- An automated three-way match control in accounts payable is best classified as:
Answer: A preventive control that stops payment of invoices not matched to an approved PO and goods receipt.
Three-way match prevents payment unless a matching PO and receipt exist - stopping unauthorized payments before they occur. Answer D is correct. It prevents rather than detects (A), does not reverse payments (B), and is a primary control (C).
- An auditor evaluates RBAC controls and finds that role definitions have not been updated in five years despite significant organizational changes. This represents:
Answer: A design and implementation gap - outdated roles may grant inappropriate access.
RBAC is only effective when role definitions match current job functions. Outdated roles create inappropriate access. Answer C is correct. Controls require ongoing maintenance (A, B, D).
- A bot posts entries using a human user's credentials. Best control design?
Answer: Assign bot a service account
A bot posting with a human account ties its actions to that person and bypasses the controls on that human account. A service account gives the bot its own identity, so you can grant least privilege, monitor it, and revoke it independently. Giving the bot limited system access is the tempting wrong answer because it still leaves the bot using the human credentials.
- A payroll manager who enters payroll data and processes the payroll run also reviews and approves the payroll register. This represents:
Answer: A segregation of duties deficiency - the same person who prepares payroll should not also approve it.
Having the same person prepare and approve payroll eliminates the independent check that approval provides. Answer C is correct. Knowledge (A) and efficiency (B) do not justify the gap. Small organization constraints require compensating controls, not acceptance (D).
- An IT audit identifies that a critical financial system has no user acceptance testing (UAT) before changes are deployed to production. This is a gap in which stage?
Answer: Quality assurance in the implementation phase - without UAT, changes may introduce defects affecting financial data accuracy.
UAT is a quality assurance control in the implementation process. Its absence means defects could reach production. Answer D is correct. Authorization (A), monitoring (B), and risk assessment (C) are distinct control activities.
- Which best illustrates a control that is well-designed but poorly implemented?
Answer: A control requiring manager approval for expenses over $1,000 that is documented and trained, but managers routinely approve requests without reviewing supporting documentation.
A well-designed control (clear threshold, appropriate responsibility) not followed in practice (approvals without review) illustrates operating effectiveness failure with adequate design. Answer B is correct. Undocumented controls (A) have design gaps. Consistently followed (C) is effective. No threshold (D) is a design gap.
- Which of the following best describes the difference between a preventive control and a detective control?
Answer: Preventive controls stop errors or fraud before they occur; detective controls identify them after they have occurred.
The key distinction is timing: preventive controls stop undesired events; detective controls identify them after the fact. Answer C is correct. Answers A, B, and D mischaracterize the distinction.
- A new rule blocks terminated employee logins. Which evidence best confirms implementation?
Answer: Direct test confirms block
The strongest evidence that a control is truly implemented is a direct test proving the terminated login is blocked. Configuration may show the rule exists, but it doesn't prove enforcement in practice. A direct test verifies the actual outcome, so it best confirms implementation.
- A reconciliation control is performed daily but variances are routinely noted and ignored without investigation. This indicates:
Answer: A design or implementation gap - without variance investigation, the reconciliation does not achieve its objective.
A reconciliation that identifies variances but never resolves them fails its objective. Answer D is correct. Uninvestigated variances mean the control is ineffective (A, B, C).
- A company's internal audit team evaluates whether controls over a new cloud-based financial system are adequate. Which of the following should the auditors assess as part of the design evaluation?
Answer: Whether the system's built-in controls (e.g., automated approvals, access restrictions, audit logs) are appropriately configured to address the organization's specific financial reporting risks.
Control design evaluation for a cloud-based system requires assessing whether the system's configurable controls are set up to address the organization's specific risks - authorization settings, access restrictions, logging configurations. Answer B is correct. Vendor longevity (A), training (C), and project delivery (D) do not assess control design adequacy.
- When assessing whether a control is appropriately designed for a high-risk process, which factor is most important?
Answer: The control directly addresses the specific risk, operates at the right point in the process, and is proportionate to risk significance.
Effective control design requires direct risk linkage, appropriate process positioning, and proportionate response. Answer C is correct. Timing (A), preparer experience (B), and auditor recommendation (D) do not determine design adequacy.
- An automated match approves invoices within a 5% tolerance. Which design is deficient?
Answer: Overrides need no approval
An override bypasses the 5% tolerance, so letting it pass without approval defeats the control; overrides should require separate authorization. Approval based on tolerance is the rule itself, not deficient, and consistent application plus logging support it. The deficient design is the unapproved override.
- Which of the following represents the strongest evidence that controls over financial reporting are well-designed?
Answer: Controls are mapped to specific risks, cover all significant risks, operate at appropriate process points, and include both preventive and detective elements.
Well-designed controls are risk-based, comprehensive, well-positioned, and layered. Answer A is correct. Documentation (B), quantity (C), and designer (D) do not demonstrate design adequacy.
- Compared to a manual approval control for purchase orders, an automated control that rejects POs with invalid vendor IDs is:
Answer: More reliable and consistent - automation applies the rule every time without human error or override.
Automated controls apply rules consistently to every transaction, eliminating human inconsistency. Answer B is correct. Automation is generally more consistent than humans for repetitive rules (A, C). Daily monitoring is not always required (D).
- A system control automatically alerts when an employee's expense report exceeds the company's per diem rate. This is best characterized as:
Answer: A detective control that identifies potentially non-compliant reports for review after submission.
Generating an alert after submission for management review is detective - it identifies exceptions after the fact. Answer B is correct. It does not block submission (A), adjust amounts (C), or instruct employees (D).
- 'Control rationalization' in control design refers to:
Answer: Evaluating and streamlining the control portfolio to ensure each control addresses a specific risk, removing redundant or ineffective controls while maintaining adequate coverage.
Control rationalization improves efficiency by ensuring every control serves a clear purpose. Answer D is correct. Eliminating untested controls (A), external approval of all designs (B), and zero residual risk (C) are all incorrect.
- Which approach most effectively evaluates overall design adequacy of an organization's internal control framework?
Answer: Mapping identified risks to controls, identifying coverage gaps, and assessing whether each control is properly designed to address its target risk.
A risk-control mapping exercise reveals whether all significant risks are covered and whether each control is designed to address its target risk. Answer D is correct. Documentation (A), approval (B), and counts (C) provide administrative evidence but not design adequacy.
- Which of the following best describes a 'compensating control'?
Answer: A control that mitigates a risk when the ideal primary control cannot be implemented, providing an alternative means of achieving the same objective.
Compensating controls provide alternative risk mitigation when the preferred control is not feasible. Answer B is correct. Automatic correction (A) is corrective. Employee compensation (C) and year-end catch-up (D) are unrelated.
- An auditor finds a control requiring manager review of a 500-page monthly report to identify exceptions. The most significant design concern is:
Answer: A 500-page manual review is impractical and unlikely to reliably identify exceptions.
A control that is theoretically sound but practically unperformable due to volume is a design weakness - reliability of detection is low. Answer B is correct. Format (A), frequency (C), and evaluator (D) are secondary issues.
- Which principle helps ensure controls remain relevant as the organization and its risks evolve?
Answer: Controls should be periodically reviewed and updated to address current risks, technologies, and business processes.
The control environment must evolve with the organization. Answer A is correct. Permanent unchanging controls (B) become outdated. Predicting all future risks (C) is not feasible. Outsourcing (D) does not ensure relevance.
