Skip to main content
Sign in Create a free account
Varsity Tutors
Sign in Sign up

Practice Test 6 - CPA Isc

20 questions. Answer them in any order, then submit to see your score and every explanation.

  1. Which of the following application controls is specifically designed to prevent a transaction from being entered and processed more than once?
  2. An auditor finds that a change management system shows 200 approved change requests, but deployment logs reveal 230 deployments. The most likely explanation and risk is:
  3. In an IT infrastructure audit at a public company, the auditor evaluates how software updates are distributed to employee endpoints. Management wants a centralized mechanism to deploy approved patches consistently and to report patch compliance, supporting IT governance and security standards. Which component is essential to manage this patch deployment process?
  4. A company skips formal documentation during the Analysis and Design phases to accelerate development timelines. The most significant risk of this approach is:
  5. Which of the following is most important when designing an IT policy framework to ensure policies are actually followed?
  6. In the COSO Internal Control framework, the 'control environment' refers to:
  7. IT general controls (ITGCs) are important to financial statement audits primarily because:
  8. Which of the following correctly describes the purpose of an IT charter or IT governance policy?
  9. An auditor finds a control requiring manager review of a 500-page monthly report to identify exceptions. The most significant design concern is:
  10. Which of the following physical access controls is specifically designed to prevent 'tailgating' (piggybacking) into secured facilities?
  11. A company's internal audit team evaluates whether controls over a new cloud-based financial system are adequate. Which of the following should the auditors assess as part of the design evaluation?
  12. A company's incident response plan has not been updated in three years and does not reflect the current IT infrastructure, key contacts, or regulatory requirements. The primary risk of this outdated plan is:
  13. Which of the following recovery control test types provides evidence of recoverability with the least operational risk?
  14. Which of the following data quality controls addresses the risk that data transferred between two systems contains errors introduced during the transfer process?
  15. Which of the following backup control deficiencies poses the greatest risk to an organization's ability to recover from a cyberattack?
  16. A risk has very high potential impact but very low likelihood. Under COSO ERM, the most appropriate initial response is typically to:
  17. Enterprise risk is within appetite, but one business unit exceeds its risk tolerance. What action best fits COSO ERM?
  18. An auditor is evaluating a macro-enabled Excel workbook that performs complex actuarial calculations for insurance reserve estimates. The auditor should be particularly concerned about which risk specific to macro-enabled spreadsheets?
  19. A company's annual external audit includes an evaluation of IT governance. The external auditor finds that the audit committee receives detailed IT audit reports but never asks questions or requires follow-up on significant findings. This observation indicates:
  20. A critical EUC spreadsheet has no backup copies. The only copy is stored on a single employee's laptop. Which risk does this most directly create?

Practice tests