CPA Quiz: Tests Of Controls
20 questions · exam conditions
0:00
Tests Of ControlsQuestion 1 of 20

You are the auditor of a nonissuer in a financial statement audit and plan to rely on controls over the revenue process to reduce substantive testing. The entity uses pre-numbered shipping documents, and a supervisor is expected to review a daily sales register and match it to shipping documents before invoices are posted. Under these circumstances, which test would best determine the effectiveness of controls over the occurrence of recorded sales?

Perform a substantive analytical procedure comparing monthly revenue trends to prior periods and investigate significant variances.
Select a sample of recorded sales entries and vouch each to an approved shipping document that evidences shipment before invoicing.
Obtain management's written representation that all recorded sales occurred and were authorized.
Confirm a sample of year-end accounts receivable balances with customers to support existence of receivables.
← Back to quizzes

CPA Quiz

CPA Quiz: Tests Of Controls

Practice Tests Of Controls in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Tests Of Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

You are the auditor of a nonissuer in a financial statement audit and plan to rely on controls over the revenue process to reduce substantive testing. The entity uses pre-numbered shipping documents, and a supervisor is expected to review a daily sales register and match it to shipping documents before invoices are posted. Under these circumstances, which test would best determine the effectiveness of controls over the occurrence of recorded sales?

  1. Perform a substantive analytical procedure comparing monthly revenue trends to prior periods and investigate significant variances.
  2. Select a sample of recorded sales entries and vouch each to an approved shipping document that evidences shipment before invoicing. (correct answer)
  3. Obtain management's written representation that all recorded sales occurred and were authorized.
  4. Confirm a sample of year-end accounts receivable balances with customers to support existence of receivables.
Explanation: This question tests the auditor's understanding of tests of controls over the occurrence assertion for revenue transactions, as outlined in AU-C 330. The key fact is that the entity has a control requiring supervisor review of daily sales registers matched to shipping documents before invoice posting, and the auditor wants to test whether this control effectively prevents fictitious sales. Vouching recorded sales entries to approved shipping documents (Choice B) directly tests whether the control ensures sales are supported by actual shipments, which addresses the occurrence assertion. Analytical procedures (Choice A) are substantive procedures, not tests of controls, and cannot evaluate whether specific control activities operated effectively. Management representations (Choice C) provide limited evidence about control effectiveness and cannot replace the auditor's testing. Confirming receivables (Choice D) tests existence of receivables, not the operating effectiveness of controls over sales occurrence. When testing controls over transaction occurrence, the auditor should select a sample of recorded transactions and examine evidence that the control activity was performed.

Question 2

During a financial statement audit of a nonissuer, you identify that the same individual can set up new vendors in the master file and also process vendor payments, and management asserts that a monthly review of the vendor change report by the controller mitigates the risk. Under these circumstances, what is the auditor's best approach to evaluate whether the mitigating control is operating effectively?

  1. Test a sample of monthly vendor change reports for evidence of controller review and follow-up of unusual items, including investigation documentation. (correct answer)
  2. Assume the review control is effective because it is performed by the controller and therefore reduce substantive testing to a minimum.
  3. Perform confirmations of year-end accounts payable only, because confirmations replace the need to test mitigating controls.
  4. Document the segregation of duties deficiency and issue an adverse opinion on internal control over financial reporting.
Explanation: This question addresses testing mitigating controls when segregation of duties deficiencies exist, as outlined in AU-C 265 and AU-C 330. The key fact is that one person can both set up vendors and process payments, creating fraud risk that management claims is mitigated by controller review of vendor changes. Testing monthly vendor change reports for evidence of controller review and investigation documentation (Choice A) evaluates whether the mitigating control operates effectively to detect unauthorized vendor additions. Assuming effectiveness based on position (Choice B) violates professional skepticism and testing requirements. Confirmations alone (Choice C) are substantive procedures that cannot evaluate control effectiveness and don't address the specific segregation risk. Issuing an adverse opinion (Choice D) is premature without first testing whether mitigating controls are effective, and applies only to integrated audits of issuers. When segregation of duties is lacking, the auditor must test whether compensating controls effectively mitigate the increased risk, requiring inspection of evidence that reviews occurred and exceptions were investigated.

Question 3

In a financial statement audit of a nonissuer, you plan to rely on controls over the purchasing process. The control states that accounts payable will only record a vendor invoice when it is matched to an approved purchase order and receiving report (three-way match), and the accounts payable supervisor reviews an exception report of unmatched items weekly. What is the most appropriate procedure for evaluating the operating effectiveness of this control?

  1. Inspect a sample of recorded vendor invoices for evidence of three-way match and supervisor review of exceptions, including dates and signatures. (correct answer)
  2. Recalculate the year-end accounts payable balance and compare it to the prior year to identify unusual fluctuations.
  3. Assess inherent risk as low because the entity has a formal purchasing policy and therefore reduce control testing.
  4. Wait until after the audit report date to test the control to ensure it operated throughout the entire period.
Explanation: This question addresses testing the operating effectiveness of a three-way match control and supervisory review, as required by AU-C 330 for controls the auditor intends to rely upon. The control involves matching vendor invoices to purchase orders and receiving reports, with supervisor review of exceptions, requiring the auditor to inspect evidence that these activities occurred. Inspecting a sample of recorded invoices for evidence of the three-way match and dated supervisor signatures (Choice A) provides direct evidence that the control operated as designed throughout the period. Recalculating balances (Choice B) is a substantive procedure that cannot evaluate control effectiveness. Assessing inherent risk as low (Choice C) violates professional standards because inherent risk assessment is independent of controls, and control testing cannot be reduced based on policies alone. Testing controls after report date (Choice D) is inappropriate because controls must be tested during the period under audit. The auditor must obtain evidence through inspection, observation, inquiry, and reperformance that controls operated effectively throughout the period of intended reliance.

Question 4

You are auditing an issuer and identified a segregation of duties control in the purchasing process: purchasing creates purchase orders, receiving confirms quantities received, and accounts payable records invoices; system roles are intended to prevent one user from performing incompatible duties. Which procedure is most appropriate to test the operating effectiveness of this segregation of duties control?

  1. Test user access and role assignments by inspecting role matrices and selecting users to verify they do not have incompatible permissions, and corroborate through system logs where applicable (correct answer)
  2. Inspect a sample of paid invoices and conclude segregation of duties is effective if invoices appear properly supported
  3. Perform only a walkthrough of one purchase transaction because segregation of duties is assessed through design only
  4. Rely on management's policy statement describing segregation of duties because system access is controlled by IT
Explanation: This question addresses testing segregation of duties via system roles in an issuer's audit, per PCAOB AS 2201. The control prevents incompatible permissions. Choice A is appropriate by inspecting matrices and logs, aligning with AS 2201. Choice B tests invoices substantively per AS 2301, while Choice C limits to walkthroughs, insufficient for effectiveness per AS 2110. Choice D relies on policy, not evidence per AS 2201. A decision rule is to verify roles against actual access logs. This framework confirms effective segregation for risk mitigation.

Question 5

In a financial statement audit of a nonissuer, the entity has a control requiring two signatures on checks over $10,000, with the second signature provided by the CFO after reviewing supporting documentation. You plan to rely on this control to reduce substantive testing of disbursements. Which test would best determine the effectiveness of the CFO's review as part of the dual-signature control?

  1. Inspect a sample of canceled checks over $10,000 for two signatures and examine the related support to assess whether the CFO's review was meaningful (correct answer)
  2. Reconcile total disbursements per bank statement to the general ledger and treat the reconciliation as a test of the dual-signature control
  3. Confirm the cash balance with the bank and conclude the dual-signature control operated effectively if the confirmation agrees
  4. Test only the design of the dual-signature policy because operating effectiveness is addressed through substantive procedures
Explanation: This question evaluates testing review controls in disbursements for a nonissuer audit, per AU-C 330. The dual-signature policy includes CFO review of support for checks over $10,000. Choice A is correct by inspecting signatures and assessing review meaningfulness, aligning with AU-C 330. Choice B is a reconciliation test, not specific to the control per AU-C 330, while Choice C is confirmation, substantive per AU-C 505. Choice D limits to design, but operating effectiveness is required per AU-C 330. Auditors should evaluate the depth of reviews beyond signatures for effectiveness. A transferable framework is to test both execution and substance of approval controls.

Question 6

You are auditing a nonissuer in a financial statement audit and plan to use a system-generated aged accounts receivable report for both tests of controls and substantive procedures. Management asserts that access to the accounts receivable aging report is restricted and that user access is reviewed quarterly by IT. Under these circumstances, which procedure is most appropriate for evaluating the effectiveness of the related IT general control over access?

  1. Inspect a sample of quarterly user access review documentation for evidence of review, timely removal of terminated users, and resolution of exceptions. (correct answer)
  2. Perform positive confirmations of accounts receivable balances to validate the accuracy of the aged receivables report.
  3. Rely on the service organization's Type 1 report to conclude that access controls operated effectively throughout the year.
  4. Test access controls only by inquiry because inspection could compromise system security.
Explanation: This question addresses IT general controls over system access, which are critical when relying on system-generated reports for audit procedures per AU-C 315 and AU-C 330. The control involves quarterly user access reviews by IT, and the auditor needs evidence these reviews effectively maintain appropriate access restrictions. Inspecting quarterly review documentation for evidence of review, terminated user removal, and exception resolution (Choice A) directly tests whether the access control operated effectively throughout the period. Confirming receivables (Choice B) is a substantive procedure unrelated to IT access controls. Type 1 reports (Choice C) only describe controls at a point in time and provide no evidence of operating effectiveness throughout the period. Testing by inquiry only (Choice D) provides insufficient evidence for IT controls and the security concern is unfounded when properly coordinated. The auditor must inspect documentation showing that access reviews occurred, identified issues like terminated employees, and resulted in timely remediation to maintain system integrity.

Question 7

You are auditing a nonissuer in a financial statement audit and plan to rely on management's monitoring control over bank reconciliations. The control is that the accounting manager prepares monthly bank reconciliations and the controller reviews and approves them, investigating reconciling items over $5,000. Which procedure is most appropriate for testing the operating effectiveness of this monitoring control?

  1. Inspect a sample of monthly bank reconciliations for evidence of timely preparation and documented controller review, and reperform the follow-up on selected reconciling items over $5,000. (correct answer)
  2. Send bank confirmations to all banks used by the client to obtain year-end balances and compare them to the general ledger.
  3. Inquire of the controller whether bank reconciliations are reviewed and conclude the control is effective if responses are consistent.
  4. Test the control only at year-end because interim testing is not permitted for monitoring controls.
Explanation: This question tests understanding of monitoring controls over bank reconciliations, which are detective controls requiring evidence of both performance and review per AU-C 330. The control involves accounting manager preparation and controller review with investigation of items over $5,000, requiring the auditor to test both components. Inspecting reconciliations for timely preparation, documented review, and reperforming follow-up on large items (Choice A) provides evidence that the monitoring control operated effectively including the investigation component. Bank confirmations (Choice B) are substantive procedures that verify balances but cannot evaluate control effectiveness. Inquiry alone (Choice C) provides limited evidence and must be corroborated with inspection or reperformance for controls testing. Testing only at year-end (Choice D) is incorrect because monitoring controls can and should be tested throughout the period, with appropriate roll-forward procedures. The auditor must obtain evidence through inspection and reperformance that monitoring controls not only occurred but also identified and resolved exceptions appropriately.

Question 8

In a financial statement audit of a nonissuer, you plan to rely on a control environment element: the audit committee's oversight of financial reporting. Management states the audit committee meets quarterly and reviews significant accounting estimates and journal entries. Which factor most likely indicates a weakness in the control environment that could reduce the auditor's ability to rely on controls?

  1. The audit committee includes members with financial reporting expertise and documents meeting minutes with follow-up actions.
  2. The audit committee's meeting minutes are prepared, reviewed, and approved by the chief financial officer without audit committee review. (correct answer)
  3. The audit committee meets more frequently during the year of a significant acquisition to address new reporting risks.
  4. The audit committee reviews a summary of uncorrected misstatements and discusses qualitative factors with the auditor.
Explanation: This question addresses control environment assessment, specifically audit committee oversight as described in AU-C 315. The control environment sets the tone at the top and influences control consciousness throughout the organization, with audit committee oversight being a critical element. Having the CFO prepare, review, and approve audit committee minutes without committee review (Choice B) represents a significant weakness because it compromises the independence and effectiveness of audit committee oversight. Financial expertise and documented follow-up (Choice A) strengthen the control environment. Increased meeting frequency for acquisitions (Choice C) demonstrates responsive oversight. Reviewing uncorrected misstatements with qualitative discussions (Choice D) shows active engagement in financial reporting oversight. When the audit committee's independence is compromised by management controlling its documentation, the auditor cannot rely on this control environment element. The auditor should assess whether this weakness affects the ability to rely on other controls and may need to increase substantive procedures.

Question 9

In a financial statement audit of a nonissuer, you identified a key control over completeness of sales: the billing supervisor reviews a daily unmatched shipping report (shipments not yet invoiced) and ensures invoices are generated or issues are resolved, documenting actions taken. Which procedure is most appropriate to test the operating effectiveness of this control?

  1. Inspect a sample of daily unmatched shipping reports for evidence of review and trace selected items to subsequent invoicing or documented resolution (correct answer)
  2. Perform a cutoff test at year-end only because daily controls are not tested throughout the year
  3. Confirm accounts receivable balances and conclude sales completeness controls are effective if confirmations agree
  4. Reperform the entire billing process for one day and treat that as sufficient evidence for the full year
Explanation: This question covers testing completeness controls in sales for a nonissuer audit, per AU-C 330. The daily review of unmatched shipments ensures invoicing. Choice A is appropriate by inspecting reports and tracing resolutions, aligning with AU-C 330. Choice B limits to year-end, ignoring period coverage per AU-C 330, while Choice C is substantive per AU-C 505. Choice D tests one day only, insufficient for the year. Auditors should sample across periods for ongoing controls. A decision rule is to trace exceptions to resolution for effectiveness.

Question 10

You are auditing an issuer and plan to rely on a control over estimates: the controller reviews the allowance for credit losses calculation quarterly, comparing key assumptions to historical write-offs and current economic data, and documents conclusions. Which procedure is most appropriate to test the operating effectiveness of this review control?

  1. Inspect a sample of quarterly reviews for evidence of the controller's documented evaluation of assumptions and follow-up on significant changes (correct answer)
  2. Recalculate the allowance at year-end and, if your estimate is close to management's, conclude the review control operated effectively
  3. Obtain an external credit report and treat it as evidence that management's review control is effective
  4. Delay testing until after issuing the audit report because estimate reviews are tested at completion only
Explanation: This question addresses testing review controls over accounting estimates in an issuer's audit, per PCAOB AS 2201. The quarterly review of allowance assumptions is documented with conclusions. Choice A is appropriate by inspecting evaluations and follow-up, aligning with AS 2201. Choice B is substantive recalculation per AS 2501, while Choice C uses external evidence inappropriately. Choice D delays testing; controls must be tested during the audit per AS 2201. A framework is to assess the precision of assumption reviews against standards. This ensures estimates are reliable for financial reporting.

Question 11

You are auditing an issuer and identified a key control over financial reporting: the audit committee reviews quarterly financial statements and discusses significant accounting estimates with management. You plan to evaluate this as part of the control environment and monitoring components. Which procedure is most appropriate to test the effectiveness of this control?

  1. Inspect audit committee minutes and related materials to verify the committee reviewed the quarterly statements and challenged significant estimates, including follow-up actions (correct answer)
  2. Obtain a management representation letter stating the audit committee performed its oversight responsibilities
  3. Perform substantive analytical procedures over quarterly results and treat consistent trends as evidence of effective audit committee oversight
  4. Communicate directly with the SEC to confirm the audit committee performed the review control
Explanation: This question evaluates testing governance controls like audit committee oversight in an issuer's audit, per PCAOB AS 2201 and AS 1301. The committee reviews quarterly statements and estimates. Choice A is correct by inspecting minutes and verifying challenges, aligning with AS 2201. Choice B relies on representations, insufficient per AS 2805, while Choice C is substantive per AS 2305. Choice D is inappropriate; auditors do not contact regulators for control evidence. A framework is to corroborate meeting discussions with actions taken. This supports control environment assessment for reliance.

Question 12

You are auditing an issuer and plan to rely on a control over revenue recognition for contracts with variable consideration. The control requires a technical accounting memo prepared by accounting, reviewed and approved by the revenue recognition manager, and retained with the contract file before revenue is recorded. Which test would best determine the operating effectiveness of this control?

  1. Select a sample of contracts with variable consideration and inspect the contract file for the memo and evidence of review/approval prior to revenue recognition (correct answer)
  2. Compare total revenue to the prior year and conclude the control is effective if growth is consistent with budget
  3. Confirm contract terms with customers and treat confirmations as evidence the internal approval control operated effectively
  4. Rely on inquiry of the revenue recognition manager because the memo is a management review control
Explanation: This question tests controls over revenue recognition with variable consideration in an issuer's audit, per PCAOB AS 2201. The control requires a reviewed memo before recording. Choice A aligns by inspecting memos and approvals, per AS 2201. Choice B is analytical, not control testing per AS 2305, while Choice C is substantive confirmation per AS 2310. Choice D is inquiry-only, insufficient per AS 2110. A framework is to verify documentation and timing of approvals. This ensures accurate revenue under ASC 606.

Question 13

In a financial statement audit of a nonissuer, you plan to rely on a control where the accounting supervisor reviews and approves all customer credit memos before they are processed, to address the risk of unauthorized sales returns and revenue reduction. Which procedure is most appropriate to test the effectiveness of this control?

  1. Select a sample of credit memos and inspect for evidence of supervisor approval prior to processing, and evaluate whether supporting documentation was reviewed (correct answer)
  2. Confirm accounts receivable balances and treat customer responses as evidence that credit memo approvals were effective
  3. Perform substantive analytical procedures on sales returns and conclude the approval control is effective if returns are stable
  4. Test the approval control only at year-end because credit memos are not relevant at interim
Explanation: This question evaluates approval controls over credit memos in a nonissuer audit, per AU-C 330. The supervisor reviews and approves to prevent unauthorized reductions. Choice A aligns by inspecting approvals and support, per AU-C 330. Choice B is confirmation, substantive per AU-C 505, while Choice C is analytical per AU-C 520. Choice D delays improperly; interim testing is allowed per AU-C 330. Auditors should assess approval timeliness and documentation. A transferable rule is to sample high-risk items for review depth.

Question 14

In a financial statement audit of a nonissuer, you tested controls over sales returns at interim and plan to rely on those controls through year-end. The control is that the credit manager approves all sales return authorizations, and evidence of approval is retained in the system. What is the auditor's best approach to address the period between interim testing and year-end?

  1. Perform roll-forward tests by selecting additional sales return authorizations from the remaining period and inspecting for credit manager approval. (correct answer)
  2. Do not perform additional procedures because interim testing always provides sufficient evidence for the entire year.
  3. Replace further control testing with a management representation that controls continued to operate effectively after interim.
  4. Delay all control testing until after the financial statements are issued to ensure the entire period is covered.
Explanation: This question tests understanding of roll-forward procedures when controls are tested at interim, as required by AU-C 330 when relying on controls for the entire period. The auditor tested sales return authorization controls at interim and needs evidence that controls continued operating effectively through year-end. Performing roll-forward tests by selecting additional transactions from the remaining period (Choice A) provides evidence that controls continued to operate effectively after interim testing. Assuming sufficiency without additional work (Choice B) violates professional standards requiring evidence for the entire period of reliance. Management representations (Choice C) cannot replace required roll-forward testing. Delaying all testing until after issuance (Choice D) is impractical and untimely. When testing controls at interim, the auditor must perform procedures to extend conclusions through period-end, including inquiry about changes, observation of current operations, and testing additional transactions. The extent of roll-forward procedures depends on the length of the remaining period, control significance, and any identified changes.

Question 15

During a financial statement audit of a nonissuer, management emphasizes meeting earnings targets and has recently reduced the internal audit budget. You are considering the impact of the control environment on the effectiveness of other controls you plan to test. Which factor most likely indicates a weakness in the control environment that could affect reliance on controls?

  1. Senior management frequently overrides established approval limits for significant transactions without documented rationale (correct answer)
  2. The entity uses a standard chart of accounts and closes the books within five business days
  3. The audit committee meets quarterly and reviews the external auditor's engagement letter annually
  4. Accounting policies are documented and available to staff on an internal website
Explanation: This question evaluates the control environment's impact on other controls in a nonissuer audit, per AU-C 315. Management's emphasis on earnings and budget cuts signal potential weaknesses. Choice A indicates a weakness through frequent overrides without rationale, aligning with AU-C 315's risk factors for control environment deficiencies. Choices B, C, and D describe neutral or positive factors, not weaknesses per AU-C 315. Auditors should assess tone at the top and override frequency to gauge environment strength. A decision rule is to identify indicators like management overrides as red flags affecting overall control reliance.

Question 16

An auditor is testing the operating effectiveness of a client's control over the approval of credit memos. The control requires a credit manager's signature on all credit memos exceeding $1,000. Which of the following audit procedures provides the most persuasive evidence that this control is operating effectively?

  1. Inquiring of the accounts receivable clerk about the process for obtaining credit memo approvals.
  2. Observing the credit manager signing credit memos during a one-hour period.
  3. Selecting a sample of sales invoices and vouching them to shipping documents.
  4. Selecting a sample of recorded credit memos and examining them for the credit manager's signature. (correct answer)
Explanation: The correct answer is D. Selecting a sample of issued credit memos and examining them for proper authorization (the manager's signature) directly tests whether the control was performed. This is a form of inspection. Choice A, inquiry, is not sufficient on its own. Choice B, observation, only provides evidence for the moment in time the auditor is observing. Choice C is a substantive test of details related to the occurrence of sales, not a test of the control over credit memo approval.

Question 17

An auditor tested a client's controls at an interim date and concluded that they were operating effectively. To support this conclusion for the entire audit period, the auditor should perform additional tests of controls for the remaining period. Which of the following factors would most likely lead the auditor to extend the testing of controls for the remaining period?

  1. The control is an automated control that has not changed since the interim testing.
  2. The auditor obtained a new management representation letter at year-end.
  3. The results of substantive procedures performed at year-end were consistent with expectations.
  4. Significant changes were made to the control environment during the remaining period. (correct answer)
Explanation: The correct answer is D. If significant changes occurred in the control environment, IT systems, or specific control procedures during the period after interim testing, the auditor cannot rely on the interim test results and must perform additional tests. Choice A would decrease the need for extensive roll-forward testing. Choice B, a management representation letter, does not provide evidence about control effectiveness. Choice C is a result of the overall audit process and does not directly inform the need to extend tests of controls.

Question 18

An auditor of a nonissuer is considering using evidence about the operating effectiveness of certain controls obtained in a prior year's audit. Under which circumstance would it be most appropriate for the auditor to rely on this prior-period evidence?

  1. The control is related to a significant risk identified in the current year.
  2. The control is a manual control that relies heavily on management judgment.
  3. The control is an automated application control that has not been changed since the prior audit. (correct answer)
  4. The client has experienced significant employee turnover in the relevant department.
Explanation: The correct answer is C. Evidence from a prior audit may be used for controls that have not changed, particularly automated controls, because they are inherently consistent. The auditor would still need to test the related IT general controls in the current period. Auditing standards require testing controls related to significant risks (A) in the current period. Manual controls (B) and situations with high turnover (D) increase risk and necessitate current-period testing.

Question 19

An auditor is evaluating the effectiveness of a client's segregation of duties between the cash handling and record-keeping functions. Which of the following audit procedures would be most appropriate?

  1. Reviewing the year-end bank reconciliation.
  2. Observing the employees performing their assigned duties. (correct answer)
  3. Examining a sample of canceled checks for proper endorsement.
  4. Inquiring with the controller about the assigned responsibilities.
Explanation: The correct answer is B. Observation is the most effective procedure for testing a control that depends on the segregation of duties. By watching the employees perform their tasks, the auditor can determine whether the person handling cash is also responsible for recording it. Inquiry (D) alone is insufficient. Reviewing bank reconciliations (A) or canceled checks (C) may reveal misstatements that resulted from a lack of segregation, but they do not directly test the performance of the control itself.

Question 20

A client uses a service organization to process its payroll. The auditor of the client company plans to rely on the controls at the service organization. What type of report from the service auditor would provide the most appropriate evidence of the operating effectiveness of these controls?

  1. A SOC 1, Type 1 report.
  2. A SOC 1, Type 2 report. (correct answer)
  3. A SOC 2, Type 1 report.
  4. An agreed-upon procedures report.
Explanation: The correct answer is B. A SOC 1 report deals with internal controls over financial reporting. A Type 2 report includes the service auditor's opinion on the fairness of the presentation of management's description of the service organization's system and the suitability of the design and operating effectiveness of the controls. A Type 1 report only covers the design of controls at a point in time. A SOC 2 report relates to controls over security, availability, processing integrity, confidentiality, or privacy, which are less relevant to financial statement audit reliance. An agreed-upon procedures report (D) does not provide an opinion or assurance.