You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 61
A DEVOPS CI/CD pipeline's automated approval gates and tests ARE:
Select an option first.
Correct answer: C — THE CHANGE MANAGEMENT CONTROL — automated, but still a control the auditor tests
Explanation: Agile and DevOps do NOT remove the need for controls — they AUTOMATE them. In a CI/CD pipeline, the automated tests, peer-review requirements and approval gates ARE the change management control. The auditor tests THOSE — including whether anyone can bypass the pipeline and deploy directly.
Question 62
The ability to BYPASS a CI/CD pipeline and deploy directly to production is:
Select an option first.
Correct answer: A — A CRITICAL CONTROL GAP — it defeats every automated gate
Explanation: If a developer can deploy DIRECTLY to production, bypassing the pipeline, every automated test and approval gate is defeated. Emergency ('break-glass') deployment paths may be necessary — but they must be TIGHTLY RESTRICTED, LOGGED, and retrospectively REVIEWED.
Question 63
A data lake with no governance becomes:
Select an option first.
Correct answer: B — A 'DATA SWAMP' — technically full, practically unusable, with no lineage or quality assurance
Explanation: SCHEMA-ON-READ gives flexibility, but without GOVERNANCE (ownership, cataloguing, lineage, quality standards, retention) a data lake degrades into a DATA SWAMP: full of data nobody can find, trust or interpret. The governance risk is the audit angle on data lakes.
Question 64
An entity's ETL process introduces a transformation error. The consequence is:
Select an option first.
Correct answer: C — CORRUPTED data in the WAREHOUSE — and every downstream report and decision built on it
Explanation: An ETL transformation error propagates SILENTLY into the warehouse and from there into every report, dashboard and decision built on it. Controls: reconciliation of record counts and control totals between source and target; exception reporting; and independent validation of the transformation logic.
Question 65
A RECONCILIATION between source and target record counts in an ETL process is a:
Select an option first.
Correct answer: B — DETECTIVE control — it identifies records lost or duplicated in transit
Explanation: Reconciling RECORD COUNTS and CONTROL TOTALS between the SOURCE and the TARGET is a DETECTIVE control — it identifies records LOST, DUPLICATED or CORRUPTED during extraction and loading. It is the ETL equivalent of a batch total.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 66
An auditor tests an automated edit check by submitting a negative quantity, which the system rejects. This is:
Select an option first.
Correct answer: B — TEST DATA — the auditor's own fictitious transaction run through the CLIENT'S program
Explanation: The auditor prepared their OWN transaction (a deliberately invalid one) and ran it through the CLIENT'S program. That is TEST DATA. Its limitation: it tests the program AT A POINT IN TIME, so it relies on CHANGE MANAGEMENT to confirm the same program ran all year.
Question 67
The key LIMITATION of the test data approach is that it:
Select an option first.
Correct answer: C — Tests the program at a POINT IN TIME — relying on ITGCs to confirm the same logic ran all period
Explanation: TEST DATA proves the program handled the auditor's transactions correctly ON THE DAY IT WAS RUN. Extrapolating that to the whole period depends entirely on CHANGE MANAGEMENT controls confirming the logic did not change. Without effective ITGCs, the test proves very little.
Question 68
Fictitious transactions processed through an ITF must be:
Select an option first.
Correct answer: A — REVERSED afterwards — they are fake transactions in a LIVE production system
Explanation: An INTEGRATED TEST FACILITY puts FICTITIOUS transactions through the LIVE production system. They MUST be REVERSED, or they will contaminate the client's real records and financial statements. Failing to reverse them is a serious (and embarrassing) audit error.
Question 69
Auditing 'THROUGH' the computer is REQUIRED when:
Select an option first.
Correct answer: A — The system is COMPLEX and PAPERLESS — the audit trail exists only inside the system
Explanation: When information is initiated, recorded, processed and reported ONLY IN ELECTRONIC FORM, and no visible audit trail survives, substantive procedures alone CANNOT provide sufficient evidence. The auditor is then REQUIRED to test controls and audit THROUGH the computer using CAATs.
Question 70
In a fully automated environment with NO paper trail, testing controls is:
Select an option first.
Correct answer: C — MANDATORY — substantive procedures alone cannot provide sufficient appropriate evidence
Explanation: This is the ONE circumstance in which control testing is REQUIRED rather than a matter of the auditor's efficiency judgement. If substantive procedures ALONE cannot provide sufficient evidence — because the evidence exists only electronically — the auditor MUST test controls.
Question 71
An entity's ERP system was implemented mid-year. The auditor should:
Select an option first.
Correct answer: C — Understand and test BOTH systems, AND the DATA CONVERSION — a one-off, high-risk event
Explanation: TWO systems operated during the period, so both must be understood and (if reliance is planned) tested. Critically, the DATA CONVERSION — migrating opening balances and master data — is a ONE-OFF, HIGH-RISK event that can introduce material errors, and it is the step most often forgotten.
Question 72
The highest-risk element of a system implementation is often:
Select an option first.
Correct answer: A — DATA CONVERSION — a one-time migration of balances and master data, with no repeat opportunity to get it right
Explanation: DATA CONVERSION is a ONE-TIME event with no second chance. Errors in migrating opening balances, customer master data or open transactions propagate silently into every subsequent period. Controls: reconciliation of pre- and post-conversion totals, record counts, and independent validation of a sample.
Question 73
A PARALLEL RUN during implementation means:
Select an option first.
Correct answer: B — The OLD and NEW systems run SIMULTANEOUSLY and outputs are COMPARED
Explanation: A PARALLEL RUN operates the OLD and NEW systems SIMULTANEOUSLY on the same data, comparing outputs. It is the SAFEST conversion approach but the most EXPENSIVE (two systems, double the work). A 'BIG BANG' cutover is cheaper and far riskier; a PHASED approach sits in between.
Question 74
A 'BIG BANG' system cutover is risky because:
Select an option first.
Correct answer: A — There is NO FALLBACK — if the new system fails, the old one has already been switched off
Explanation: A BIG BANG cutover switches everything at once. If the new system fails, there is NO fallback — the old system is gone. It is the cheapest and fastest approach, and the riskiest. A rollback plan is essential, and rarely tested.
Question 75
An entity outsources its data centre. The relevant ITGC consideration is:
Select an option first.
Correct answer: D — The OUTSOURCED provider's ITGCs are now relevant, and must be evidenced (typically via a SOC report)
Explanation: OUTSOURCING transfers the CONTROL, not the RELEVANCE. The provider's ITGCs (access, change management, operations) now underpin the user's financial reporting. The auditor obtains evidence via a SOC 1, or by testing at the service organisation directly.
Question 76
A user entity's IT department has a single administrator who develops, tests AND deploys code. This is:
Select an option first.
Correct answer: B — A SEGREGATION OF DUTIES failure — the same person can write and deploy untested or malicious code with no independent check
Explanation: One person controlling DEVELOPMENT, TESTING and DEPLOYMENT can push untested or malicious code straight to production with no independent check. In a SMALL entity this may be unavoidable — but a COMPENSATING control is then essential: independent review of code changes, or a review of deployment logs by someone outside IT.
Question 77
In a SMALL entity where SoD is impractical, the auditor should:
Select an option first.
Correct answer: B — Look for COMPENSATING controls — such as owner review of change logs and system reports
Explanation: Where formal segregation is impossible, look for COMPENSATING controls: active OWNER review of change logs, system reports and exception listings. Where such review is genuine and effective, control risk need not be at maximum. Skipping the evaluation entirely is the error.
Question 78
An entity's backup runs nightly. Its RPO is therefore, at worst:
Select an option first.
Correct answer: B — 24 HOURS — up to a full day of data could be lost
Explanation: BACKUP FREQUENCY determines the RPO. Nightly backups mean that a failure just before the next backup loses up to 24 HOURS of data. If the business requires an RPO of 1 hour, nightly backups are inadequate — hourly snapshots or continuous replication are needed.
Question 79
An organisation with an RPO of 15 MINUTES requires:
Select an option first.
Correct answer: B — CONTINUOUS or near-continuous replication / frequent snapshots
Explanation: An RPO of 15 minutes means at most 15 minutes of data may be lost — which demands SNAPSHOTS at least that frequently, or continuous replication. Backup FREQUENCY is dictated by RPO; recovery INFRASTRUCTURE is dictated by RTO. The two objectives drive different investments.
Question 80
Backups stored ONLINE and WRITABLE on the network are vulnerable to:
Select an option first.
Correct answer: A — RANSOMWARE — the attacker encrypts the backups along with everything else
Explanation: An attacker who compromises the network will deliberately seek out and ENCRYPT the BACKUPS first, so the victim has no choice but to pay. This is why the 3-2-1 rule requires an OFFLINE, AIR-GAPPED or IMMUTABLE copy — one the attacker cannot reach even with domain admin rights.
Question 81
An IMMUTABLE backup means:
Select an option first.
Correct answer: A — It CANNOT BE ALTERED OR DELETED for a defined retention period — even by an administrator
Explanation: IMMUTABILITY (write-once-read-many, or object lock) means the backup CANNOT be modified or deleted for a set retention period — not even by an administrator with full credentials. It is the strongest defence against ransomware, precisely because it removes the administrator's ability to destroy it.
Question 82
A restore test reveals the backup is CORRUPT. This demonstrates that:
Select an option first.
Correct answer: B — The BACKUP was not a control — only a TESTED RESTORE is; the organisation had the ILLUSION of recovery
Explanation: A backup that cannot be RESTORED is not a control — it is an illusion. This is why auditors ask WHEN the restore was LAST TESTED and what the RESULT was. Discovering corruption in a test is a success; discovering it in a disaster is a catastrophe.
Question 83
A DR plan that has NEVER been TESTED provides:
Select an option first.
Correct answer: B — LITTLE assurance — untested plans routinely fail on contact with reality (stale contacts, missing dependencies, insufficient capacity)
Explanation: An UNTESTED DR plan is a document, not a capability. Tests routinely reveal: out-of-date contact lists; forgotten dependencies (the application works, but the authentication server is not in scope); insufficient capacity at the DR site; and staff who have never performed the procedure.
Question 84
An entity's application control (a credit limit check) is automated. The auditor must ALSO consider:
Select an option first.
Correct answer: A — The ITGCs on which its continued effective operation depends — particularly CHANGE MANAGEMENT and ACCESS
Explanation: An IT-DEPENDENT control cannot be evaluated in isolation. Its continued operation across the period depends on CHANGE MANAGEMENT (was the logic altered?) and ACCESS (could someone change the limit or the code?). The auditor must consider BOTH the application control AND the ITGCs beneath it.
Question 85
The exception report from an automated control is only useful if:
Select an option first.
Correct answer: D — SOMEONE actually REVIEWS it and RESOLVES the exceptions — the review IS the control
Explanation: An EXCEPTION REPORT that nobody reads is not a control. The REVIEW is the control — and the auditor tests whether the report was actually reviewed, whether exceptions were investigated, and whether they were RESOLVED. A report generated daily and filed unread is a control in name only.
Question 86
A management review control's effectiveness depends critically on its:
Select an option first.
Correct answer: D — PRECISION — whether it operates at a level granular enough to DETECT a material misstatement
Explanation: PRECISION is the threshold at which the review would actually CATCH an error. A monthly review of top-level totals may be far too imprecise to detect a material misstatement buried in a large balance. An imprecise review, however diligently performed, provides no assurance — and testing it more times only confirms that.
Question 87
An RPA bot with the credentials of a departed employee is:
Select an option first.
Correct answer: C — A SERIOUS control failure — the bot's actions cannot be attributed, and the credential should have been de-provisioned
Explanation: Bots must have their OWN identities with LEAST PRIVILEGE — never a human's credentials, and certainly never a DEPARTED employee's. Otherwise: no accountability (whose action was it?), no de-provisioning (the account cannot be disabled without breaking the bot), and audit trails that point to a person who no longer works there.
Question 88
A bot performing BOTH vendor creation AND payment approval is:
Select an option first.
Correct answer: A — A SEGREGATION OF DUTIES violation — automating an incompatible combination does not make it acceptable
Explanation: AUTOMATING an incompatible combination of duties does not cure the incompatibility — it entrenches it, and removes the human judgement that might have flagged it. Bots must be designed with the SAME segregation-of-duties constraints as human roles.
Question 89
An entity's machine learning model makes credit decisions. The audit concern is:
Select an option first.
Correct answer: D — EXPLAINABILITY and BIAS — can the decision be justified, and does the model discriminate on a protected characteristic?
Explanation: ML models raise distinctive concerns: EXPLAINABILITY (can you tell a rejected applicant WHY?), BIAS (does the model discriminate, even inadvertently, via proxy variables?), MODEL DRIFT (does it degrade as conditions change?), and DATA QUALITY (garbage in, garbage out — at scale and with authority).
Question 90
MODEL DRIFT means:
Select an option first.
Correct answer: B — The model's ACCURACY DEGRADES over time as real-world conditions diverge from the training data
Explanation: MODEL DRIFT: a model trained on historical data degrades as the world changes (consumer behaviour shifts, a pandemic occurs, fraud patterns evolve). Without ongoing MONITORING and RETRAINING, a model that was accurate at deployment silently becomes unreliable — while still producing confident-looking outputs.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.