WorksheetsM04_Risk assessment – Business process
Total questions: 12
Worksheet time: 16mins
M04Q1. In what workflow screen/section can you add relevant process level automated controls?
Section 2.2.2 IT Understanding
Section 2.2.SO Service Organizations
Section 3.3 Business processes
Section 2.2.3 Fraud
M04Q2. Which of the following are PRPs? Select all that apply.
Vendor invoices with inaccurate quantities and/or pricing are recorded and paid to the vendor.
Purchase orders (POs) with inaccurate coding are expensed improperly.
Significant agreements contain embedded derivatives, leases, contingencies, guarantees, and/or consolidation issues that are not identified and accounted for appropriately.
Expenditures are overstated.
M04Q3. Identify the relevant control attributes for the following control activity: Daily interface between the Policy Administration System and Data Warehouse transferring the premium and claims data related to policies.
Validation of transaction totals for sales and refunds.
Validation of record counts.
Messaging to operations management if errors occurred during processing.
All of the above.
M04Q4. How does the consistency and/or frequency of control performance commonly affect the precision of an automated control?
The control is designed to operate consistently each time it is performed, however, the frequency is not routine, which indicates high precision.
The control is not designed to operate consistently each time it is performed and the frequency is not routine, which indicates high precision.
The control is not designed to operate consistently each time it is performed, however, the frequency is adequately routine, which indicates high precision.
The control is designed to operate consistently each time it is performed and the frequency is adequately routine, which indicates high precision.
M04Q5. The definition of control attributes are the specific procedures performed by the control operator that make-up the control activity and are important to the design of the control?
Yes
No
M04Q6. What will drive most the extent of audit evidence we have to obtain when testing general IT controls?
Number of GITCs identified.
Frequency of the control activity.
Knowledge and competence of the control owner.
The higher the risk associated with the automated control to which it is linked.
M04Q7. Which factors that may increase RAWTC above the inherent risk assessment are relevant to automated controls? Select all that apply.
A. Nature of the control is complex.
B. Control relies on the effectiveness of other controls.
C. Deficiencies identified in prior years.
D. Control operates infrequently.
E. Changes to control or process in which the control operates.
M04Q8. For scenario 1, what level of RAWTC did you think was appropriate?
Base
Elevated
Significant
Significant +
M04Q9. For scenario 2, what level of RAWTC did you think was appropriate?
Base
Elevated
Significant
Significant +
M04Q10. Has anyone ever relied on the consistent operation of automated controls without testing relevant GITCs?
Yes
No
M04Q11. If choosing to not rely on relevant general IT controls, how would you determine the test frequency for the automated control? Select all that apply.
A. Assessment of inherent risk for the risks of material misstatement (RMMs).
B. Complexity of the IT environment.
C. Nature of the control.
D. Frequency of changes to the relevant IT layers.
E. Risk associated with the control (RAWTC) for the automated control.
M04Q12. Has anyone ever benchmarked automated controls before?
Yes
No
