- An auditor is evaluating ITGCs for a company subject to SOX Section 404. The auditor selects a sample of user account provisioning and termination events. For each sampled event, the auditor verifies that access was granted only to appropriate roles and terminated promptly. This procedure tests which ITGC?
Answer: Logical access controls - specifically the provisioning and deprovisioning process for user accounts.
Testing the provisioning and deprovisioning of user accounts is directly testing logical access controls - the ITGC category governing who has access to systems and how access rights are managed. Answer A is correct. Account management is access control (A), not change management (B), operations (C), or development (D).
- An ITGC assessment reveals that privileged access to the financial reporting database is not logged or monitored. The most significant risk is:
Answer: Unauthorized data modifications by privileged users would go undetected, creating a risk of unnoticed manipulation of financial data.
Without logging and monitoring of privileged access, any unauthorized data modifications - even by administrators - would be invisible. This is a critical detective control gap for financial data. Answer C is correct. Legitimate tasks (A) are expected. Performance (B) and storage (D) are operational concerns unrelated to control effectiveness.
- An organization's new cloud ERP system automatically logs all user activities, access attempts, and configuration changes. How should the auditor evaluate these automated logs as part of the ITGC assessment?
Answer: Evaluate whether the logs are comprehensive, tamper-proof, retained for an appropriate period, and reviewed by management on a regular basis with follow-up on exceptions.
Logs are only valuable as controls if they are complete, protected from alteration, retained long enough to support investigation, and actually reviewed with follow-up - simply having logs does not confirm effective ITGC monitoring. Answer D is correct. Logs alone are not sufficient evidence (A). Cloud logs are still the organization's responsibility (B). Logs support multiple ITGC assessments beyond just access levels (C).
- During an ITGC assessment, an auditor finds that the organization's production database has 47 active user accounts belonging to former employees. The most appropriate audit finding is:
Answer: A logical access control deficiency - terminated employee accounts were not promptly deactivated, creating risk of unauthorized access by former employees.
Active accounts for terminated employees is a logical access control deficiency - the offboarding process failed to revoke access, creating unauthorized access risk. Answer D is correct. This is not an operations (A), development (B), or change control (C) issue.
- An auditor determines that an organization's program change controls are ineffective - developers can directly modify production code without authorization. What is the most significant implication for the financial statement audit?
Answer: Automated application controls in the affected systems cannot be relied upon, requiring the auditor to perform additional substantive procedures.
Ineffective change controls mean automated controls could have been altered without authorization - the auditor cannot rely on them and must compensate with increased substantive testing. Answer C is correct. Input control testing (A) does not fully compensate. Prior year restatement (B) is not automatic. An adverse opinion (D) is not required solely due to ITGC weaknesses.
- An organization relies on a single IT administrator who has full administrative rights to all production systems, performs all deployments, manages user access, and responds to all incidents. From an ITGC perspective, the primary concern is:
Answer: A complete lack of segregation of duties - one person controls all aspects of the IT environment, creating unlimited opportunity for unauthorized changes or fraud without detection.
One person controlling all IT functions - access, changes, deployments, and operations - eliminates all segregation of duties and any possibility of independent check, representing a critical ITGC deficiency. Answer A is correct. Technical skills (B), best practices (C), and workload (D) are secondary concerns.
- A SOC 1 Type II report is most relevant for evaluating ITGCs at:
Answer: A third-party service provider that processes transactions on behalf of the organization, such as a payroll processor or cloud ERP provider.
SOC 1 Type II reports provide independent assurance over the controls at a service organization that may affect the user entity's financial reporting - primarily relevant for third-party processors and cloud providers. Answer D is correct. Internal teams (A, C) are assessed through direct ITGC testing. Standard-setters (B) are regulatory bodies, not service organizations.
- A financial services company implements a quarterly user access review requiring managers to certify that their team members' system access rights remain appropriate. This is an example of which ITGC category?
Answer: Logical access controls
User access reviews and recertifications are logical access controls - they ensure that access rights remain appropriate and aligned with current job responsibilities. Answer B is correct. Program development (A) governs new system creation. Computer operations (C) governs system operation. Change controls (D) govern system modifications.
- Which of the following is an example of a computer operations control?
Answer: Monitoring job scheduling to ensure batch processes run at their scheduled times and investigating failures promptly.
Computer operations controls govern the day-to-day operation of IT systems - job scheduling, batch monitoring, operations logs, and incident response. Answer D is correct. Deployment approval (A) is a change control. Database access restriction (B) is a logical access control. Design review (C) is a program development control.
- An auditor finds that an organization's ITGC framework is comprehensive but has not been updated in four years. Significant technology changes have occurred, including migration to cloud infrastructure and adoption of new ERP modules. The primary risk is:
Answer: The existing ITGC framework may not address risks introduced by new technologies, creating unmitigated control gaps.
ITGCs must evolve with technology - a cloud migration and new ERP introduce new access paths, change mechanisms, and operational risks that the old framework may not address. Answer B is correct. Auditor impressions (A), employee familiarity (C), and maturity ratings (D) are secondary concerns.
- Which of the following most accurately describes the scope of ITGCs relevant to a financial statement audit?
Answer: IT systems and controls that support the processing, storage, or transmission of financial data, or that support automated application controls relied upon in the audit.
ITGC scope for financial auditing is risk-based - focused on systems that touch financial data or support relied-upon application controls. Non-financial systems are generally out of scope. Answer B is correct. All IT systems (A, D) is too broad. Only the GL system (C) may be too narrow if other systems feed financial processes.
- Computer operations controls include which of the following activities?
Answer: Monitoring scheduled batch jobs, investigating job failures, managing system capacity, and maintaining operations logs.
Computer operations controls govern the day-to-day running of IT infrastructure - batch scheduling, job monitoring, capacity management, and operational logging. Answer C is correct. Code review (A) is development. Access approvals (B) are logical access. Change approvals (D) are change management.
- When evaluating the design of ITGCs, an auditor finds that the organization has no formal segregation of duties between developers and production system administrators. The most significant risk is:
Answer: Developers could make unauthorized changes directly to production systems without detection, undermining both change management and automated application controls.
Without segregation between development and production, developers can implement unauthorized code directly in production - a fundamental ITGC control failure that compromises all downstream application controls. Answer C is correct. Technical skills (A), business requirements (B), and best practice compliance (D) are secondary concerns compared to the unauthorized change risk.
- Which of the following correctly identifies the four primary categories of IT general controls?
Answer: Logical access controls, program change controls, computer operations controls, and program development controls.
The four standard ITGC categories are: (1) logical access controls (who can access what), (2) program change controls (how changes are authorized and implemented), (3) computer operations controls (how systems are operated and monitored), and (4) program development controls (how new systems are developed). Answer A is correct. Answer B describes application controls. Answers C and D are not standard ITGC categories.
- Which of the following represents a program development control?
Answer: Documenting system design specifications, conducting code reviews, and requiring user acceptance testing before any new application goes live.
Program development controls govern the lifecycle of new system development - design documentation, code reviews, and UAT ensure new systems are built correctly and work as intended before production deployment. Answer B is correct. Deployment approvals (A) are change controls. Batch monitoring (C) is operations. Access approval (D) is logical access.
- A company implements a change management control requiring that all production deployments be performed by a dedicated release management team, separate from the development team. This control addresses which ITGC risk?
Answer: The risk that developers introduce unauthorized or untested code directly into production systems.
Separating development from production deployment enforces segregation of duties, preventing developers from unilaterally deploying their own code - the primary change management ITGC risk. Answer A is correct. Release team errors (B), ticket generation (C), and change request volume (D) are secondary concerns.
- An auditor evaluating ITGCs tests a sample of password configuration settings across financial systems. The auditor finds that three systems do not enforce the minimum password length policy. This is a finding in which ITGC category?
Answer: Logical access controls
Password configuration settings govern how users authenticate - enforcing password policies is a logical access control requirement that ensures authentication standards are maintained. Answer D is correct. Password settings are not development (A), operations (B), or change (C) controls.
- When evaluating ITGCs for a cloud-hosted financial system, which of the following additional considerations is unique to the cloud environment?
Answer: Whether the cloud provider's own ITGCs are adequate, typically assessed through a SOC 1 Type II report covering the provider's relevant controls.
Cloud environments introduce a shared responsibility model - the organization must assess whether the cloud provider's ITGCs (infrastructure access, change management, operations) are effective, typically through a SOC 1 Type II report. Answer C is correct. IT steering committees (A) and DR plans (B) apply to all environments. Application control design (D) is not cloud-specific.
- Which of the following audit procedures provides the strongest evidence that program change controls operated effectively throughout the audit period?
Answer: Selecting a sample of production changes deployed throughout the year and verifying each has an approved change request, testing evidence, and was deployed by someone other than the developer.
Testing a sample of actual changes against control requirements throughout the year provides direct evidence of consistent operating effectiveness. Answer A is correct. Policy review (B) and interviews (C) address design. Ticket generation (D) confirms process initiation but not control execution.
- Which of the following best describes how ITGC testing findings affect the financial statement audit?
Answer: ITGC deficiencies may cause the auditor to assess IT-dependent controls as unreliable, requiring more extensive substantive testing to obtain sufficient audit evidence.
ITGC deficiencies cascade into the reliance assessment for automated controls - if the IT environment cannot be trusted, the auditor must compensate with more substantive procedures to obtain assurance. Answer A is correct. Qualified opinions (B) are not automatic from ITGC deficiencies. Restatements (C) require actual financial misstatements. Management representations (D) do not resolve ITGC deficiencies.
