CPA Quiz: Master Data And Data Controls
20 questions · exam conditions
0:00
Master Data And Data ControlsQuestion 1 of 20

Which of the following best describes the concept of a 'golden record' in master data management?

A premium-tier customer record that receives special billing treatment.
A record that has been reviewed and approved by the executive team.
A backup copy of master data stored in a secure offsite location.
The single authoritative version of a master data entity that has been deduplicated, validated, and is used as the definitive source across all systems.
← Back to quizzes

CPA Quiz

CPA Quiz: Master Data And Data Controls

Practice Master Data And Data Controls in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Master Data And Data Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which of the following best describes the concept of a 'golden record' in master data management?

  1. A premium-tier customer record that receives special billing treatment.
  2. A record that has been reviewed and approved by the executive team.
  3. A backup copy of master data stored in a secure offsite location.
  4. The single authoritative version of a master data entity that has been deduplicated, validated, and is used as the definitive source across all systems. (correct answer)
Explanation: A golden record is the single trusted version of a data entity - the result of consolidating and reconciling duplicate records from multiple sources into one authoritative, accurate version. Answer D is correct. Customer tiers (A), executive approval (B), and offsite backup (C) are unrelated to the MDM golden record concept.

Question 2

A company's employee master data record is updated when an employee changes departments. Controls require the HR system to automatically update the payroll and access management systems. An auditor finds that access management was not updated in 12 of 50 sampled department changes. This finding indicates:

  1. The HR system has insufficient capacity to process all employee changes.
  2. The access management system does not support automated updates.
  3. An interface or automated provisioning control failure - the HR-to-access management integration did not consistently update access rights when employees changed departments. (correct answer)
  4. A minor documentation issue that can be resolved with a memo from the HR department.
Explanation: A 24% failure rate in automated access updates represents a significant interface control failure - employees who changed departments may have retained inappropriate access to their former systems. Answer C is correct. Capacity issues (A) would affect all updates. System support (B) would produce 100% failures, not 24%. The financial and security implications are not minor (D).

Question 3

An organization's payroll system maintains an employee master file with salary and bank account information. An auditor reviews controls over this file and finds that payroll staff can modify bank account numbers without any secondary approval. The primary fraud risk is:

  1. Payroll staff may change bank accounts for legitimate employees who lost access to their accounts.
  2. Bank account changes will cause payroll processing to run slower.
  3. Employees will have difficulty receiving their pay if accounts are changed incorrectly.
  4. Payroll staff could redirect payroll funds to personal accounts by changing bank account numbers for other employees, a form of payroll diversion fraud. (correct answer)
Explanation: Unrestricted bank account modification in payroll is a direct fraud risk - payroll staff can redirect employee pay to accounts they control. This is one of the most common payroll fraud schemes. Answer D is correct. Legitimate reasons (A) do not eliminate the fraud risk. Processing speed (B) and payment receipt (C) are operational concerns, not the primary fraud risk.

Question 4

A company's item master data includes the unit of measure (UOM) for each inventory item. A UOM error causes 100 units of a high-value component to be recorded as 100 individual items instead of 100 boxes of 12. The primary financial reporting impact is:

  1. The inventory system will display items in the wrong location.
  2. Inventory quantities and values will be materially misstated - the correct count is 1,200 units but the system records 100, significantly understating inventory and potentially COGS. (correct answer)
  3. The warehouse will have difficulty physically locating the items.
  4. The purchasing department will order too much inventory in future periods.
Explanation: A UOM error directly causes financial misstatement - recording 100 boxes of 12 as 100 individual units understates inventory count by 1,100 units, which could be material depending on the item value. Answer B is correct. Location display (A) and physical location (C) are operational concerns. Future ordering (D) is a downstream operational impact.

Question 5

An organization maintains a chart of accounts with 2,400 active GL accounts. During an audit, the auditor finds 340 accounts that have never been used in the 5 years since the ERP system was implemented. The most appropriate recommendation is:

  1. Delete all 340 unused accounts to simplify the financial reporting structure.
  2. No action required since unused accounts do not create risks.
  3. Review the unused accounts, inactivate those with no legitimate future business purpose, and document the disposition - reducing the COA complexity and eliminating potential vehicles for unauthorized transaction recording. (correct answer)
  4. Transfer all unused accounts to a contingency reserve category.
Explanation: Unused GL accounts should be reviewed and inactivated if no longer needed - they represent unnecessary complexity and potential avenues for posting unauthorized transactions. Answer C is correct. Immediate deletion (A) requires review first. Unused accounts can create fraud risk (B). Reclassification (D) doesn't address the control issue.

Question 6

An auditor reviews vendor master file change activity and finds that 3 new vendors were added, all within the same week, by the same AP clerk, with addresses in the same city, and all have received payments within 30 days of being added. This pattern is most consistent with:

  1. Normal vendor onboarding activity for a new geographic market.
  2. Automatic vendor creation triggered by EDI purchase orders.
  3. A potential fictitious vendor fraud scheme warranting detailed investigation of the new vendors, their payments, and the clerk's authorization. (correct answer)
  4. A data quality issue causing vendor records to be duplicated.
Explanation: The combination of rapid creation by a single individual, geographic clustering, and quick payments is a high-risk pattern for fictitious vendor fraud - the clerk may have created vendors they control to divert company payments. Answer C is correct. The pattern is too specific to be coincidental normal activity (A) or automated (B). Duplicates don't explain rapid new payments (D).

Question 7

A company's product master data includes standard cost information used for inventory valuation. An unauthorized change increases the standard cost of a component by 35%. What is the primary financial reporting risk?

  1. The inventory system will display incorrect location codes for affected items.
  2. Inventory balances and cost of goods sold will be materially misstated - overstated inventory and understated COGS (or vice versa) resulting from incorrect standard costs flowing through inventory valuation. (correct answer)
  3. The purchasing team will pay too much for the component in future periods.
  4. The system will trigger a variance alert that IT staff will need to investigate.
Explanation: Standard costs directly drive inventory valuation and COGS calculations - a 35% unauthorized change in standard cost produces material misstatement of both balance sheet inventory and income statement COGS. Answer B is correct. Location codes (A) are operational. Future purchasing (C) is a procurement concern. Variance alerts (D) may be a detective control but the primary risk is financial misstatement.

Question 8

Which of the following best describes the purpose of data ownership in a master data governance framework?

  1. Assigning accountability for the accuracy, completeness, and appropriate use of a master data domain to a specific business leader who is responsible for defining standards and resolving quality issues. (correct answer)
  2. Tracking which users last modified each master data record.
  3. Restricting read access to master data to the department that creates it.
  4. Ensuring each record has a unique identifier assigned by the IT department.
Explanation: Data ownership establishes accountability - the data owner (business leader) is responsible for the master data domain's quality, standards, and governance. Answer A is correct. Modification tracking (B) is audit logging. Access restriction (C) relates to access controls. Unique identifiers (D) are a technical data integrity measure.

Question 9

During an audit of product master data controls, the auditor finds that product prices in the master data file can be overridden at the time of sale by any sales representative. The primary risk of this configuration is:

  1. Products may be sold below the approved price, reducing profit margins without management authorization.
  2. Both A and a broader concern: unrestricted price overrides create risk of unauthorized discounts, potential collusion with customers, and revenue misstatement - all without management authorization. (correct answer)
  3. The product master file may become outdated if prices are frequently overridden.
  4. Sales representatives may spend too much time negotiating prices with customers.
Explanation: Unrestricted price overrides create multiple risks: unauthorized discounts reduce revenue and margin, potential fraud through customer collusion, and misstatement of revenue at non-approved prices. Answer B captures the full risk picture. Answer A is partially correct but incomplete. Product staleness (C) is a secondary concern. Time management (D) is not a control issue.

Question 10

An auditor discovers that three different employees in the accounts payable department can independently add, modify, and delete vendor records without any secondary approval. This represents:

  1. An efficient process allowing the AP team to respond quickly to vendor requests.
  2. A segregation of duties deficiency in vendor master data controls - unrestricted access to create, modify, and delete vendors increases the risk of fictitious vendor fraud and unauthorized changes. (correct answer)
  3. A normal configuration for accounts payable systems in most organizations.
  4. An acceptable risk since vendor master changes are reviewed in the monthly AP aging report.
Explanation: Unrestricted ability to create, modify, and delete vendor records in AP creates uncontrolled risk of fictitious vendor schemes - a classic fraud vector. Answer B is correct. Efficiency (A) does not justify the control gap. This is not normal best practice (C). Monthly aging reports (D) are detective controls that do not mitigate the preventive control gap.

Question 11

A company finds that its customer master file contains records for 800 customers who have had no transactions in the past three years. The most appropriate action is:

  1. Delete all inactive customer records immediately to clean up the database.
  2. Encrypt the inactive records to protect them from unauthorized access.
  3. Move all inactive records to a separate, unauthorized-access database.
  4. Review inactive records against retention policies and applicable regulatory requirements, archiving or inactivating records as appropriate while maintaining required records for the mandated period. (correct answer)
Explanation: Inactive master data should be managed through a formal review process - some records may need to be retained for regulatory or legal purposes while others can be archived or inactivated. Answer D is correct. Immediate deletion (A) may violate retention requirements. Encryption (B) doesn't address inactivity. Unauthorized database access (C) is not a data management control.

Question 12

Which of the following is the most effective control for detecting unauthorized changes to the vendor master file?

  1. An automated report comparing all vendor master file changes to approved change requests, with unexplained changes escalated to management for investigation. (correct answer)
  2. Encrypting all vendor records to prevent unauthorized modifications.
  3. Requiring all vendors to confirm their information annually by mail.
  4. Restricting access to vendor master data to read-only for all employees.
Explanation: Comparing master file changes to approved change requests is a detective control that identifies unauthorized modifications - directly linking changes to authorization evidence. Answer A is correct. Encryption (B) prevents reading, not modification by authorized users. Vendor confirmation (C) is a separate reconciliation process. Read-only access (D) prevents all changes including legitimate ones.

Question 13

An organization discovers that the same customer exists in its CRM, billing, and shipping systems under three different names with three different addresses. This is best described as a:

  1. Master data quality problem - duplicate and inconsistent records across systems indicate a lack of master data governance and a single authoritative source. (correct answer)
  2. System integration failure caused by API connectivity issues.
  3. User access control problem requiring additional access restrictions.
  4. Data encryption failure exposing customer data to unauthorized modification.
Explanation: Duplicate customer records with inconsistent data across systems is a master data quality problem - the classic symptom of inadequate MDM governance. Answer A is correct. API failures (B), access controls (C), and encryption (D) are unrelated to the described data consistency issue.

Question 14

Which of the following controls most directly prevents unauthorized additions to the vendor master file in an accounts payable system?

  1. Encrypting all vendor records in the vendor master file.
  2. Running monthly reports of all active vendors for management review.
  3. Requiring that all new vendor additions be approved by an authorized manager who is independent of the accounts payable processing function, with supporting documentation. (correct answer)
  4. Requiring vendors to sign a confidentiality agreement before being added.
Explanation: An authorization control requiring independent management approval for new vendor additions directly prevents unauthorized vendor creation - a key preventive control against fictitious vendor fraud. Answer C is correct. Encryption (A) protects confidentiality. Monthly reports (B) are detective controls. Confidentiality agreements (D) are legal controls, not data entry controls.

Question 15

A company's chart of accounts (COA) is a type of master data. Which of the following controls most directly ensures the accuracy and completeness of the COA for financial reporting purposes?

  1. A formal change control process requiring documentation, business justification, and appropriate management approval for all additions, modifications, or deletions of GL accounts. (correct answer)
  2. Encrypting the chart of accounts to prevent unauthorized viewing.
  3. Requiring all employees to verify the chart of accounts annually.
  4. Running an automated comparison of the COA to industry benchmarks each quarter.
Explanation: A formal change control process for the COA ensures changes are authorized and appropriate - preventing unauthorized account creation or modification that could misrepresent or obscure financial activity. Answer A is correct. Encryption (B) protects confidentiality. Employee verification (C) is not a standard COA control. Industry benchmarks (D) are strategic planning tools, not COA controls.

Question 16

An organization implements a data stewardship program for its customer master data. A data steward's primary responsibility for master data is to:

  1. Encrypt all customer records to comply with data privacy regulations.
  2. Back up the customer database on a daily basis.
  3. Monitor and enforce data quality standards, resolve duplicate and inconsistent records, and serve as the accountable party for the accuracy and integrity of customer master data. (correct answer)
  4. Restrict access to customer data to the sales department only.
Explanation: A data steward is the operational accountability role for master data quality - monitoring quality metrics, resolving issues, enforcing standards, and ensuring the data remains accurate and fit for use. Answer C is correct. Encryption (A), backup (B), and access restriction (D) are IT operations and security functions, not data stewardship roles.

Question 17

A company's price master data contains approved pricing for 50,000 products. An auditor finds that 127 products have negative prices in the master file. This represents:

  1. A data quality control failure - negative prices are likely data entry errors or unauthorized modifications that could result in customers being paid to purchase products, causing revenue and financial reporting errors. (correct answer)
  2. A system configuration setting allowing price promotions.
  3. Normal pricing variations within acceptable business rules.
  4. A minor finding since only 0.25% of products are affected.
Explanation: Negative prices in a product master file are a significant data quality error - they could result in credit invoices being generated instead of sales invoices, directly affecting revenue. Answer A is correct. Price promotions use discount structures, not negative prices (B). Negative prices are not normal (C). Financial impact of 127 products could be material (D).

Question 18

Which of the following represents the primary risk of maintaining outdated or inaccurate customer master data?

  1. The customer management system will require additional storage capacity.
  2. Customer service staff will have difficulty navigating the customer database.
  3. Billing errors, shipments to wrong addresses, incorrect tax calculations, and inaccurate accounts receivable records could result from using stale customer data in transactions. (correct answer)
  4. Marketing campaigns will be less effective due to outdated customer preferences.
Explanation: Inaccurate customer master data cascades through all downstream processes - billing, shipping, AR, tax calculations - because transactions reference master data at the time of processing. Answer C is correct. Storage capacity (A) and navigation difficulty (B) are operational concerns. Marketing effectiveness (D) is a business concern but not the primary data integrity risk.

Question 19

An organization's ERP system is configured to prevent the same bank account number from being assigned to more than one vendor. This system control is best described as:

  1. A processing control that validates bank account numbers after payments are made.
  2. An output control that generates alerts about suspicious vendor payments.
  3. An access control restricting which users can update vendor bank accounts.
  4. An input/master data validation control that prevents duplicate bank account numbers in the vendor master file - directly blocking a common fictitious vendor fraud technique. (correct answer)
Explanation: A uniqueness constraint on bank account numbers in the vendor master file is a preventive input control - blocking at the data entry stage the creation of multiple vendor records pointing to the same bank account. Answer D is correct. Processing controls (A) and output controls (B) operate after entry. Access controls (C) restrict users, not data values.

Question 20

Which of the following is the most important control over changes to the employee pay rate master data in a payroll system?

  1. Segregation of duties requiring that pay rate changes be initiated by HR and approved by management, with a separate reviewer comparing authorized rates to processed payroll. (correct answer)
  2. Encrypting all pay rate data to prevent unauthorized reading of salary information.
  3. Requiring employees to confirm their pay rate each month via a self-service portal.
  4. Archiving all historical pay rate data for regulatory compliance.
Explanation: Pay rate changes require segregation of duties: HR initiates based on approved changes, management approves, and an independent reviewer verifies payroll processed correctly - preventing unauthorized rate increases. Answer A is correct. Encryption (B) protects confidentiality. Employee self-service (C) is not an authorization control. Archiving (D) supports retention but not change authorization.