CPA Isc Quiz: Evaluate It General Controls Itgcs

What this quiz covers

This quiz focuses on Evaluate It General Controls Itgcs, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. The auditor must test all input controls manually.
2. The organization must restate its financial statements for the prior year.
3. Automated application controls in the affected systems cannot be relied upon, requiring the auditor to perform additional substantive procedures. (correct answer)
4. The auditor must issue an adverse opinion on the financial statements.

Explanation: Ineffective change controls mean automated controls could have been altered without authorization - the auditor cannot rely on them and must compensate with increased substantive testing. Answer C is correct. Input control testing (A) does not fully compensate. Prior year restatement (B) is not automatic. An adverse opinion (D) is not required solely due to ITGC weaknesses.

Question 2

1. Logical access controls - specifically the provisioning and deprovisioning process for user accounts. (correct answer)
2. Program change controls - confirming that account changes were authorized through the change management process.
3. Computer operations controls - confirming that system administrators managed user accounts correctly.
4. Program development controls - confirming that the user provisioning system was properly developed.

Explanation: Testing the provisioning and deprovisioning of user accounts is directly testing logical access controls - the ITGC category governing who has access to systems and how access rights are managed. Answer A is correct. Account management is access control (A), not change management (B), operations (C), or development (D).

Question 3

1. It allows the auditor to calculate a statistically precise error rate.
2. It ensures the sample includes both major and minor changes.
3. It reduces the time required to complete ITGC testing.
4. It provides evidence that controls operated consistently throughout the financial reporting period, not just at the time of testing. (correct answer)

Explanation: For ITGCs supporting financial reporting, controls must have operated throughout the period under audit - a sample covering all quarters provides evidence of consistent operation, not just point-in-time compliance. Answer D is correct. Statistical precision (A), change size coverage (B), and time reduction (C) are not the primary reason for full-year sampling.

Question 4

1. A complete lack of segregation of duties - one person controls all aspects of the IT environment, creating unlimited opportunity for unauthorized changes or fraud without detection. (correct answer)
2. The administrator may lack the technical expertise to manage all these functions.
3. The organization is non-compliant with IT infrastructure best practices.
4. The administrator may become overwhelmed and cause performance issues.

Explanation: One person controlling all IT functions - access, changes, deployments, and operations - eliminates all segregation of duties and any possibility of independent check, representing a critical ITGC deficiency. Answer A is correct. Technical skills (B), best practices (C), and workload (D) are secondary concerns.

Question 5

1. ITGC deficiencies may cause the auditor to assess IT-dependent controls as unreliable, requiring more extensive substantive testing to obtain sufficient audit evidence. (correct answer)
2. ITGC deficiencies always require the auditor to issue a qualified opinion.
3. ITGC deficiencies require the organization to restate prior year financial statements.
4. ITGC deficiencies have no effect on the financial statement audit if management provides written representations about control effectiveness.

Explanation: ITGC deficiencies cascade into the reliance assessment for automated controls - if the IT environment cannot be trusted, the auditor must compensate with more substantive procedures to obtain assurance. Answer A is correct. Qualified opinions (B) are not automatic from ITGC deficiencies. Restatements (C) require actual financial misstatements. Management representations (D) do not resolve ITGC deficiencies.

Question 6

1. Program development controls
2. Computer operations controls
3. Program change controls
4. Logical access controls (correct answer)

Explanation: Password configuration settings govern how users authenticate - enforcing password policies is a logical access control requirement that ensures authentication standards are maintained. Answer D is correct. Password settings are not development (A), operations (B), or change (C) controls.

Question 7

1. Accept the logs as sufficient evidence of control effectiveness without further testing.
2. Ignore the logs since cloud systems are managed by the provider.
3. Use the logs only to assess whether users have appropriate access levels.
4. Evaluate whether the logs are comprehensive, tamper-proof, retained for an appropriate period, and reviewed by management on a regular basis with follow-up on exceptions. (correct answer)

Explanation: Logs are only valuable as controls if they are complete, protected from alteration, retained long enough to support investigation, and actually reviewed with follow-up - simply having logs does not confirm effective ITGC monitoring. Answer D is correct. Logs alone are not sufficient evidence (A). Cloud logs are still the organization's responsibility (B). Logs support multiple ITGC assessments beyond just access levels (C).

Question 8

1. All IT systems in the organization, regardless of their connection to financial data.
2. IT systems and controls that support the processing, storage, or transmission of financial data, or that support automated application controls relied upon in the audit. (correct answer)
3. Only the ERP system used for general ledger accounting.
4. All IT systems managed by the IT department, including HR, facilities, and marketing systems.

Explanation: ITGC scope for financial auditing is risk-based - focused on systems that touch financial data or support relied-upon application controls. Non-financial systems are generally out of scope. Answer B is correct. All IT systems (A, D) is too broad. Only the GL system (C) may be too narrow if other systems feed financial processes.

Question 9

1. Program development controls
2. Logical access controls (correct answer)
3. Computer operations controls
4. Program change controls

Explanation: User access reviews and recertifications are logical access controls - they ensure that access rights remain appropriate and aligned with current job responsibilities. Answer B is correct. Program development (A) governs new system creation. Computer operations (C) governs system operation. Change controls (D) govern system modifications.

Question 10

1. The ITGC documentation will fail to impress external auditors.
2. The existing ITGC framework may not address risks introduced by new technologies, creating unmitigated control gaps. (correct answer)
3. Employees will not be familiar with the outdated ITGC documentation.
4. The organization may not achieve the highest rating in IT maturity assessments.

Explanation: ITGCs must evolve with technology - a cloud migration and new ERP introduce new access paths, change mechanisms, and operational risks that the old framework may not address. Answer B is correct. Auditor impressions (A), employee familiarity (C), and maturity ratings (D) are secondary concerns.

Question 11

1. Logical access controls
2. Computer operations controls (correct answer)
3. Program change controls
4. Program development controls

Explanation: Monitoring batch job execution and responding to failures is a computer operations control responsibility. Unmonitored job failures represent an operations control deficiency. Answer B is correct. Access controls (A), change controls (C), and development controls (D) are not implicated by batch monitoring failures.

Question 12

1. The risk that developers introduce unauthorized or untested code directly into production systems. (correct answer)
2. The risk that the release management team makes configuration errors during deployment.
3. The risk that the change management system fails to generate unique ticket numbers.
4. The risk that end users request too many system changes simultaneously.

Explanation: Separating development from production deployment enforces segregation of duties, preventing developers from unilaterally deploying their own code - the primary change management ITGC risk. Answer A is correct. Release team errors (B), ticket generation (C), and change request volume (D) are secondary concerns.

Question 13

1. Whether the organization has an IT steering committee that reviews IT investments.
2. Whether the organization's disaster recovery plan covers the financial system.
3. Whether the cloud provider's own ITGCs are adequate, typically assessed through a SOC 1 Type II report covering the provider's relevant controls. (correct answer)
4. Whether the system's automated application controls are properly designed.

Explanation: Cloud environments introduce a shared responsibility model - the organization must assess whether the cloud provider's ITGCs (infrastructure access, change management, operations) are effective, typically through a SOC 1 Type II report. Answer C is correct. IT steering committees (A) and DR plans (B) apply to all environments. Application control design (D) is not cloud-specific.

Question 14

1. Requiring two approvers for all production deployments.
2. Documenting system design specifications, conducting code reviews, and requiring user acceptance testing before any new application goes live. (correct answer)
3. Monitoring batch job logs for failures and investigating them promptly.
4. Reviewing and approving user access requests based on job function.

Explanation: Program development controls govern the lifecycle of new system development - design documentation, code reviews, and UAT ensure new systems are built correctly and work as intended before production deployment. Answer B is correct. Deployment approvals (A) are change controls. Batch monitoring (C) is operations. Access approval (D) is logical access.

Question 15

1. They directly process financial transactions and calculate account balances.
2. They provide the foundation for the reliability of application controls - if ITGCs are weak, automated application controls may be unreliable regardless of their design. (correct answer)
3. They replace the need for substantive testing when operating effectively.
4. They are required by GAAP for all publicly traded companies.

Explanation: ITGCs are the IT environment controls that underpin application controls. Weak ITGCs (e.g., poor change management) mean that automated application controls could have been modified without authorization, making their outputs unreliable. Answer B is correct. ITGCs do not directly process transactions (A). Effective ITGCs reduce but do not eliminate substantive testing (C). GAAP does not prescribe ITGCs (D).

Question 16

1. Requiring manager approval before deploying code changes to production.
2. Restricting database access to authorized personnel only.
3. Reviewing the design specifications for a new financial application before development begins.
4. Monitoring job scheduling to ensure batch processes run at their scheduled times and investigating failures promptly. (correct answer)

Explanation: Computer operations controls govern the day-to-day operation of IT systems - job scheduling, batch monitoring, operations logs, and incident response. Answer D is correct. Deployment approval (A) is a change control. Database access restriction (B) is a logical access control. Design review (C) is a program development control.

Question 17

1. The development team may not have adequate technical skills.
2. Production administrators may not understand the business requirements for system changes.
3. Developers could make unauthorized changes directly to production systems without detection, undermining both change management and automated application controls. (correct answer)
4. The organization may not comply with IT governance best practices.

Explanation: Without segregation between development and production, developers can implement unauthorized code directly in production - a fundamental ITGC control failure that compromises all downstream application controls. Answer C is correct. Technical skills (A), business requirements (B), and best practice compliance (D) are secondary concerns compared to the unauthorized change risk.

Question 18

1. A computer operations control deficiency - former employee accounts affect system performance.
2. A program development control deficiency - the user provisioning system was not properly developed.
3. A program change control deficiency - account deactivation was not implemented as a change.
4. A logical access control deficiency - terminated employee accounts were not promptly deactivated, creating risk of unauthorized access by former employees. (correct answer)

Explanation: Active accounts for terminated employees is a logical access control deficiency - the offboarding process failed to revoke access, creating unauthorized access risk. Answer D is correct. This is not an operations (A), development (B), or change control (C) issue.

Question 19

1. ITGCs and automated application controls are independent - the effectiveness of one does not affect the other.
2. ITGCs provide the foundation for automated application controls - if ITGCs are effective, auditors can place greater reliance on automated controls without additional testing. (correct answer)
3. Automated application controls are more important than ITGCs for financial reporting purposes.
4. Strong automated application controls can fully compensate for weak ITGCs.

Explanation: Effective ITGCs (especially change controls and access controls) provide assurance that automated application controls have not been tampered with, enabling greater reliance. Weak ITGCs undermine automated control reliability. Answer B is correct. They are interdependent (A). ITGCs underpin application controls (C). Weak ITGCs cannot be fully compensated by strong automated controls (D).

Question 20

1. Reviewing code quality during software development sprints.
2. Approving user access requests for new employees.
3. Monitoring scheduled batch jobs, investigating job failures, managing system capacity, and maintaining operations logs. (correct answer)
4. Reviewing and approving proposed changes to production systems.

Explanation: Computer operations controls govern the day-to-day running of IT infrastructure - batch scheduling, job monitoring, capacity management, and operational logging. Answer C is correct. Code review (A) is development. Access approvals (B) are logical access. Change approvals (D) are change management.