CPA Isc Quiz: Evaluate It General Controls Itgcs

What this quiz covers

This quiz focuses on Evaluate It General Controls Itgcs, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. The auditor must test all input controls manually.
2. The organization must restate its financial statements for the prior year.
3. Automated application controls in the affected systems cannot be relied upon, requiring the auditor to perform additional substantive procedures. (correct answer)
4. The auditor must issue an adverse opinion on the financial statements.

Explanation: Ineffective change controls mean automated controls could have been altered without authorization - the auditor cannot rely on them and must compensate with increased substantive testing. Answer C is correct. Input control testing (A) does not fully compensate. Prior year restatement (B) is not automatic. An adverse opinion (D) is not required solely due to ITGC weaknesses.

Question 2

1. Requiring manager approval before deploying code changes to production.
2. Restricting database access to authorized personnel only.
3. Reviewing the design specifications for a new financial application before development begins.
4. Monitoring job scheduling to ensure batch processes run at their scheduled times and investigating failures promptly. (correct answer)

Explanation: Computer operations controls govern the day-to-day operation of IT systems - job scheduling, batch monitoring, operations logs, and incident response. Answer D is correct. Deployment approval (A) is a change control. Database access restriction (B) is a logical access control. Design review (C) is a program development control.

Question 3

1. The development team may not have adequate technical skills.
2. Production administrators may not understand the business requirements for system changes.
3. Developers could make unauthorized changes directly to production systems without detection, undermining both change management and automated application controls. (correct answer)
4. The organization may not comply with IT governance best practices.

Explanation: Without segregation between development and production, developers can implement unauthorized code directly in production - a fundamental ITGC control failure that compromises all downstream application controls. Answer C is correct. Technical skills (A), business requirements (B), and best practice compliance (D) are secondary concerns compared to the unauthorized change risk.

Question 4

1. Logical access controls - specifically the provisioning and deprovisioning process for user accounts. (correct answer)
2. Program change controls - confirming that account changes were authorized through the change management process.
3. Computer operations controls - confirming that system administrators managed user accounts correctly.
4. Program development controls - confirming that the user provisioning system was properly developed.

Explanation: Testing the provisioning and deprovisioning of user accounts is directly testing logical access controls - the ITGC category governing who has access to systems and how access rights are managed. Answer A is correct. Account management is access control (A), not change management (B), operations (C), or development (D).

Question 5

1. A computer operations control deficiency - former employee accounts affect system performance.
2. A program development control deficiency - the user provisioning system was not properly developed.
3. A program change control deficiency - account deactivation was not implemented as a change.
4. A logical access control deficiency - terminated employee accounts were not promptly deactivated, creating risk of unauthorized access by former employees. (correct answer)

Explanation: Active accounts for terminated employees is a logical access control deficiency - the offboarding process failed to revoke access, creating unauthorized access risk. Answer D is correct. This is not an operations (A), development (B), or change control (C) issue.

Question 6

1. ITGCs and automated application controls are independent - the effectiveness of one does not affect the other.
2. ITGCs provide the foundation for automated application controls - if ITGCs are effective, auditors can place greater reliance on automated controls without additional testing. (correct answer)
3. Automated application controls are more important than ITGCs for financial reporting purposes.
4. Strong automated application controls can fully compensate for weak ITGCs.

Explanation: Effective ITGCs (especially change controls and access controls) provide assurance that automated application controls have not been tampered with, enabling greater reliance. Weak ITGCs undermine automated control reliability. Answer B is correct. They are interdependent (A). ITGCs underpin application controls (C). Weak ITGCs cannot be fully compensated by strong automated controls (D).

Question 7

1. Whether the organization has an IT steering committee that reviews IT investments.
2. Whether the organization's disaster recovery plan covers the financial system.
3. Whether the cloud provider's own ITGCs are adequate, typically assessed through a SOC 1 Type II report covering the provider's relevant controls. (correct answer)
4. Whether the system's automated application controls are properly designed.

Explanation: Cloud environments introduce a shared responsibility model - the organization must assess whether the cloud provider's ITGCs (infrastructure access, change management, operations) are effective, typically through a SOC 1 Type II report. Answer C is correct. IT steering committees (A) and DR plans (B) apply to all environments. Application control design (D) is not cloud-specific.

Question 8

1. It allows the auditor to calculate a statistically precise error rate.
2. It ensures the sample includes both major and minor changes.
3. It reduces the time required to complete ITGC testing.
4. It provides evidence that controls operated consistently throughout the financial reporting period, not just at the time of testing. (correct answer)

Explanation: For ITGCs supporting financial reporting, controls must have operated throughout the period under audit - a sample covering all quarters provides evidence of consistent operation, not just point-in-time compliance. Answer D is correct. Statistical precision (A), change size coverage (B), and time reduction (C) are not the primary reason for full-year sampling.

Question 9

1. Requiring two approvers for all production deployments.
2. Documenting system design specifications, conducting code reviews, and requiring user acceptance testing before any new application goes live. (correct answer)
3. Monitoring batch job logs for failures and investigating them promptly.
4. Reviewing and approving user access requests based on job function.

Explanation: Program development controls govern the lifecycle of new system development - design documentation, code reviews, and UAT ensure new systems are built correctly and work as intended before production deployment. Answer B is correct. Deployment approvals (A) are change controls. Batch monitoring (C) is operations. Access approval (D) is logical access.

Question 10

1. A complete lack of segregation of duties - one person controls all aspects of the IT environment, creating unlimited opportunity for unauthorized changes or fraud without detection. (correct answer)
2. The administrator may lack the technical expertise to manage all these functions.
3. The organization is non-compliant with IT infrastructure best practices.
4. The administrator may become overwhelmed and cause performance issues.

Explanation: One person controlling all IT functions - access, changes, deployments, and operations - eliminates all segregation of duties and any possibility of independent check, representing a critical ITGC deficiency. Answer A is correct. Technical skills (B), best practices (C), and workload (D) are secondary concerns.

Question 11

1. ITGC deficiencies may cause the auditor to assess IT-dependent controls as unreliable, requiring more extensive substantive testing to obtain sufficient audit evidence. (correct answer)
2. ITGC deficiencies always require the auditor to issue a qualified opinion.
3. ITGC deficiencies require the organization to restate prior year financial statements.
4. ITGC deficiencies have no effect on the financial statement audit if management provides written representations about control effectiveness.

Explanation: ITGC deficiencies cascade into the reliance assessment for automated controls - if the IT environment cannot be trusted, the auditor must compensate with more substantive procedures to obtain assurance. Answer A is correct. Qualified opinions (B) are not automatic from ITGC deficiencies. Restatements (C) require actual financial misstatements. Management representations (D) do not resolve ITGC deficiencies.

Question 12

1. Reviewing code quality during software development sprints.
2. Approving user access requests for new employees.
3. Monitoring scheduled batch jobs, investigating job failures, managing system capacity, and maintaining operations logs. (correct answer)
4. Reviewing and approving proposed changes to production systems.

Explanation: Computer operations controls govern the day-to-day running of IT infrastructure - batch scheduling, job monitoring, capacity management, and operational logging. Answer C is correct. Code review (A) is development. Access approvals (B) are logical access. Change approvals (D) are change management.

Question 13

1. Program development controls
2. Computer operations controls
3. Program change controls
4. Logical access controls (correct answer)

Explanation: Password configuration settings govern how users authenticate - enforcing password policies is a logical access control requirement that ensures authentication standards are maintained. Answer D is correct. Password settings are not development (A), operations (B), or change (C) controls.

Question 14

1. Selecting a sample of production changes deployed throughout the year and verifying each has an approved change request, testing evidence, and was deployed by someone other than the developer. (correct answer)
2. Reviewing the change management policy to confirm it requires authorization and testing.
3. Interviewing the change manager to confirm the process is followed.
4. Confirming the change management system generates a ticket for each request.

Explanation: Testing a sample of actual changes against control requirements throughout the year provides direct evidence of consistent operating effectiveness. Answer A is correct. Policy review (B) and interviews (C) address design. Ticket generation (D) confirms process initiation but not control execution.

Question 15

1. Whether the deficiency was identified by internal audit or the external auditor.
2. How long the deficiency has existed.
3. Whether the deficiency creates a reasonable possibility that a material misstatement in the financial statements could occur and not be prevented or detected. (correct answer)
4. Whether management was aware of the deficiency before the audit.

Explanation: SOX severity classification (significant deficiency vs. material weakness) depends on whether the control gap creates a meaningful risk of undetected material misstatement - the threshold question for all ITGC deficiency assessments. Answer C is correct. Discovery source (A), deficiency age (B), and management awareness (D) are relevant context but not the primary severity criterion.

Question 16

1. Accept the logs as sufficient evidence of control effectiveness without further testing.
2. Ignore the logs since cloud systems are managed by the provider.
3. Use the logs only to assess whether users have appropriate access levels.
4. Evaluate whether the logs are comprehensive, tamper-proof, retained for an appropriate period, and reviewed by management on a regular basis with follow-up on exceptions. (correct answer)

Explanation: Logs are only valuable as controls if they are complete, protected from alteration, retained long enough to support investigation, and actually reviewed with follow-up - simply having logs does not confirm effective ITGC monitoring. Answer D is correct. Logs alone are not sufficient evidence (A). Cloud logs are still the organization's responsibility (B). Logs support multiple ITGC assessments beyond just access levels (C).

Question 17

1. Logical access controls, program change controls, computer operations controls, and program development controls. (correct answer)
2. Input controls, processing controls, output controls, and interface controls.
3. Governance controls, risk controls, compliance controls, and monitoring controls.
4. Network controls, database controls, application controls, and physical controls.

Explanation: The four standard ITGC categories are: (1) logical access controls (who can access what), (2) program change controls (how changes are authorized and implemented), (3) computer operations controls (how systems are operated and monitored), and (4) program development controls (how new systems are developed). Answer A is correct. Answer B describes application controls. Answers C and D are not standard ITGC categories.

Question 18

1. All IT systems in the organization, regardless of their connection to financial data.
2. IT systems and controls that support the processing, storage, or transmission of financial data, or that support automated application controls relied upon in the audit. (correct answer)
3. Only the ERP system used for general ledger accounting.
4. All IT systems managed by the IT department, including HR, facilities, and marketing systems.

Explanation: ITGC scope for financial auditing is risk-based - focused on systems that touch financial data or support relied-upon application controls. Non-financial systems are generally out of scope. Answer B is correct. All IT systems (A, D) is too broad. Only the GL system (C) may be too narrow if other systems feed financial processes.

Question 19

1. Program development controls
2. Logical access controls (correct answer)
3. Computer operations controls
4. Program change controls

Explanation: User access reviews and recertifications are logical access controls - they ensure that access rights remain appropriate and aligned with current job responsibilities. Answer B is correct. Program development (A) governs new system creation. Computer operations (C) governs system operation. Change controls (D) govern system modifications.

Question 20

1. The ITGC documentation will fail to impress external auditors.
2. The existing ITGC framework may not address risks introduced by new technologies, creating unmitigated control gaps. (correct answer)
3. Employees will not be familiar with the outdated ITGC documentation.
4. The organization may not achieve the highest rating in IT maturity assessments.

Explanation: ITGCs must evolve with technology - a cloud migration and new ERP introduce new access paths, change mechanisms, and operational risks that the old framework may not address. Answer B is correct. Auditor impressions (A), employee familiarity (C), and maturity ratings (D) are secondary concerns.