All questions
Question 1
During a batch processing run, the system processes 980 of 1,000 transactions and terminates due to an error. The remaining 20 transactions are not processed. Which processing control would most directly detect this incomplete processing?
- Encryption of the batch file before processing begins.
- Access controls limiting who can initiate batch processing runs.
- A run-to-run control total that compares the number of records and total amounts processed against expected totals established before the run. (correct answer)
- A format check validating the structure of each transaction record.
Explanation: Run-to-run control totals compare expected counts and amounts to actual processed results, directly detecting incomplete processing - the 20 missing transactions would cause a discrepancy. Answer C is correct. Encryption (A) addresses confidentiality. Access controls (B) address authorization. Format checks (D) validate data structure, not completeness of processing.
Question 2
A financial reporting system automatically locks the accounting period at month-end, preventing any further journal entries from being posted to the closed period. This is an example of which type of application control?
- Input validation - preventing entries in incorrect date formats.
- Processing control - enforcing period-end cutoff by preventing transactions from being processed to a closed accounting period. (correct answer)
- Output control - ensuring reports reflect only transactions in the current period.
- Access control - restricting which users can post journal entries.
Explanation: Period locking is a processing control that enforces accounting cutoff - ensuring no transactions are processed to periods that have already been closed. Answer B is correct. Date format validation (A) is an input control. Report filtering (C) is an output function. User restrictions (D) are access controls.
Question 3
A company generates a daily transaction report listing all journal entries posted to the general ledger during the day. Management reviews this report for unusual items. This is an example of which type of control?
- Input control - validating journal entries before posting.
- Processing control - ensuring journal entries are calculated correctly.
- Access control - restricting who can view journal entries.
- Output control - using system-generated reports as a detective control to identify unusual or unauthorized transactions after posting. (correct answer)
Explanation: Reviewing system-generated output reports to detect unusual items after processing is a detective output control. Answer D is correct. The review occurs after posting (not input A or processing B), and is a detective control, not an access restriction (C).
Question 4
A payroll system generates pay stubs for 500 employees. The system also generates a control report showing total gross pay, total deductions, and total net pay for the batch. Management reconciles this control report to the general ledger payroll entries. This reconciliation is an example of:
- An input control verifying payroll data at entry.
- A processing control ensuring the payroll calculations are correct.
- An output control reconciling system-generated totals to the general ledger to verify completeness and accuracy of the payroll processing. (correct answer)
- An access control limiting who can approve payroll disbursements.
Explanation: Reconciling the system's output control report to the GL after processing is an output control - using the system's own totals as evidence of complete, accurate processing. Answer C is correct. Payroll entry validation (A) is input. Calculation verification (B) is processing. Access restrictions (D) are separate.
Question 5
An auditor is testing application controls over a revenue recognition system. Which of the following procedures would provide evidence about the effectiveness of input controls?
- Attempting to enter transactions with invalid customer IDs, missing required fields, or out-of-range amounts, and verifying that the system rejects or flags them. (correct answer)
- Reviewing the system's access control log to identify who has made entries.
- Reconciling the total revenue recognized to the general ledger balance.
- Reviewing the disaster recovery plan for the revenue recognition system.
Explanation: Testing input controls requires attempting to enter invalid data and confirming the system properly rejects or flags the exceptions - directly evaluating whether validation rules operate as designed. Answer A is correct. Access logs (B) test access controls. Reconciliation (C) tests output controls. DR plans (D) are not application control tests.
Question 6
An organization generates financial statements from an automated reporting system. Which of the following output controls would best ensure the statements are complete and include all required disclosures?
- A checklist or automated template that validates the financial statement package against required components (all statements, notes, supplementary schedules) before distribution. (correct answer)
- Encrypting the financial statements before sending them to external parties.
- Requiring that financial statements be printed on company letterhead.
- Storing a copy of all financial statements in an archive system.
Explanation: A completeness checklist or automated validation against required components ensures all required elements of the financial statement package are present before distribution - directly addressing output completeness. Answer A is correct. Encryption (B) and letterhead (C) are presentation/security concerns. Archiving (D) addresses retention, not completeness.
Question 7
An organization's financial reporting process generates a management report containing prior period comparisons. Which output control would help ensure the comparative figures are accurate?
- Requiring the report to be printed on secure paper.
- Restricting electronic access to the report to finance managers only.
- Reconciling the prior period figures in the report to the prior period's audited financial statements or general ledger balances. (correct answer)
- Applying a date stamp to all report pages when printed.
Explanation: Reconciling comparative period figures to audited or agreed-upon prior period balances is the most effective control for verifying accuracy of prior period output data. Answer C is correct. Secure paper (A) and date stamps (D) are physical controls with limited value. Access restriction (B) is an authorization control.
Question 8
An accounts payable system automatically matches vendor invoices to purchase orders and goods receipts before allowing payment processing. This three-way match is best classified as:
- An output control that verifies payment reports after disbursements are made.
- An access control that restricts payment processing to authorized staff.
- A processing control that validates transactions against multiple authorization records before allowing them to proceed. (correct answer)
- An input control that validates invoice data format at the time of entry.
Explanation: The three-way match occurs during the payment processing stage - verifying the transaction against source documents (PO and receipt) before allowing processing to continue. It is a processing control. Answer C is correct. Output controls (A) operate after processing. Access controls (B) restrict users. Input controls (D) validate at entry.
Question 9
After processing a large batch of vendor payments, the accounts payable system generates an exception report listing payments that could not be matched to approved purchase orders. The accounts payable manager reviews this report. This is an example of:
- A processing control that prevents unmatched payments from being processed.
- An output control that provides a detective check over payment processing completeness and authorization. (correct answer)
- An input control that validates purchase order data at entry.
- An access control restricting who can approve vendor payments.
Explanation: An exception report generated after processing for management review is a detective output control - it identifies issues that occurred during processing rather than preventing them. Answer B is correct. A preventive control would have stopped unmatched payments (A). Input controls operate at entry (C). Access controls restrict users (D).
Question 10
An organization's order management system accepts order quantities up to 9,999 units without any alert. A data entry error results in 99,999 units being entered for a single order. Which input control failure does this represent?
- Completeness check failure - the quantity field was left blank.
- Limit or range check failure - the system should have rejected or flagged quantities exceeding a reasonable maximum. (correct answer)
- Validity check failure - the quantity does not match an authorized list.
- Format check failure - the quantity was entered in an incorrect format.
Explanation: A quantity of 99,999 units should have been flagged or rejected by a limit check - a control that rejects entries exceeding defined maximum values. Answer B is correct. The field was populated (A). Quantity values don't reference a list (C). The format appears correct - the issue is the value, not the structure (D).
Question 11
Which of the following represents an effective set of controls covering all three categories - input, processing, and output - for a billing system?
- Encrypting all billing data and storing it in a secure database.
- Input: validating customer IDs and amounts at entry; Processing: run-to-run control totals verifying all invoices are processed; Output: reconciling billed amounts to the accounts receivable ledger. (correct answer)
- Restricting billing system access to accounts receivable staff only.
- Generating daily billing reports and distributing them to the finance team.
Explanation: A complete application control suite covers all three layers: input validation catches data errors at entry; processing controls verify completeness during the run; output reconciliation confirms the results are accurately reflected downstream. Answer B is correct. Encryption (A) and access controls (C) are IT general controls. Report distribution (D) is only one output control.
Question 12
A company's general ledger system requires that all journal entries balance (debits equal credits) before they can be saved. This is an example of:
- A processing control that recalculates debits and credits after posting.
- An output control that generates a trial balance report.
- An input control that enforces the fundamental accounting equation at the point of data entry. (correct answer)
- An access control requiring two users to approve each journal entry.
Explanation: Requiring balanced debits and credits before saving is an input validation - it enforces a fundamental accounting rule at the moment of data entry, preventing unbalanced entries from ever being recorded. Answer C is correct. This occurs at entry, not during post-entry processing (A) or reporting (B). It's a data rule, not an authorization control (D).
Question 13
Which of the following best describes the purpose of 'edit checks' in application input controls?
- To encrypt input data fields for security before database storage.
- To generate output reports summarizing all input transactions for management review.
- To restrict which users are authorized to enter data into the application.
- To automatically validate data at the point of entry using rules such as format, range, completeness, and validity checks - rejecting or flagging entries that fail validation. (correct answer)
Explanation: Edit checks are automated input validation rules that enforce data quality standards at entry time, preventing invalid data from entering the system. Answer D is correct. Encryption (A), reporting (B), and access restriction (C) are separate control types.
Question 14
A company's fixed asset system requires that the useful life entered for a new asset falls between 1 and 50 years. Entry of 0 years or 51+ years is rejected. This is an example of:
- A range check input control enforcing reasonable boundaries for useful life values. (correct answer)
- A validity check verifying the useful life against an authorized list.
- A completeness check ensuring the useful life field is not blank.
- A processing control applied during the depreciation calculation run.
Explanation: Enforcing minimum and maximum acceptable values for a field is a range check - one of the fundamental input validation types. Answer A is correct. Validity checks reference a list (B). Completeness checks prevent blanks (C). The control occurs at entry, not during processing (D).
Question 15
Which of the following application controls is specifically designed to prevent a transaction from being entered and processed more than once?
- A range check validating transaction amounts.
- A completeness check ensuring all required fields are populated.
- An output reconciliation comparing processed totals to source documents.
- A duplicate transaction check that compares new entries to previously processed transactions on key fields such as vendor, invoice number, amount, and date. (correct answer)
Explanation: Duplicate transaction detection specifically compares new transactions to historical records on key identifying fields, preventing the same transaction from being processed more than once. Answer D is correct. Range checks (A) and completeness checks (B) validate data characteristics. Output reconciliation (C) detects discrepancies after processing.
Question 16
A critical financial application calculates loan interest payments. An auditor wants to verify that the interest calculation logic is correct. Which audit procedure is most appropriate?
- Reviewing the application's access control list to confirm only authorized users can access the system.
- Re-performing a sample of interest calculations manually using known inputs and comparing the results to system outputs to verify calculation accuracy. (correct answer)
- Reviewing the system's backup logs to confirm data is protected.
- Confirming that the application was tested before its initial deployment.
Explanation: Re-performing calculations with known inputs and comparing to system outputs directly tests whether the application's processing logic produces accurate results - the most direct test of processing control effectiveness. Answer B is correct. Access lists (A) test access controls. Backup logs (C) test recovery controls. Initial testing documentation (D) is historical evidence, not a current control test.
Question 17
Application controls over data input are designed primarily to:
- Ensure that data entered into a system is accurate, complete, and authorized before it is processed. (correct answer)
- Encrypt all data as it is entered to protect confidentiality.
- Prevent unauthorized users from logging into the application.
- Generate output reports that management uses for decision-making.
Explanation: Input controls are the first line of application control - validating data at the point of entry to prevent inaccurate, incomplete, or unauthorized data from entering the system. Answer A is correct. Encryption (B) is a security control. Authentication (C) is an access control. Report generation (D) is an output function.
Question 18
Which of the following output controls helps ensure that sensitive financial reports are not accessed by unauthorized individuals after they are generated?
- Implementing access controls on the report distribution system, requiring authentication to retrieve reports, and logging all report access. (correct answer)
- Applying range checks to all amounts in the report before distribution.
- Requiring a second employee to verify all calculations before the report is finalized.
- Printing reports immediately after generation and locking them in a filing cabinet.
Explanation: Output security requires access controls on the report delivery mechanism - authentication, authorization, and logging - to ensure only intended recipients can retrieve sensitive reports. Answer A is correct. Range checks (B) are input controls. Calculation verification (C) is a processing/review control. Physical filing (D) is a limited physical control that doesn't address electronic distribution.
Question 19
A system rejects a purchase order entry because the vendor ID entered does not exist in the approved vendor master file. This is an example of which type of input control?
- Format check - verifying the data is in the correct format.
- Range check - verifying the data falls within an acceptable range.
- Validity check - verifying the data matches an authorized value in a reference table. (correct answer)
- Completeness check - verifying all required fields are populated.
Explanation: A validity check verifies that entered data matches an authorized list or reference table - in this case, the approved vendor master file. Answer C is correct. Format checks (A) validate structure (e.g., date format). Range checks (B) validate numeric ranges. Completeness checks (D) ensure required fields are filled.
Question 20
Which of the following is an example of a processing control?
- A field validation that rejects entries exceeding a maximum dollar amount.
- A batch control total that compares the sum of transaction amounts before and after processing to verify completeness. (correct answer)
- A report that lists all transactions processed during the period for management review.
- A system prompt that requires users to confirm their identity before entering data.
Explanation: A batch control total that reconciles pre- and post-processing totals is a processing control - it verifies that all transactions were processed correctly and completely. Answer B is correct. Field validation (A) is an input control. Management reports (C) are output controls. Identity confirmation (D) is an access control.