You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 31
An INTEGRATED TEST FACILITY (ITF) involves:
Select an option first.
Correct answer: B — A DUMMY ENTITY established within the client's LIVE system, through which the auditor processes fictitious transactions
Explanation: An ITF establishes a fictitious entity (a dummy branch, department or customer) within the client's LIVE production system. The auditor processes test transactions through it to verify processing controls under real conditions. Because the transactions are fake but the system is live, they MUST be reversed afterwards.
Question 32
GENERALISED AUDIT SOFTWARE (ACL, IDEA) is used to:
Select an option first.
Correct answer: D — QUERY and ANALYSE client data — enabling 100% population testing
Explanation: GENERALISED AUDIT SOFTWARE lets the auditor extract, sort, stratify, sample and analyse client data directly — enabling testing of ENTIRE POPULATIONS rather than samples, and supporting journal-entry fraud testing.
Question 33
Auditing 'AROUND the computer' means:
Select an option first.
Correct answer: B — Testing INPUTS against OUTPUTS, ignoring the processing in between
Explanation: Auditing 'AROUND' the computer ignores the processing and tests only INPUTS against OUTPUTS. It works ONLY where a clear AUDIT TRAIL exists and volumes are low. In a complex, high-volume, paperless environment, the trail vanishes inside the system and the auditor must audit 'THROUGH' it using CAATs.
Question 34
A CHANGE MANAGEMENT control requires that program changes be:
Select an option first.
Correct answer: D — REQUESTED, APPROVED, TESTED and DEPLOYED through a controlled process
Explanation: CHANGE MANAGEMENT requires changes to be formally REQUESTED, APPROVED, TESTED (in a separate environment) and DEPLOYED by someone OTHER than the developer. The classic failure is a DEVELOPER WITH PRODUCTION ACCESS — a segregation-of-duties breach that lets code bypass testing entirely.
Question 35
A developer having ACCESS TO PRODUCTION is a violation of:
Select an option first.
Correct answer: D — SEGREGATION OF DUTIES — the developer could deploy untested or malicious code
Explanation: A DEVELOPER with PRODUCTION ACCESS can bypass testing and approval entirely, deploying untested or malicious code. Development, testing and production environments must be SEPARATE, and deployment must be performed by someone other than the developer. This is the archetypal ITGC failure.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 36
The purpose of a SEPARATE TEST environment is to:
Select an option first.
Correct answer: C — Allow changes to be VALIDATED without risking the PRODUCTION system or its data
Explanation: A separate TEST (and often a separate DEVELOPMENT and STAGING) environment lets changes be validated without endangering production. It also supports SEGREGATION OF DUTIES. Note that using LIVE PRODUCTION DATA in a test environment creates a PRIVACY risk — data should be masked or anonymised.
Question 37
Using LIVE PRODUCTION DATA in a test environment creates a risk to:
Select an option first.
Correct answer: A — CONFIDENTIALITY and PRIVACY — test environments typically have weaker controls
Explanation: Test environments typically have WEAKER access controls and broader developer access. Populating them with LIVE production data (real customer records, real PII) exposes that data to a far larger group. The control is to MASK, ANONYMISE or SYNTHESISE the test data.
Question 38
An emergency ('break-glass') change should:
Select an option first.
Correct answer: C — Be permitted, but DOCUMENTED and RETROSPECTIVELY APPROVED and reviewed
Explanation: EMERGENCY changes are legitimate — production outages cannot wait for a change advisory board. But the elevated access must be TIME-LIMITED, LOGGED, and the change RETROSPECTIVELY documented, approved and reviewed. Unlogged, unreviewed emergency access is a major control gap.
Question 39
A DISASTER RECOVERY PLAN differs from a BUSINESS CONTINUITY PLAN in that the DRP:
Select an option first.
Correct answer: C — Focuses specifically on restoring IT SYSTEMS and DATA
Explanation: A DISASTER RECOVERY PLAN focuses on restoring IT SYSTEMS and DATA. A BUSINESS CONTINUITY PLAN is BROADER — covering how the entire BUSINESS continues to operate (alternate premises, staff, suppliers, communications). DR is a component of BC.
Question 40
The most important test of a backup is:
Select an option first.
Correct answer: A — A TESTED RESTORE — an untested backup is not a recovery capability
Explanation: The BACKUP is not the control — the RESTORE is. An organisation that backs up religiously but never tests a restore has only the ILLUSION of recovery capability. Auditors ask WHEN THE RESTORE WAS LAST TESTED, and what the result was.
Question 41
The 3-2-1 backup rule recommends:
Select an option first.
Correct answer: A — 3 copies, 2 media types, 1 offsite
Explanation: The 3-2-1 rule: THREE copies of the data, on TWO different media types, with at least ONE stored OFFSITE (or offline/immutable). The offline copy is what defeats RANSOMWARE — an attacker who encrypts everything reachable on the network cannot touch an air-gapped copy.
Question 42
A MASTER FILE change (e.g. adding a vendor) should be:
Select an option first.
Correct answer: D — SEGREGATED from payment approval and INDEPENDENTLY reviewed
Explanation: Controlling the VENDOR MASTER FILE must be SEGREGATED from PAYMENT APPROVAL. Otherwise one person can invent a fictitious vendor and pay it — the classic SHELL VENDOR fraud. Master file changes should be independently reviewed against supporting documentation.
Question 43
An AUDIT TRAIL (transaction log) provides:
Select an option first.
Correct answer: C — A DETECTIVE record of who did what, when — supporting accountability and investigation
Explanation: An AUDIT TRAIL is a DETECTIVE control: it records WHO did WHAT and WHEN. It does not PREVENT anything, but it supports accountability, investigation and non-repudiation. Critically, LOGS MUST BE PROTECTED from alteration by the very users they monitor.
Question 44
System logs should be protected because:
Select an option first.
Correct answer: B — An attacker (or insider) will attempt to ALTER OR DELETE them to hide their tracks
Explanation: The FIRST thing a sophisticated attacker does after gaining access is COVER THEIR TRACKS by altering or deleting LOGS. Logs must therefore be written to a SEPARATE, WRITE-ONCE or append-only system that the compromised account cannot modify (a SIEM, a log server).
Question 45
A SIEM (Security Information and Event Management) system:
Select an option first.
Correct answer: A — AGGREGATES and CORRELATES logs from across the environment to detect anomalies
Explanation: A SIEM AGGREGATES logs from firewalls, servers, applications and endpoints, then CORRELATES events to detect patterns invisible in any single log. It is a DETECTIVE control, and its effectiveness depends entirely on whether anyone actually MONITORS and RESPONDS to the alerts it generates.
Question 46
Robotic Process Automation (RPA) presents which control risk?
Select an option first.
Correct answer: A — A BOT credential with EXCESSIVE privileges, and changes to bot logic bypassing change management
Explanation: RPA bots operate with THEIR OWN CREDENTIALS — often granted broad privileges for convenience. Risks: excessive bot privilege; bot logic changed without change management; no segregation of duties (one bot performing incompatible functions); and inadequate exception handling. Bots need the same ITGCs as any application.
Question 47
Blockchain's principal control characteristic is:
Select an option first.
Correct answer: C — IMMUTABILITY — records, once written and confirmed, are extremely difficult to alter
Explanation: BLOCKCHAIN's defining characteristic is IMMUTABILITY through cryptographic chaining and distributed consensus. Note this is a double-edged sword: it prevents tampering, but it also means an ERRONEOUS or FRAUDULENT entry cannot simply be corrected — it must be reversed by a new offsetting transaction.
Question 48
An entity's data GOVERNANCE programme establishes:
Select an option first.
Correct answer: B — OWNERSHIP, QUALITY standards, policies and accountability for data across its lifecycle
Explanation: DATA GOVERNANCE establishes WHO OWNS which data (data owners and stewards), what QUALITY standards apply, what POLICIES govern its use, and who is ACCOUNTABLE. Without governance, a data lake becomes a 'data swamp' — technically full, practically useless.
Question 49
Data QUALITY dimensions include:
Select an option first.
Correct answer: B — ACCURACY, COMPLETENESS, CONSISTENCY, TIMELINESS and VALIDITY
Explanation: DATA QUALITY dimensions: ACCURACY (correct), COMPLETENESS (nothing missing), CONSISTENCY (the same fact agrees across systems), TIMELINESS (current enough for its use), VALIDITY (conforms to defined rules), and UNIQUENESS (no duplicates). Poor data quality invalidates every analysis built on it.
Question 50
A DATA DICTIONARY documents:
Select an option first.
Correct answer: A — The DEFINITION, format, source and permitted values of each data element
Explanation: A DATA DICTIONARY (metadata repository) documents each data element: its DEFINITION, FORMAT, SOURCE, permitted VALUES, and relationships. It is essential for consistency — without it, two departments will compute 'revenue' differently and both will believe they are right.
Question 51
An entity's automated three-way match tested effectively in June. Change management is INEFFECTIVE. The auditor should:
Select an option first.
Correct answer: B — Recognise the program logic could have CHANGED at any point — the June result cannot be extrapolated across the period
Explanation: The ITGC dependency in its purest form. Without effective CHANGE MANAGEMENT, the auditor has no assurance the program tested in June is the same program that ran in March or December. A point-in-time test of an automated control extrapolates ONLY if ITGCs guarantee the logic did not change.
Question 52
An AUTOMATED control, once its logic is verified and ITGCs are effective, may be tested with:
Select an option first.
Correct answer: B — A SINGLE instance — a program executes identically every time
Explanation: An automated control operates with PERFECT CONSISTENCY: it applies the same logic every time. Once the logic is verified and ITGCs confirm it did not change, a SINGLE instance may suffice. A MANUAL control, by contrast, is subject to human error and fatigue, and needs a much larger sample.
Question 53
A MANUAL control requires a LARGER sample than an automated one because:
Select an option first.
Correct answer: A — Each instance is an INDEPENDENT opportunity for human error, fatigue or override
Explanation: A MANUAL control depends on a person performing it correctly EVERY time. Each occurrence is an independent opportunity for error, fatigue, misunderstanding or deliberate override — so a larger sample is needed to conclude on operating effectiveness. Automation removes that variability.
Question 54
Control testing sample size is driven principally by:
Select an option first.
Correct answer: A — The FREQUENCY of the control's operation
Explanation: Control testing sample sizes scale with FREQUENCY, not account size. Rough guides: ANNUAL = 1; QUARTERLY = 2; MONTHLY = 2-5; WEEKLY = 5-15; DAILY = 20-40; MANY TIMES PER DAY = 25-60. You cannot sample more instances than exist — an annual control has a population of ONE.
Question 55
A cloud SaaS provider suffers an outage. The user entity's responsibility is:
Select an option first.
Correct answer: A — To have ASSESSED the availability risk, negotiated SLAs, and planned for the outage — accountability was never outsourced
Explanation: Outsourcing the SYSTEM does not outsource ACCOUNTABILITY. The user remains responsible for its own operations and reporting. It should have assessed the provider's availability controls (via a SOC 2 covering AVAILABILITY), negotiated SLAs, and maintained a contingency plan. 'The vendor's fault' is not an answer to a regulator.
Question 56
A user entity's data in a MULTI-TENANT public cloud is protected from other tenants by:
Select an option first.
Correct answer: D — LOGICAL separation (segregation controls) — which is precisely what a SOC 2 provides assurance over
Explanation: In a MULTI-TENANT public cloud, your data shares physical infrastructure with strangers. Separation is LOGICAL, not physical. That logical segregation is exactly the control a SOC 2 examines — and it is why multi-tenancy is the central audit concern with public cloud.
Question 57
An entity uses a cloud provider that uses ANOTHER cloud provider for hosting. The second provider is a:
Select an option first.
Correct answer: B — SUBSERVICE ORGANISATION — whose controls are typically CARVED OUT of the first provider's SOC report
Explanation: The hosting provider is a SUBSERVICE ORGANISATION to your service organisation. Under the (default) CARVE-OUT method, its controls are EXCLUDED from the SOC report you receive — leaving a HOLE you must fill by obtaining ITS SOC report. Nested outsourcing is common and routinely overlooked.
Question 58
An RPO of ZERO would require:
Select an option first.
Correct answer: C — CONTINUOUS REPLICATION (synchronous) — no data loss is acceptable
Explanation: An RPO of ZERO means NO DATA LOSS is acceptable — requiring SYNCHRONOUS, CONTINUOUS REPLICATION to a secondary site. It is extremely expensive. Most organisations set an RPO reflecting what they can actually afford to lose (15 minutes, an hour, a day).
Question 59
A business can tolerate 3 days of downtime. The appropriate DR site is likely:
Select an option first.
Correct answer: C — COLD or WARM — a hot site would be a waste of money for a 3-day RTO
Explanation: The DR site must be driven by the RTO from the BIA — not by preference. A 3-DAY tolerance is comfortably met by a COLD or WARM site at a fraction of the cost of a HOT site. An auditor should challenge a hot site for a business that can tolerate days of outage: it is a control that fails the cost-benefit test.
Question 60
The constraint 'RTO must be ≤ MTD' means:
Select an option first.
Correct answer: C — Recovery must be achieved BEFORE the maximum tolerable downtime is reached — otherwise the business fails
Explanation: MTD (Maximum Tolerable Downtime) is the point beyond which the business suffers unacceptable or existential damage. RTO (the recovery target) must be SHORTER than MTD — with a margin. An RTO exceeding MTD means the recovery plan, even if executed perfectly, arrives too late.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.