- An auditor is evaluating a macro-enabled Excel workbook that performs complex actuarial calculations for insurance reserve estimates. The auditor should be particularly concerned about which risk specific to macro-enabled spreadsheets?
Answer: Macros may contain logic errors or unauthorized code that manipulates data in ways that are not transparent to users reviewing the spreadsheet output.
Macros introduce embedded code that is invisible in the spreadsheet interface - potentially containing errors or unauthorized logic that produces incorrect outputs without any visible indication. Answer C is correct. Storage size (A) is not a material concern. Macros can be reviewed by auditors with appropriate skills (B). Financial reporting standards do not prohibit macros (D).
- Which of the following best describes the purpose of documenting EUC tool logic, assumptions, and data sources?
Answer: To enable independent verification, facilitate handover if the developer leaves, support ongoing maintenance, and provide evidence for audit purposes.
Documentation serves multiple critical purposes: enabling independent review, preserving institutional knowledge, supporting continuity when personnel change, facilitating updates, and providing audit evidence. Answer B is correct. Document management compliance (A), IT rebuilding (C), and performance reviews (D) are not the primary purposes.
- An auditor reviewing EUC controls finds that a spreadsheet used to calculate executive compensation has embedded formulas that reference cells containing hardcoded override values. These override values are not visible without inspecting individual cells. The primary concern is:
Answer: Hidden hardcoded values could be manipulated to alter compensation calculations without being visible in standard spreadsheet review, creating a fraud risk.
Hidden hardcoded values in critical calculation cells are a significant fraud and error risk - they could be manipulated to alter outcomes without any visible change in the spreadsheet's surface presentation. Answer C is correct. Complexity (A) and performance (B) are secondary. Reporting format (D) is a presentation issue.
- An organization implements a requirement that all critical EUC spreadsheets display a header confirming the version number, last modified date, and the name of the person who last modified them. The primary purpose of this control is to:
Answer: Provide basic version identification that helps users confirm they are working with the correct, current version and supports auditability of changes.
Version headers help users identify the correct version, detect unauthorized changes through modification date/author tracking, and create a basic audit trail for EUC tools. Answer C is correct. IT tracking (A) and document management (B) are not the primary purpose. Version headers do not technically prevent modification (D).
- Which of the following represents a key difference between controls over EUC tools and controls over enterprise IT systems?
Answer: Enterprise systems typically have formal IT general controls (change management, access controls, testing) enforced by IT governance; EUC tools often lack these controls and rely on user discipline.
The critical distinction is the IT governance framework: enterprise systems are subject to formal ITGCs, while EUC tools operate outside this framework, creating the primary EUC control risk. Answer C is correct. Testing frequency (A) and regulatory requirements (B) favor enterprise systems, not EUC tools. Transaction volume (D) typically favors enterprise systems.
- An organization uses a complex Excel spreadsheet developed by the CFO to calculate quarterly bonus accruals. This spreadsheet is used to record journal entries totaling $2 million per quarter. The primary risk associated with this EUC tool is:
Answer: Formula errors, manual data entry mistakes, or unauthorized modifications may go undetected, producing materially incorrect accrual amounts recorded in the financial statements.
An uncontrolled EUC spreadsheet calculating significant financial amounts is a high risk for errors and unauthorized changes that could directly result in materially misstated financial statements. Answer A is correct. File size (B), version compatibility (C), and access (D) are minor operational concerns compared to financial accuracy risk.
- When evaluating EUC controls for Sarbanes-Oxley (SOX) compliance, management and auditors should focus on EUC tools that:
Answer: Directly support or feed into financial reporting processes relevant to internal control over financial reporting (ICFR).
SOX ICFR focuses on controls over financial reporting. EUC tools in scope are those that directly affect financial statement preparation or support key financial reporting controls. Answer D is correct. Age (A), user count (B), and operating system support (C) are not the SOX scoping criteria.
- When auditing EUC tools used in financial reporting, an auditor should consider which of the following factors to assess the risk level?
Answer: The financial significance of the data processed, complexity of the tool, frequency of use, number of users, and adequacy of controls over the tool.
EUC risk assessment considers financial impact (significance), complexity (error probability), usage patterns, user base (access), and control quality. Answer B is correct. Computer age (A), developer credentials (C), and software brand (D) are not primary risk factors.
- Which of the following EUC controls most directly addresses the risk of unauthorized modification of a critical financial spreadsheet?
Answer: Protecting the spreadsheet with password-based file protection and locking formula cells, with access restricted to authorized users only.
Preventing unauthorized modification requires technical controls - cell and file protection, restricted access - that physically prevent unauthorized changes rather than relying on labels or periodic reviews. Answer D is correct. Monthly review (A) detects, not prevents. Labels (B) are ineffective technical controls. Print backups (C) support recovery but do not prevent modification.
- An organization's EUC policy requires that all high-risk spreadsheets undergo an annual independent review. During an audit, the auditor finds that the last review of the critical payroll accrual spreadsheet was performed three years ago and a new, more complex formula was added two years ago without review. The auditor should:
Answer: Flag this as a control deficiency - the EUC policy was not followed, and the unreviewed formula change creates an unmitigated risk of payroll accrual errors.
A missed mandatory review plus an unreviewed significant change creates a clear control deficiency - the EUC policy was not followed and the risk is unmitigated. Answer A is correct. A three-year-old review (B) does not satisfy an annual requirement. Preparer qualifications (C) do not substitute for independent review. The auditor should document the finding with evidence (D).
- A company's month-end close process relies on a spreadsheet to aggregate data from five different systems and calculate consolidated revenue. The spreadsheet has no input validation, no formula documentation, and is updated by multiple users with no access restrictions. Which of the following correctly characterizes the control environment for this EUC tool?
Answer: High risk - multiple uncontrolled factors (no validation, no documentation, unrestricted multi-user access) create significant potential for undetected errors or unauthorized changes in a material process.
Multiple simultaneous control weaknesses in a material revenue process represents high risk - no input controls, no audit trail, no access control, and no documentation compound to create serious financial reporting exposure. Answer D is correct. Regular use without known errors does not confirm control adequacy (A, B, C).
- A business user modifies a critical revenue calculation spreadsheet without documenting the change or notifying the finance team. This scenario illustrates which EUC control weakness?
Answer: Absence of version control and change management for EUC tools - unauthorized or undocumented changes can introduce errors without detection.
Undocumented, unauthorized changes to critical EUC tools is a version control and change management failure - a fundamental EUC control risk. Answer A is correct. Encryption (B), IT access (C), and prior audits (D) are not the primary issues here.
- Which of the following scenarios represents the highest risk EUC situation from a financial reporting perspective?
Answer: A complex macro-enabled workbook used to calculate revenue recognition timing for the entire company, with no documentation, no version control, and used exclusively by one employee.
A complex, undocumented, uncontrolled tool that single-handedly calculates enterprise revenue recognition for financial reporting - with a single point of failure and no controls - represents maximum EUC risk. Answer C is correct. Non-financial tools (A, B) and collection templates (D) have significantly lower financial reporting risk.
- During an audit of EUC controls, the auditor requests the current version of a key financial calculation spreadsheet. The finance team provides four different versions with different names and modification dates, and cannot confirm which is the authoritative version. This situation represents:
Answer: A significant EUC control deficiency - without version control and a single authoritative source, there is a risk that the wrong version is used in financial reporting.
Multiple conflicting versions with no clear authoritative source is a serious EUC risk - the wrong version could be used to generate financial data, producing errors in the financial statements. Answer C is correct. This is not minor (A), not acceptable (B), and is a process control failure, not primarily an IT infrastructure issue (D).
- Which of the following best describes an effective EUC governance framework?
Answer: Inventorying EUC tools, classifying them by risk, applying proportionate controls, and periodically reviewing their adequacy.
Effective EUC governance takes a risk-based approach - identifying tools, assessing their risk, applying appropriate controls, and monitoring on an ongoing basis. Answer B is correct. Blanket prohibition (A) and mandatory migration (C) are impractical. Arbitrary thresholds (D) ignore lower-value tools that may still be material.
- An auditor testing a key EUC spreadsheet used to calculate depreciation expense requests evidence of testing and validation of the spreadsheet's formulas. The business user responds that 'it has worked correctly for years.' The auditor should:
Answer: Perform independent testing of the spreadsheet formulas and recalculate a sample of depreciation amounts to verify accuracy, documenting the results as audit evidence.
User representations of accuracy are insufficient audit evidence for a key EUC tool. The auditor must independently verify formula logic and recalculate outputs. Answer A is correct. Relying on years of use (B) is not appropriate audit evidence. IT departments do not certify business-user spreadsheets (C). Depreciation may be material (D).
- A company's internal audit team identifies 47 spreadsheets used in the financial close process. To prioritize audit resources, which criteria should drive the risk assessment of these tools?
Answer: The financial impact of the data processed, complexity of formulas, number of users, frequency of changes, and existing controls over each tool.
Risk assessment should be based on factors that determine potential impact and likelihood of error: financial materiality, formula complexity, access breadth, change frequency, and current control strength. Answer B is correct. File characteristics (A, D) and user seniority (C) are not meaningful risk indicators.
- Which of the following is the most effective control for ensuring the accuracy of formulas in a critical financial spreadsheet used as an EUC tool?
Answer: Performing an independent review of all formulas and logic by a second qualified person, documenting the review, and re-performing key calculations to verify accuracy.
Independent formula review and recalculation by a second qualified person is the most direct control for detecting spreadsheet errors - verifying the underlying logic rather than just the outputs. Answer D is correct. Shared access (A) increases risk. Print copies (B) do not verify formula accuracy. CFO sign-off (C) reviews output but may not detect embedded formula errors.
- End-user computing (EUC) tools present unique control risks primarily because:
Answer: They are typically developed and maintained by non-IT business users outside formal IT governance, increasing the risk of errors, unauthorized changes, and lack of documentation.
EUC tools (spreadsheets, Access databases, desktop applications) are created and managed by business users who may lack formal development training and often bypass IT change management, access controls, and documentation standards. Answer B is correct. EUC tools are typically inexpensive (A), require no specialized IT staff to operate (C), and can connect to enterprise data sources (D).
- An organization's EUC policy requires that all spreadsheets used in financial reporting be inventoried and assessed for risk. The primary purpose of this inventory is to:
Answer: Identify which EUC tools are material to financial reporting so that appropriate controls can be designed and applied proportionate to their risk.
An EUC inventory enables risk-based control decisions - high-risk tools (large financial impact, complex logic) receive stronger controls than low-risk tools. Answer C is correct. Encryption (A) and storage (D) are secondary concerns. Migration (B) may be a long-term goal but is not the purpose of the inventory.
