M04_Risk assessment – Business process

M04Q1. In what workflow screen/section can you add relevant process level automated controls?

• Section 2.2.2 IT Understanding

• Section 2.2.SO Service Organizations

• Section 3.3 Business processes

• Section 2.2.3 Fraud

M04Q2. Which of the following are PRPs? Select all that apply.

• Vendor invoices with inaccurate quantities and/or pricing are recorded and paid to the vendor.

• Purchase orders (POs) with inaccurate coding are expensed improperly.

• Significant agreements contain embedded derivatives, leases, contingencies, guarantees, and/or consolidation issues that are not identified and accounted for appropriately.

• Expenditures are overstated.

M04Q3. Identify the relevant control attributes for the following control activity: Daily interface between the Policy Administration System and Data Warehouse transferring the premium and claims data related to policies.

• Validation of transaction totals for sales and refunds.

• Validation of record counts.

• Messaging to operations management if errors occurred during processing.

• All of the above.

M04Q4. How does the consistency and/or frequency of control performance commonly affect the precision of an automated control?

• The control is designed to operate consistently each time it is performed, however, the frequency is not routine, which indicates high precision.

• The control is not designed to operate consistently each time it is performed and the frequency is not routine, which indicates high precision.

• The control is not designed to operate consistently each time it is performed, however, the frequency is adequately routine, which indicates high precision.

• The control is designed to operate consistently each time it is performed and the frequency is adequately routine, which indicates high precision.

M04Q5. The definition of control attributes are the specific procedures performed by the control operator that make-up the control activity and are important to the design of the control?

• Yes

• No

M04Q6. What will drive most the extent of audit evidence we have to obtain when testing general IT controls?

• Number of GITCs identified.

• Frequency of the control activity.

• Knowledge and competence of the control owner.

• The higher the risk associated with the automated control to which it is linked.

M04Q7. Which factors that may increase RAWTC above the inherent risk assessment are relevant to automated controls? Select all that apply.

• A. Nature of the control is complex.

• B. Control relies on the effectiveness of other controls.

• C. Deficiencies identified in prior years.

• D. Control operates infrequently.

• E. Changes to control or process in which the control operates.

M04Q8. For scenario 1, what level of RAWTC did you think was appropriate?

• Base

• Elevated

• Significant

• Significant +

M04Q9. For scenario 2, what level of RAWTC did you think was appropriate?

• Base

• Elevated

• Significant

• Significant +

M04Q10. Has anyone ever relied on the consistent operation of automated controls without testing relevant GITCs?

• Yes

• No