M02Q4. Which of the following best defines ‘internal control’?

The auditor’s tests to obtain reasonable assurance of over an entity’s objectives related to financial reporting, operations, and compliance with laws and regulations.

Activities performed by the entity related to support the reliability of the financial statement assertions and disclosures.

An entity’s processes to provide reasonable assurance over its objectives related to financial reporting, operations, and compliance with laws and regulations.

An entity’s processes to address all risks of misstatement related to financial reporting, operations, and compliance with laws and regulations.

M03Q2. Based on the scenario presented, which layers would be considered relevant to risk assessment?

Application, Database and Operating System.

Application and Operating System.

M03Q3. What areas does the engagement team document in the IT Understanding Screen?

How the entity uses IT as part of financial reporting and related business processes.

The entity’s IT organization.

The entity’s IT policies and procedures.

M03Q4. When do we use the SSC instructions and reporting templates in KAEG?

To document your evaluation of a service organization controls (SOC) report.

To communicate the nature, timing and extent of procedures performed by the SSC auditor on behalf of the group engagement team and/or SSC user auditors.

When a SOC report is not provided by the Service Organization.

When the SSC auditor identifies issues that may require an audit response.

M03Q6. When do we involve a team member with specialization in IT in response to a cybersecurity incident?

When an exception is noted during your testing of database access.

If an interface from an external source does not successfully complete.

When a cybersecurity incident at any layer comes to your attention during the audit.

When an terminated employee retains access privileges to a financially relevant application.

M04Q1. In what workflow screen/section can you add relevant process level automated controls?

Section 2.2.SO Service Organizations

M04Q2. Which of the following are PRPs? Select all that apply.

Vendor invoices with inaccurate quantities and/or pricing are recorded and paid to the vendor.

Purchase orders (POs) with inaccurate coding are expensed improperly.

Significant agreements contain embedded derivatives, leases, contingencies, guarantees, and/or consolidation issues that are not identified and accounted for appropriately.

M04Q3. Identify the relevant control attributes for the following control activity: Daily interface between the Policy Administration System and Data Warehouse transferring the premium and claims data related to policies.

Validation of transaction totals for sales and refunds.

Messaging to operations management if errors occurred during processing.

M04Q4. How does the consistency and/or frequency of control performance commonly affect the precision of an automated control?

The control is designed to operate consistently each time it is performed, however, the frequency is not routine, which indicates high precision.

The control is not designed to operate consistently each time it is performed and the frequency is not routine, which indicates high precision.

The control is not designed to operate consistently each time it is performed, however, the frequency is adequately routine, which indicates high precision.

The control is designed to operate consistently each time it is performed and the frequency is adequately routine, which indicates high precision.

M04Q6. What will drive most the extent of audit evidence we have to obtain when testing general IT controls?

Frequency of the control activity.

Knowledge and competence of the control owner.

The higher the risk associated with the automated control to which it is linked.

M04Q7. Which factors that may increase RAWTC above the inherent risk assessment are relevant to automated controls? Select all that apply.

Nature of the control is complex.

Control relies on the effectiveness of other controls.

Deficiencies identified in prior years.

Changes to control or process in which the control operates.

M04Q11. If choosing to not rely on relevant general IT controls, how would you determine the test frequency for the automated control? Select all that apply.

Assessment of inherent risk for the risks of material misstatement (RMMs).

Complexity of the IT environment.

Frequency of changes to the relevant IT layers.

Risk associated with the control (RAWTC) for the automated control.

M05Q1. Below are examples of RAFITs and PRPs. Which of the below examples are RAFITs. Select all that apply.

The automated interest expense calculation is not programmed to result in a complete and accurate recognition of interest expense.

Changes to IT system configurations do not function as intended.

Sales forecasts used in the inventory reserve calculation may not adequately reflect market conditions.

Logical access permissions are not revoked in a timely manner.

M05Q5. For the same control, which of the following RAFITs did you identify as relevant to the Oracle application layer? Select all that apply.

APD 1.1 – Identification and authentication mechanisms are not implemented to restrict logical access to IT systems and data.

APD 1.2 – Logical access permissions are granted to users and accounts (including shared or generic accounts) that are unauthorized or not commensurate with job responsibilities.

APD 1.3 – Logical access permissions are not revoked in a timely manner.

APD 1.4 – Logical access to users and accounts (including shared or generic accounts) that can perform privileged tasks and functions within IT systems is unauthorized or not commensurate with job responsibilities.

APD 1.5 – Physical access to facilities housing IT systems and/or electronic media is unauthorized or not commensurate with job responsibilities.

M05Q6. For the RAFITs identified as relevant in the previous question (APD1.1, 1.2, 1.3 and 1.4), which of the following GITCs would be relevant?

Management approves the nature and extent of user access privileges for new and modified user access, including standard application profiles/roles, critical financial reporting transactions, and segregation of duties.

Access for terminated or transferred users is removed or modified in a timely manner.

Access is authenticated through generic user IDs and passwords for validating that users are authorized to gain access to the system.

Privileged-level access (e.g. configuration, data and security administrators) is authorized and appropriately restricted.

M05Q7. Which of the following considerations might you have when identifying IT systems that are used to execute GITCs? Select all that apply.

Relevant GITCs that support the consistent effective operation of the automated controls.

Assessment of the knowledge and competence of those performing the control activity.

Identification of automated controls that entity’s management is relying on.

Assessment of layers of technology and RAFITs relevant to automated GITCs identified.

Assessment of the functionality of IT systems that enable GITCs.

M05Q8. There are 7 categories of automated controls within KAEG. Only 4 of these categories are relevant for automated GITCs and are able to be selected in the workflow. Which of the following are relevant? Select all that apply.

System access controls, including enforcing segregation of duties

Configuration of system generated reports or other data outputs

M06Q1. Consider a control activity where access for terminated or transferred users is removed or modified in a timely manner. Identify the relevant control attributes for the control activity. Select all that apply.

System access of the terminated/resigned user was revoked.

System access of the transferring user was revoked.

System access revocation was done within 1 day after the user's termination/resignation/ transfer date, in accordance with company policies and procedures.

Authorized personnel perform the quarterly user access review across IT systems to ensure revocation of access was performed as per management’s request.

M06Q2. You determine the RAWTC for GITCs by considering specific factors that may indicate the general IT control is ineffective. Identify the factors that could be used to determine RAWTC. Select all that apply.

The effectiveness of CERAMIC controls, especially controls that monitor other controls.

The competence of the personnel performing the general IT control or monitoring its performance.

The complexity of the general IT control and the significance of the judgments made about its operation.

The results of the previous years’ testing of the automated control to which the general IT control supports.

Whether there have been changes in the general IT control since it was previously tested.

M06Q3. Fill in the blank. For each automated control, you assess RAWTC for at least one GITC that supports the effective operation of the automated control _______.

At higher than the RAWTC for the related automated control.

At equal to the RAWTC for the related automated control.

At equal to or higher than the RAWTC for the related automated control.

At equal to or less than the RAWTC for the related automated control.

M06Q6. When documenting the testing procedures performed for an automated control, what are the from and through dates that should be entered?

The from date is the first day of the relevant financial year and the through date is the day of testing of the automated control.

The from and through dates are the same and are the day of testing the automated control.

The from date is the first day of the relevant financial year and the through date is the year end date.

The from date is the day of testing the automated control and the through date is the year end date.

M06Q7. When performing mitigating procedures in response to a GITC deficiency, where should this be documented in the Workflow?

Section 2.2.SO Service Organizations

Section 2.2.5 Response to deficient GITC

M06Q8. In the scenario you just documented in the Workflow, which RAFIT did the retrospective review control address?

CM1 - Unapproved changes to IT system program are implemented into the production environment.

CM2 - Changes to IT system program do not function as intended.

CM3 - Unapproved changes to IT system configurations are implemented into the production environment.

CM4 - Changes to IT system configurations do not function as intended.

CM5 - Logical access to implement changes to IT system program or configurations into the production environment is unauthorized or not commensurate with job responsibilities.

M07Q1. Which of the following are the first 2 steps of the process for information used in the audit? Select all that apply.

Identify information used in the audit

Identify information used in control activities

M07Q3. What are appropriate audit responses for information used in substantive procedures? Select all that apply.

Design and perform substantive procedures

Test entity management’s controls

M07Q4. Where in the Workflow do you document the audit response for information used in substantive procedures? Select all that apply.

Documentation within the procedure

M07Q5. Entity management uses the inventory turnover report to identify potentially obsolete inventory. In this example, how is the information used in the audit?

Subject of substantive procedures

Perform risk assessment procedures

M07Q6. What is the appropriate audit response for the inventory turnover report discussed in the last question? Select all that apply.

Substantive audit procedures to evaluate the source

Understand how the control operator is satisfied

The control procedure addresses reliability

IT Audit KCw課程

Authored by Lily Lin

Other

Professional Development

Used 11+ times

AI Actions

Add similar questions

Adjust reading levels

Convert to real-world scenario

Translate activity

More...

Content View

Student View

67 questions

Show all answers

MULTIPLE SELECT QUESTION

1 min • 1 pt

M01Q1. What tool do we use in the Workflow to allocate individuals with tasks and manage minimum review requirements?

Atlas

Briefcase

Engagement Management

Project Plan

MULTIPLE SELECT QUESTION

1 min • 1 pt

M01Q2. What is the name of the menu option we access in order to take us to the main area of the audit file where we begin our documentation?

Advanced Capabilities

Engagement Profile

Atlas

My Engagement

MULTIPLE SELECT QUESTION

1 min • 1 pt

M01Q3. What are the Workflow scaling options relevant to IT auditors?

Less Complex Audit Workflow, International-Enhanced, AICPA, PCAOB.

International-Core, International-Enhanced.

Less Complex Audit Workflow, International-Core, International-Enhanced, US.

Less Complex Audit Workflow, International-Core, International-Enhanced, AICPA, PCAOB.

MULTIPLE SELECT QUESTION

1 min • 1 pt

M01Q4. Compared to International-Enhanced, which of the following items are true of International-Core?

The information module differs.

Risks of material misstatement are not included.

The IT Understanding activity screen is not used.

Documentation of the precision of the control is not required.

MULTIPLE SELECT QUESTION

1 min • 1 pt

M02Q1. Which of the following best defines risks of misstatement?

Risks that could result in a misstatement to the financial statements.

Measurement of the level of risk attached to an assertion.

Our assessment of the measurement of risk attached to assertion level risks.

Risks with a significant possibility of resulting in a material misstatement to the financial statements.

MULTIPLE SELECT QUESTION

1 min • 1 pt

M02Q2. Which of the following best defines risks of material misstatement?

Measurement of the level of risk attached to an assertion.

Risks with a reasonable possibility of resulting in misstatements that are material to the financial statement audit.

Risks with an inherent risk level of Elevated or Significant.

Risks with a remote possibility of resulting in misstatements that are material to the financial statement audit.

MULTIPLE SELECT QUESTION

1 min • 1 pt

M02Q3. What are the levels of inherent risk? Select all that apply.

Low

Base

High

Significant

Elevated

Access all questions and much more by creating a free account

Create resources

Host any resource

Get auto-graded reports

Continue with Google

Continue with Email

Continue with Classlink

Continue with Clever

or continue with

Microsoft

Apple

Others

Already have an account?

Similar Resources on Wayground

65 questions

Prueba Aviación Civil Drones

Quiz

•

Professional Development

70 questions

WKF Kumite Test 1

Quiz

•

Professional Development

64 questions

Planeamiento Operacional Cap III Secc 12y3

Quiz

•

Professional Development

70 questions

HVAC FC 06

Quiz

•

Professional Development

62 questions

English - Book 12 Unit 3

Quiz

•

Professional Development

63 questions

2025 OPOS A1

Quiz

•

Professional Development

64 questions

PRAXIS 5362

Quiz

•

Professional Development

64 questions

P&C Basics

Quiz

•

Professional Development

Popular Resources on Wayground

8 questions

Spartan Way - Classroom Responsible

Quiz

•

9th - 12th Grade

15 questions

Fractions on a Number Line

Quiz

•

3rd Grade

14 questions

Boundaries & Healthy Relationships

Lesson

•

6th - 8th Grade

20 questions

Equivalent Fractions

Quiz

•

3rd Grade

3 questions

Integrity and Your Health

Lesson

•

6th - 8th Grade

25 questions

Multiplication Facts

Quiz

•

5th Grade

9 questions

FOREST Perception

Lesson

•

20 questions

Main Idea and Details

Quiz

•

5th Grade

Discover more resources for Other

15 questions

LOTE_SPN2 5WEEK3 Day 2 Itinerary

Quiz

•

Professional Development

6 questions

Copy of G5_U6_L5_22-23

Lesson

•

KG - Professional Dev...

10 questions

March Quiz

Quiz

•

Professional Development

5 questions

Copy of G5_U6_L8_22-23

Lesson

•

KG - Professional Dev...

10 questions

suffixes FUL OR LESS

Quiz

•

Professional Development

IT Audit KCw課程

M01Q1. What tool do we use in the Workflow to allocate individuals with tasks and manage minimum review requirements?

M01Q2. What is the name of the menu option we access in order to take us to the main area of the audit file where we begin our documentation?

M01Q3. What are the Workflow scaling options relevant to IT auditors?

M01Q4. Compared to International-Enhanced, which of the following items are true of International-Core?

M02Q1. Which of the following best defines risks of misstatement?

M02Q2. Which of the following best defines risks of material misstatement?

M02Q3. What are the levels of inherent risk? Select all that apply.

M02Q4. Which of the following best defines ‘internal control’?

M03Q1. During your audit engagements, what layers of technology do you commonly identify as relevant? Select all that apply.

M03Q2. Based on the scenario presented, which layers would be considered relevant to risk assessment?

Access all questions and much more by creating a free account

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Other