CPA Isc Quiz: Evaluate End User Computing Controls

What this quiz covers

This quiz focuses on Evaluate End User Computing Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. They are more expensive to maintain than enterprise systems.
2. They are typically developed and maintained by non-IT business users outside formal IT governance, increasing the risk of errors, unauthorized changes, and lack of documentation. (correct answer)
3. They require specialized IT staff to operate and are difficult to access.
4. They cannot be connected to enterprise databases and therefore contain only test data.

Explanation: EUC tools (spreadsheets, Access databases, desktop applications) are created and managed by business users who may lack formal development training and often bypass IT change management, access controls, and documentation standards. Answer B is correct. EUC tools are typically inexpensive (A), require no specialized IT staff to operate (C), and can connect to enterprise data sources (D).

Question 2

1. Storing the spreadsheet on a shared network drive accessible to all finance staff.
2. Printing a hard copy of the spreadsheet output each period for the files.
3. Requiring the CFO to sign off on the spreadsheet output monthly.
4. Performing an independent review of all formulas and logic by a second qualified person, documenting the review, and re-performing key calculations to verify accuracy. (correct answer)

Explanation: Independent formula review and recalculation by a second qualified person is the most direct control for detecting spreadsheet errors - verifying the underlying logic rather than just the outputs. Answer D is correct. Shared access (A) increases risk. Print copies (B) do not verify formula accuracy. CFO sign-off (C) reviews output but may not detect embedded formula errors.

Question 3

1. Ensure all spreadsheets comply with IT security standards for encryption.
2. Allow the IT department to migrate all spreadsheets to enterprise systems.
3. Identify which EUC tools are material to financial reporting so that appropriate controls can be designed and applied proportionate to their risk. (correct answer)
4. Determine how much storage space spreadsheets consume on company servers.

Explanation: An EUC inventory enables risk-based control decisions - high-risk tools (large financial impact, complex logic) receive stronger controls than low-risk tools. Answer C is correct. Encryption (A) and storage (D) are secondary concerns. Migration (B) may be a long-term goal but is not the purpose of the inventory.

Question 4

1. Absence of version control and change management for EUC tools - unauthorized or undocumented changes can introduce errors without detection. (correct answer)
2. Inadequate encryption of spreadsheet data at rest.
3. Excessive access granted to IT staff for the spreadsheet.
4. Failure of the external auditors to review the spreadsheet during the prior year audit.

Explanation: Undocumented, unauthorized changes to critical EUC tools is a version control and change management failure - a fundamental EUC control risk. Answer A is correct. Encryption (B), IT access (C), and prior audits (D) are not the primary issues here.

Question 5

1. Requiring the spreadsheet to be reviewed by management monthly.
2. Storing the spreadsheet in a folder labeled 'Official - Do Not Modify.'
3. Printing a backup copy of the spreadsheet at each month-end.
4. Protecting the spreadsheet with password-based file protection and locking formula cells, with access restricted to authorized users only. (correct answer)

Explanation: Preventing unauthorized modification requires technical controls - cell and file protection, restricted access - that physically prevent unauthorized changes rather than relying on labels or periodic reviews. Answer D is correct. Monthly review (A) detects, not prevents. Labels (B) are ineffective technical controls. Print backups (C) support recovery but do not prevent modification.

Question 6

1. Prohibiting all EUC tools from being used in financial reporting processes.
2. Inventorying EUC tools, classifying them by risk, applying proportionate controls, and periodically reviewing their adequacy. (correct answer)
3. Requiring all EUC tools to be redeveloped as enterprise IT applications within one year.
4. Limiting EUC governance to tools that process more than $10 million in transactions.

Explanation: Effective EUC governance takes a risk-based approach - identifying tools, assessing their risk, applying appropriate controls, and monitoring on an ongoing basis. Answer B is correct. Blanket prohibition (A) and mandatory migration (C) are impractical. Arbitrary thresholds (D) ignore lower-value tools that may still be material.

Question 7

1. Adequate - the spreadsheet is regularly used and has not produced errors.
2. Adequate - multiple users provides redundant review.
3. Moderate risk - only the lack of documentation is concerning.
4. High risk - multiple uncontrolled factors (no validation, no documentation, unrestricted multi-user access) create significant potential for undetected errors or unauthorized changes in a material process. (correct answer)

Explanation: Multiple simultaneous control weaknesses in a material revenue process represents high risk - no input controls, no audit trail, no access control, and no documentation compound to create serious financial reporting exposure. Answer D is correct. Regular use without known errors does not confirm control adequacy (A, B, C).

Question 8

1. Enterprise systems require more frequent testing than EUC tools.
2. EUC tools are subject to more rigorous regulatory requirements than enterprise systems.
3. Enterprise systems typically have formal IT general controls (change management, access controls, testing) enforced by IT governance; EUC tools often lack these controls and rely on user discipline. (correct answer)
4. EUC tools process more transactions per day than enterprise systems.

Explanation: The critical distinction is the IT governance framework: enterprise systems are subject to formal ITGCs, while EUC tools operate outside this framework, creating the primary EUC control risk. Answer C is correct. Testing frequency (A) and regulatory requirements (B) favor enterprise systems, not EUC tools. Transaction volume (D) typically favors enterprise systems.

Question 9

1. Immediately - all EUC tools should be replaced by enterprise systems regardless of risk or cost.
2. Only when the EUC tool is more than five years old.
3. Only when the external auditors specifically request migration.
4. When the EUC tool's risk profile exceeds what compensating controls can adequately mitigate - particularly for high-volume, high-risk, or complex processes that require robust IT controls. (correct answer)

Explanation: Migration is warranted when the business risk of an EUC tool cannot be adequately controlled through compensating measures - typically when processing volume, complexity, or financial impact makes EUC controls insufficient. Answer D is correct. Blanket migration (A) ignores cost-benefit. Age alone (B) is not the trigger. External auditors do not mandate migration (C).

Question 10

1. The file size and creation date of each spreadsheet.
2. The financial impact of the data processed, complexity of formulas, number of users, frequency of changes, and existing controls over each tool. (correct answer)
3. The seniority of the employees who use each spreadsheet.
4. The number of worksheets contained in each workbook.

Explanation: Risk assessment should be based on factors that determine potential impact and likelihood of error: financial materiality, formula complexity, access breadth, change frequency, and current control strength. Answer B is correct. File characteristics (A, D) and user seniority (C) are not meaningful risk indicators.

Question 11

1. Flag this as a control deficiency - the EUC policy was not followed, and the unreviewed formula change creates an unmitigated risk of payroll accrual errors. (correct answer)
2. Accept the control as adequate since the spreadsheet was reviewed three years ago.
3. Accept the control since the formula addition was made by a qualified accountant.
4. Defer the finding to management for evaluation without further testing.

Explanation: A missed mandatory review plus an unreviewed significant change creates a clear control deficiency - the EUC policy was not followed and the risk is unmitigated. Answer A is correct. A three-year-old review (B) does not satisfy an annual requirement. Preparer qualifications (C) do not substitute for independent review. The auditor should document the finding with evidence (D).

Question 12

1. Password protecting the spreadsheet to prevent unauthorized access.
2. Documenting the spreadsheet formulas in a user guide.
3. Performing an annual review of the spreadsheet's formula logic.
4. Reconciling the input data in the spreadsheet to the source system reports before processing to verify completeness and accuracy of the data feed. (correct answer)

Explanation: Input data reconciliation - comparing what enters the spreadsheet to source system reports - directly detects errors or omissions in the data before it is processed. Answer D is correct. Password protection (A), formula documentation (B), and annual formula review (C) do not address input data accuracy.

Question 13

1. Version control for the script with documented change history, and a formal change approval and testing process before any changes are deployed to production. (correct answer)
2. Encrypting the Python script source code to prevent unauthorized reading.
3. Requiring the analyst to obtain a programming certification before maintaining the script.
4. Migrating the script to a compiled executable that cannot be easily modified.

Explanation: A production script managing financial data without change management has the same risks as any uncontrolled EUC tool - version control and a formal change process ensure changes are authorized and tested. Answer A is correct. Encryption (B) and certifications (C) address different risks. Compiled code (D) makes the script harder to maintain and audit.

Question 14

1. A simple budget tracking spreadsheet maintained by a department manager with no financial statement impact.
2. A spreadsheet used to prepare the annual IT budget with review by the CIO.
3. A complex macro-enabled workbook used to calculate revenue recognition timing for the entire company, with no documentation, no version control, and used exclusively by one employee. (correct answer)
4. A spreadsheet template used to collect expense estimates from 10 department heads.

Explanation: A complex, undocumented, uncontrolled tool that single-handedly calculates enterprise revenue recognition for financial reporting - with a single point of failure and no controls - represents maximum EUC risk. Answer C is correct. Non-financial tools (A, B) and collection templates (D) have significantly lower financial reporting risk.

Question 15

1. Were developed more than three years ago.
2. Are used by more than 10 employees simultaneously.
3. Run on operating systems that are no longer supported.
4. Directly support or feed into financial reporting processes relevant to internal control over financial reporting (ICFR). (correct answer)

Explanation: SOX ICFR focuses on controls over financial reporting. EUC tools in scope are those that directly affect financial statement preparation or support key financial reporting controls. Answer D is correct. Age (A), user count (B), and operating system support (C) are not the SOX scoping criteria.

Question 16

1. Enable the IT department to track spreadsheet usage across the organization.
2. Comply with document management system requirements.
3. Provide basic version identification that helps users confirm they are working with the correct, current version and supports auditability of changes. (correct answer)
4. Prevent unauthorized users from modifying the spreadsheet.

Explanation: Version headers help users identify the correct version, detect unauthorized changes through modification date/author tracking, and create a basic audit trail for EUC tools. Answer C is correct. IT tracking (A) and document management (B) are not the primary purpose. Version headers do not technically prevent modification (D).

Question 17

1. Formula errors, manual data entry mistakes, or unauthorized modifications may go undetected, producing materially incorrect accrual amounts recorded in the financial statements. (correct answer)
2. The spreadsheet may be too large to open on the CFO's computer.
3. The spreadsheet may not be compatible with future versions of Excel.
4. The CFO may not have sufficient access rights to view the underlying data.

Explanation: An uncontrolled EUC spreadsheet calculating significant financial amounts is a high risk for errors and unauthorized changes that could directly result in materially misstated financial statements. Answer A is correct. File size (B), version compatibility (C), and access (D) are minor operational concerns compared to financial accuracy risk.

Question 18

1. Macro-enabled workbooks consume significantly more disk space than standard spreadsheets.
2. Macros cannot be tested by auditors since they are proprietary code.
3. Macros may contain logic errors or unauthorized code that manipulates data in ways that are not transparent to users reviewing the spreadsheet output. (correct answer)
4. Macro-enabled workbooks are prohibited under most financial reporting standards.

Explanation: Macros introduce embedded code that is invisible in the spreadsheet interface - potentially containing errors or unauthorized logic that produces incorrect outputs without any visible indication. Answer C is correct. Storage size (A) is not a material concern. Macros can be reviewed by auditors with appropriate skills (B). Financial reporting standards do not prohibit macros (D).

Question 19

1. Perform independent testing of the spreadsheet formulas and recalculate a sample of depreciation amounts to verify accuracy, documenting the results as audit evidence. (correct answer)
2. Accept the user's representation since the spreadsheet has been in use without identified errors.
3. Request that the IT department certify the spreadsheet as accurate.
4. Accept the spreadsheet since depreciation is an immaterial account.

Explanation: User representations of accuracy are insufficient audit evidence for a key EUC tool. The auditor must independently verify formula logic and recalculate outputs. Answer A is correct. Relying on years of use (B) is not appropriate audit evidence. IT departments do not certify business-user spreadsheets (C). Depreciation may be material (D).

Question 20

1. Business continuity and availability risk - if the laptop is lost, stolen, or damaged, the spreadsheet and all its formulas and historical data are permanently lost. (correct answer)
2. Confidentiality risk - the spreadsheet is accessible to anyone who accesses the laptop.
3. Integrity risk - the formulas may be altered by unauthorized users.
4. Compliance risk - single-copy EUC tools violate most regulatory requirements.

Explanation: A single-copy EUC tool with no backup creates severe availability risk - a single point of failure that could completely disrupt a critical financial process. Answer A is correct. Confidentiality (B) and integrity (C) are also risks but require different conditions. Most regulations do not specifically address single-copy EUC tools (D).