Risk Assessment and Internal Control - Test 3: answer key

Question 1 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s Sharma & Associates has been appointed statutory auditor of Alpha Infotech Ltd, a listed software services company processing approximately 25,000 financial transactions daily through an integrated cloud-based ERP system. Its accounting applications are hosted on servers maintained by an external IT service provider. The company's finance, procurement, payroll and inventory modules communicate through automated interfaces. During the audit, the engagement team discovers that the service provider schedules overnight batch-processing jobs, but no independent employee verifies whether all jobs have completed successfully. Backups are retained on the same primary server, and management has not conducted a disaster recovery simulation during the last two years. The company also lacks documented business continuity arrangements for prolonged network interruptions. The IT administrator possesses unrestricted access to the operating system, database and financial applications. Former employees' accounts remain active, and several users share administrator credentials. Management states that these arrangements are necessary to ensure uninterrupted operations. Further, the company introduced a new revenue-processing module during the year. The software vendor modified the underlying program directly in the production environment without documented approval, testing evidence or formal tracking of change requests. The CFO refuses to provide the vendor's modification logs, claiming commercial confidentiality. The engagement team also notices that automated application checks are relied upon for invoice validation, credit limits and revenue calculations. The engagement partner must determine the nature of the relevant General IT Controls, the extent to which application controls can be relied upon and the additional audit procedures necessary where the underlying IT controls are ineffective.

The overnight processing jobs at Alpha Infotech Ltd are scheduled by its external service provider. No independent person verifies successful completion, and backups are retained only on the primary server. Which assessment most appropriately identifies the relevant General IT Control deficiency?

1. Data centre and network operations controls are deficient because batch processing, backup retention and business continuity arrangements are inadequately monitored. (correct answer)
2. Application controls are deficient because mandatory invoice fields are not being validated during the purchase and sales processes.
3. Access security controls are deficient because employees have not been assigned separate responsibilities for processing individual transactions.
4. Program change controls are deficient because the company has not maintained evidence of every modification to its revenue recognition policy.

Answer: A — Data centre and network operations controls are deficient because batch processing, backup retention and business continuity arrangements are inadequately monitored.

Explanation. SA 315, ICAI Study Material Chapter 3, §11.5(A)(a), identifies data centre and network operations as General IT Controls. These include management of computer operations, preparation and scheduling of batch jobs, monitoring, storage and retention of backups, and business continuity and disaster recovery arrangements. Alpha's weaknesses directly affect these activities. The application validation and program modification issues represent separate control matters and do not change the primary classification of the stated deficiencies.

Where it goes wrong. Confusing batch-processing and backup arrangements with application-level validation or program change controls.

Authority. SA 315

Question 2 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The software vendor modifies Alpha's revenue-processing program directly in production without documented change requests, approval or testing. Which General IT Control should the auditor principally evaluate?

1. Data centre operations, because every change to a financial application constitutes a batch-processing activity.
2. Program change controls, because modifications must be recorded, managed, tracked and appropriately tested before implementation. (correct answer)
3. Application input controls, because every program change necessarily concerns validation of customer invoice information.
4. IT-dependent manual controls, because program modifications are always reviewed through manually prepared exception reports.

Answer: B — Program change controls, because modifications must be recorded, managed, tracked and appropriately tested before implementation.

Explanation. SA 315, Chapter 3, §11.5(A)(b), explains that program change controls ensure modified systems continue to meet financial reporting objectives. These controls include change management procedures, recording and tracking change requests, and making and testing modifications. Direct production changes without documentation or testing undermine the reliability of the financial application. Application input controls address transaction-level validations, while data centre controls concern computer operations, backups and recovery arrangements.

Where it goes wrong. Confusing a change to the financial application itself with an input validation check performed within the application.

Authority. SA 315

Question 3 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The administrator retains access to the operating system, database and financial applications even after employees leave. Several users also share administrator credentials. What is the most appropriate classification and objective of the relevant control?

1. Program change controls, whose objective is to ensure that each application modification is appropriately approved and tested.
2. Data centre controls, whose objective is to ensure that production systems are backed up and processed according to scheduled timings.
3. Access security controls, whose objective is to ensure that access to programs and data is properly authenticated and authorised. (correct answer)
4. Application controls, whose objective is to validate the accuracy of individual transaction amounts entered into the system.

Answer: C — Access security controls, whose objective is to ensure that access to programs and data is properly authenticated and authorised.

Explanation. SA 315, Chapter 3, §11.5(A)(c), identifies access security as a General IT Control. Its objective is to ensure that access to programs and data is authenticated and authorised. Relevant controls include application, data, operating system, network and physical security. Retained accounts and shared privileged credentials create opportunities for unauthorised access and direct data modification. Program change controls address system modifications, while application controls operate at the business-process level.

Where it goes wrong. Mistaking excessive user privileges for a transaction-level application control deficiency.

Authority. SA 315

Question 4 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor identifies ineffective General IT Controls but finds that automated revenue validations are functioning during a limited walkthrough. What is the most appropriate audit response?

1. Rely on the automated revenue controls because successful observation during one walkthrough conclusively establishes their continued effectiveness.
2. Discontinue all audit procedures involving electronic information because ineffective General IT Controls make computer-generated evidence unusable in every circumstance.
3. Accept management's explanation that the application is reliable because the external software vendor designed the revenue-processing module.
4. Assess IT risks and environmental complexity, evaluate the reliability of system information and plan alternative procedures before relying on system-based evidence. (correct answer)

Answer: D — Assess IT risks and environmental complexity, evaluate the reliability of system information and plan alternative procedures before relying on system-based evidence.

Explanation. SA 315, Chapter 3, §§11.5(C), 11.6 and 11.7, explains that General IT Controls support the reliable functioning of application controls. Where GITCs are absent or ineffective, the auditor should assess the impact of IT risks and the complexity of the automated environment and plan alternative audit procedures. A single walkthrough does not establish the ongoing reliability of the system. Equally, ineffective GITCs do not automatically make every electronic record unusable; reliability must be evaluated.

Where it goes wrong. Assuming either that a successful application walkthrough overrides defective GITCs or that all electronic evidence automatically becomes invalid.

Authority. SA 315

Question 5 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s V. Raman & LLP is conducting the statutory audit of Zenith Manufacturing Pvt Ltd, an automobile-component manufacturer using an integrated ERP platform for purchases, production, inventory and sales. The company receives electronic purchase requisitions from departments, converts approved requisitions into purchase orders and records supplier invoices after matching them with goods-received notes. The ERP system contains mandatory supplier identification fields, invoice-date validations and checks preventing certain duplicate invoice references. It also generates sequential purchase order numbers and automatically calculates production costs using quantities issued and predefined material rates. However, the finance team recently changed the ERP configuration, and management cannot produce complete documentation demonstrating that the revised processing rules were tested before implementation. The company also generates a daily report identifying unmatched goods-received notes, unusual supplier balances and purchases exceeding departmental limits. The purchase manager manually reviews this report and signs it electronically. The auditor discovers that the report is generated using a restricted ERP query, but the same administrator who maintains the database can modify the query without independent approval. Consequently, the completeness and accuracy of information included in the report are uncertain. During substantive verification, several machinery purchase vouchers are missing, and management refuses to provide alternative supporting documents. The engagement team must distinguish automated application controls from manual controls dependent on system-generated information. It must also determine the significance of General IT Controls, the reliability of application processing and the audit implications of weaknesses in report generation and review.

Zenith's ERP requires supplier identification, invoice date and other mandatory information before an invoice can be submitted for processing. Which type of control is most directly illustrated?

1. A General IT Control because it governs access to the operating system and network infrastructure.
2. An application input control because it validates the completeness and acceptability of information entered into the business application. (correct answer)
3. An IT-dependent manual control because an employee must independently review every mandatory field before submission.
4. A data centre control because invoice information is temporarily stored before the overnight batch-processing cycle.

Answer: B — An application input control because it validates the completeness and acceptability of information entered into the business application.

Explanation. SA 315, Chapter 3, §11.5(B), identifies input validation, mandatory data fields and edit checks as examples of application controls embedded within business applications. These controls help ensure the completeness, accuracy and integrity of information entered into the system. The stated checks operate automatically during invoice entry, rather than through independent manual review. GITCs support the application but operate across systems and applications rather than specifically validating individual business transactions.

Where it goes wrong. Confusing automated validation at the point of data entry with General IT access controls or manual report reviews.

Authority. SA 315

Question 6 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Zenith's ERP assigns sequential purchase order numbers, prevents certain duplicate references and calculates production costs automatically using recorded quantities and predefined material rates. Which assessment is most appropriate?

1. These are exclusively General IT Controls because they affect the processing of all purchase and production transactions.
2. These are IT-dependent manual controls because the finance department ultimately uses production costs in preparing financial statements.
3. These are application controls because programmed checks operate within the business process to support completeness and accuracy of transaction processing. (correct answer)
4. These are data centre operations controls because every automatically calculated amount is generated through scheduled batch processing.

Answer: C — These are application controls because programmed checks operate within the business process to support completeness and accuracy of transaction processing.

Explanation. SA 315, Chapter 3, §11.5(B), recognises sequence number checks, edit checks, user-limit checks and reasonableness checks as application controls. Application controls may be automated or manual and operate at business-process level to support data completeness, accuracy and integrity. The programmed sequence and duplicate checks address transaction processing, while automatic production-cost calculations concern processing accuracy. GITCs support the functioning of such controls but do not themselves represent the individual transaction-level checks.

Where it goes wrong. Classifying every control involving computerised processing as a General IT Control.

Authority. SA 315

Question 7 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The purchase manager manually reviews an ERP-generated exception report and signs it electronically. The underlying query can be modified by the database administrator without independent approval. What is the most significant concern?

1. The review is an automated application control because the report is generated automatically by the ERP system.
2. The review is independent of IT because the purchase manager personally signs the report after examining its contents.
3. The review is a data centre control because the exception report is generated using the company's database infrastructure.
4. The review is an IT-dependent manual control whose effectiveness depends on the completeness and accuracy of the underlying system-generated report. (correct answer)

Answer: D — The review is an IT-dependent manual control whose effectiveness depends on the completeness and accuracy of the underlying system-generated report.

Explanation. SA 315, Chapter 3, §11.5(C), defines IT-dependent controls as manual controls using information or reports generated by IT systems. Their effectiveness depends on the reliability of the underlying source data. Here, the manager performs a manual review, but the report's completeness and accuracy are questionable because its generating query can be altered without approval. The manual signature does not establish the integrity of the source information.

Where it goes wrong. Assuming that manual review makes a control independent of the IT system that supplies its information.

Authority. SA 315

Question 8 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor discovers that Zenith's ERP configuration was changed without adequate testing documentation. How should this weakness influence the assessment of its application controls?

1. The auditor should recognise that ineffective GITCs may undermine confidence in automated application controls and plan appropriate alternative procedures. (correct answer)
2. The auditor should rely on application controls because their automated nature guarantees consistent functioning despite unauthorised changes.
3. The auditor should disregard the configuration weakness because application controls and General IT Controls operate independently of each other.
4. The auditor should treat all ERP processing as incorrect because a single undocumented configuration change proves that every transaction is misstated.

Answer: A — The auditor should recognise that ineffective GITCs may undermine confidence in automated application controls and plan appropriate alternative procedures.

Explanation. SA 315, Chapter 3, §§11.5(A)(b), 11.5(B), 11.5(C) and 11.6, establishes the relationship between General IT Controls and application controls. Program change controls help ensure that modified systems continue to meet financial reporting objectives. GITCs support reliable functioning of application controls. Where they are ineffective, the auditor should assess the resulting risks and consider alternative audit procedures. The weakness does not automatically prove that every transaction is misstated.

Where it goes wrong. Assuming that automated controls operate reliably irrespective of the effectiveness of the underlying program-change controls.

Authority. SA 315

Question 9 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s K. Mehta & Co has been appointed statutory auditor of Suryodaya Retail Ltd, a nationwide retail chain operating 180 stores. Sales, purchases, inventory transfers, customer refunds and cash receipts are processed through a centralised ERP system. Approximately 90% of the company's transactions are recorded electronically, and management provides the statutory auditors with large data extracts containing transaction-level details. During planning, the engagement team decides to use data analytics software to examine purchase transactions, journal entries and inventory movements. The initial analysis identifies repeated payments to certain vendors, multiple journal entries posted late at night and unusual inventory adjustments shortly before year-end. Management explains these matters as routine operational corrections but does not provide supporting reconciliation statements for several transactions. The audit team proposes to use spreadsheets and specialised audit tools such as IDEA and ACL to examine the electronic records. However, the extraction files have not been reconciled with the ERP's underlying transaction population. Certain transaction identifiers are missing, and management cannot establish whether cancelled and reversed entries have been included consistently. The auditors also discover that the company's system administrator can modify historical records without generating an independent change report. The finance controller argues that the analytics results should be accepted as conclusive evidence because millions of transactions have been analysed. The engagement partner disagrees and requires the team to establish population completeness, evaluate the reliability of system-generated information, investigate unusual journal entries and determine the appropriate use of analytical procedures, sample selection and recalculations. The team must also consider whether identified anomalies indicate weaknesses in IT controls requiring alternative audit procedures.

Before using Suryodaya's transaction extract for data analytics, the auditor discovers that some transaction identifiers are missing and management cannot reconcile the extract with the ERP population. What should the auditor do first?

1. Proceed with the analysis because testing a large volume of transactions automatically compensates for missing source records.
2. Select a random sample from the extract and assume that the omitted records have no material effect on the analysis.
3. Establish the completeness and reliability of the electronic data and population before using the information for audit testing. (correct answer)
4. Conclude that the missing identifiers represent fraud and modify the audit opinion without further investigation.

Answer: C — Establish the completeness and reliability of the electronic data and population before using the information for audit testing.

Explanation. SA 315, Chapter 3, §§11.3-11.4 and §14, requires consideration of IT-related risks and the reliability of electronic information used in audit procedures. The study material identifies checking the completeness of data and the population used in tests of controls or substantive procedures as an application of data analytics. An incomplete population can invalidate subsequent analysis and sampling. A large dataset cannot compensate for missing records, and missing identifiers require investigation rather than an automatic fraud conclusion.

Where it goes wrong. Confusing the volume of electronic data analysed with the completeness of the underlying audit population.

Authority. SA 315

Question 10 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The engagement team wishes to select transactions from Suryodaya's substantiated electronic population for detailed audit testing. Which approach is specifically contemplated in the study material as an application of data analytics?

1. Select transactions exclusively on the basis of management's explanations of unusual entries and payments.
2. Select only transactions processed during normal business hours because such entries are less likely to contain errors.
3. Avoid electronic sampling because CAATs are restricted to recalculating balances and cannot assist in sample selection.
4. Use computer-assisted techniques to select audit samples through random sampling or systematic sampling. (correct answer)

Answer: D — Use computer-assisted techniques to select audit samples through random sampling or systematic sampling.

Explanation. SA 315, ICAI Study Material Chapter 3, §14, explains that Computer Assisted Auditing Techniques such as IDEA and ACL may be used for selection of audit samples, including random and systematic sampling. Electronic sample selection can be particularly useful in a high-volume environment. However, the reliability and completeness of the population must first be established. Selecting transactions solely on management's explanation or on the time of posting would not provide an appropriate basis for representative audit sampling.

Where it goes wrong. Assuming that computer-assisted audit techniques can analyse data but cannot assist with audit sample selection.

Authority. SA 315

Question 11 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The finance controller claims that testing millions of Suryodaya's transactions through data analytics provides conclusive evidence of the correctness of its financial statements. Which response should the auditor adopt?

1. Accept the controller's position because testing the complete transaction population eliminates all risks arising from inaccurate source data.
2. Disregard data analytics because electronic analytical procedures cannot provide useful audit evidence in statutory audits.
3. Use the analysis selectively, after evaluating source-data reliability, completeness and the need for corroborating procedures addressing identified exceptions. (correct answer)
4. Accept the analytical findings as conclusive because CAATs automatically establish the accuracy of management's accounting estimates.

Answer: C — Use the analysis selectively, after evaluating source-data reliability, completeness and the need for corroborating procedures addressing identified exceptions.

Explanation. SA 315, Chapter 3, §§11.3-11.4 and §14, supports the use of data analytics for electronic-record testing, but also requires consideration of risks arising from IT systems. Testing a large population does not establish that the underlying data is complete and accurate. The auditor must evaluate the reliability of the extracted data, investigate exceptions and obtain appropriate corroborative evidence. CAATs facilitate audit work; they do not automatically guarantee the correctness of financial statements or eliminate audit risk.

Where it goes wrong. Equating extensive electronic data analysis with conclusive evidence, without considering the reliability of the underlying source population.

Authority. SA 315

Question 12 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The audit team identifies duplicate vendor payments, unusual late-night journal entries and suspicious inventory adjustments. Which application of data analytics would be most directly relevant to these findings?

1. Reconstructing the trial balance exclusively to identify differences between opening and closing equity balances.
2. Analysing journal entries and transaction patterns to investigate potential fraud and evaluate the impact of control deficiencies. (correct answer)
3. Selecting only systematic samples of customer invoices to establish the completeness of sales revenue.
4. Recalculating depreciation charges without examining the unusual payment and journal-entry patterns identified.

Answer: B — Analysing journal entries and transaction patterns to investigate potential fraud and evaluate the impact of control deficiencies.

Explanation. SA 315, ICAI Study Material Chapter 3, §14, identifies journal-entry analysis, fraud investigation and evaluation of control deficiencies as uses of data analytics. Suryodaya's unusual posting patterns and duplicate payments provide circumstances in which these techniques may assist the auditor in identifying suspicious transactions and possible control weaknesses. Reconstructing the trial balance and recalculating depreciation are also recognised uses of CAATs, but do not directly address the identified anomalies.

Where it goes wrong. Selecting a valid data analytics technique without checking whether it addresses the specific audit risk under investigation.

Authority. SA 315

Question 13 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company operates a cloud-based accounting system. Its IT department maintains access restrictions for the operating system, database, network infrastructure and financial applications. Which statement most accurately describes these controls?

A company operates a cloud-based accounting system. Its IT department maintains access restrictions for the operating system, database, network infrastructure and financial applications. Which statement most accurately describes these controls?

1. They are application controls because they directly validate the accuracy of individual invoices and receipts.
2. They are IT-dependent manual controls because administrators personally approve each transaction recorded by the finance department.
3. They are data centre controls because authentication and authorisation are performed only when batch jobs are executed.
4. They are General IT access security controls because they protect programs and data through authentication and authorisation. (correct answer)

Answer: D — They are General IT access security controls because they protect programs and data through authentication and authorisation.

Explanation. SA 315, Chapter 3, §11.5(A)(c), identifies access security as a General IT Control. Its objective is to ensure that access to programs and data is authenticated and authorised. The study material specifically includes application security, data security, operating system security, network security and physical security. These controls apply across IT systems and are not limited to individual invoice validation or transaction-level approval procedures.

Where it goes wrong. Confusing infrastructure-level access protection with application controls operating over individual transactions.

Authority. SA 315

Question 14 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A retail company's ERP prevents entry of a sales invoice when the customer code is invalid, the quantity field is blank or the invoice date falls outside an allowed format. How should these features be classified?

A retail company's ERP prevents entry of a sales invoice when the customer code is invalid, the quantity field is blank or the invoice date falls outside an allowed format. How should these features be classified?

1. Application input controls that validate data entered into the system before the transaction is accepted for further processing. (correct answer)
2. General IT access controls that authenticate the identity of users before they can access operating system resources.
3. Data centre controls that ensure that daily sales-processing jobs are executed according to their scheduled timings.
4. IT-dependent manual controls that require the finance manager to inspect a system-generated exception report.

Answer: A — Application input controls that validate data entered into the system before the transaction is accepted for further processing.

Explanation. SA 315, Chapter 3, §11.5(B), identifies edit checks, input validation and mandatory data fields as automated application controls. They operate at business-process level and help ensure the completeness, accuracy and integrity of data. In the stated situation, invalid customer codes, missing quantities and improper date formats are rejected at the input stage. User authentication belongs to General IT access security, while manual reviews of system reports are IT-dependent controls.

Where it goes wrong. Confusing validation of transaction content with authentication of the individual entering the transaction.

Authority. SA 315

Question 15 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company acquires a new ERP platform for financial reporting. The implementation team performs project initiation, system analysis, software configuration, construction, testing and quality assurance before deployment. Which General IT Control area does this primarily represent?

A company acquires a new ERP platform for financial reporting. The implementation team performs project initiation, system analysis, software configuration, construction, testing and quality assurance before deployment. Which General IT Control area does this primarily represent?

1. Data centre and network operations controls, because the system will eventually be hosted on company servers.
2. Application system acquisition, development and maintenance controls, because the system must be developed and implemented to meet financial reporting objectives. (correct answer)
3. IT-dependent controls, because the implementation team will manually review information produced by the new application.
4. Application input controls, because the system configuration necessarily validates every individual transaction entered after implementation.

Answer: B — Application system acquisition, development and maintenance controls, because the system must be developed and implemented to meet financial reporting objectives.

Explanation. SA 315, Chapter 3, §11.5(A)(d), describes General IT Controls over application system acquisition, development and maintenance. Their objective is to ensure that systems are developed, configured and implemented to meet financial reporting objectives. Relevant activities include project initiation, analysis and design, construction, testing and quality assurance. Hosting and batch operations belong to data centre controls, while transaction-level validation belongs to application controls.

Where it goes wrong. Mistaking the development and implementation of an application for the controls operating inside that application.

Authority. SA 315

Question 16 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An organisation introduces a policy restricting unauthorised changes to operating system configurations and database security settings. It also restricts physical access to its server room. How should these arrangements be assessed?

An organisation introduces a policy restricting unauthorised changes to operating system configurations and database security settings. It also restricts physical access to its server room. How should these arrangements be assessed?

1. As application controls because operating system configurations directly calculate financial statement balances.
2. As IT-dependent controls because security policies require the manual approval of financial transactions.
3. As General IT access security controls covering operating system security, data security and physical security. (correct answer)
4. As data analytics controls because changes to server configurations must be identified through statistical analysis.

Answer: C — As General IT access security controls covering operating system security, data security and physical security.

Explanation. SA 315, Chapter 3, §11.5(A)(c), includes operating system security, data security and physical security within access security controls. These General IT Controls protect the programs, infrastructure and data supporting financial reporting. They are applied across multiple applications and business processes. Application controls operate at the transaction level, whereas data analytics are audit tools used to examine electronic information. The presence of manual approvals does not alter the primary classification of the security arrangements.

Where it goes wrong. Assuming that controls over operating systems and server infrastructure are application-level financial transaction controls.

Authority. SA 315

Question 17 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company maintains daily backups of financial information, monitors database performance, schedules batch jobs and periodically tests its disaster recovery plan. Which assessment is most appropriate?

A company maintains daily backups of financial information, monitors database performance, schedules batch jobs and periodically tests its disaster recovery plan. Which assessment is most appropriate?

1. These are application controls because they validate the completeness and accuracy of individual transaction inputs.
2. These are IT-dependent manual controls because they require employees to approve the company's financial statements.
3. These are program change controls because every backup constitutes an approved modification to the financial application.
4. These are General IT Controls over data centre and network operations supporting continuity and reliability of production processing. (correct answer)

Answer: D — These are General IT Controls over data centre and network operations supporting continuity and reliability of production processing.

Explanation. SA 315, Chapter 3, §11.5(A)(a), includes batch scheduling and execution, backup storage and retention, performance monitoring of systems and databases, and business continuity and disaster recovery arrangements within data centre and network operations controls. These controls support reliable production processing and the availability of financial information. Application controls instead address transaction-level completeness, accuracy and integrity. The described activities are broader infrastructure-level controls.

Where it goes wrong. Confusing backup and disaster recovery arrangements with the controls validating individual transactions.

Authority. SA 315

Question 18 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An auditor discovers that an ERP system has effective mandatory-field validations and sequence-number checks. However, General IT Controls over program modifications and administrator access are ineffective. Which conclusion most accurately reflects the relationship between the two categories of controls?

An auditor discovers that an ERP system has effective mandatory-field validations and sequence-number checks. However, General IT Controls over program modifications and administrator access are ineffective. Which conclusion most accurately reflects the relationship between the two categories of controls?

1. Application controls and General IT Controls are independent, so weaknesses in the latter cannot influence the reliability of the former.
2. General IT Controls support application controls, and their ineffectiveness may undermine confidence in the reliability of automated processing. (correct answer)
3. Application controls replace General IT Controls because successful validation checks automatically prevent all unauthorised system changes.
4. General IT Controls become relevant only when the organisation uses manual accounting records instead of an integrated application.

Answer: B — General IT Controls support application controls, and their ineffectiveness may undermine confidence in the reliability of automated processing.

Explanation. SA 315, Chapter 3, §11.6, explains that General IT Controls and application controls are interrelated. GITCs support the functioning of application controls, and both are needed to ensure complete and accurate information processing. Weak access security and program change arrangements may permit unauthorised modification of otherwise effective automated checks. Consequently, the auditor cannot assess application controls in isolation from the General IT Controls on which their reliability depends.

Where it goes wrong. Assuming that satisfactory transaction-level checks remain reliable regardless of weaknesses in the underlying IT environment.

Authority. SA 315

Question 19 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. The finance manager manually reviews an ERP-generated ageing report and follows up overdue receivables. The auditor intends to rely on this procedure as a control over recoverability. What additional consideration is most important?

The finance manager manually reviews an ERP-generated ageing report and follows up overdue receivables. The auditor intends to rely on this procedure as a control over recoverability. What additional consideration is most important?

1. The finance manager's signature is sufficient because manual review automatically establishes the completeness of all receivable balances.
2. The auditor must evaluate the reliability and completeness of the source information because the manual control depends on system-generated data. (correct answer)
3. The auditor should classify the procedure as a General IT Control because the report originates from the company's database.
4. The auditor should disregard the procedure because manual reviews cannot provide audit evidence in an automated environment.

Answer: B — The auditor must evaluate the reliability and completeness of the source information because the manual control depends on system-generated data.

Explanation. SA 315, Chapter 3, §11.5(C), identifies this arrangement as an IT-dependent manual control. Although the review is performed manually, its effectiveness depends on the reliability of the information produced by the IT system. The auditor must therefore consider whether the ageing report contains complete and accurate data and whether relevant GITCs support its reliability. A signature alone does not establish that the underlying population has been correctly generated.

Where it goes wrong. Confusing performance of a manual review with the reliability of the electronically generated information on which it depends.

Authority. SA 315

Question 20 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company processes 50,000 routine purchase invoices monthly. Management proposes replacing automated validation and duplicate-invoice checks with manual verification by a single accounts executive. Which assessment is most appropriate?

A company processes 50,000 routine purchase invoices monthly. Management proposes replacing automated validation and duplicate-invoice checks with manual verification by a single accounts executive. Which assessment is most appropriate?

1. Manual procedures are necessarily preferable because they eliminate programming errors and management override risks.
2. Automated controls are unsuitable for recurring transactions because they cannot accommodate large volumes of electronic invoices.
3. Automated control elements may be more suitable for high-volume recurring transactions, while manual controls may be more prone to bypass, inconsistency and human error. (correct answer)
4. The change has no significance for audit risk because both manual and automated procedures provide identical assurance.

Answer: C — Automated control elements may be more suitable for high-volume recurring transactions, while manual controls may be more prone to bypass, inconsistency and human error.

Explanation. SA 315, ICAI Study Material Chapter 3, §12.1, explains that manual controls may be less reliable because they can be bypassed, ignored or overridden and are more prone to simple errors. Manual elements may be less suitable for high-volume recurring transactions where predictable errors can be prevented or detected through automated parameters. Accordingly, replacing automated invoice validation with a single manual reviewer may increase risk. The auditor should assess the changed control arrangements.

Where it goes wrong. Assuming manual controls are always more reliable than automated controls simply because a human being performs them.

Authority. SA 315

Question 21 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor wants to test whether an automated purchase approval control operates according to its documented configuration. Which approach most appropriately combines audit evidence in an automated environment?

An auditor wants to test whether an automated purchase approval control operates according to its documented configuration. Which approach most appropriately combines audit evidence in an automated environment?

1. Inquire of the finance manager and accept the verbal explanation without obtaining any additional supporting evidence.
2. Inspect the company's annual report and assume that all system configurations operate exactly as described by management.
3. Observe one transaction and conclude that the approval control operated consistently throughout the entire financial year.
4. Combine inquiry with inspection of application configuration and relevant evidence, using observation or reperformance where necessary. (correct answer)

Answer: D — Combine inquiry with inspection of application configuration and relevant evidence, using observation or reperformance where necessary.

Explanation. SA 315, Chapter 3, §11.7, identifies inquiry, observation, inspection and reperformance as audit testing methods in automated environments. Inquiry alone provides the least audit evidence and should be combined with another procedure. A walkthrough using inquiry, observation and inspection can help understand end-to-end transaction processing. Reperformance generally provides strong evidence but may be time-consuming. The auditor should select and document an appropriate combination based on risk and the evidence required.

Where it goes wrong. Treating inquiry or a single observation as sufficient evidence of the continuing operating effectiveness of an automated control.

Authority. SA 315

Question 22 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. A company claims that its automated application calculates interest correctly on all borrowings. The auditor wishes to test the reliability of this processing rather than merely obtain management's explanation. Which procedure would provide the most persuasive direct evidence?

A company claims that its automated application calculates interest correctly on all borrowings. The auditor wishes to test the reliability of this processing rather than merely obtain management's explanation. Which procedure would provide the most persuasive direct evidence?

1. Reperform the interest calculation using relevant loan terms and independently substantiated underlying data. (correct answer)
2. Inquire of the system administrator whether the interest calculation program was designed correctly.
3. Observe an employee opening the application and confirm that the interest calculation screen is displayed.
4. Inspect the company's accounting manual and accept the documented interest calculation methodology without further testing.

Answer: A — Reperform the interest calculation using relevant loan terms and independently substantiated underlying data.

Explanation. SA 315, Chapter 3, §11.7, identifies reperformance as an audit testing method that generally provides the strongest audit evidence, although it may be time-consuming. Independently recalculating interest using substantiated loan terms directly tests the accuracy of the system's result. Inquiry alone supplies the least evidence, while observing a screen or inspecting a manual does not independently establish that the calculation was correctly performed. The auditor must also consider the reliability of the underlying source information.

Where it goes wrong. Confusing an explanation of how software is intended to operate with independent verification of what it actually calculated.

Authority. SA 315

Question 23 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. The statutory auditor of a manufacturing company uses spreadsheet tools to independently recalculate depreciation charges and bank interest using extracted electronic records. Under the ICAI Study Material, this represents which application of data analytics?

The statutory auditor of a manufacturing company uses spreadsheet tools to independently recalculate depreciation charges and bank interest using extracted electronic records. Under the ICAI Study Material, this represents which application of data analytics?

1. Using CAATs exclusively for detecting unauthorised changes to network security configurations.
2. Using CAATs to reperform mathematical calculations and verify the correctness of accounting computations. (correct answer)
3. Using CAATs exclusively to select samples through random and systematic sampling methods.
4. Using CAATs to replace the need to evaluate the completeness of electronic transaction populations.

Answer: B — Using CAATs to reperform mathematical calculations and verify the correctness of accounting computations.

Explanation. SA 315, ICAI Study Material Chapter 3, §14, identifies reperformance of mathematical calculations as an application of data analytics. The examples specifically include recalculating depreciation and bank interest. Spreadsheet tools and specialised software can assist the auditor in independently verifying computations using electronic records. Sampling, population completeness checks and fraud investigation are other applications of CAATs, but they are different objectives from the recalculation described in the question.

Where it goes wrong. Confusing mathematical recalculation with sample selection or investigation of system security.

Authority. SA 315

Question 24 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. During a statutory audit, the auditor uses IDEA to identify unusual journal entries posted near year-end, including entries made by senior finance personnel outside normal working hours. What is the most appropriate purpose of this analysis?

During a statutory audit, the auditor uses IDEA to identify unusual journal entries posted near year-end, including entries made by senior finance personnel outside normal working hours. What is the most appropriate purpose of this analysis?

1. To establish that every journal entry posted outside office hours represents a fraudulent transaction requiring immediate qualification of the audit opinion.
2. To verify that system backups were stored correctly and that the company's disaster recovery plan was tested throughout the year.
3. To identify potentially suspicious journal-entry patterns for further investigation and assess possible fraud or control deficiencies. (correct answer)
4. To establish the reliability of user passwords and network authentication without examining transaction-related information.

Answer: C — To identify potentially suspicious journal-entry patterns for further investigation and assess possible fraud or control deficiencies.

Explanation. SA 315, ICAI Study Material Chapter 3, §14, identifies journal-entry analysis, fraud investigation and evaluation of control deficiencies as important applications of data analytics. Unusual posting times and senior-user activity may identify transactions requiring additional investigation, but they do not independently establish fraud. The auditor should evaluate the circumstances, supporting evidence, authorisation and accounting rationale of identified entries before reaching conclusions.

Where it goes wrong. Assuming that an unusual journal-entry characteristic proves fraud rather than identifying a risk requiring further investigation.

Authority. SA 315

Question 25 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor reconstructs the company's trial balance directly from transaction-level electronic records using specialised audit software and compares it with the trial balance prepared by management. Which application of CAATs is primarily illustrated?

An auditor reconstructs the company's trial balance directly from transaction-level electronic records using specialised audit software and compares it with the trial balance prepared by management. Which application of CAATs is primarily illustrated?

1. Using data analytics to evaluate the effectiveness of physical security controls over the server room.
2. Using application controls to validate mandatory supplier fields before invoices enter the accounting system.
3. Using General IT Controls to authorise modifications to the company's accounting application.
4. Using data analytics to re-compute balances by reconstructing the trial balance from underlying transaction data. (correct answer)

Answer: D — Using data analytics to re-compute balances by reconstructing the trial balance from underlying transaction data.

Explanation. SA 315, ICAI Study Material Chapter 3, §14, expressly identifies reconstruction of the trial balance from transaction data as an application of data analytics for re-computation of balances. The auditor can use spreadsheets or specialised audit tools to independently derive financial information and compare it with management's records. This is a recalculation and reconciliation application of CAATs, not a test of access security, application input validation or program change controls.

Where it goes wrong. Confusing independent reconstruction of financial balances with testing of the IT controls that process the underlying transactions.

Authority. SA 315