- Which of the following describes a 'false positive' in the context of audit data analytics anomaly detection?
Answer: A transaction flagged as an anomaly by the analytics that, upon investigation, turns out to be a legitimate transaction.
A false positive occurs when the analytics flags a transaction that appears anomalous but is actually legitimate. Managing false positives is important to avoid wasting investigative resources. Answer B is correct. A missed genuine anomaly (A) is a false negative. Programming errors (C) are data analytics integrity issues. Data corruption (D) is a data quality issue.
- Which of the following best describes the purpose of using stratification in audit data analytics?
Answer: To divide a data population into homogeneous subgroups based on defined characteristics so that each subgroup can be analyzed separately.
Stratification divides data into meaningful subgroups (e.g., by dollar range, department, or transaction type) enabling focused analysis on high-risk segments. Answer B is correct. Deduplication (A) removes duplicates. Correlation (C) measures relationships between variables. Data conversion (D) is a data preparation technique.
- A data analyst discovers that inventory quantities in the ERP system were adjusted downward on the last day of each quarter but recovered to prior levels shortly after the quarter closed. Which type of anomaly does this pattern most likely represent?
Answer: Potential manipulation of period-end inventory to manage reported financial results.
Systematic downward adjustments at quarter-end that reverse shortly after are a classic indicator of inventory manipulation to affect reported financial results (e.g., reducing COGS or asset values temporarily). Answer B is correct. Normal seasonal patterns (A) do not reverse immediately after quarter-end. IT recalibration (C) would not follow this financial reporting cycle pattern. Data entry errors (D) would be random, not systematic at quarter-end.
- Which of the following data analytics outputs would best help an auditor assess the completeness of revenue recognition for a subscription-based company?
Answer: A comparison of active subscription counts from the CRM system to revenue recognition entries in the general ledger.
Comparing active subscription records in the CRM to recognized revenue entries tests whether all active subscribers are generating revenue entries - a completeness test using cross-system analytics. Answer C is correct. Benford's Law (A) tests digit distributions, not completeness. Regression (B) develops an expectation but does not directly test completeness by subscription. Stratification (D) does not address completeness across systems.
- Which of the following data analytics techniques is most appropriate for identifying duplicate invoice payments?
Answer: Matching and deduplication analysis comparing invoice number, vendor ID, amount, and date.
Duplicate payment detection requires comparing records on key fields (invoice number, vendor, amount, date) to identify identical or near-identical entries. Matching and deduplication analysis directly addresses this. Answer A is correct. Regression (B), time-series (C), and stratification (D) do not identify duplicate individual transactions.
- Which of the following statements best describes a 'continuous auditing' approach using data analytics?
Answer: An automated process that analyzes transactions on an ongoing basis and generates alerts when anomalies or exceptions are detected.
Continuous auditing leverages automated analytics to monitor the full population of transactions on an ongoing basis, flagging exceptions for immediate investigation rather than waiting for periodic audits. Answer C is correct. Annual full-population testing (A) is traditional auditing. Manual sampling (B) is also traditional. Real-time financial reporting (D) is a financial reporting concept, not continuous auditing.
- A data analyst reviews accounts receivable aging data and identifies that a small number of customer accounts have balances that have remained unchanged for over 18 months. This finding is most consistent with which type of anomaly?
Answer: Potentially fictitious or uncollectible balances that have not been written off or investigated.
Receivable balances that remain static for extended periods often indicate write-off avoidance, fictitious receivables, or collection failures - anomalies that should trigger further investigation. Answer D is correct. Duplicate postings (A) would change rather than freeze balances. Credit limit changes (B) affect future credit, not static aging. Rounding errors (C) would create small discrepancies, not static large balances.
- Which of the following is a limitation of using data analytics to identify anomalies in financial data?
Answer: Data analytics identifies statistical exceptions that require professional judgment to determine whether they represent actual errors or fraud.
Data analytics flags statistical anomalies, but every exception requires auditor judgment to determine whether it represents a genuine error, fraud, or an explainable legitimate transaction. Answer D is correct. Modern analytics tools handle millions of transactions (A). Analytics results are valid audit evidence (B). Analytics applies across all financial data, not just payroll (C).
- A company's purchasing analytics system flags all purchase orders where the order amount is just below the manager approval threshold of $10,000. This type of control is designed to detect which type of fraudulent activity?
Answer: Purchase order splitting - breaking a large purchase into smaller amounts to avoid authorization controls.
Flagging transactions just below approval thresholds detects 'splitting' - deliberately structuring purchases in amounts below authorization limits to circumvent controls. Answer A is correct. Vendor master manipulation (B) involves changes to vendor data. Duplicate payments (C) are detected by matching, not threshold analysis. Inventory quantity changes (D) are unrelated to purchase order amounts.
- An auditor wants to test all journal entries for unusual characteristics such as round-dollar amounts, entries posted on holidays, or entries made by IT administrators. Which audit analytics approach is most appropriate?
Answer: Full population analysis with multiple filter criteria applied simultaneously to the complete journal entry file.
Testing the full population of journal entries against multiple risk-based criteria (round numbers, unusual dates, unusual preparers) simultaneously is the most comprehensive and appropriate approach. Answer B is correct. Regression (A) is predictive modeling. Statistical sampling (C) misses transactions not in the sample. Cluster analysis (D) groups similar items but does not apply specific risk filters.
- An auditor wants to identify all transactions in the accounts payable ledger where the same vendor bank account number appears on multiple vendor records. Which analytics technique is most appropriate?
Answer: Cross-reference matching of vendor bank account numbers across all vendor master records.
Cross-reference matching identifies shared attributes (same bank account) across different records - a key technique for detecting fictitious vendor schemes where one person controls multiple vendor accounts. Answer C is correct. Time-series (A), stratification (B), and Benford's Law (D) do not detect shared bank account numbers across vendor records.
- In audit data analytics, which of the following best describes 'data extraction'?
Answer: The process of retrieving and importing data from source systems into an analytics environment for analysis.
Data extraction is the first step in the analytics process - pulling raw data from ERP, databases, or other source systems into the audit analytics environment. Answer D is correct. Visualization (A) is a later step in presenting results. Statistical sampling (B) is a different technique. Deduplication (C) is a data cleansing step that follows extraction.
- An auditor analyzes payroll data and discovers that several employees received pay increases significantly above the approved percentage range during the same pay period. Which type of analytics procedure best describes this analysis?
Answer: Exception reporting to identify transactions outside defined parameters.
Identifying transactions that fall outside defined acceptable ranges (approved increase percentage) is exception reporting - a fundamental anomaly detection technique. Answer C is correct. Trend analysis (A) looks at aggregate patterns over time. Benford's Law (B) analyzes leading digit distributions. Regression (D) models predictive relationships.
- Which of the following data quality issues would most significantly compromise the reliability of anomaly detection analytics?
Answer: Incomplete or inaccurate data in the source system, leading to false positives or missed anomalies.
If source data is incomplete or inaccurate, analytics will produce unreliable results - either flagging legitimate transactions as anomalies or missing actual exceptions. Data quality is foundational to analytics reliability. Answer A is correct. SQL vs. specialized software (B) is a tool choice, not a data quality issue. Multi-year analysis (C) can be appropriate. Large amounts (D) are not inherently problematic.
- Under audit standards, when data analytics identifies a high volume of exceptions requiring follow-up, the auditor should:
Answer: Apply professional judgment to prioritize the highest-risk exceptions and perform targeted investigation, documenting conclusions for each.
When analytics produces many exceptions, the auditor applies professional judgment to prioritize those most likely to represent significant issues, investigates them, and documents the conclusions. Answer A is correct. Not all exceptions are fraud (B). Dismissing all exceptions (C) violates auditing standards. Expanding the sample (D) is irrelevant when full population analytics is already being used.
- Which of the following best describes the use of 'data profiling' as a precursor to audit analytics?
Answer: Examining the structure, content, and quality of a dataset to understand its characteristics and identify potential data issues before analysis.
Data profiling involves understanding the dataset - its completeness, format consistency, range of values, null fields, and other characteristics - before running analytics, ensuring the analysis will produce reliable results. Answer C is correct. Predictive modeling (A) is a subsequent analytics step. Visualization (B) presents results. Encryption (D) is a data security measure.
- An auditor uses regression analysis to establish an expectation of sales revenue based on units sold and average price. Actual revenues are then compared to this expectation. Which audit objective does this analytics procedure primarily support?
Answer: Accuracy - identifying whether recorded revenue amounts are consistent with expectations based on underlying business activity.
Regression-based expectation models compare actual recorded amounts to analytically derived expectations, primarily testing whether revenue is accurately stated relative to underlying business drivers. Answer B is correct. Completeness (A) involves testing for missing transactions. Existence (C) involves confirming transactions occurred. Cutoff (D) involves timing of recognition.
- An auditor performs a gap analysis on a sequence of pre-numbered sales invoices. The purpose of this analysis is to:
Answer: Identify missing invoice numbers that may indicate unrecorded sales transactions.
A gap analysis on pre-numbered documents identifies breaks in the numeric sequence, which may indicate missing or suppressed transactions - a key completeness test in auditing. Answer C is correct. Deviation from average amounts (A) is an exception test. Duplicate detection (B) is a separate test. Statistical distribution (D) is a different analytical procedure.
- A continuous monitoring system automatically flags any general ledger journal entries posted after 11 PM on weekdays or at any time on weekends. Which fraud risk does this control most directly address?
Answer: Unauthorized journal entries posted outside normal business hours by individuals attempting to conceal fraudulent activity.
Fraudsters often post fictitious or concealing journal entries outside normal business hours to avoid detection. Flagging after-hours journal entries is a common automated control targeting this risk. Answer D is correct. Duplicate vendor payments (A) occur during business hours in normal processing. Ghost employees (B) are payroll-level anomalies. Inventory theft (C) is a physical control matter.
- A company's internal auditor runs a Benford's Law analysis on expense reimbursement data. The analysis reveals that the digit '5' appears as the leading digit far more frequently than expected. This finding most likely suggests:
Answer: Employees may be fabricating or manipulating expense amounts, potentially clustering just below a review threshold.
Benford's Law predicts the natural frequency of leading digits in large numeric datasets. A spike in '5' as the leading digit often signals amounts clustered just below a common approval threshold (e.g., $500 or $5,000), a red flag for fraud. Answer B is correct. Accurate data (A) would conform to expected Benford's distribution. Date errors (C) would not create a leading-digit pattern in amounts. Rounding (D) affects trailing digits, not leading digits systematically.
