- A company's fixed asset system requires that the useful life entered for a new asset falls between 1 and 50 years. Entry of 0 years or 51+ years is rejected. This is an example of:
Answer: A range check input control enforcing reasonable boundaries for useful life values.
Enforcing minimum and maximum acceptable values for a field is a range check - one of the fundamental input validation types. Answer A is correct. Validity checks reference a list (B). Completeness checks prevent blanks (C). The control occurs at entry, not during processing (D).
- Which of the following represents an effective set of controls covering all three categories - input, processing, and output - for a billing system?
Answer: Input: validating customer IDs and amounts at entry; Processing: run-to-run control totals verifying all invoices are processed; Output: reconciling billed amounts to the accounts receivable ledger.
A complete application control suite covers all three layers: input validation catches data errors at entry; processing controls verify completeness during the run; output reconciliation confirms the results are accurately reflected downstream. Answer B is correct. Encryption (A) and access controls (C) are IT general controls. Report distribution (D) is only one output control.
- After processing a large batch of vendor payments, the accounts payable system generates an exception report listing payments that could not be matched to approved purchase orders. The accounts payable manager reviews this report. This is an example of:
Answer: An output control that provides a detective check over payment processing completeness and authorization.
An exception report generated after processing for management review is a detective output control - it identifies issues that occurred during processing rather than preventing them. Answer B is correct. A preventive control would have stopped unmatched payments (A). Input controls operate at entry (C). Access controls restrict users (D).
- Application controls over data input are designed primarily to:
Answer: Ensure that data entered into a system is accurate, complete, and authorized before it is processed.
Input controls are the first line of application control - validating data at the point of entry to prevent inaccurate, incomplete, or unauthorized data from entering the system. Answer A is correct. Encryption (B) is a security control. Authentication (C) is an access control. Report generation (D) is an output function.
- A payroll system generates pay stubs for 500 employees. The system also generates a control report showing total gross pay, total deductions, and total net pay for the batch. Management reconciles this control report to the general ledger payroll entries. This reconciliation is an example of:
Answer: An output control reconciling system-generated totals to the general ledger to verify completeness and accuracy of the payroll processing.
Reconciling the system's output control report to the GL after processing is an output control - using the system's own totals as evidence of complete, accurate processing. Answer C is correct. Payroll entry validation (A) is input. Calculation verification (B) is processing. Access restrictions (D) are separate.
- Which of the following best describes a 'completeness check' as an input control?
Answer: A check that verifies all required fields in a record are populated before the record can be saved.
A completeness check ensures no mandatory fields are left blank - preventing records with missing critical data from entering the system. Answer D is correct. Range checks (A), validity checks (B), and format checks (C) address different data quality dimensions.
- An auditor is testing application controls over a revenue recognition system. Which of the following procedures would provide evidence about the effectiveness of input controls?
Answer: Attempting to enter transactions with invalid customer IDs, missing required fields, or out-of-range amounts, and verifying that the system rejects or flags them.
Testing input controls requires attempting to enter invalid data and confirming the system properly rejects or flags the exceptions - directly evaluating whether validation rules operate as designed. Answer A is correct. Access logs (B) test access controls. Reconciliation (C) tests output controls. DR plans (D) are not application control tests.
- An organization's order management system accepts order quantities up to 9,999 units without any alert. A data entry error results in 99,999 units being entered for a single order. Which input control failure does this represent?
Answer: Limit or range check failure - the system should have rejected or flagged quantities exceeding a reasonable maximum.
A quantity of 99,999 units should have been flagged or rejected by a limit check - a control that rejects entries exceeding defined maximum values. Answer B is correct. The field was populated (A). Quantity values don't reference a list (C). The format appears correct - the issue is the value, not the structure (D).
- Which of the following application controls is specifically designed to prevent a transaction from being entered and processed more than once?
Answer: A duplicate transaction check that compares new entries to previously processed transactions on key fields such as vendor, invoice number, amount, and date.
Duplicate transaction detection specifically compares new transactions to historical records on key identifying fields, preventing the same transaction from being processed more than once. Answer D is correct. Range checks (A) and completeness checks (B) validate data characteristics. Output reconciliation (C) detects discrepancies after processing.
- A critical financial application calculates loan interest payments. An auditor wants to verify that the interest calculation logic is correct. Which audit procedure is most appropriate?
Answer: Re-performing a sample of interest calculations manually using known inputs and comparing the results to system outputs to verify calculation accuracy.
Re-performing calculations with known inputs and comparing to system outputs directly tests whether the application's processing logic produces accurate results - the most direct test of processing control effectiveness. Answer B is correct. Access lists (A) test access controls. Backup logs (C) test recovery controls. Initial testing documentation (D) is historical evidence, not a current control test.
- An accounts payable system automatically matches vendor invoices to purchase orders and goods receipts before allowing payment processing. This three-way match is best classified as:
Answer: A processing control that validates transactions against multiple authorization records before allowing them to proceed.
The three-way match occurs during the payment processing stage - verifying the transaction against source documents (PO and receipt) before allowing processing to continue. It is a processing control. Answer C is correct. Output controls (A) operate after processing. Access controls (B) restrict users. Input controls (D) validate at entry.
- An organization's financial reporting process generates a management report containing prior period comparisons. Which output control would help ensure the comparative figures are accurate?
Answer: Reconciling the prior period figures in the report to the prior period's audited financial statements or general ledger balances.
Reconciling comparative period figures to audited or agreed-upon prior period balances is the most effective control for verifying accuracy of prior period output data. Answer C is correct. Secure paper (A) and date stamps (D) are physical controls with limited value. Access restriction (B) is an authorization control.
- An organization generates financial statements from an automated reporting system. Which of the following output controls would best ensure the statements are complete and include all required disclosures?
Answer: A checklist or automated template that validates the financial statement package against required components (all statements, notes, supplementary schedules) before distribution.
A completeness checklist or automated validation against required components ensures all required elements of the financial statement package are present before distribution - directly addressing output completeness. Answer A is correct. Encryption (B) and letterhead (C) are presentation/security concerns. Archiving (D) addresses retention, not completeness.
- Which of the following is an example of a processing control?
Answer: A batch control total that compares the sum of transaction amounts before and after processing to verify completeness.
A batch control total that reconciles pre- and post-processing totals is a processing control - it verifies that all transactions were processed correctly and completely. Answer B is correct. Field validation (A) is an input control. Management reports (C) are output controls. Identity confirmation (D) is an access control.
- An ERP system automatically prevents a sales order from being saved if the customer's credit limit would be exceeded. This control is best characterized as:
Answer: An input control that validates the transaction against the customer's credit limit at the time of data entry.
The credit limit check occurs at order entry - preventing the user from saving the order (input) if it exceeds the credit limit. This is an input validation control applied at the point of data entry. Answer D is correct. It occurs at entry, not fulfillment processing (A), report generation (B), or user authorization (C).
- During a batch processing run, the system processes 980 of 1,000 transactions and terminates due to an error. The remaining 20 transactions are not processed. Which processing control would most directly detect this incomplete processing?
Answer: A run-to-run control total that compares the number of records and total amounts processed against expected totals established before the run.
Run-to-run control totals compare expected counts and amounts to actual processed results, directly detecting incomplete processing - the 20 missing transactions would cause a discrepancy. Answer C is correct. Encryption (A) addresses confidentiality. Access controls (B) address authorization. Format checks (D) validate data structure, not completeness of processing.
- A company's general ledger system requires that all journal entries balance (debits equal credits) before they can be saved. This is an example of:
Answer: An input control that enforces the fundamental accounting equation at the point of data entry.
Requiring balanced debits and credits before saving is an input validation - it enforces a fundamental accounting rule at the moment of data entry, preventing unbalanced entries from ever being recorded. Answer C is correct. This occurs at entry, not during post-entry processing (A) or reporting (B). It's a data rule, not an authorization control (D).
- A financial reporting system automatically locks the accounting period at month-end, preventing any further journal entries from being posted to the closed period. This is an example of which type of application control?
Answer: Processing control - enforcing period-end cutoff by preventing transactions from being processed to a closed accounting period.
Period locking is a processing control that enforces accounting cutoff - ensuring no transactions are processed to periods that have already been closed. Answer B is correct. Date format validation (A) is an input control. Report filtering (C) is an output function. User restrictions (D) are access controls.
- Which of the following best describes the purpose of 'edit checks' in application input controls?
Answer: To automatically validate data at the point of entry using rules such as format, range, completeness, and validity checks - rejecting or flagging entries that fail validation.
Edit checks are automated input validation rules that enforce data quality standards at entry time, preventing invalid data from entering the system. Answer D is correct. Encryption (A), reporting (B), and access restriction (C) are separate control types.
- Which of the following output controls ensures that system-generated reports reach only intended, authorized recipients?
Answer: Implementing distribution controls that restrict report delivery to authorized users and require logging of report access.
Output controls over distribution ensure reports are delivered to and accessed only by authorized individuals - preventing sensitive financial or operational data from reaching unauthorized parties. Answer D is correct. Range checks (A) are input controls. Secondary approval (B) is an authorization control. Encrypting during processing (C) is a security control, not an output distribution control.
