CPA Isc Quiz: Evaluate End User Computing Controls
20 questions · exam conditions
0:00
Evaluate End User Computing ControlsQuestion 1 of 20

Which of the following is the most effective control for ensuring the accuracy of formulas in a critical financial spreadsheet used as an EUC tool?

Storing the spreadsheet on a shared network drive accessible to all finance staff.
Printing a hard copy of the spreadsheet output each period for the files.
Requiring the CFO to sign off on the spreadsheet output monthly.
Performing an independent review of all formulas and logic by a second qualified person, documenting the review, and re-performing key calculations to verify accuracy.
← Back to quizzes

CPA Isc Quiz

CPA Isc Quiz: Evaluate End User Computing Controls

Practice Evaluate End User Computing Controls in CPA Isc with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Evaluate End User Computing Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which of the following is the most effective control for ensuring the accuracy of formulas in a critical financial spreadsheet used as an EUC tool?

  1. Storing the spreadsheet on a shared network drive accessible to all finance staff.
  2. Printing a hard copy of the spreadsheet output each period for the files.
  3. Requiring the CFO to sign off on the spreadsheet output monthly.
  4. Performing an independent review of all formulas and logic by a second qualified person, documenting the review, and re-performing key calculations to verify accuracy. (correct answer)
Explanation: Independent formula review and recalculation by a second qualified person is the most direct control for detecting spreadsheet errors - verifying the underlying logic rather than just the outputs. Answer D is correct. Shared access (A) increases risk. Print copies (B) do not verify formula accuracy. CFO sign-off (C) reviews output but may not detect embedded formula errors.

Question 2

A company's month-end close process relies on a spreadsheet to aggregate data from five different systems and calculate consolidated revenue. The spreadsheet has no input validation, no formula documentation, and is updated by multiple users with no access restrictions. Which of the following correctly characterizes the control environment for this EUC tool?

  1. Adequate - the spreadsheet is regularly used and has not produced errors.
  2. Adequate - multiple users provides redundant review.
  3. Moderate risk - only the lack of documentation is concerning.
  4. High risk - multiple uncontrolled factors (no validation, no documentation, unrestricted multi-user access) create significant potential for undetected errors or unauthorized changes in a material process. (correct answer)
Explanation: Multiple simultaneous control weaknesses in a material revenue process represents high risk - no input controls, no audit trail, no access control, and no documentation compound to create serious financial reporting exposure. Answer D is correct. Regular use without known errors does not confirm control adequacy (A, B, C).

Question 3

Which of the following represents a key difference between controls over EUC tools and controls over enterprise IT systems?

  1. Enterprise systems require more frequent testing than EUC tools.
  2. EUC tools are subject to more rigorous regulatory requirements than enterprise systems.
  3. Enterprise systems typically have formal IT general controls (change management, access controls, testing) enforced by IT governance; EUC tools often lack these controls and rely on user discipline. (correct answer)
  4. EUC tools process more transactions per day than enterprise systems.
Explanation: The critical distinction is the IT governance framework: enterprise systems are subject to formal ITGCs, while EUC tools operate outside this framework, creating the primary EUC control risk. Answer C is correct. Testing frequency (A) and regulatory requirements (B) favor enterprise systems, not EUC tools. Transaction volume (D) typically favors enterprise systems.

Question 4

An organization's EUC policy requires that all high-risk spreadsheets undergo an annual independent review. During an audit, the auditor finds that the last review of the critical payroll accrual spreadsheet was performed three years ago and a new, more complex formula was added two years ago without review. The auditor should:

  1. Flag this as a control deficiency - the EUC policy was not followed, and the unreviewed formula change creates an unmitigated risk of payroll accrual errors. (correct answer)
  2. Accept the control as adequate since the spreadsheet was reviewed three years ago.
  3. Accept the control since the formula addition was made by a qualified accountant.
  4. Defer the finding to management for evaluation without further testing.
Explanation: A missed mandatory review plus an unreviewed significant change creates a clear control deficiency - the EUC policy was not followed and the risk is unmitigated. Answer A is correct. A three-year-old review (B) does not satisfy an annual requirement. Preparer qualifications (C) do not substitute for independent review. The auditor should document the finding with evidence (D).

Question 5

A company uses a Python script developed by a finance analyst to extract, transform, and load data from the ERP into a reporting database. This tool is not managed under IT change management. Which control is most important to implement?

  1. Version control for the script with documented change history, and a formal change approval and testing process before any changes are deployed to production. (correct answer)
  2. Encrypting the Python script source code to prevent unauthorized reading.
  3. Requiring the analyst to obtain a programming certification before maintaining the script.
  4. Migrating the script to a compiled executable that cannot be easily modified.
Explanation: A production script managing financial data without change management has the same risks as any uncontrolled EUC tool - version control and a formal change process ensure changes are authorized and tested. Answer A is correct. Encryption (B) and certifications (C) address different risks. Compiled code (D) makes the script harder to maintain and audit.

Question 6

An organization implements a requirement that all critical EUC spreadsheets display a header confirming the version number, last modified date, and the name of the person who last modified them. The primary purpose of this control is to:

  1. Enable the IT department to track spreadsheet usage across the organization.
  2. Comply with document management system requirements.
  3. Provide basic version identification that helps users confirm they are working with the correct, current version and supports auditability of changes. (correct answer)
  4. Prevent unauthorized users from modifying the spreadsheet.
Explanation: Version headers help users identify the correct version, detect unauthorized changes through modification date/author tracking, and create a basic audit trail for EUC tools. Answer C is correct. IT tracking (A) and document management (B) are not the primary purpose. Version headers do not technically prevent modification (D).

Question 7

An organization uses a complex Excel spreadsheet developed by the CFO to calculate quarterly bonus accruals. This spreadsheet is used to record journal entries totaling $2 million per quarter. The primary risk associated with this EUC tool is:

  1. Formula errors, manual data entry mistakes, or unauthorized modifications may go undetected, producing materially incorrect accrual amounts recorded in the financial statements. (correct answer)
  2. The spreadsheet may be too large to open on the CFO's computer.
  3. The spreadsheet may not be compatible with future versions of Excel.
  4. The CFO may not have sufficient access rights to view the underlying data.
Explanation: An uncontrolled EUC spreadsheet calculating significant financial amounts is a high risk for errors and unauthorized changes that could directly result in materially misstated financial statements. Answer A is correct. File size (B), version compatibility (C), and access (D) are minor operational concerns compared to financial accuracy risk.

Question 8

An auditor is evaluating a macro-enabled Excel workbook that performs complex actuarial calculations for insurance reserve estimates. The auditor should be particularly concerned about which risk specific to macro-enabled spreadsheets?

  1. Macro-enabled workbooks consume significantly more disk space than standard spreadsheets.
  2. Macros cannot be tested by auditors since they are proprietary code.
  3. Macros may contain logic errors or unauthorized code that manipulates data in ways that are not transparent to users reviewing the spreadsheet output. (correct answer)
  4. Macro-enabled workbooks are prohibited under most financial reporting standards.
Explanation: Macros introduce embedded code that is invisible in the spreadsheet interface - potentially containing errors or unauthorized logic that produces incorrect outputs without any visible indication. Answer C is correct. Storage size (A) is not a material concern. Macros can be reviewed by auditors with appropriate skills (B). Financial reporting standards do not prohibit macros (D).

Question 9

An auditor testing a key EUC spreadsheet used to calculate depreciation expense requests evidence of testing and validation of the spreadsheet's formulas. The business user responds that 'it has worked correctly for years.' The auditor should:

  1. Perform independent testing of the spreadsheet formulas and recalculate a sample of depreciation amounts to verify accuracy, documenting the results as audit evidence. (correct answer)
  2. Accept the user's representation since the spreadsheet has been in use without identified errors.
  3. Request that the IT department certify the spreadsheet as accurate.
  4. Accept the spreadsheet since depreciation is an immaterial account.
Explanation: User representations of accuracy are insufficient audit evidence for a key EUC tool. The auditor must independently verify formula logic and recalculate outputs. Answer A is correct. Relying on years of use (B) is not appropriate audit evidence. IT departments do not certify business-user spreadsheets (C). Depreciation may be material (D).

Question 10

An auditor reviewing EUC controls finds that a spreadsheet used to calculate executive compensation has embedded formulas that reference cells containing hardcoded override values. These override values are not visible without inspecting individual cells. The primary concern is:

  1. The spreadsheet is too complex for the compensation committee to understand.
  2. The hardcoded values may cause the spreadsheet to calculate slowly.
  3. Hidden hardcoded values could be manipulated to alter compensation calculations without being visible in standard spreadsheet review, creating a fraud risk. (correct answer)
  4. The compensation committee requires a summary table rather than a detailed spreadsheet.
Explanation: Hidden hardcoded values in critical calculation cells are a significant fraud and error risk - they could be manipulated to alter outcomes without any visible change in the spreadsheet's surface presentation. Answer C is correct. Complexity (A) and performance (B) are secondary. Reporting format (D) is a presentation issue.

Question 11

An organization implements a control requiring that all changes to a critical EUC spreadsheet be logged in a change register, reviewed by the controller, and tested before the updated spreadsheet is used in reporting. This control most directly addresses which EUC risk?

  1. The risk that the spreadsheet is stored in an insecure location.
  2. The risk that unauthorized or erroneous changes to the spreadsheet introduce errors into financial reporting. (correct answer)
  3. The risk that the spreadsheet is not backed up regularly.
  4. The risk that the spreadsheet formula logic is too complex for users to understand.
Explanation: A change control register, review, and testing process directly mitigates the risk of unauthorized or erroneous modifications producing incorrect financial data. Answer B is correct. Storage security (A), backup (C), and complexity (D) are separate EUC concerns.

Question 12

During an audit of EUC controls, the auditor requests the current version of a key financial calculation spreadsheet. The finance team provides four different versions with different names and modification dates, and cannot confirm which is the authoritative version. This situation represents:

  1. A minor documentation issue that can be resolved by the finance team after the audit.
  2. Acceptable practice since multiple versions allow comparison.
  3. A significant EUC control deficiency - without version control and a single authoritative source, there is a risk that the wrong version is used in financial reporting. (correct answer)
  4. An IT infrastructure problem caused by inadequate file server configuration.
Explanation: Multiple conflicting versions with no clear authoritative source is a serious EUC risk - the wrong version could be used to generate financial data, producing errors in the financial statements. Answer C is correct. This is not minor (A), not acceptable (B), and is a process control failure, not primarily an IT infrastructure issue (D).

Question 13

An organization's EUC policy requires that all spreadsheets used in financial reporting be inventoried and assessed for risk. The primary purpose of this inventory is to:

  1. Ensure all spreadsheets comply with IT security standards for encryption.
  2. Allow the IT department to migrate all spreadsheets to enterprise systems.
  3. Identify which EUC tools are material to financial reporting so that appropriate controls can be designed and applied proportionate to their risk. (correct answer)
  4. Determine how much storage space spreadsheets consume on company servers.
Explanation: An EUC inventory enables risk-based control decisions - high-risk tools (large financial impact, complex logic) receive stronger controls than low-risk tools. Answer C is correct. Encryption (A) and storage (D) are secondary concerns. Migration (B) may be a long-term goal but is not the purpose of the inventory.

Question 14

A business user modifies a critical revenue calculation spreadsheet without documenting the change or notifying the finance team. This scenario illustrates which EUC control weakness?

  1. Absence of version control and change management for EUC tools - unauthorized or undocumented changes can introduce errors without detection. (correct answer)
  2. Inadequate encryption of spreadsheet data at rest.
  3. Excessive access granted to IT staff for the spreadsheet.
  4. Failure of the external auditors to review the spreadsheet during the prior year audit.
Explanation: Undocumented, unauthorized changes to critical EUC tools is a version control and change management failure - a fundamental EUC control risk. Answer A is correct. Encryption (B), IT access (C), and prior audits (D) are not the primary issues here.

Question 15

Which of the following EUC controls most directly addresses the risk of unauthorized modification of a critical financial spreadsheet?

  1. Requiring the spreadsheet to be reviewed by management monthly.
  2. Storing the spreadsheet in a folder labeled 'Official - Do Not Modify.'
  3. Printing a backup copy of the spreadsheet at each month-end.
  4. Protecting the spreadsheet with password-based file protection and locking formula cells, with access restricted to authorized users only. (correct answer)
Explanation: Preventing unauthorized modification requires technical controls - cell and file protection, restricted access - that physically prevent unauthorized changes rather than relying on labels or periodic reviews. Answer D is correct. Monthly review (A) detects, not prevents. Labels (B) are ineffective technical controls. Print backups (C) support recovery but do not prevent modification.

Question 16

Which of the following best describes an effective EUC governance framework?

  1. Prohibiting all EUC tools from being used in financial reporting processes.
  2. Inventorying EUC tools, classifying them by risk, applying proportionate controls, and periodically reviewing their adequacy. (correct answer)
  3. Requiring all EUC tools to be redeveloped as enterprise IT applications within one year.
  4. Limiting EUC governance to tools that process more than $10 million in transactions.
Explanation: Effective EUC governance takes a risk-based approach - identifying tools, assessing their risk, applying appropriate controls, and monitoring on an ongoing basis. Answer B is correct. Blanket prohibition (A) and mandatory migration (C) are impractical. Arbitrary thresholds (D) ignore lower-value tools that may still be material.

Question 17

When should an organization consider migrating a critical EUC tool to a formal enterprise application?

  1. Immediately - all EUC tools should be replaced by enterprise systems regardless of risk or cost.
  2. Only when the EUC tool is more than five years old.
  3. Only when the external auditors specifically request migration.
  4. When the EUC tool's risk profile exceeds what compensating controls can adequately mitigate - particularly for high-volume, high-risk, or complex processes that require robust IT controls. (correct answer)
Explanation: Migration is warranted when the business risk of an EUC tool cannot be adequately controlled through compensating measures - typically when processing volume, complexity, or financial impact makes EUC controls insufficient. Answer D is correct. Blanket migration (A) ignores cost-benefit. Age alone (B) is not the trigger. External auditors do not mandate migration (C).

Question 18

A company's internal audit team identifies 47 spreadsheets used in the financial close process. To prioritize audit resources, which criteria should drive the risk assessment of these tools?

  1. The file size and creation date of each spreadsheet.
  2. The financial impact of the data processed, complexity of formulas, number of users, frequency of changes, and existing controls over each tool. (correct answer)
  3. The seniority of the employees who use each spreadsheet.
  4. The number of worksheets contained in each workbook.
Explanation: Risk assessment should be based on factors that determine potential impact and likelihood of error: financial materiality, formula complexity, access breadth, change frequency, and current control strength. Answer B is correct. File characteristics (A, D) and user seniority (C) are not meaningful risk indicators.

Question 19

Which of the following EUC controls addresses the risk that input data fed into a critical spreadsheet from source systems contains errors?

  1. Password protecting the spreadsheet to prevent unauthorized access.
  2. Documenting the spreadsheet formulas in a user guide.
  3. Performing an annual review of the spreadsheet's formula logic.
  4. Reconciling the input data in the spreadsheet to the source system reports before processing to verify completeness and accuracy of the data feed. (correct answer)
Explanation: Input data reconciliation - comparing what enters the spreadsheet to source system reports - directly detects errors or omissions in the data before it is processed. Answer D is correct. Password protection (A), formula documentation (B), and annual formula review (C) do not address input data accuracy.

Question 20

Which of the following scenarios represents the highest risk EUC situation from a financial reporting perspective?

  1. A simple budget tracking spreadsheet maintained by a department manager with no financial statement impact.
  2. A spreadsheet used to prepare the annual IT budget with review by the CIO.
  3. A complex macro-enabled workbook used to calculate revenue recognition timing for the entire company, with no documentation, no version control, and used exclusively by one employee. (correct answer)
  4. A spreadsheet template used to collect expense estimates from 10 department heads.
Explanation: A complex, undocumented, uncontrolled tool that single-handedly calculates enterprise revenue recognition for financial reporting - with a single point of failure and no controls - represents maximum EUC risk. Answer C is correct. Non-financial tools (A, B) and collection templates (D) have significantly lower financial reporting risk.