M02Q4. Which of the following best defines ‘internal control’?

The auditor’s tests to obtain reasonable assurance of over an entity’s objectives related to financial reporting, operations, and compliance with laws and regulations.

Activities performed by the entity related to support the reliability of the financial statement assertions and disclosures.

An entity’s processes to provide reasonable assurance over its objectives related to financial reporting, operations, and compliance with laws and regulations.

An entity’s processes to address all risks of misstatement related to financial reporting, operations, and compliance with laws and regulations.

M03Q2. Based on the scenario presented, which layers would be considered relevant to risk assessment?

Application, Database and Operating System.

Application and Operating System.

M03Q3. What areas does the engagement team document in the IT Understanding Screen?

How the entity uses IT as part of financial reporting and related business processes.

The entity’s IT organization.

The entity’s IT policies and procedures.

M03Q4. When do we use the SSC instructions and reporting templates in KAEG?

To document your evaluation of a service organization controls (SOC) report.

To communicate the nature, timing and extent of procedures performed by the SSC auditor on behalf of the group engagement team and/or SSC user auditors.

When a SOC report is not provided by the Service Organization.

When the SSC auditor identifies issues that may require an audit response.

M03Q6. When do we involve a team member with specialization in IT in response to a cybersecurity incident?

When an exception is noted during your testing of database access.

If an interface from an external source does not successfully complete.

When a cybersecurity incident at any layer comes to your attention during the audit.

When an terminated employee retains access privileges to a financially relevant application.

M04Q1. In what workflow screen/section can you add relevant process level automated controls?

Section 2.2.SO Service Organizations

M04Q2. Which of the following are PRPs? Select all that apply.

Vendor invoices with inaccurate quantities and/or pricing are recorded and paid to the vendor.

Purchase orders (POs) with inaccurate coding are expensed improperly.

Significant agreements contain embedded derivatives, leases, contingencies, guarantees, and/or consolidation issues that are not identified and accounted for appropriately.

M04Q3. Identify the relevant control attributes for the following control activity: Daily interface between the Policy Administration System and Data Warehouse transferring the premium and claims data related to policies.

Validation of transaction totals for sales and refunds.

Messaging to operations management if errors occurred during processing.

M04Q4. How does the consistency and/or frequency of control performance commonly affect the precision of an automated control?

The control is designed to operate consistently each time it is performed, however, the frequency is not routine, which indicates high precision.

The control is not designed to operate consistently each time it is performed and the frequency is not routine, which indicates high precision.

The control is not designed to operate consistently each time it is performed, however, the frequency is adequately routine, which indicates high precision.

The control is designed to operate consistently each time it is performed and the frequency is adequately routine, which indicates high precision.

M04Q6. What will drive most the extent of audit evidence we have to obtain when testing general IT controls?

Frequency of the control activity.

Knowledge and competence of the control owner.

The higher the risk associated with the automated control to which it is linked.

M04Q7. Which factors that may increase RAWTC above the inherent risk assessment are relevant to automated controls? Select all that apply.

Nature of the control is complex.

Control relies on the effectiveness of other controls.

Deficiencies identified in prior years.

Changes to control or process in which the control operates.

M04Q11. If choosing to not rely on relevant general IT controls, how would you determine the test frequency for the automated control? Select all that apply.

Assessment of inherent risk for the risks of material misstatement (RMMs).

Complexity of the IT environment.

Frequency of changes to the relevant IT layers.

Risk associated with the control (RAWTC) for the automated control.

M05Q1. Below are examples of RAFITs and PRPs. Which of the below examples are RAFITs. Select all that apply.

The automated interest expense calculation is not programmed to result in a complete and accurate recognition of interest expense.

Changes to IT system configurations do not function as intended.

Sales forecasts used in the inventory reserve calculation may not adequately reflect market conditions.

Logical access permissions are not revoked in a timely manner.

M05Q5. For the same control, which of the following RAFITs did you identify as relevant to the Oracle application layer? Select all that apply.

APD 1.1 – Identification and authentication mechanisms are not implemented to restrict logical access to IT systems and data.

APD 1.2 – Logical access permissions are granted to users and accounts (including shared or generic accounts) that are unauthorized or not commensurate with job responsibilities.

APD 1.3 – Logical access permissions are not revoked in a timely manner.

APD 1.4 – Logical access to users and accounts (including shared or generic accounts) that can perform privileged tasks and functions within IT systems is unauthorized or not commensurate with job responsibilities.

APD 1.5 – Physical access to facilities housing IT systems and/or electronic media is unauthorized or not commensurate with job responsibilities.

M05Q6. For the RAFITs identified as relevant in the previous question (APD1.1, 1.2, 1.3 and 1.4), which of the following GITCs would be relevant?

Management approves the nature and extent of user access privileges for new and modified user access, including standard application profiles/roles, critical financial reporting transactions, and segregation of duties.

Access for terminated or transferred users is removed or modified in a timely manner.

Access is authenticated through generic user IDs and passwords for validating that users are authorized to gain access to the system.

Privileged-level access (e.g. configuration, data and security administrators) is authorized and appropriately restricted.

M05Q7. Which of the following considerations might you have when identifying IT systems that are used to execute GITCs? Select all that apply.

Relevant GITCs that support the consistent effective operation of the automated controls.

Assessment of the knowledge and competence of those performing the control activity.

Identification of automated controls that entity’s management is relying on.

Assessment of layers of technology and RAFITs relevant to automated GITCs identified.

Assessment of the functionality of IT systems that enable GITCs.

M05Q8. There are 7 categories of automated controls within KAEG. Only 4 of these categories are relevant for automated GITCs and are able to be selected in the workflow. Which of the following are relevant? Select all that apply.

System access controls, including enforcing segregation of duties

Configuration of system generated reports or other data outputs

M06Q1. Consider a control activity where access for terminated or transferred users is removed or modified in a timely manner. Identify the relevant control attributes for the control activity. Select all that apply.

System access of the terminated/resigned user was revoked.

System access of the transferring user was revoked.

System access revocation was done within 1 day after the user's termination/resignation/ transfer date, in accordance with company policies and procedures.

Authorized personnel perform the quarterly user access review across IT systems to ensure revocation of access was performed as per management’s request.

M06Q2. You determine the RAWTC for GITCs by considering specific factors that may indicate the general IT control is ineffective. Identify the factors that could be used to determine RAWTC. Select all that apply.

The effectiveness of CERAMIC controls, especially controls that monitor other controls.

The competence of the personnel performing the general IT control or monitoring its performance.

The complexity of the general IT control and the significance of the judgments made about its operation.

The results of the previous years’ testing of the automated control to which the general IT control supports.

Whether there have been changes in the general IT control since it was previously tested.

M06Q3. Fill in the blank. For each automated control, you assess RAWTC for at least one GITC that supports the effective operation of the automated control _______.

At higher than the RAWTC for the related automated control.

At equal to the RAWTC for the related automated control.

At equal to or higher than the RAWTC for the related automated control.

At equal to or less than the RAWTC for the related automated control.

M06Q6. When documenting the testing procedures performed for an automated control, what are the from and through dates that should be entered?

The from date is the first day of the relevant financial year and the through date is the day of testing of the automated control.

The from and through dates are the same and are the day of testing the automated control.

The from date is the first day of the relevant financial year and the through date is the year end date.

The from date is the day of testing the automated control and the through date is the year end date.

M06Q7. When performing mitigating procedures in response to a GITC deficiency, where should this be documented in the Workflow?

Section 2.2.SO Service Organizations

Section 2.2.5 Response to deficient GITC

M06Q8. In the scenario you just documented in the Workflow, which RAFIT did the retrospective review control address?

CM1 - Unapproved changes to IT system program are implemented into the production environment.

CM2 - Changes to IT system program do not function as intended.

CM3 - Unapproved changes to IT system configurations are implemented into the production environment.

CM4 - Changes to IT system configurations do not function as intended.

CM5 - Logical access to implement changes to IT system program or configurations into the production environment is unauthorized or not commensurate with job responsibilities.

M07Q1. Which of the following are the first 2 steps of the process for information used in the audit? Select all that apply.

Identify information used in the audit

Identify information used in control activities

M07Q3. What are appropriate audit responses for information used in substantive procedures? Select all that apply.

Design and perform substantive procedures

Test entity management’s controls

M07Q4. Where in the Workflow do you document the audit response for information used in substantive procedures? Select all that apply.

Documentation within the procedure

M07Q5. Entity management uses the inventory turnover report to identify potentially obsolete inventory. In this example, how is the information used in the audit?

Subject of substantive procedures

Perform risk assessment procedures

M07Q6. What is the appropriate audit response for the inventory turnover report discussed in the last question? Select all that apply.

Substantive audit procedures to evaluate the source

Understand how the control operator is satisfied

The control procedure addresses reliability

IT Audit KCw課程

Professional Development

•

67 Qs

Similar activities

BTS Mock Exam

Professional Development

•

68 Qs

Star Wars Legendary Quiz

1st Grade - Professional Development

•

67 Qs

uCertify HTML Vocabulary - Lessons 1-7

10th Grade - Professional Development

•

70 Qs

Latihan Soal AKG 2020 Paket B

Professional Development

•

70 Qs

mcyt(and other yt) god au

7th Grade - Professional Development

•

68 Qs

Seleksi Jumbara Nasional Tingkat Kabupaten Cianjur

Professional Development

•

70 Qs

UF1118

Professional Development

•

72 Qs

WPTRT

Professional Development

•

62 Qs

IT Audit KCw課程

Quiz

•

Other

•

Professional Development

•

Practice Problem

•

Hard

Lily Lin

Used 11+ times

FREE Resource

High

Significant

Elevated

Create a free account and access millions of resources

Create resources

Host any resource

Get auto-graded reports

Continue with Google

Continue with Email

Continue with Classlink

Continue with Clever

or continue with

Microsoft

Apple

Others

Already have an account?

Similar Resources on Wayground

68 questions

Krissquiz: Star Wars

Quiz

•

Professional Development

66 questions

HVAC FC 08

Quiz

•

Professional Development

65 questions

Conduction System & Hemodynamics

Quiz

•

Professional Development

72 questions

39/2015 LPAC

Quiz

•

Professional Development

69 questions

MC RICA

Quiz

•

Professional Development

70 questions

Pelatihan ERP

Quiz

•

Professional Development

64 questions

SCANIA P410 - 8X4 DUMP TRUCK

Quiz

•

Professional Development

70 questions

HVAC FC 07

Quiz

•

Professional Development

Popular Resources on Wayground

5 questions

This is not a...winter edition (Drawing game)

Quiz

•

1st - 5th Grade

15 questions

4:3 Model Multiplication of Decimals by Whole Numbers

Quiz

•

5th Grade

25 questions

Multiplication Facts

Quiz

•

5th Grade

10 questions

The Best Christmas Pageant Ever Chapters 1 & 2

Quiz

•

4th Grade

12 questions

Unit 4 Review Day

Quiz

•

3rd Grade

10 questions

Identify Iconic Christmas Movie Scenes

Interactive video

•

6th - 10th Grade

20 questions

Christmas Trivia

Quiz

•

6th - 8th Grade

18 questions

Kids Christmas Trivia

Quiz

•

KG - 5th Grade

Discover more resources for Other

26 questions

Christmas Movie Trivia

Lesson

•

8th Grade - Professio...

10 questions

Christmas Trivia

Quiz

•

Professional Development

21 questions

Name that Holiday Movie

Quiz

•

Professional Development

IT Audit KCw課程

67 questions

M01Q1. What tool do we use in the Workflow to allocate individuals with tasks and manage minimum review requirements?

M01Q2. What is the name of the menu option we access in order to take us to the main area of the audit file where we begin our documentation?

M01Q3. What are the Workflow scaling options relevant to IT auditors?

M01Q4. Compared to International-Enhanced, which of the following items are true of International-Core?

M02Q1. Which of the following best defines risks of misstatement?

M02Q2. Which of the following best defines risks of material misstatement?

M02Q3. What are the levels of inherent risk? Select all that apply.

M02Q4. Which of the following best defines ‘internal control’?

M03Q1. During your audit engagements, what layers of technology do you commonly identify as relevant? Select all that apply.

M03Q2. Based on the scenario presented, which layers would be considered relevant to risk assessment?

Create a free account and access millions of resources

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Other