WorksheetsIT Audit KCw課程
Total questions: 67
Worksheet time: 1hrs 25mins
M01Q1. What tool do we use in the Workflow to allocate individuals with tasks and manage minimum review requirements?
Atlas
Briefcase
Engagement Management
Project Plan
M01Q2. What is the name of the menu option we access in order to take us to the main area of the audit file where we begin our documentation?
Advanced Capabilities
Engagement Profile
Atlas
My Engagement
M01Q3. What are the Workflow scaling options relevant to IT auditors?
Less Complex Audit Workflow, International-Enhanced, AICPA, PCAOB.
International-Core, International-Enhanced.
Less Complex Audit Workflow, International-Core, International-Enhanced, US.
Less Complex Audit Workflow, International-Core, International-Enhanced, AICPA, PCAOB.
M01Q4. Compared to International-Enhanced, which of the following items are true of International-Core?
The information module differs.
Risks of material misstatement are not included.
The IT Understanding activity screen is not used.
Documentation of the precision of the control is not required.
M02Q1. Which of the following best defines risks of misstatement?
Risks that could result in a misstatement to the financial statements.
Measurement of the level of risk attached to an assertion.
Our assessment of the measurement of risk attached to assertion level risks.
Risks with a significant possibility of resulting in a material misstatement to the financial statements.
M02Q2. Which of the following best defines risks of material misstatement?
Measurement of the level of risk attached to an assertion.
Risks with a reasonable possibility of resulting in misstatements that are material to the financial statement audit.
Risks with an inherent risk level of Elevated or Significant.
Risks with a remote possibility of resulting in misstatements that are material to the financial statement audit.
M02Q3. What are the levels of inherent risk? Select all that apply.
Low
Base
High
Significant
Elevated
M02Q4. Which of the following best defines ‘internal control’?
The auditor’s tests to obtain reasonable assurance of over an entity’s objectives related to financial reporting, operations, and compliance with laws and regulations.
Activities performed by the entity related to support the reliability of the financial statement assertions and disclosures.
An entity’s processes to provide reasonable assurance over its objectives related to financial reporting, operations, and compliance with laws and regulations.
An entity’s processes to address all risks of misstatement related to financial reporting, operations, and compliance with laws and regulations.
M03Q1. During your audit engagements, what layers of technology do you commonly identify as relevant? Select all that apply.
Application
Database
Operating system
Network
M03Q2. Based on the scenario presented, which layers would be considered relevant to risk assessment?
Application, Database and Operating System.
Application and Operating System.
Application and Database
Database and Operating System
M03Q3. What areas does the engagement team document in the IT Understanding Screen?
How the entity uses IT as part of financial reporting and related business processes.
The entity’s IT organization.
The entity’s IT policies and procedures.
All of the above.
M03Q4. When do we use the SSC instructions and reporting templates in KAEG?
To document your evaluation of a service organization controls (SOC) report.
To communicate the nature, timing and extent of procedures performed by the SSC auditor on behalf of the group engagement team and/or SSC user auditors.
When a SOC report is not provided by the Service Organization.
When the SSC auditor identifies issues that may require an audit response.
M03Q5. Did you find it easy navigating KAEG?
Yes
No
M03Q6. When do we involve a team member with specialization in IT in response to a cybersecurity incident?
When an exception is noted during your testing of database access.
If an interface from an external source does not successfully complete.
When a cybersecurity incident at any layer comes to your attention during the audit.
When an terminated employee retains access privileges to a financially relevant application.
M04Q1. In what workflow screen/section can you add relevant process level automated controls?
Section 2.2.2 IT Understanding
Section 2.2.SO Service Organizations
Section 3.3 Business processes
Section 2.2.3 Fraud
M04Q2. Which of the following are PRPs? Select all that apply.
Vendor invoices with inaccurate quantities and/or pricing are recorded and paid to the vendor.
Purchase orders (POs) with inaccurate coding are expensed improperly.
Significant agreements contain embedded derivatives, leases, contingencies, guarantees, and/or consolidation issues that are not identified and accounted for appropriately.
Expenditures are overstated.
M04Q3. Identify the relevant control attributes for the following control activity: Daily interface between the Policy Administration System and Data Warehouse transferring the premium and claims data related to policies.
Validation of transaction totals for sales and refunds.
Validation of record counts.
Messaging to operations management if errors occurred during processing.
All of the above.
M04Q4. How does the consistency and/or frequency of control performance commonly affect the precision of an automated control?
The control is designed to operate consistently each time it is performed, however, the frequency is not routine, which indicates high precision.
The control is not designed to operate consistently each time it is performed and the frequency is not routine, which indicates high precision.
The control is not designed to operate consistently each time it is performed, however, the frequency is adequately routine, which indicates high precision.
The control is designed to operate consistently each time it is performed and the frequency is adequately routine, which indicates high precision.
M04Q5. The definition of control attributes are the specific procedures performed by the control operator that make-up the control activity and are important to the design of the control?
Yes
No
M04Q6. What will drive most the extent of audit evidence we have to obtain when testing general IT controls?
Number of GITCs identified.
Frequency of the control activity.
Knowledge and competence of the control owner.
The higher the risk associated with the automated control to which it is linked.
M04Q7. Which factors that may increase RAWTC above the inherent risk assessment are relevant to automated controls? Select all that apply.
Nature of the control is complex.
Control relies on the effectiveness of other controls.
Deficiencies identified in prior years.
Control operates infrequently.
Changes to control or process in which the control operates.
M04Q8. For scenario 1, what level of RAWTC did you think was appropriate?
Base
Elevated
Significant
Significant +
M04Q9. For scenario 2, what level of RAWTC did you think was appropriate?
Base
Elevated
Significant
Significant +
M04Q10. Has anyone ever relied on the consistent operation of automated controls without testing relevant GITCs?
Yes
No
M04Q11. If choosing to not rely on relevant general IT controls, how would you determine the test frequency for the automated control? Select all that apply.
Assessment of inherent risk for the risks of material misstatement (RMMs).
Complexity of the IT environment.
Nature of the control.
Frequency of changes to the relevant IT layers.
Risk associated with the control (RAWTC) for the automated control.
M04Q12. Has anyone ever benchmarked automated controls before?
Yes
No
M05Q1. Below are examples of RAFITs and PRPs. Which of the below examples are RAFITs. Select all that apply.
The automated interest expense calculation is not programmed to result in a complete and accurate recognition of interest expense.
Changes to IT system configurations do not function as intended.
Sales forecasts used in the inventory reserve calculation may not adequately reflect market conditions.
Logical access permissions are not revoked in a timely manner.
M05Q2. Which of the following are the four layers of technology per the KAEG?
Application
Interface
Database
Operating system
Server
M05Q3. As shown in the previous example, would we identify the database layer as relevant to the automated control?
Yes
No
M05Q4. For the following control, ‘Access to enter/update the Oracle standard price list is restricted to the appropriate personnel,’ what layers did you identify as relevant? Select all that apply.
Oracle application
Oracle database
Windows 10
Access security protocols
M05Q5. For the same control, which of the following RAFITs did you identify as relevant to the Oracle application layer? Select all that apply.
APD 1.1 – Identification and authentication mechanisms are not implemented to restrict logical access to IT systems and data.
APD 1.2 – Logical access permissions are granted to users and accounts (including shared or generic accounts) that are unauthorized or not commensurate with job responsibilities.
APD 1.3 – Logical access permissions are not revoked in a timely manner.
APD 1.4 – Logical access to users and accounts (including shared or generic accounts) that can perform privileged tasks and functions within IT systems is unauthorized or not commensurate with job responsibilities.
APD 1.5 – Physical access to facilities housing IT systems and/or electronic media is unauthorized or not commensurate with job responsibilities.
M05Q6. For the RAFITs identified as relevant in the previous question (APD1.1, 1.2, 1.3 and 1.4), which of the following GITCs would be relevant?
Management approves the nature and extent of user access privileges for new and modified user access, including standard application profiles/roles, critical financial reporting transactions, and segregation of duties.
Access for terminated or transferred users is removed or modified in a timely manner.
Access is authenticated through generic user IDs and passwords for validating that users are authorized to gain access to the system.
Privileged-level access (e.g. configuration, data and security administrators) is authorized and appropriately restricted.
M05Q7. Which of the following considerations might you have when identifying IT systems that are used to execute GITCs? Select all that apply.
Relevant GITCs that support the consistent effective operation of the automated controls.
Assessment of the knowledge and competence of those performing the control activity.
Identification of automated controls that entity’s management is relying on.
Assessment of layers of technology and RAFITs relevant to automated GITCs identified.
Assessment of the functionality of IT systems that enable GITCs.
M05Q8. There are 7 categories of automated controls within KAEG. Only 4 of these categories are relevant for automated GITCs and are able to be selected in the workflow. Which of the following are relevant? Select all that apply.
System access controls, including enforcing segregation of duties
Edit checks
Configuration of system generated reports or other data outputs
System configuration controls
System calculation controls
M05Q9. In what screen are you able to add GITCs in the Workflow?
Section 2.2 IT Understanding
Section 2.2.1 RAFITs screen
Section 3.3 Business processes
Section CA. Control activities
M05Q10. In what screen are you able to group IT layers?
Section 2.2 IT Understanding
Section 2.2.1 RAFITs screen
Section 3.3 Business processes
Section CA. Control activities
M06Q1. Consider a control activity where access for terminated or transferred users is removed or modified in a timely manner.
Identify the relevant control attributes for the control activity. Select all that apply.
System access of the terminated/resigned user was revoked.
System access of the transferring user was revoked.
System access revocation was done within 1 day after the user's termination/resignation/ transfer date, in accordance with company policies and procedures.
Authorized personnel perform the quarterly user access review across IT systems to ensure revocation of access was performed as per management’s request.
M06Q2. You determine the RAWTC for GITCs by considering specific factors that may indicate the general IT control is ineffective. Identify the factors that could be used to determine RAWTC. Select all that apply.
The effectiveness of CERAMIC controls, especially controls that monitor other controls.
The competence of the personnel performing the general IT control or monitoring its performance.
The complexity of the general IT control and the significance of the judgments made about its operation.
The results of the previous years’ testing of the automated control to which the general IT control supports.
Whether there have been changes in the general IT control since it was previously tested.
M06Q3. Fill in the blank.
For each automated control, you assess RAWTC for at least one GITC that supports the effective operation of the automated control _______.
At higher than the RAWTC for the related automated control.
At equal to the RAWTC for the related automated control.
At equal to or higher than the RAWTC for the related automated control.
At equal to or less than the RAWTC for the related automated control.
M06Q4. What is an appropriate sample size for the following control?
RAWTC Assessment – Base
Population – 150
5
11
15
25
M06Q5. What is an appropriate sample size for the following control?
RAWTC Assessment – Significant +
Population – 38
5
11
15
25
M06Q6. When documenting the testing procedures performed for an automated control, what are the from and through dates that should be entered?
The from date is the first day of the relevant financial year and the through date is the day of testing of the automated control.
The from and through dates are the same and are the day of testing the automated control.
The from date is the first day of the relevant financial year and the through date is the year end date.
The from date is the day of testing the automated control and the through date is the year end date.
M06Q7. When performing mitigating procedures in response to a GITC deficiency, where should this be documented in the Workflow?
Section 2.2.SO Service Organizations
Section 2.2.2 IT Understanding
Section 2.1 RAFITs screen
Section 2.2.5 Response to deficient GITC
M06Q8. In the scenario you just documented in the Workflow, which RAFIT did the retrospective review control address?
CM1 - Unapproved changes to IT system program are implemented into the production environment.
CM2 - Changes to IT system program do not function as intended.
CM3 - Unapproved changes to IT system configurations are implemented into the production environment.
CM4 - Changes to IT system configurations do not function as intended.
CM5 - Logical access to implement changes to IT system program or configurations into the production environment is unauthorized or not commensurate with job responsibilities.
M07Q1. Which of the following are the first 2 steps of the process for information used in the audit? Select all that apply.
Evaluate relevance
Evaluate reliability
Evaluate precision
Identify information used in the audit
Identify information used in control activities
M07Q2. Which of the following is the third step in the process for information used in the audit?
Evaluate relevance
Evaluate reliability
Evaluate resilience
Evaluate repeatability
M07Q3. What are appropriate audit responses for information used in substantive procedures? Select all that apply.
Understand the source
Direct test
Design and perform substantive procedures
Test entity management’s controls
M07Q4. Where in the Workflow do you document the audit response for information used in substantive procedures? Select all that apply.
Estimates module
Information module
On-screen text box
Documentation within the procedure
M07Q5. Entity management uses the inventory turnover report to identify potentially obsolete inventory. In this example, how is the information used in the audit?
Subject of substantive procedures
Perform a control activity
Management estimates
Perform risk assessment procedures
M07Q6. What is the appropriate audit response for the inventory turnover report discussed in the last question? Select all that apply.
Substantive audit procedures to evaluate the source
Understand how the control operator is satisfied
The control procedure addresses reliability
Test management’s controls
Direct test the information
M07Q7. Should you activate the information module in the workflow if KPMG uses the information to select a sample for testing?
Yes
No
M07Q8. What are some examples of controls that address data input risks for the information presented in the prior slide? Select all that apply.
Purchase orders are authorized by the FC in the finance system prior to issuance to the supplier.
Access to the finance system database is restricted to limited IT personnel whose access is commensurate with job responsibilities.
Purchase orders can only be entered by individuals who have the purchase ledger clerk role allocated to their user account.
The report is configured to extract complete and accurate information.
M07Q9. The financial audit team have identified information and would like to adopt the direct testing method. The RAWTC associated with the information is Significant and there are over 250 lines of data. How many items would be tested by the financial audit team?
120
80
60
45
M07Q10. The financial audit team have identified information and would like to adopt the direct testing method. The RAWTC associated with the information is Significant and there are over 250 lines of data. How many items would be tested by the financial audit team?
120
80
60
45
M08Q1. Arrange the steps you perform when seeking to rely on controls within a service organization in the correct order.
Arrange the steps you perform when seeking to rely on controls within a service organization in the correct order.
Identify relevant controls that exist within the control objective.
Determine whether all controls under each control objective are relevant.
Identify the control objectives within the Service Organization Controls Report.
M08Q2. Which steps do you perform when seeking to rely on controls within a service organization? Select all that apply.
Document rationale for exclusion of each control under the selected control objective.
Determine whether all controls under each control objective are relevant.
Identify relevant controls that exist within the SOC report.
Identify relevant controls that exist within the control objective.
Document rationale for exclusion of each complementary user entity control (CUEC) within the Service Organization Controls Report.
M08Q3. What is the first step in the process when considering relying on a SOC 2 Type II report?
Evaluate if the description, test of design and operating effectiveness procedures appropriately address the user auditor's purposes.
Evaluating the impact to the control environment from any control deficiencies identified.
Evaluating whether the user entity designed and implemented relevant complementary user entity controls identified in the report.
Evaluating the period covered by the report and the entity’s audit period.
M08Q4. On which screen do IT auditors most often identify and activate service organizations?
1.1.3 Audit plan
SO. Service organizations -> 1. Understanding
2.2 Components of internal control
2.2.2 Understanding of IT
M08Q5. What factors should you consider when relying on internal audit’s work? Select all that apply.
Were members of the internal audit function previously employed by KPMG?
Does reliance on internal audit alter the nature, timing, or extent of procedures?
Do internal auditors have the adequate levels of education as well as audit and industry experience?
Does the internal audit function have access to report directly to those charged with governance or an officer with appropriate authority?
Does the internal audit function report findings directly to the external audit team?
M08Q6. What factors should you consider when relying on internal audit’s work? Select all that apply.
Were members of the internal audit function previously employed by KPMG?
Does reliance on internal audit alter the nature, timing, or extent of procedures?
Do internal auditors have the adequate levels of education as well as audit and industry experience?
Does the internal audit function have access to report directly to those charged with governance or an officer with appropriate authority?
Does the internal audit function report findings directly to the external audit team?
M09Q1. Which screen in the KPMG Clara workflow do you select to generate the IT Overview Report?
2.1.1 Entity and its environment
2.2.2 IT Understanding
1.1 Audit plan
4.1 Evaluate audit results
M09Q2. What is the main purpose of the IT Overview Report?
To provide an understanding of the linkages between automated controls, IT layers, RAFITs and GITCs, and help identify potential gaps in linking.
To provide reliable results for all GITC testing conclusions for related application controls and information.
To prove that all IT application controls and information are linked to the correct GITCs and identify ineffective GITCs.
To show all IT layers and GITCs that are tested and how GITC test results impact related IT application controls and information.
M09Q3. What does the legend icon shown here indicate?
All GITC(s) linked to this IT layer/RAFIT concluded as effective.
This IT layer is linked to an automated control, but no RAFITs have been linked (no RAFITs).
All GITC(s) linked to this IT layer/RAFIT not yet concluded on.
No GITCs yet linked to this RAFIT.
M09Q4. Which errors or discussion items did you identify in the activity? Select all that apply.
Program development controls suggest a need for additional discussion over systems implementation scoping.
Application controls are ineffective because they are linked to the ineffective GITC APD3 (access removals).
GITC results indicate control deficiencies exist within related Service Organization Control Objectives.
The RAWTC for at least one GITC does not align with the highest assessed RAWTC for application controls and should be discussed further.
In the application layer, there are potential errors privileged access testing linkage to RAFITs.
M10Q1. Where would you go first for functionality help if you didn’t know how to do something in the workflow?
Guidance
The lead in-charge senior on the financial audit team
Your LM_01 Learner Workbook
KPMG HELP hotline
M10Q2. What icon do you select to mark a screen prepared or reviewed?
M10Q3. When an item is deselected in the workflow, will the data be purged or maintained in the background?
Maintained in the background
Purged
