Free CPA AUD (Auditing & Attestation) Assessing Risk and Developing a Planned Response Practice Questions
Risk assessment and planned response on the CPA AUD exam covers understanding the entity and its environment, identifying risks of material misstatement, planning the audit, and designing audit procedures responsive to assessed risks.
Sample Questions
Question 1
Easy
Which of the following is an example of an IT general control?
Solution
B is correct.
IT general controls (ITGCs) are policies and procedures that relate to many applications and support the effective functioning of application controls. Access management — including role-based authentication and periodic access reviews — is a fundamental ITGC category.
IT general controls (ITGCs) are policies and procedures that relate to many applications and support the effective functioning of application controls. Access management — including role-based authentication and periodic access reviews — is a fundamental ITGC category.
Question 2
Medium
Under COSO's Internal Control — Integrated Framework, which of the following best illustrates the risk assessment component?
Solution
C is correct.
Under COSO, the risk assessment component involves management's process for identifying and analyzing risks relevant to achieving the entity's objectives, including financial reporting objectives. This includes evaluating the likelihood and significance of risks and determining how they should be managed.
Under COSO, the risk assessment component involves management's process for identifying and analyzing risks relevant to achieving the entity's objectives, including financial reporting objectives. This includes evaluating the likelihood and significance of risks and determining how they should be managed.
Question 3
Hard
An auditor obtains the complete population of journal entries from a technology company's ERP system. When selecting entries to test for evidence of management override, which combination of characteristics should receive the highest priority for selection?
Solution
AU-C 240 identifies specific characteristics that increase the risk that journal entries may be used for fraudulent financial reporting. High-risk characteristics include entries posted by individuals who do not typically make entries (such as a controller), entries to unusual or seldom-used accounts, entries made at period end or as post-closing adjustments, and entries with little or no explanation. The combination in the correct choice includes multiple high-risk characteristics: senior management posting entries, seldom-used accounts, post-closing timing, and minimal descriptions. This combination warrants highest selection priority because it exhibits multiple indicators of potential override.