management states that no financial data were altered. The auditor has identified deficiencies in privileged access management and is evaluating the impact on ICFR. Which factor would most likely affect the auditor's assessment of IT controls?
Answer: Whether the incident involved a privileged account with access to applications and databases supporting financial reporting
PCAOB AS 2201 guides the evaluation of IT control deficiencies in ICFR, focusing on risks to financial reporting from cybersecurity incidents. The key facts include a compromised privileged account and deficiencies in access management, with no financial data alterations claimed. Option A most affects the assessment as privileged access to financial systems heightens misstatement risks, aligning with COSO's risk assessment principles. Option B is irrelevant as website downtime does not impact ICFR, and Option C is incorrect because future plans do not remediate current deficiencies, per AS 2201. Option D is wrong as press releases do not substitute for control evidence, emphasizing substance over disclosure in COBIT. A transferable judgment framework is to assess deficiency severity by likelihood and magnitude of misstatement from privileged access breaches. Auditors should apply professional skepticism, considering compensating controls when evaluating overall ICFR effectiveness.
- When evaluating the effectiveness of a client's logical access controls, an auditor would most likely examine the system's password parameter settings to determine if they require:
Answer: A combination of password complexity, length, and periodic expiration.
Strong password policies are a fundamental logical access control. Auditors expect to see system-enforced parameters that require passwords to meet minimum length and complexity requirements (e.g., use of upper/lower case letters, numbers, symbols), be changed periodically, and prevent the reuse of old passwords. A is a good practice but less comprehensive than C. B is a very poor practice that increases risk. D is a procedural choice; automated resets can also be secure.
- An issuer is audited under PCAOB standards, and the company implemented a new revenue recognition module within its ERP during the year. The module includes automated allocation calculations and posts journal entries to the general ledger. The auditor intends to rely on the automated allocation control. Which control should the auditor evaluate to support reliance on the automated control?
Answer: IT change management controls over the revenue module configuration, including approvals, testing evidence, and restricted migration to production
PCAOB AS 2201 requires testing ITGCs like change management to support reliance on automated controls. The key facts involve a new ERP revenue module with automated allocations posting to the GL, intended for reliance. Option A aligns with COBIT by requiring approvals, testing, and restricted changes to ensure control reliability. Option B is incorrect as contract approvals do not address configurations, and Option C is wrong because post-audit reviews lack timeliness, per AS 2201. Option D is inadequate as methodologies without evidence do not support testing. A transferable framework is to verify change controls by inspecting documentation against automated control risks. Professional judgment should determine reliance based on control stability over the period.
- An auditor is testing a client's control that requires department managers to perform a quarterly review of their employees' access rights to the financial reporting system. Which audit procedure would best test the operating effectiveness of this control?
Answer: Selecting a sample of quarterly review forms and verifying evidence of the manager's review and the timely removal of inappropriate access.
To test the operating effectiveness of the access review control, the auditor must examine evidence that the control was performed and that corrective actions were taken. This involves inspecting the signed review forms (evidence of performance) and then tracing any identified issues (e.g., employees who transferred or left) to ensure their access was promptly revoked. A, B, and C test other related controls but not the manager's quarterly review itself.
- An entity's IT disaster recovery plan, a key component of its computer operations controls, should be designed primarily to:
Answer: Specify procedures for restoring essential data and processing capabilities in the event of a major disruption.
The core purpose of a disaster recovery plan (DRP) is to enable the entity to recover from a disaster and restore critical IT infrastructure, data, and processing capabilities within a predetermined timeframe. A is a security objective, but not the primary purpose of a DRP. B is a procedural detail for after recovery. D is incorrect; a DRP mitigates operational risk but does not replace the need for insurance to cover financial losses.
- An auditor has identified a significant deficiency in an entity's IT general controls related to program change management. What is the auditor's most likely conclusion concerning the testing of automated application controls that were not modified during the period under audit?
Answer: The auditor may be able to rely on the automated application controls after testing them at a point in time to verify their functionality.
Even with weak change controls, an automated control that has not changed since it was last tested may still be reliable. The auditor can use a 'benchmark' or 'baseline' strategy, which involves testing the control's functionality at a point in time. This is more efficient than testing its operation throughout the period (C). A is too extreme; if the control hasn't changed, it may be reliable. D is never appropriate as management representation alone is not sufficient audit evidence.
- Which of the following control activities is most critical to include in an entity's policies for developing and implementing new IT systems (i.e., systems development life cycle controls)?
Answer: User departments should be actively involved in the testing and acceptance of the new system before it is placed into production.
User Acceptance Testing (UAT) is a critical control in systems development. It ensures the system meets the business requirements and functions as expected from the users' perspective, which is essential for a successful implementation. A is not required; others can perform post-implementation reviews. B is a significant violation of segregation of duties. C is an unrealistic business constraint; the risk should be managed with other controls.
- What is the most appropriate conclusion for the company's auditor to draw from this report regarding the audit of payroll?
Answer: The auditor can reduce the assessment of control risk for payroll assertions, assuming the user entity's own complementary controls are also effective.
A SOC 1, Type 2 report with an unmodified opinion provides evidence that allows the user auditor to place some reliance on the service organization's controls. This enables the auditor to reduce the assessed level of control risk for relevant assertions. However, the auditor must still evaluate and test the user entity's own controls (complementary user entity controls) related to the outsourced function. A is incorrect because user entity controls must still be considered. C is incorrect because the purpose of the SOC report is to avoid this. D is incorrect as the report is highly relevant.
- The primary objective of implementing formal program change management controls is to provide reasonable assurance that:
Answer: All modifications to production systems are properly authorized, tested, and implemented.
The core purpose of program change management controls is to maintain the integrity, security, and availability of the production environment. This is achieved by ensuring that all changes are subject to a formal process of authorization, testing, approval, and implementation, preventing unauthorized or faulty code from being moved into production. A, B, and C relate to IT management or operational efficiency, not the primary control objective.
- An issuer is audited under PCAOB standards. The auditor finds that IT governance policies exist, but there is no documented inventory of applications and interfaces that support financial reporting, and ownership for key systems is unclear. The company recently completed several system integrations following an acquisition. What is the most appropriate audit procedure for testing IT governance?
Answer: Evaluate whether management maintains and reviews an inventory of in-scope financial reporting systems and assigns accountability, by inspecting documentation and corroborating through inquiry and walkthroughs
PCAOB AS 2201 requires testing IT governance, including system inventories and ownership for financial reporting. The key facts include existing policies but no documented inventory or clear ownership, post-acquisition integrations. Option A aligns with AS 2201 by inspecting documentation and corroborating. Option B limits to substantive, ignoring IT, and Option C accepts verbal without evidence, per AS 2301. Option D substitutes without testing. A transferable decision rule is to verify governance by tracing inventories to accountability. Professional judgment should evaluate pervasiveness on ICFR.
- A nonissuer retail chain is undergoing a financial statement audit under AICPA standards. The company implemented a new point-of-sale (POS) system that transmits daily sales data to the ERP general ledger through an automated API, and there is limited documentation of the change management process. The auditor plans to rely on automated controls over sales completeness and accuracy. Which control should the auditor evaluate to support reliance on automated application controls in this environment?
Answer: A change management control requiring documented testing, approval, and migration of POS and ERP configuration changes to production
AICPA AU-C 330 requires testing of IT controls supporting reliance on automated application controls, such as change management for system implementations. The key facts involve a new POS system with automated API transmission to the ERP and limited change management documentation, affecting sales completeness and accuracy. Option A aligns with COBIT's change management controls, requiring testing, approval, and restricted migration to ensure reliable automated controls. Option B is incorrect as ethics training does not address IT changes, and Option C focuses on manual reviews without investigating configurations, per AU-C 315. Option D is inadequate because post-audit reviews do not support current-period reliance, violating timeliness in audit evidence. A transferable decision rule is to evaluate change management by verifying segregation and documentation against risks to automated controls. Professional judgment should balance the nature, timing, and extent of testing to achieve sufficient assurance.
- An issuer is audited under PCAOB standards. The company's IT governance assigns responsibility for cybersecurity and financial systems to separate leaders, and there is no formal process for escalating cybersecurity incidents to the audit committee. A recent ransomware event affected a file server used to store accounting support schedules, though systems were restored from backups. Which factor would most likely affect the auditor's assessment of IT controls?
Answer: Whether incident response and escalation procedures include timely communication of events affecting financial reporting information to those charged with governance
PCAOB AS 2201 integrates IT governance in ICFR, including escalation of incidents affecting financial data. The key facts include separate leaders without formal escalation to the audit committee, and a ransomware event impacting accounting files. Option A most affects the assessment as escalation ensures governance oversight, aligning with COSO monitoring. Option B is irrelevant to ICFR, and Option C is incorrect as insurance does not replace controls, per AS 2201. Option D is partial without addressing governance gaps. A transferable framework is to assess incident procedures by tracing escalations to governance roles. Professional judgment should evaluate monitoring's role in risk mitigation.
- Which of the following is an example of an IT general control, rather than an application control?
Answer: A policy requiring all changes to the payroll system software to be formally authorized and tested before implementation.
Program change management controls (B) are a classic example of an IT general control because they apply broadly to all systems and applications to ensure the integrity of the production environment. Choices A, C, and D are all examples of application controls because they are embedded within a specific business process (data entry, accounts payable, credit sales) to ensure transactions are processed correctly.
- How does an entity's overall control environment, as defined by the COSO framework, relate to its IT general controls?
Answer: An effective control environment provides the foundation for effective IT general controls by establishing the appropriate tone at the top.
The control environment sets the tone of an organization and provides the foundation for all other components of internal control, including ITGCs. Management's commitment to integrity, ethical values, and competence directly influences how IT controls are designed, implemented, and monitored. They are highly interrelated, not substitutes (A) or mutually exclusive (D). The control environment impacts both manual and automated processes (B).
- A nonissuer technology company is undergoing a financial statement audit under AICPA standards. The company uses a source code repository and automated deployment tools to push changes to its billing application, which feeds revenue transactions into the general ledger. The auditor notes that developers can approve their own pull requests and deployments. Which control should the auditor evaluate to address the risk of unauthorized changes to programs affecting financial reporting?
Answer: Segregation of duties in the deployment process, including independent code review/approval, restricted production deployment rights, and audit logs of deployments
AICPA AU-C 330 requires controls over program changes to mitigate unauthorized modifications affecting financial reporting. The key facts involve developers approving their own deployments to the billing application feeding the GL. Option A aligns with COBIT by enforcing segregation, reviews, and logs to prevent unauthorized changes. Option B lacks independence, and Option C is incorrect as trend analysis is monitoring, not preventive, per AU-C 315. Option D is inadequate without specific evidence. A transferable decision rule is to evaluate deployment controls by verifying segregation against change risks. Auditors should consider logging for detective effectiveness.
- If an auditor identifies pervasive and significant deficiencies in a client's IT general controls, what is the most likely impact on the audit plan?
Answer: The auditor will likely adopt a predominantly substantive audit strategy and reduce reliance on automated controls.
Weak ITGCs undermine the reliability of data and application controls. Consequently, the auditor cannot rely on those controls to reduce substantive testing. The appropriate response is to increase the assessed level of control risk and adopt a predominantly substantive audit strategy, which involves more direct testing of account balances and transactions. A is incorrect because control deficiencies only lead to a modified opinion if they result in undetected material misstatements. B is the opposite of the correct action, as weak ITGCs make client data less reliable for analytics. D is insufficient; the auditor must modify the audit strategy in response to the increased risk.
