You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 91
An entity's blockchain records an ERRONEOUS transaction. It:
Select an option first.
Correct answer: D — CANNOT be edited — it must be REVERSED by a new offsetting transaction; immutability cuts both ways
Explanation: IMMUTABILITY prevents tampering — but it also means an ERROR cannot simply be corrected. It must be REVERSED by a NEW offsetting transaction, leaving both the error and the correction permanently visible. Immutability is a control benefit AND an operational constraint.
Question 92
A SMART CONTRACT's control risk is that:
Select an option first.
Correct answer: A — A CODING ERROR executes AUTOMATICALLY and IRREVERSIBLY — 'the code is the contract'
Explanation: A SMART CONTRACT executes AUTOMATICALLY when its conditions are met. A coding error therefore executes irreversibly, at speed, with no human able to intervene. The control is rigorous CODE REVIEW and INDEPENDENT AUDIT of the contract BEFORE deployment — because afterwards is too late.
Question 93
A data element is defined differently in two systems ('revenue'). This is a failure of:
Select an option first.
Correct answer: A — DATA GOVERNANCE — specifically, the absence of an enforced DATA DICTIONARY and single source of truth
Explanation: When two departments compute 'revenue' differently and both believe they are right, the failure is in DATA GOVERNANCE: no agreed DEFINITION, no DATA DICTIONARY, no SINGLE SOURCE OF TRUTH, and no data owner accountable for the definition. The consequence is that management reports contradict each other.
Question 94
MASTER DATA MANAGEMENT aims to establish:
Select an option first.
Correct answer: B — A SINGLE, AUTHORITATIVE source of truth for key entities (customer, vendor, product)
Explanation: MDM creates a SINGLE, AUTHORITATIVE record for core entities — one customer record, not seven near-duplicates across seven systems. Without it: duplicate payments, inconsistent reporting, failed reconciliations, and an inability to answer 'how much do we sell to this customer in total?'
Question 95
DATA LINEAGE documents:
Select an option first.
Correct answer: D — WHERE data ORIGINATED and every TRANSFORMATION it underwent on the way to a report
Explanation: DATA LINEAGE traces a figure in a report back through every transformation, join and calculation to its ORIGINAL SOURCE. It is essential for troubleshooting ('why is this number wrong?'), for regulatory defensibility, and for assessing the IMPACT of a change to an upstream system.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 96
An auditor uses Benford's Law on journal entries to:
Select an option first.
Correct answer: C — Identify entries whose LEADING DIGITS depart from the expected natural distribution — a possible fabrication indicator
Explanation: BENFORD'S LAW holds that in many naturally occurring data sets, '1' is the leading digit about 30% of the time, '2' about 18%, and so on. FABRICATED numbers rarely follow this pattern. A significant departure is a RED FLAG for investigation — not proof of fraud.
Question 97
Journal entry testing typically targets entries that are:
Select an option first.
Correct answer: A — POSTED at unusual TIMES, by unusual USERS, in ROUND amounts, or with weak descriptions
Explanation: Journal entry testing targets the fingerprints of MANUAL INTERVENTION outside the normal process: entries posted at WEEKENDS or period-end, by users OUTSIDE accounting, in suspiciously ROUND amounts, with vague or missing descriptions, or reversing shortly after. These are the vehicles of MANAGEMENT OVERRIDE.
Question 98
A TOP-SIDE journal entry is one posted:
Select an option first.
Correct answer: D — At the CONSOLIDATION or reporting level, OUTSIDE the normal transaction systems
Explanation: TOP-SIDE entries are posted at the consolidation or reporting level, BYPASSING the routine transaction systems and their controls. Often posted by senior finance staff with thin documentation, they are the natural vehicle for management override — and therefore a priority for testing.
Question 99
Data analytics testing 100% of a population produces EXCEPTIONS. These are:
Select an option first.
Correct answer: C — ITEMS MEETING A CRITERION — places to LOOK, not conclusions
Explanation: An analytic produces EXCEPTIONS, not conclusions. If 1,200 of 400,000 entries meet the criteria, the criteria may simply be too broad. The auditor REFINES the criteria and investigates the residual population using RISK-BASED JUDGEMENT. Testing everything makes it possible to see everything — it does not remove the need for judgement.
Question 100
The auditor uses the CLIENT'S OWN analytics tool to extract data. The auditor must:
Select an option first.
Correct answer: C — TEST the ACCURACY and COMPLETENESS of the extract — analysing an incomplete population proves nothing
Explanation: The output of the client's tool is INFORMATION PRODUCED BY THE ENTITY. The auditor must test its ACCURACY and COMPLETENESS — agreeing it to source data and confirming the extract captured the WHOLE population. Analysing 100% of an incomplete extract is analysing 100% of the wrong thing.
Question 101
An entity's disaster recovery site is in the SAME METRO AREA as its primary site. The risk is:
Select an option first.
Correct answer: B — A REGIONAL disaster (hurricane, earthquake, grid failure) could disable BOTH sites simultaneously
Explanation: GEOGRAPHIC CONCENTRATION defeats the purpose of a DR site. A regional event — hurricane, earthquake, flood, wide-area power failure — takes out both sites at once. DR sites should be far enough away to be outside the same threat zone, but close enough for practical staffing and acceptable latency.
Question 102
A cloud provider offering a 99.9% availability SLA implies annual downtime of about:
Select an option first.
Correct answer: C — About 8.8 HOURS per year
Explanation: 99.9% ('three nines') = 0.1% downtime = 0.001 × 8,760 hours = 8.76 HOURS per year. 99.99% ('four nines') = about 53 MINUTES. 99.999% ('five nines') = about 5 MINUTES. Each additional nine costs dramatically more — the business must decide what the downtime is actually worth.
Question 103
An entity's IT steering committee approves major system investments. This is an example of:
Select an option first.
Correct answer: C — IT GOVERNANCE — aligning IT investment with business strategy
Explanation: IT GOVERNANCE ensures IT investment aligns with BUSINESS STRATEGY and that risks are managed. An IT STEERING COMMITTEE (with business, not just IT, representation) is a common governance mechanism. Governance sits ABOVE the ITGCs.
Question 104
COBIT is:
Select an option first.
Correct answer: A — An IT GOVERNANCE and MANAGEMENT framework
Explanation: COBIT (Control Objectives for Information and Related Technologies) is an IT GOVERNANCE and MANAGEMENT framework from ISACA. It maps IT processes to business objectives. ITIL addresses IT SERVICE MANAGEMENT; ISO 27001 addresses INFORMATION SECURITY management; NIST CSF addresses CYBERSECURITY.
Question 105
ITIL primarily addresses:
Select an option first.
Correct answer: C — IT SERVICE MANAGEMENT — incident, problem, change and configuration management
Explanation: ITIL is the leading IT SERVICE MANAGEMENT framework: incident management, problem management, CHANGE management, configuration management, and service level management. Its change management processes map directly onto the ITGC change domain.
Question 106
ISO 27001 certification indicates the entity has:
Select an option first.
Correct answer: C — An INFORMATION SECURITY MANAGEMENT SYSTEM (ISMS) certified against the standard
Explanation: ISO 27001 CERTIFIES that an entity has an INFORMATION SECURITY MANAGEMENT SYSTEM meeting the standard's requirements. It is a CERTIFICATION (pass/fail against a standard); a SOC 2 is an ATTESTATION (an auditor's opinion with detailed test results). Customers often accept either — but they answer different questions.
Question 107
The difference between ISO 27001 and a SOC 2 is that ISO 27001 is a:
Select an option first.
Correct answer: D — CERTIFICATION against a standard, whereas SOC 2 is an ATTESTATION with detailed testing disclosed
Explanation: ISO 27001: a CERTIFICATION — you either meet the standard or you do not, and the certificate says little more. SOC 2: an ATTESTATION — a CPA's opinion, WITH the system description, the controls, the tests performed and any DEVIATIONS disclosed. SOC 2 gives the reader far more to work with.
Question 108
A CONFIGURATION MANAGEMENT DATABASE (CMDB) records:
Select an option first.
Correct answer: A — IT ASSETS and their RELATIONSHIPS — enabling impact analysis before a change
Explanation: A CMDB records IT ASSETS (configuration items) and their RELATIONSHIPS. Its control value: before making a change, you can determine what DEPENDS on the item being changed. Without it, a 'simple' server patch takes down an application nobody realised was connected.
Question 109
An entity cannot produce a complete list of its IT assets. The consequence is:
Select an option first.
Correct answer: C — It cannot PATCH, MONITOR or PROTECT what it does not know it has — asset inventory is a foundational control
Explanation: You cannot protect what you do not know you have. ASSET INVENTORY is the FIRST control in most frameworks (CIS Control 1; NIST's IDENTIFY function) for exactly this reason. Unknown, unmanaged 'shadow IT' assets are unpatched, unmonitored, and are frequently the entry point.
Question 110
SHADOW IT refers to:
Select an option first.
Correct answer: C — Systems and services adopted by business units WITHOUT IT's knowledge or approval
Explanation: SHADOW IT: a department signs up for a SaaS tool with a corporate credit card, uploads customer data, and IT never knows. The risks: unassessed vendor security, uncontrolled data, no backup, no de-provisioning when staff leave, and potentially a breach of privacy law. The cause is usually that official IT is too slow.
Question 111
The best response to SHADOW IT is generally:
Select an option first.
Correct answer: A — Understand WHY it happened (official IT was too slow or inadequate) and provide a sanctioned, usable alternative
Explanation: Shadow IT is a SYMPTOM: the official process was too slow, too restrictive, or did not meet the need. Purely punitive responses drive it further underground. The effective response combines DISCOVERY (cloud access security brokers), a fast SANCTIONED path, and enforcement — in that order.
Question 112
An entity's DEVELOPERS have read access to PRODUCTION DATA for troubleshooting. The risk is:
Select an option first.
Correct answer: A — CONFIDENTIALITY — developers can view sensitive customer data, and the access may be unmonitored
Explanation: Developer READ access to production data exposes real customer PII to a group that has no business need to see it, often without monitoring. Better approaches: MASKED or SYNTHETIC data in lower environments; JUST-IN-TIME, time-limited, LOGGED access for genuine troubleshooting.
Question 113
A change deployed WITHOUT testing caused an outage. The ITGC failure is in:
Select an option first.
Correct answer: C — CHANGE MANAGEMENT — the testing and approval gates were bypassed or absent
Explanation: Deploying UNTESTED code is a CHANGE MANAGEMENT failure. The auditor should determine whether the testing requirement EXISTS (a design deficiency) or exists but was BYPASSED (an operating deficiency) — and whether bypassing is possible for anyone, or only via a controlled emergency path.
Question 114
An entity's change log shows 40 changes, but the change management system records only 25. This indicates:
Select an option first.
Correct answer: B — 15 changes BYPASSED the change management process — a serious control gap
Explanation: A gap between changes ACTUALLY DEPLOYED (from the system logs) and changes RECORDED in the change management tool means changes are bypassing the process. This is a powerful audit test — reconcile the deployment log to the change tickets, and investigate every unmatched deployment.
Question 115
The best evidence that ALL changes went through the process is:
Select an option first.
Correct answer: D — A RECONCILIATION of the PRODUCTION DEPLOYMENT LOG to the change tickets — starting from what actually happened
Explanation: Starting with the CHANGE TICKETS can only tell you that approved changes were approved. To find UNAPPROVED changes, you must start OUTSIDE the process — with the PRODUCTION DEPLOYMENT LOG (or a file-integrity monitor) — and work back to the tickets. This is the completeness/direction-of-testing principle from AUD, applied to ITGCs.
Question 116
FILE INTEGRITY MONITORING (FIM) detects:
Select an option first.
Correct answer: D — UNAUTHORISED CHANGES to critical system files or configurations
Explanation: FIM computes a cryptographic hash of critical files and alerts when they CHANGE. It DETECTS unauthorised modification — including changes made outside the change management process, and malware that alters system binaries. It is a detective control that complements preventive change management.
Question 117
An entity's job scheduler runs a nightly batch. If it FAILS silently:
Select an option first.
Correct answer: D — Data may be INCOMPLETE or STALE, with no one aware — job monitoring and failure alerting is the control
Explanation: A SILENT batch failure is dangerous precisely because nobody knows. Financial data goes stale, interfaces do not run, reconciliations are performed against incomplete data. The control is JOB MONITORING with FAILURE ALERTING and a documented escalation path — part of the IT OPERATIONS ITGC domain.
Question 118
An INTERFACE between two systems fails to transfer 500 records. The control that should detect this is:
Select an option first.
Correct answer: A — A RECONCILIATION of record counts and control totals between source and target
Explanation: INTERFACE controls: reconcile RECORD COUNTS and CONTROL TOTALS between source and target; produce EXCEPTION REPORTS for rejected records; and ensure someone REVIEWS and RESOLVES the exceptions. Without them, records disappear silently and the two systems quietly diverge.
Question 119
An entity relies on END-USER COMPUTING (a complex spreadsheet) for a material estimate. The risks include:
Select an option first.
Correct answer: D — NO version control, NO change management, NO access restriction, and formula errors that are easy to introduce and hard to detect
Explanation: EUC (spreadsheets) sits OUTSIDE the ITGC framework: no version control, no change management, no access restrictions, no testing, and formula errors that propagate silently. A material spreadsheet needs EUC controls: version control, access restriction, independent review of formula changes, and reconciliation of outputs.
Question 120
The most effective control over a MATERIAL spreadsheet is:
Select an option first.
Correct answer: A — A combination — restricted ACCESS, VERSION control, LOCKED formulas, and INDEPENDENT REVIEW of changes and outputs
Explanation: No single control suffices. EUC controls layer: RESTRICT who can edit; LOCK/protect formula cells; maintain VERSION CONTROL; require INDEPENDENT REVIEW of formula changes; and RECONCILE outputs to an independent source. Password-protecting a workbook does nothing about a wrong formula.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.