CPA Quiz: Assess Interface And Data Transfer Controls
20 questions · exam conditions
0:00
Assess Interface And Data Transfer ControlsQuestion 1 of 20

An auditor is reviewing an interface between a company's HR system and its payroll system. Which of the following would be the most relevant test of the interface's completeness?

Selecting a sample of employee change records in the HR system and verifying each was reflected in the payroll system.
Reviewing the encryption algorithm used to protect payroll data in transit.
Confirming that the HR system's database is backed up nightly.
Reviewing access controls over the HR system to ensure only HR staff can make changes.
← Back to quizzes

CPA Quiz

CPA Quiz: Assess Interface And Data Transfer Controls

Practice Assess Interface And Data Transfer Controls in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Assess Interface And Data Transfer Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An auditor is reviewing an interface between a company's HR system and its payroll system. Which of the following would be the most relevant test of the interface's completeness?

  1. Selecting a sample of employee change records in the HR system and verifying each was reflected in the payroll system. (correct answer)
  2. Reviewing the encryption algorithm used to protect payroll data in transit.
  3. Confirming that the HR system's database is backed up nightly.
  4. Reviewing access controls over the HR system to ensure only HR staff can make changes.
Explanation: Tracing HR change records to corresponding payroll updates directly tests whether all changes were completely and accurately transferred. Answer A is correct. Encryption testing (B) addresses confidentiality. Backup review (C) addresses availability. Access control testing (D) addresses authorization, not interface completeness.

Question 2

Which of the following best describes a 'data reconciliation' control in the context of system interfaces?

  1. A process that encrypts data before it is sent to another system.
  2. A process that restricts which systems are authorized to send data to each other.
  3. A process that converts data formats between systems with different schemas.
  4. A process that compares data totals, record counts, or hash values between source and target systems to verify the transfer was complete and accurate. (correct answer)
Explanation: Data reconciliation verifies transfer integrity by comparing key metrics (counts, totals, checksums) between sender and receiver, detecting any discrepancies. Answer D is correct. Encryption (A) addresses confidentiality. Authorization controls (B) address access. Data conversion (C) is mapping/transformation, not reconciliation.

Question 3

A company transfers daily sales data from its point-of-sale system to its general ledger. Which of the following controls would best detect if records were lost during the transfer?

  1. Requiring a supervisor to review all sales transactions before transfer.
  2. Comparing record counts and total amounts in the source file to the records loaded into the general ledger after each transfer. (correct answer)
  3. Encrypting the sales data file during transmission.
  4. Restricting access to the general ledger to accounting staff only.
Explanation: Record count and control total reconciliation between source and target systems directly detects data loss during transfer. Answer B is correct. Supervisor review (A) is a manual authorization control. Encryption (C) protects confidentiality. Access restrictions (D) address authorization, not completeness.

Question 4

An automated interface between a payroll system and a bank's ACH payment system fails silently - transactions are dropped without generating an error alert. Which type of control is most notably absent?

  1. Encryption of the ACH file during transmission.
  2. Role-based access controls on the payroll system.
  3. Error handling and exception notification controls that alert operations staff when interface failures occur. (correct answer)
  4. Digital signature verification of ACH payment files.
Explanation: Silent failures indicate the absence of error handling and notification controls - the interface should detect failures and alert responsible staff immediately so corrective action can be taken. Answer C is correct. Encryption (A), access controls (B), and digital signatures (D) do not address the silent failure detection gap.

Question 5

A company uses an API to receive customer order data from an e-commerce platform and load it into its ERP system. Which of the following interface controls is most important to verify the authenticity of data received through this API?

  1. Compressing the API data before transmission to improve performance.
  2. Storing all received API data in a separate staging table before processing.
  3. Reconciling order counts between the e-commerce platform and the ERP weekly.
  4. Implementing API authentication (e.g., API keys, OAuth tokens) to ensure data is only accepted from the authorized e-commerce platform. (correct answer)
Explanation: API authentication controls verify that data is received from a legitimate, authorized source, preventing malicious or unauthorized parties from injecting data into the ERP system. Answer D is correct. Compression (A) is a performance measure. Staging tables (B) aid processing but don't verify authenticity. Weekly reconciliation (C) is detective, not preventive.

Question 6

An IT auditor is assessing the controls over a financial data interface and requests interface run logs for the past quarter. What information in these logs is most relevant to the audit?

  1. The names of the IT staff members who developed the interface program.
  2. The hardware specifications of the servers running the interface.
  3. Records of each interface execution including start/end times, record counts, error conditions, and any exceptions or failures. (correct answer)
  4. The source code of the interface program.
Explanation: Interface run logs document execution history - when the interface ran, how many records were processed, and any errors or failures. This information is essential for assessing completeness, reliability, and incident response. Answer C is correct. Developer names (A) and server specs (B) are not relevant to interface control testing. Source code review (D) is a separate IT audit procedure.

Question 7

A company's interface transmits accounts payable data from a subsidiary to the parent company's consolidation system. An auditor verifies that the total accounts payable balance in the subsidiary's system equals the amount received by the parent's consolidation system. This audit procedure tests which assertion?

  1. Existence - confirming that the accounts payable amounts are real obligations.
  2. Completeness - verifying that all subsidiary accounts payable data was fully and accurately transferred to the consolidation system. (correct answer)
  3. Valuation - confirming that accounts payable amounts are recorded at the correct amounts.
  4. Rights and obligations - confirming the company has a legal obligation to pay the recorded amounts.
Explanation: Comparing source to target totals tests completeness of the data transfer - ensuring all data moved across the interface without loss. Answer B is correct. Existence (A) tests whether recorded items are real. Valuation (C) tests measurement. Rights and obligations (D) tests legal standing.

Question 8

A company implements automated three-way match in its procure-to-pay interface, comparing purchase orders, goods receipts, and vendor invoices before authorizing payment. From an interface controls perspective, this primarily addresses which risk?

  1. The risk of processing unauthorized or inaccurate payments by ensuring invoice data matches authorized purchase orders and confirmed receipts. (correct answer)
  2. The risk of data encryption failures during invoice transmission.
  3. The risk of excessive network latency in the procure-to-pay workflow.
  4. The risk of unauthorized access to vendor master data.
Explanation: Three-way match ensures that payments are only authorized when the invoice matches an approved purchase order and a confirmed receipt - preventing payment of unauthorized, duplicate, or inflated invoices. Answer A is correct. Encryption (B), latency (C), and vendor master access (D) are separate control concerns.

Question 9

A company's interface between its CRM and billing systems incorrectly maps the 'discount percentage' field, resulting in customers being overcharged. This type of error is best detected by which control?

  1. End-to-end testing of the interface with test data that includes discount scenarios, verifying that output amounts match expected results. (correct answer)
  2. Encrypting the discount percentage field during transmission.
  3. Restricting access to the billing system to senior finance staff.
  4. Logging all changes made to the interface mapping configuration.
Explanation: End-to-end testing with scenarios covering discounts would reveal mapping errors before go-live by comparing expected to actual output - detecting logic errors in the interface. Answer A is correct. Encryption (B) does not detect logical mapping errors. Access restriction (C) limits who can make changes but does not detect errors. Change logging (D) tracks changes but does not verify correctness.

Question 10

A batch interface file is transmitted from a subsidiary's accounting system to the corporate consolidation system. The file arrives but several records contain invalid account codes. Which control should have prevented this?

  1. Firewall rules blocking unauthorized IP addresses from sending files.
  2. Digital signatures verifying the file came from the correct source.
  3. Validation edits at the source system ensuring all records contain valid account codes before the file is generated. (correct answer)
  4. Encryption of the batch file during transmission.
Explanation: Source-side validation controls should ensure records conform to required formats and valid values before the file is generated, preventing invalid data from being transmitted downstream. Answer C is correct. Firewalls (A) and digital signatures (B) address authentication and access. Encryption (D) protects confidentiality, not data validity.

Question 11

A company receives supplier invoices via an EDI interface. The interface accepts invoices without validating that the purchase order referenced on each invoice exists in the company's purchasing system. This missing control exposes the company to:

  1. The risk of data loss if the EDI connection is interrupted.
  2. The risk that supplier invoice data is encrypted using an unsupported algorithm.
  3. The risk of paying fictitious or unauthorized invoices that do not correspond to legitimate purchase orders. (correct answer)
  4. The risk that invoice data is transmitted in an uncompressed format.
Explanation: Without PO validation, the system may process and pay invoices for goods or services never ordered, creating a fraud and overpayment risk. Answer C is correct. Data loss from connection interruption (A) is a different risk. Encryption algorithms (B) and compression (D) are technical concerns unrelated to authorization validation.

Question 12

During an interface run, 5,000 records are sent from the source system but only 4,985 records are received by the target system. Which of the following is the most likely cause and the appropriate control to detect this?

  1. The target system's database is full; the appropriate control is to monitor disk space.
  2. The encryption algorithm failed on 15 records; the appropriate control is to use a stronger algorithm.
  3. The network dropped 15 records; the appropriate control is to upgrade network hardware.
  4. A transmission or processing error caused record loss; the appropriate control is record count reconciliation between source and target after each run. (correct answer)
Explanation: Record count discrepancies are most commonly caused by transmission or processing failures. Record count reconciliation is the standard detective control that identifies the discrepancy. Answer D is correct. The cause could be any failure - disk space (A), encryption (B), or network (C) - but the applicable detective control is reconciliation, not technology-specific monitoring.

Question 13

An auditor discovers that an interface between the order management and inventory systems runs successfully but the inventory system shows quantities that do not match the orders processed. What type of control failure is most likely?

  1. An access control failure - unauthorized users modified inventory records after the interface ran.
  2. An encryption failure - data was corrupted during transmission.
  3. A logging failure - the interface did not generate a record of processed transactions.
  4. A mapping or transformation error in the interface logic that incorrectly updates inventory quantities. (correct answer)
Explanation: If the interface runs successfully (no errors, counts match) but data values are wrong, the most likely cause is a logic error in how the interface maps or transforms data - applying the wrong calculation or mapping to the wrong field. Answer D is correct. Access modification (A) would show after the fact. Encryption corruption (B) would cause interface errors. Logging failure (C) affects traceability, not accuracy.

Question 14

An organization runs nightly batch interfaces that transfer transactions from subsidiary systems to a central data warehouse. Which of the following would be the most effective detective control over these interfaces?

  1. Requiring manual approval of each batch before it runs.
  2. Encrypting all batch files during transmission.
  3. Limiting interface execution to a specific service account.
  4. Automated reconciliation reports that compare source and target record counts and financial totals, with exception alerts sent to responsible staff. (correct answer)
Explanation: Automated reconciliation reports run after each batch provide timely detection of discrepancies, with alerts prompting immediate investigation. Answer D is correct. Manual pre-approval (A) is preventive but impractical for nightly automated batches. Encryption (B) addresses confidentiality. Service account restrictions (C) address authorization.

Question 15

A company's payroll interface generates a hash value of the payroll file before transmission and verifies the hash upon receipt. The purpose of this control is to:

  1. Encrypt the payroll file during transmission to protect employee salary data.
  2. Detect any unauthorized modification or corruption of the payroll file during transmission. (correct answer)
  3. Authenticate that the payroll file was sent by an authorized source system.
  4. Compress the payroll file to reduce transmission bandwidth.
Explanation: Hash verification detects changes to file content - if the hash upon receipt differs from the hash at transmission, the file was altered or corrupted during transit. Answer B is correct. Encryption (A) protects confidentiality. Hash verification detects changes but does not authenticate the sender (C). Compression (D) is unrelated to hashing.

Question 16

Which of the following best describes the purpose of a 'staging area' or 'landing zone' in a system interface architecture?

  1. A secure vault where encryption keys used by the interface are stored.
  2. A temporary holding area where incoming data is validated and cleansed before being loaded into the target production system. (correct answer)
  3. A backup copy of the target system maintained for disaster recovery purposes.
  4. A monitoring console where IT staff review interface logs in real time.
Explanation: A staging area holds incoming data for validation, transformation, and cleansing before it enters the production target system, serving as a quality gate between source and destination. Answer B is correct. Key storage (A) is a key management function. Backup systems (C) serve disaster recovery. Monitoring consoles (D) are operational tools.

Question 17

A company's procurement system automatically sends approved purchase orders to a supplier portal. Which of the following is the most critical interface control to implement?

  1. Ensuring only fully authorized purchase orders (meeting all approval requirements) are transmitted to the supplier portal. (correct answer)
  2. Encrypting the supplier portal's web interface with TLS.
  3. Requiring suppliers to confirm receipt of each purchase order within 24 hours.
  4. Restricting suppliers from viewing purchase orders older than 90 days.
Explanation: The most critical interface control ensures that only properly authorized transactions are transmitted - preventing unapproved orders from reaching suppliers and avoiding unauthorized commitments. Answer A is correct. TLS (B) addresses transit security. Supplier confirmation (C) is a business process control. Historical view restrictions (D) address access, not authorization.

Question 18

Which of the following is the primary risk associated with using flat file interfaces (such as CSV files) for transferring financial data between systems?

  1. Flat file interfaces are incompatible with modern ERP systems.
  2. Flat files cannot contain more than a few thousand records.
  3. Flat files can be manually edited before processing, introducing errors or fraud if adequate controls are not in place. (correct answer)
  4. Flat files are not supported by standard encryption algorithms.
Explanation: Unlike direct system-to-system APIs, flat files are discrete files that can be intercepted and manually altered before processing, creating a risk of unauthorized modification. Answer C is correct. Flat files are widely compatible (A) and can contain millions of records (B). Flat files can be encrypted (D).

Question 19

Which of the following is a key characteristic that distinguishes real-time (API-based) interfaces from batch interfaces from a controls perspective?

  1. Real-time interfaces process individual transactions immediately, requiring controls that validate each transaction at the time of processing; batch interfaces process groups of transactions periodically, enabling control total verification across the batch. (correct answer)
  2. Real-time interfaces are less secure than batch interfaces because they operate continuously.
  3. Batch interfaces do not require reconciliation because they process complete datasets.
  4. Real-time interfaces eliminate the need for error handling because failures are immediately visible to users.
Explanation: Real-time interfaces require per-transaction validation since there is no batch aggregation. Batch interfaces enable pre/post run control total comparisons across the group. Both have distinct control requirements. Answer A is correct. Real-time interfaces can be highly secure (B). Batch interfaces require reconciliation (C). Real-time interfaces absolutely require error handling (D).

Question 20

Which of the following is a preventive interface control designed to stop unauthorized or erroneous data from entering a target system?

  1. Reviewing interface error logs on a daily basis.
  2. Comparing system record counts before and after each interface run.
  3. Implementing input validation rules in the interface program that reject records failing format, range, or referential integrity checks. (correct answer)
  4. Generating exception reports of transactions rejected by the interface.
Explanation: Input validation rules in the interface layer are preventive - they stop invalid records from entering the target system before any processing occurs. Answer C is correct. Error log review (A), record count comparisons (B), and exception reports (D) are all detective controls that identify problems after they have occurred.